In Vitro Transformation of Compiled SWFs

1/27/2005

Filed under: General, Flash — geoff @ 1:04 pm

Ever wish you could alter the variables in a compiled SWF file without having to re-publish the SWF? Or perhaps inject different XML into a compiled SWF? It turns out it’s not as hard as you might think. Variables are stored in uncompressed SWFs as plain text. So, it’s just a matter of finding that text and replacing it. It’s a little trickier than that, though…

The first question that may come to your mind is, “Why would I want to do that, when I can load variables and XML dynamically from the server?” Well, there are times when you may want to offer a SWF for download or offline browsing, or some sort of personally packaged SWF for your users. Also, search engines that can peer into SWF files don’t execute the code, so they will never see any data from your database.

The tricky part is, the variables you will be placing into your SWF need to be the exact same length as your original variables. So, you need to plan ahead. The steps are as follows:

Create your dummy variable, and assign a very long string to it. Make sure that it has unique markers at the beginning and end of the string. For instance “xxxxxx…“. Your variable must be at least as long as the longest possible value you would replace it with.
Publish your SWF, uncompressed, and upload it to your server. The SWF will be noticably larger than before, but we will use ZLIB compression to get it back down to size.
Customize the following code snippet, and upload that as well.

$newXML =“insert new XML or variable value here”;
// read source SWF
$fp = fopen(“source.swf”, r);
$sourceswf = fread($fp, filesize(“source.swf”));
fclose($fp);
// get XML marker and find length
$markerstart = strpos($sourceswf,““);
$markerend = strpos($sourceswf,““,$markerstart) +7;
$markerlength =$markerend -$markerstart;
$marker = substr($sourceswf,$markerstart,$markerlength);
$markerlength = strlen($marker);
// set length of XML to same length as marker by padding with spaces
$newXML = str_pad($newXML,$markerlength,” “, STR_PAD_RIGHT);
// replace marker with new XML
$sourceswf = str_replace($marker,$newXML,$sourceswf);
// compress SWF file
$real_size = pack(“V”, strlen($sourceswf));
$sourceswf = substr($sourceswf,0,4).$real_size.substr($sourceswf,8, strlen($sourceswf));
$sourceswf =“CWS”.substr($sourceswf,3);
$sourceswf = substr($sourceswf,0,8).gzcompress(substr($sourceswf,8, strlen($sourceswf)));
// save new SWF
$swfout =“destination.swf”;
$fd = fopen($swfout,“wb”);
$out = fwrite($fd,$sourceswf);
fclose($fd);

This little snippet will load in your SWF file, search for the beginning and end markers you’ve specified, and replace that string with the new string containing the new value of that variable. It will pad the new string if necessary to match the exact length of your original value. It will then compress your SWF using ZLIB compression, and save it out.

If you are populating this variable with XML, make sure you have actionscript in your movie that will parse the string into an XML object.

There you have it! You can now create customized SWFs with fresh embedded variables. You could use this to create something as simple as a graphical title, to an form confirmation image, to a full offline RSS browser. I hope you find this useful!

Recently Steamed:

08/27/2008: Flash Player 10 will not work with Amazon S3
07/23/2008: Mochi Media Site Relaunch
07/22/2008: Amazon S3 Downtime Visualized

9 Comments »

Very nice and useful bit of code - I already have a great use for it - automated embedding of an IMEI # of a cell phone or other personalized info, into Flash Lite content. Plenty of other valid uses for this kind of work. One improvement might be to determine the preceding byte info that describes the length of the variable your substituting so that it would not have to be the same length in size. That way you could “inject” arbitrarily sized information, as long as you also adjust the bytes that describe the length. To be honest - I havent looked into the .swf spec to see if thats actually stored in the .swf - but I seem to remember that this is info contained within a .swf - it seems logical at least. I’ll dig in and see what I can come up with. Nice work!

Rob

Comment by Robert M. Hall — 1/27/2005 @ 11:14 pm
You’re right, the length of the variable is stored in the SWF. That byte would have to be changed, along with recomputing the size in bytes of the entire movie, which is stored in the header of the SWF. If the size of the movie is incorrect, the SWF will not play. Finding that out is easy, but locating the proper byte in the variable array is the harder one. I’d love it if someone figured that one out.

Comment by Geoff — 1/27/2005 @ 11:45 pm
I use this concept for flash version number tracking… embed version numbers as variables, and then you can view them easily using Perl.

Comment by Ewan — 1/28/2005 @ 3:42 am
You could also use KineticFusion to do the same trick. Simply convert the SWF to XML, make any changes you need using text editor, XSLT, file concatenation etc then let KineticFusion worry about putting it all back together again.

Comment by Alex — 1/28/2005 @ 11:04 am
I hope that MTASC will be able to solve this problem once and for all.

Comment by Anatoly Ropotov — 4/11/2005 @ 6:27 pm
Nice tip, but also remember there’s a 64K limit on embedding a string this way.

(btw, i find your Captcha very tough, I’m on my fourth go)

Comment by Alexander McCabe — 2/22/2006 @ 7:17 am
Hmm.. really? A 64k limit per string, or per SWF? If it’s the former, I figure if you need to go longer you could always split up your string and join it back together at runtime.

Yeah, the Captcha is tough… I just installed WP 2.01 with Authimage. I think there’s ways to tweak it. tough part comes when the contrast between background and letters is too low, or a letter drops off the bottom of the image. Is that an ‘L’ or an ‘I’?? :/

Comment by geoff — 2/22/2006 @ 10:18 am
Yep, per string. You can indeed break it up, then patch it up with actionscript. I’ve just had to do this with for a program.

Comment by Alexander McCabe — 3/4/2006 @ 11:42 pm
[…] 3) Accessible to actionscript is rewriting of variables in the swf This is useful when root vars aren’t an option, and or license keys (e.g. encrypted tokens) need to be embedded into the swf. http://neurofuzzy.net/index.php?p=25 […]

Pingback by TroyWorks » Blog Archive » DRM, MetaData and swfs. — 9/18/2007 @ 1:17 am