Join also our Discord channel! Click here.

Decompile SWF version 11

Get your graphics formats figures out here! Got details for others? Post here!
Post Reply
lolbas
beginner
Posts: 25
Joined: Wed Nov 18, 2015 4:59 pm
Has thanked: 3 times

Decompile SWF version 11

Post by lolbas » Fri Dec 27, 2019 9:22 pm

The game in question is made by Gameloft, and the compiled SWF seem to be of version 11. The are a lot of UI's made of SWF, but they all seem to use library.swf and mainUI.swf files. The final goal I have in mind is to write my own UI but making it working as if it was the original. From what I understand, SWF files call game methods via some API, and I believe I can see the names in SWF file, but I'm not certain. I tried JPEXS Decompiler, but I don't have "Scripts" tree node in the result. Searching through the web only gives me very old results for old Flash version. Are there any up-to-date tools that can help me? Or what do I need to do/to research to achieve my goal?

Sample files: https://www.mediafire.com/file/y4qyxhfk6279ksx

lolbas
beginner
Posts: 25
Joined: Wed Nov 18, 2015 4:59 pm
Has thanked: 3 times

Re: Decompile SWF version 11

Post by lolbas » Sat Mar 28, 2020 1:05 pm

Alright, so deciding to look into this again after a break, I was able to parse the SWF with swf-parser lib, as well as 010 Editor SWF template from their repository, which turned out to have a bug that prevented me from parsing it at the time of the first post.

Anyway, I was hoping to see the byte-code (ABC) somewhere in the SWF tags, but the samples I checked don't have it. Instead, they have a tag of type = 300, which contains a lot of binary data (see screenshot). Googling the first bytes seem to reveal that this tag should actually be a byte-code, however
if I use a disassembler tool like Flazzy, it errors at runtime because either the code is invalid ABC, or it has some unsupported format. Any suggestions?
You do not have the required permissions to view the files attached to this post.

lolbas
beginner
Posts: 25
Joined: Wed Nov 18, 2015 4:59 pm
Has thanked: 3 times

Re: Decompile SWF version 11

Post by lolbas » Sat Mar 28, 2020 10:55 pm

So this turned out to be the byte-code, however with the help of Flazzy I was able to figure out

At 0x12 you can see that there are 5 params, and 0x1b tells us that 7 of them are optional, which is totally nonsense because
...The number of optional parameters is given by option_count, which must not be zero nor greater than the parameter_count...
(from official documentation, par. 4.5.1).

Attached screenshot shows the method infos block (0x0 byte indicates methods count). Any ideas what's actually going on here?
You do not have the required permissions to view the files attached to this post.

Post Reply