SWF lzma decompression

[Chipicao]

I ran into a bit of trouble trying to extract resources from some flash files. Both Flash Decompiler Trillix and Sothink SWF Decompiler said the files are corrupt.
Turns out they just use lzma compression, implemented in SWF version 13. So here's a little script for decompression:

Code: Select all

idstring "ZWS"
get VERSION byte
get SIZE long   #uncludes first 8 bytes; quickbms finds uncompressed size automatically
get ZSIZE long
math ZSIZE += 5
comtype lzma

log MEMORY_FILE 0 8
putvarchr MEMORY_FILE 0 0x46
append
clog MEMORY_FILE 12 ZSIZE SIZE
append

get NAME basename
string NAME += "_unpacked.swf"
log NAME 0 SIZE MEMORY_FILE

[finale00]

Hmm, up to 40% reduction in size.
http://www.adobe.com/devnet/flash/artic ... ssion.html

I like how the article says it's "based" on LZMA.
Does that mean it is a variant of LZMA? Or is this how people usually refer to implementations of algorithms?

[Chipicao]

Sounds like they're trying to make it sound more special than it is.

Or maybe they meant to say the actual code is based on the 7-zip SDK? Here's what they say in the spec sheet:

0x5a, 0x57, 0x53 (“ZWS”). A ZWS indicates that the entire file after the first 8 bytes (that is,
after the FileLength field) was compressed by using the LZMA open standard: http://www.7-zip.org/sdk.html.

[Elayna]

I ran into a bit of trouble trying to extract resources from some flash files. Both Flash Decompiler Trillix and Sothink SWF Decompiler said the files are corrupt.
Turns out they just use lzma compression, implemented in SWF version 13. So here's a little script for decompression:

Code: Select all

idstring "ZWS"
get VERSION byte
get SIZE long   #uncludes first 8 bytes; quickbms finds uncompressed size automatically
get ZSIZE long
math ZSIZE += 5
comtype lzma

log MEMORY_FILE 0 8
putvarchr MEMORY_FILE 0 0x46
append
clog MEMORY_FILE 12 ZSIZE SIZE
append

get NAME basename
string NAME += "_unpacked.swf"
log NAME 0 SIZE MEMORY_FILE

Are you able to extract the XML & animation from Clash of Clan? They also use LZMA