[Arrangement] SWF File Analysis 1

Due to the need to analyze SWF files in recent projects, I have found a lot of information on the Internet and referred to the SWF file format document officially released by Adobe, but I am not quite clear about it. Later, after several days of hard work, I finally had an epiphany (poor native slowness, poor comprehension ability, it's only time to make up for it ). I will share with you the results of my efforts over the past few days (some of the materials are collected from netizens, but I cannot provide a complete original article address because I cannot tell who is the original author, ). Most people are analyzing uncompressed SWF files when sorting out the user's information, which makes me feel overwhelmed during my own testing. Later, I found out how to decompress the SWF file. In Versions later than Flash 6, the generated SWF files support compression, so it is of little use for parsing uncompressed SWF files.

Let's take a look at how to analyze it! I analyzed it with a compressed file. (In fact, I cannot find the uncompressed SWF file of the lower version)

SWF file header information

The SWF file header contains a large amount of information. It tells people the basic information about how SWF files work.

The Macromedia Flash file format is the file format where the Macromedia Flash Player publishes vector images and animations on the Internet.

The SWF file format is designed not to share images between image editors but to efficiently interpret the format. It is designed to meet the following conditions:

A: real-time display on the screen: The main purpose of this format is to display and support instances on the screen, quick playback of color images, animation and interactive buttons.

B: Scalability: This format is a label format. Therefore, its player can be upgraded by adding new features to be compatible with earlier versions of its player.

C: network publishing: This format can be transmitted with limited network resources and unpredictable network conditions. Files are compressed to a very small size and stream playback is supported. A swf file is a binary file that cannot be directly read and understood like an HTML file. SWF files use methods such as bit compression and optional field structure to reduce the file size.

D: Simplicity: This simple structure makes flash players very small and portable. In addition, flash players only rely on a limited set of operating system features.

E: file independence: file display does not depend on any extended resources such as fonts.

F: variability: it is important that files work well in a limited hardware environment and use better hardware as much as possible, because the user's computer has different display settings and color depth.

G: Speed: files can be played quickly and with high quality.

H: script supported: This format contains tags in the agreed format, which specifies the sequence in which the stack machine interprets bytecode. Bytecode supports an Action Script Language. Flash Player specifies the runtime Action Script Mode, which allows the interaction between the original rendering, service, and Flash Player features.

The extension name of the SWF file is .swf. It is a mime (multi-purpose Internet Mail Extension protocol) type application.Program(X-Shockwave-flash ).

Swf format has gone through several versions. In the 5th versions, SwF tag settings have been enriched and improved on a large scale. After the first version, the file format changes little. For example, more and more new flash features or full implementations are available only in ActionScript. Therefore, if you want to add more new features to the SWF file, you should be familiar with the ActionScript object model provided by Flash Player. The best reference for these is O 'Reilly's ActionScript: the definitive guide, published by Colin Mok.

SWF file header: All SWF files start with the following header:

The file header starts with a three-byte identifier, Which is 0x46, 0x57, 0x53 ("FWS ") or 0x43, 0x57, 0x53 ("CWS. The "FWS" identifier indicates that the file is an uncompressed SWF file, and the "CWS" identifier indicates that the first eight bytes of the file are later than the file length field) all data is compressed in the standard zlib mode.

The data format used by the zlib library is described in the request annotation from 1950 to 1952, and is detailed in the internet standard documentation (rfcs. CWF File compression only applies to version 6 or later.

The identifier is a byte version number, which is not an ascii code but an 8-digit number. For example, version 4 is identified by 0x04, instead of the ASCII code "4" (0x35 ).

The file length field is the length of the entire file including the file header. If it is an uncompressed SWF file (the identifier FWS), the length field should exactly match the file size, if it is a compressed SWF file (identifier CWS), the file length field refers to the total length of the file after being decompressed. Therefore, it generally does not match the file size, the uncompressed file size can make the decompression process more efficient.

The frame size field defines the width and height of a video. It uses a rect structure for storage, which means that its size can vary according to the number of digits required for coordinate encoding. The minimum value of the X and Y axes used by the rect structure of the frame size is 0. The maximum values of X and Y axes indicate the width and height (see bit values)

The frame rate is the frame playback rate per second. This rate is not guaranteed when the SWF file contains streaming audio data or when the flash player runs on a low-speed CPU.

The number of frames is the total number of SwF video frames.

SWF file structure

The file header is followed by a series of consecutive tag data blocks. All tags share a common format. Therefore, any program that parses the SWF file can skip unidentifiable data blocks. Data in a block can point to the offset in the current block, but cannot point to the offset in other data blocks. This allows the tag to be removed, inserted, or modified by the tool that processes the SWF file.

SWF File Format

========================================================== ========

Tag format

Each label starts with a type and a length value. There are two label header formats: short format and long format. The short label header is used for 62 bytes or smaller Label data. The long label header can be used for any label data of no more than 4 GB. In the long run, this will be very practical.

Note: The tag encoding and length fields are not a 10-bit field followed by a 6-bit field, but a double byte field, the uninterrupted byte sorting of SWF files makes the two different la S.

The length of this field does not contain the record header at the beginning of the tag (that is, the length occupied by this field ).

If the length of a tag is greater than or equal to 63 bytes, it is stored in the long label header. The long label header consists of a 63-byte (0x3f) Short label header and a 32-bit length.

Description label and control label

The label in SWF is divided into two types: Description label and control label:

The description label describes the content-shape, text, image, and sound of a SwF video. Each defined tag specifies a unique ID called "role ID" for its description. Flash Player stores these roles in a library called dictionary. The description label itself cannot drive the generation of an event.

The control label can create and drive role instances in the dictionary to control video playback.

SWF file tag Classification

Generally, the label in the SWF file can appear at will. However, a few rules must be followed:

1. A tag can only depend on the previously defined tag. No tag can depend on the tag defined later.

2. The description label must be defined before any control label that uses it.

3. stream sound labels must be stored in sequence. Irregular stream sound tags may cause abnormal sound playback.

4. The end tag is generally the last tag of the SWF file.

Dictionary

A dictionary is a database that stores defined roles. It can be applied by control labels. The establishment and use of dictionaries should follow the following rules:

1. The description label defines the shape, Font, bitmap, or sound.

2. Each description label is specified with a unique role ID.

3. The contents in the dictionary are stored after the role ID.

4. The control label can locate the desired content in the dictionary using the role ID and perform some operations on it, such as displaying the shape or playing sound.

A unique ID must be specified for each role ID. Duplicate IDs are not allowed. For example, the first role ID is 1, and the second role ID is 2. Role 0 is specified as the dedicated ID of the empty role.

Not only control tags can reference dictionaries. Description labels can also use data in the dictionary for more complex role definitions. For example, buttons and editing tags both use roles that define their content. Text labels also contain the font role to select different fonts for text.

Describes a typical interaction between a tag, a control tag, and a dictionary as a table:

========================================================== ========

* For details, see the display list.

Process SWF files

Flash players process all the tags in the SWF file before encountering the "display frame" label. In this way, the display list will be copied to the scenario, and the flash player will remain idle until the next frame is processed. The content of the first frame is the effect accumulated by all the control label operations before the first frame. The content of the second frame is the effect accumulated by all the control label operations before the second frame, and so on.

File compression Policy

As SWF files are frequently transmitted over the network, it is important to compress files as much as possible. There are several methods to achieve this purpose. The following methods are described:

The structure of the reusable role Dictionary makes it easy to reuse the elements of the SWF file. For example, a shape, button, Font, or bitmap can be stored and referenced multiple times.

Compression when the starting coordinate of a line is assumed to be the ending coordinate of the previous line, the shape can be compressed using a very effective triangular encoding method. The distance is usually expressed by the relative relationship with the last position.

Default matrix and color conversion types usually have more common fields than other structures. For example, for a matrix, the conversion field is the most commonly used field, while the scaling ratio and rotation are used less. Therefore, if the scaling field does not appear, the default value is 100%. If the rotation field does not appear, it is assumed that there is no rotation. Use the default value to reduce the file size.

According to the regulations, SWF files can only store changes between States. However, the shape data structure and position, movement, and moving model used in the display list are opposite.

Shape Data structure shape data structure uses a unique structure to reduce the file size and effectively play real-name shapes in the scene.

Summary

A swf file consists of a header and many labels. There are two types: Description label and control label. A description tag defines an object that is considered a role and is defined in the dictionary. Controls tag operations and roles, and controls the video process.

Here is an example. The following is a compressed binary file of a SWF file:

CWS indicates that the file is compressed, and 0a indicates that the file version is 10 (that is, flash10 ). This is the meaning of the first four groups of numbers. The following 64 05 00 00 digits indicate the file size. But here it is in reverse order, so it is actually 00 05 64, and the conversion to 10 is 1380 bytes.

Now we have parsed the first eight bytes. Starting from 9th bytes, let's take a look at the file size. However, the SWF files later than version 6 are compressed by zlib starting from 9th bytes, and Flash 10 is compressed by zlib. We decompress zlib to obtain a series of bytes as follows (starting from 9th bytes ):

9th bytes												21st bytes
78	00	05	5f	00	00	0f	A0	00	00	18	01	00

In this case, we can look at the file size. The size of SWF files is stored by rect, and rect is a type of flash storage structure. Let's take a look at how to get the size.

1. First, convert the 9th bytes into a binary value, that is, 01111000. Take the first five digits (01111) and get 15. Why do we need to take the first five digits here? This is mainly because the five digits are the digits of each attribute value in the rect structure. To put it bluntly, it is: the minimum value in the X axis direction, the maximum value in the X axis direction, the minimum value in the Y axis direction, and the maximum value in the Y axis direction. Here we get 01111 (15 ). The size of the data to be stored includes the minimum value in the X axis, the maximum value in the X axis, the minimum value in the Y axis, and the maximum value in the Y axis, and the number of digits in each data is 15 bits. Therefore, we need at least 4*15 + 5 = 65 bits to represent the file size, with 65/8 = 8.125, so we need at least 9 bytes to represent the file size.

2. Convert the following nine bytes, including 78 00 05 5f 00 00 0f A0 00, into binary:

01111000 00000000 00000101 01011111 00000000 00000000 00001111 10100000

The first five digits are used as the attribute values to store data, and each 15 digits are separated. The remaining digits are redundant and discarded. As follows:

Convert to decimal to get:

Minimum value in the X axis direction = 0

Maximum Value in the X axis direction = 11000

Minimum value in Y axis = 0

Maximum Value in Y axis = 8000

So width (width) = (maximum value in the X axis direction-Minimum value in the X axis direction)/20 = (11000-0)/20 = 550, height) = (maximum value in Y axis-Minimum value in Y axis)/20 = (8000-0)/20 = 400

PS: Why is it divided by 20? Because the length unit in the SWF file is twip, and 20 twip = 1 pixel.

Next let's take a look at the frame rate. The frame rate is expressed in two bytes, that is, 00 18, which is converted to 24 in decimal format. The frame rate here is 24.

Let's take a look at the number of frames next time. The number of frames is also expressed in two bytes, that is, 01 00. However, if the number of frames is 1, it must be parsed in reverse order.

At this point, the file header has been analyzed. Next articleArticleTo analyze the file content. Coming soon...