@cwahlers - index-of.co.uk/index-of.co.uk/web-application/hackingswf.pdf · 2019-03-07 · hacking...
TRANSCRIPT
![Page 1: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/1.jpg)
Hacking SWFClaus Wahlers
côdeazur brasilpowerflasher
@cwahlers
Saturday, 28. August 2010
overview of the swf file format (structure, datatypes, flow in flash player) - as3swf: as3 library to parse swf, create, modify - some stuff i’ve been working on
![Page 2: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/2.jpg)
SWF 10 Specadobe.com/devnet/swf
RTFM !
Saturday, 28. August 2010
![Page 3: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/3.jpg)
as3swfgithub.com/claus/as3swf
Low level ActionScript 3 class library to parse, create, modify and publish SWF files.
Saturday, 28. August 2010
![Page 4: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/4.jpg)
as3abcgithub.com/claus/as3abc
ABC bytecode parserContributed by Jim Cheng
Based on code by Joa Ebert (Apparat)
Saturday, 28. August 2010
compliments as3swf
![Page 5: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/5.jpg)
swfassistlibspark.org/wiki/yossy/swfassist
Low level ActionScript 3 class library to parse, create, modify and publish SWF files.
Saturday, 28. August 2010
![Page 6: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/6.jpg)
DEMO
Saturday, 28. August 2010
![Page 7: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/7.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
Saturday, 28. August 2010
![Page 8: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/8.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
Saturday, 28. August 2010
![Page 9: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/9.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
Signature”FWS” - uncompressed”CWS” - compressed
btw..FWS is SWF backwards
Saturday, 28. August 2010
![Page 10: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/10.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
Signature”FWS” - uncompressed”CWS” - compressed
Compression is applied after the File length field
ZLIB compressed
Saturday, 28. August 2010
![Page 11: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/11.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
Version1 .. 10
Saturday, 28. August 2010
![Page 12: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/12.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
File lengthTotal length of the uncompressed SWF
Saturday, 28. August 2010
![Page 13: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/13.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
Frame sizeSize of the SWF’s stageMeasured in Twips (1/20 pixel)
Saturday, 28. August 2010
![Page 14: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/14.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
Frame ratePlayback rate in FPS
Saturday, 28. August 2010
![Page 15: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/15.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
Tag
Frame countTotal number of frames
Saturday, 28. August 2010
![Page 16: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/16.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
The last tag must be the End tag
Tag
Tag
Tag
End
Saturday, 28. August 2010
![Page 17: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/17.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
The first tag must be the FileAttributes tag(for SWF 8 or later)
FileAttributes
Tag
Tag
End
Saturday, 28. August 2010
![Page 18: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/18.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
The first tag must be the FileAttributes tag(for SWF 8 or later)
Defines some flags:• AS3
• Metadata
• UseNetwork
• UseGPU
• UseDirectBlit
FileAttributes
Tag
Tag
End
Saturday, 28. August 2010
![Page 19: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/19.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Tag
Tag
End
Tag HeaderType
Length
Tag Content
Structure of a Tag
Saturday, 28. August 2010
![Page 20: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/20.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Unknown Tag
Tag
End
Tag HeaderType
Length
Tag Content
Saturday, 28. August 2010
![Page 21: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/21.jpg)
The structure of a SWF
SWF Anatomy
SWF HeaderSignatureVersion
File lengthFrame sizeFrame rate
Frame count
Tag
Unknown Tag
Tag
End
Tag HeaderType
Length
Tag Content
When the Flash Player encounters a tag with an unknown type, it skips
that tag
ExtensibleForward compatible
Saturday, 28. August 2010
![Page 22: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/22.jpg)
Data types used by SWF
SWF Anatomy
A tag’s content is made up of various data typesSome those are rather obscure
(The exact format for each tag is defined in the SWF spec)
Integers•UI8
•UI16
•UI24
•UI32
•SI8
•SI16
•SI32
•EncodedU32
Numbers•FIXED
•FIXED8
•FLOAT
•FLOAT16
•DOUBLE
Bit arrays•UB[nBits]
•SB[nBits]
•FB[nBits]
Others•String
•RGB
•RGBA
•RECT
•MATRIX
Saturday, 28. August 2010
![Page 23: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/23.jpg)
Data types used by SWF
SWF Anatomy
Example: RECT and bit arrays
nBits11
00000000000 01000100110 00000000000 00110010000
Xmin0
Xmax550
Ymin0
Ymax400
01011
Saturday, 28. August 2010
![Page 24: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/24.jpg)
Data types used by SWF
SWF Anatomy
Example: RECT and bit arrays
nBits11
nBits specifies the minimum number of bits neededto represent all values in the array
01011 00000000000 01000100110 00000000000 00110010000
Xmin0
Xmax550
Ymin0
Ymax400
Saturday, 28. August 2010
![Page 25: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/25.jpg)
Data types used by SWF
SWF Anatomy
Example: RECT and bit arrays
nBits11
nBits specifies the minimum number of bits neededto represent all values in the array
All values are stored as a bit stream(no byte boundaries)
01011 00000000000 01000100110 00000000000 00110010000
Xmin0
Xmax550
Ymin0
Ymax400
0101100000000000010001001100000000000000110010000
Saturday, 28. August 2010
![Page 26: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/26.jpg)
Data types used by SWF
SWF Anatomy
Example: RECT and bit arrays
xmin
xmax
ymin
ymax
0
550
0
400
0
01000100110
0
0110010000
Saturday, 28. August 2010
![Page 27: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/27.jpg)
Data types used by SWF
SWF Anatomy
Example: RECT and bit arrays
0
550
0
400
0
01000100110
0
0110010000
01110110110 nBits = 11
xmin
xmax
ymin
ymax
Saturday, 28. August 2010
![Page 28: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/28.jpg)
Data types used by SWF
SWF Anatomy
Example: RECT and bit arrays
0
550
0
400
00000000000
01000100110
00000000000
00110010000
01110110110 nBits = 11
xmin
xmax
ymin
ymax
Saturday, 28. August 2010
![Page 29: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/29.jpg)
Data types used by SWF
SWF Anatomy
Example: RECT and bit arrays
0
550
0
400
00000000000
01000100110
00000000000
00110010000
concatenate
00000000000 01000100110 00000000000 00110010000
xmin
xmax
ymin
ymax
Saturday, 28. August 2010
![Page 30: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/30.jpg)
Data types used by SWF
SWF Anatomy
Example: RECT and bit arrays
0
550
0
400
00000000000
01000100110
00000000000
00110010000
Uses 44 + 5 bits(compared to 128 bits, if four 32 bit integers were used to store this info)
01011
xmin
xmax
ymin
ymax
00000000000 01000100110 00000000000 00110010000
Saturday, 28. August 2010
![Page 31: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/31.jpg)
SWF 10 defines a total of 64 different tags
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
![Page 32: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/32.jpg)
SWF 1
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
Shapes (DefineShape), Buttons (DefineButton), Embedded fonts, static text (DefineFont/FontInfo/Text), JPEGs (DefineBits/JPEGTables), Event and streaming sound, Place/RemoveObject, ShowFrame
![Page 33: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/33.jpg)
SWF 2
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
DefineBitsJPEG2 gets rid of JPEGTables, adds GIF and PNG, DefineButtonSound defines sounds played on state transitions, DefineShape2: more styles, multiple style lists
![Page 34: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/34.jpg)
SWF 3
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
DoAction: first simple scripting model!!, DefineSprite: Movieclips!!, DefineBitsJPEG3/DefineBitsLossless2: adds alpha channel for JPEG, DefineButton2: button actions, PlaceObject2: tweens, DefineMorphShape: shape tweens
![Page 35: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/35.jpg)
SWF 4
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
dynamic/input text!!, Extended action model (variables, expressions, branching and looping) stack based virtual machine
![Page 36: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/36.jpg)
SWF 5
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
Import/ExportAssets: adds ability to import characters from loaded swfs
![Page 37: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/37.jpg)
SWF 6
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
DefineVideoStream/VideoFrame: Video!!, DoInitAction (#initclip on sprites)
![Page 38: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/38.jpg)
SWF 7
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
some more actionscript goodness (exceptions)
![Page 39: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/39.jpg)
SWF 8
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
DefineFont3: better resolution for glyph shapes (20x), DefineShape4: joints/caps, stroke fills, PlaceObject3: cacheAsBitmap, blend modes, filters
![Page 40: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/40.jpg)
SWF 9
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
DoABC/SymbolClass: AS3!!
![Page 41: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/41.jpg)
SWF 10
SWF Tag Evolution
CSMTextSettingsDefineBinaryDataDefineBitsDefineBitsJPEG2DefineBitsJPEG3DefineBitsJPEG4DefineBitsLosslessDefineBitsLossless2DefineButtonDefineButton2DefineButtonCxformDefineButtonSoundDefineEditTextDefineFontDefineFont2DefineFont3
DefineFont4DefineFontAlignZonesDefineFontInfoDefineFontInfo2DefineFontNameDefineMorphShapeDefineMorphShape2DefineScalingGridDefineSceneAnd...DefineShapeDefineShape2DefineShape3DefineShape4DefineSoundDefineSpriteDefineText
DefineText2DefineVideoStreamDoABCDoActionDoInitActionEnableDebuggerEnableDebugger2EndExportAssetsFileAttributesFrameLabelImportAssetsImportAssets2JPEGTablesMetadataPlaceObject
PlaceObject2PlaceObject3ProtectRemoveObjectRemoveObject2ScriptLimitsSetBackgroundColorSetTabIndexShowFrameSoundStreamBlockSoundStreamHeadSoundStreamHead2StartSoundStartSound2SymbolClassVideoFrame
Saturday, 28. August 2010
DefineFont4: new text engine, embedded fonts in CFF format (previously: swf shapes)
![Page 42: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/42.jpg)
Definition tags
SWF Tag Families
DefineShapeDefineButtonDefineSpriteDefineBitsDefineFontDefineText
DefineSoundDefineVideoStream
Define the SWF’s contentAssign a unique character id
(characters are stored in a dictionary for use/reuse)
Saturday, 28. August 2010
![Page 43: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/43.jpg)
Control tags
SWF Tag Families
Control the flow of the SWFCreate and manipulate instances of objects on the display list
PlaceObjectRemoveObject
ShowFrame
Saturday, 28. August 2010
![Page 44: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/44.jpg)
Control tags
SWF Tag Families
Control the flow of the SWFCreate and manipulate instances of objects on the display list
PlaceObjectPlaces a character from the dictionary on the display list
Modifies a character that was previously placed on the display list
RemoveObjectShowFrame
Saturday, 28. August 2010
![Page 45: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/45.jpg)
Control tags
SWF Tag Families
Control the flow of the SWFCreate and manipulate instances of objects on the display list
PlaceObjectPlaces a character from the dictionary on the display list
Modifies a character that was previously placed on the display list
RemoveObjectRemoves a character from the display list
ShowFrame
Saturday, 28. August 2010
![Page 46: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/46.jpg)
Control tags
SWF Tag Families
Control the flow of the SWFCreate and manipulate instances of objects on the display list
PlaceObjectPlaces a character from the dictionary on the display list
Modifies a character that was previously placed on the display list
RemoveObjectRemoves a character from the display list
ShowFrameTells the Flash Player to render the display list
Saturday, 28. August 2010
![Page 47: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/47.jpg)
A simple example
The Flow
SWF Dictionary Display list
Empty EmptyDefineShapeID 1
DefineSpriteID 2
PlaceObjectID 1 at depth 1
ShowFrame
ShowFrame
PlaceObjectID 2 at depth 2
RemoveObjectfrom depth 1
Saturday, 28. August 2010
![Page 48: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/48.jpg)
A simple example
The Flow
SWF
DefineShapeID 1
DefineSpriteID 2
PlaceObjectID 1 at depth 1
ShowFrame
ShowFrame
Dictionary Display list
Empty
PlaceObjectID 2 at depth 2
RemoveObjectfrom depth 1
ShapeID 1
Saturday, 28. August 2010
![Page 49: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/49.jpg)
A simple example
The Flow
SWF
DefineShapeID 1
DefineSpriteID 2
PlaceObjectID 1 at depth 1
ShowFrame
ShowFrame
Dictionary Display list
Empty
PlaceObjectID 2 at depth 2
RemoveObjectfrom depth 1
ShapeID 1
SpriteID 2
Saturday, 28. August 2010
![Page 50: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/50.jpg)
A simple example
The Flow
SWF
DefineShapeID 1
DefineSpriteID 2
ShowFrame
ShowFrame
Dictionary Display list
PlaceObjectID 2 at depth 2
RemoveObjectfrom depth 1
ShapeID 1
SpriteID 2
PlaceObjectID 1 at depth 1
Shapeat depth 1
Saturday, 28. August 2010
![Page 51: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/51.jpg)
A simple example
The Flow
SWF
DefineShapeID 1
DefineSpriteID 2
ShowFrame
ShowFrame
Dictionary Display list
PlaceObjectID 2 at depth 2
RemoveObjectfrom depth 1
ShapeID 1
SpriteID 2
PlaceObjectID 1 at depth 1
Shapeat depth 1
Spriteat depth 2
Saturday, 28. August 2010
![Page 52: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/52.jpg)
A simple example
The Flow
SWF
DefineShapeID 1
DefineSpriteID 2
ShowFrame
ShowFrame
Dictionary Display list
PlaceObjectID 2 at depth 2
RemoveObjectfrom depth 1
ShapeID 1
SpriteID 2
PlaceObjectID 1 at depth 1
Shapeat depth 1
Spriteat depth 2
Display list is rendered on screen
Saturday, 28. August 2010
![Page 53: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/53.jpg)
A simple example
The Flow
SWF
DefineShapeID 1
DefineSpriteID 2
ShowFrame
ShowFrame
Dictionary Display list
PlaceObjectID 2 at depth 2
RemoveObjectfrom depth 2
ShapeID 1
SpriteID 2
PlaceObjectID 1 at depth 1
Shapeat depth 1
Spriteat depth 2
Saturday, 28. August 2010
![Page 54: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/54.jpg)
A simple example
The Flow
SWF
DefineShapeID 1
DefineSpriteID 2
ShowFrame
ShowFrame
Dictionary Display list
PlaceObjectID 2 at depth 2
RemoveObjectfrom depth 2
ShapeID 1
SpriteID 2
PlaceObjectID 1 at depth 1
Shapeat depth 1
Display list is rendered on screen
Saturday, 28. August 2010
![Page 55: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/55.jpg)
Compile time/date, info about compiler used
The ProductInfo tag
[41:ProductInfo] ProductID: 3 Edition: 6 Version: 4.0.0.14159 CompileDate: Wed Apr 21 03:23:16 GMT-0400 2010
ProductID (UI32) 0: Unknown 1: Macromedia Flex for J2EE 2: Macromedia Flex for .NET 3: Adobe Flex
Edition (UI32) 0: Developer Edition 1: Full Commercial Edition 2: Non Commercial Edition 3: Educational Edition 4: Not For Resale (NFR) Edition 5: Trial Edition 6: None
Saturday, 28. August 2010
![Page 56: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/56.jpg)
Defines styles and geometry of a shape
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,125,15,125, EdgeBounds: 20,120,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,20, FillStyle1: 1, LineStyle: 1 [SWFShapeRecordStraightEdge] Vertical: 100 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordEnd]
Saturday, 28. August 2010
![Page 57: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/57.jpg)
Defines styles and geometry of a shape
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,125,15,125, EdgeBounds: 20,120,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,20, FillStyle1: 1, LineStyle: 1 [SWFShapeRecordStraightEdge] Vertical: 100 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordEnd]
Shape records are not drawing instructions!They define the geometry of the shape.
Saturday, 28. August 2010
![Page 58: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/58.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 59: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/59.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 60: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/60.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 61: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/61.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 62: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/62.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 63: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/63.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 64: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/64.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 65: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/65.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 66: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/66.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 67: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/67.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 68: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/68.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 69: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/69.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 70: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/70.jpg)
The DefineShape tagSo what about those two FillStyles?!
?????
Saturday, 28. August 2010
![Page 71: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/71.jpg)
The DefineShape tagSo what about those two FillStyles?!
Saturday, 28. August 2010
![Page 72: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/72.jpg)
The DefineShape tagSo what about those two FillStyles?!
FillStyle1(color to the right)
FillStyle0(color to the left)
Saturday, 28. August 2010
![Page 73: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/73.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 74: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/74.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 75: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/75.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 76: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/76.jpg)
The DefineShape tag
[83:DefineShape4] ID: 1, ShapeBounds: 15,175,15,125, EdgeBounds: 20,170,20,120 FillStyles: [1] [SWFFillStyle] Type: 0 (solid), Color: FF0000 [2] [SWFFillStyle] Type: 0 (solid), Color: 666666 LineStyles: [1] [SWFLineStyle2] Width: 10, Color: 000000 ShapeRecords: [SWFShapeRecordStyleChange] MoveTo: 120,45, FillStyle1: 2, LineStyle: 1 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStyleChange] FillStyle1: 1 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStraightEdge] Horizontal: -100 [SWFShapeRecordStraightEdge] Vertical: -100 [SWFShapeRecordStraightEdge] Horizontal: 100 [SWFShapeRecordStraightEdge] Vertical: 25 [SWFShapeRecordStyleChange] FillStyle0: 2 [SWFShapeRecordStraightEdge] Horizontal: -50 [SWFShapeRecordStraightEdge] Vertical: 50 [SWFShapeRecordStraightEdge] Horizontal: 50 [SWFShapeRecordEnd]
Defines styles and geometry of a shape
Saturday, 28. August 2010
![Page 77: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/77.jpg)
DEMO
Saturday, 28. August 2010
![Page 78: @cwahlers - index-of.co.uk/index-of.co.uk/Web-Application/HackingSWF.pdf · 2019-03-07 · Hacking SWF Claus Wahlers côdeazur brasil powerflasher @cwahlers Saturday, 28. August](https://reader030.vdocuments.mx/reader030/viewer/2022040608/5ec596055cee4454e935eb1c/html5/thumbnails/78.jpg)
Thanks!
wahlers.com.br/claus/blogBlog
github.com/clausGitHub
@cwahlersTwitter
Claus [email protected]
Saturday, 28. August 2010