I have a bunch of SWF files that represent UI in the game. Most of them contain DoABC tag, however the tag type is 300
instead of 82
.
Putting this trouble aside, I started parsing the tag according to the official AVM2 overview, and found multiple other issues with the structure:
- For most of the methods
flag
value contains flags0x01
and0x04
(NEED_ARGUMENTS
andNEED_REST
) which according to the doc must not be used together. - For some reason the
option_info.option_count
is always greater thanparam_count
. - If I was to ignore point 2 and parse params anyway - param type in most cases is incorrect (page 26)
Here is the sample byte-code. 0x2F
means method count. While parsed according to the doc, at 0x12 you can see that there are 5 params, and 0x1b tells us that 7 of them are optional, which is totally nonsense because
[...] The number of optional parameters is given by option_count, which must not be zero nor greater than the parameter_count [...]
My guesses are that the 300
tag indicates custom tag so custom parsing rules could apply and for other points I would say that the order of fields changed and the flag, as well as param count and optionals info, is at different offset. But how can I be sure that the certain way of parsing is the correct one? I am unfamiliar with ActionScript and have no idea if method name, param name or param type make any sense.
If we take the example above, parsing it according to the doc would result in the first method (address 0x01
) named flash.events
(0x03
) has 0 params (0x01
) with the return type fl.transitions.easing.Back
(0x02
) and flag 0x05
(0x04
)
DoABC
spec up until methods into. Well, at least I think it does cuz Flazzy parser parses the prior data fine.