SWF Bytecode & Reverse Engineering: ABC Instructions & the Tamarin AVM2 Virtual Machine

1. The ABC File Format: Structure of a DoABC Tag

ActionScript 3.0 bytecode is packaged into an SWF within DoABC (Tag ID 72) or DoABC2 (Tag ID 82) tags. The binary payload follows a strict specification defined in Adobe's AVM2 overview:

• Version Header: 16-bit minor version (typically 16) and 16-bit major version (typically 46).
• Constant Pool (cpool_info): The central symbol table storing integer, unsigned integer, double-precision float, string, namespace, namespace set, and Multiname entries.
• Method Signatures (method_info): Defines return types, parameter types, method names, and flags (such as NEED_REST or NEED_ARGUMENTS).
• Class & Trait Metadata (metadata_info & class_info): Records class inheritance, implemented interfaces, constructor pointers, and static/instance member trait slots.
• Method Bodies (method_body_info): Contains the active bytecode instructions, local register counts, evaluation stack limits, exception handler tables, and trait definitions.

2. The Tamarin AVM2 Stack Machine & Bytecode Instructions

The AVM2 virtual machine is a stack machine: computational instructions pop arguments from the evaluation stack and push results. AVM2 provides over 150 unique opcodes optimized for object-oriented programming:

// Disassembled AVM2 Bytecode: Calculating Pythagorean Distance
// AS3: return Math.sqrt(dx * dx + dy * dy);
getlocal_1             // Push local variable dx (Register 1)
getlocal_1             // Push local variable dx
multiply               // Pop both, multiply -> push (dx * dx)
getlocal_2             // Push local variable dy (Register 2)
getlocal_2             // Push local variable dy
multiply               // Pop both, multiply -> push (dy * dy)
add                    // Pop both products, sum -> push (dx*dx + dy*dy)
getlex      Math       // Push global Math class object
swap                   // Swap Math and sum on evaluation stack
callproperty sqrt, 1   // Invoke Math.sqrt with 1 argument
returnvalue            // Return result from method

AVM2's property resolution relies on Multinames—a qualified name paired with one or more namespaces. This enabled Flash to enforce package-private, internal, and custom user-defined namespaces at the virtual machine level.

3. Instruction Reference: Common AVM2 Bytecode Opcodes

4. Decompilation Pipelines & Control Flow Graph (CFG) Reconstruction

Converting flat linear bytecode back into high-level structured control statements requires decompilation software (such as JPEXS Free Flash Decompiler or RABCDAsm) to execute multi-stage graph analysis:

• Basic Block Partitioning: The bytecode stream is partitioned into basic blocks—sequences of instructions with a single entry point and a single exit branch.
• Control Flow Graph (CFG): Branch target addresses (iftrue, iffalse, jump) form directed edges between basic blocks.
• Loop Detection & Structuring: Dominator tree analysis identifies loop back-edges, converting low-level jumps into structured while, for, and do-while blocks.
• Type Inference & Register Recovery: Registers assigned inside loops are traced to deduce variable scoping and eliminate compiler-generated temporary storage variables.

5. Automated Bytecode-to-TypeScript Transpilation

Rather than relying on manual source code rewrites, modern enterprise migration engines parse the ABC bytecode directly into a modern TypeScript AST:

// Transpiled Modern TypeScript Output (Generated from AVM2 Bytecode)
export class GameEntity {
  public x: number = 0.0;
  public y: number = 0.0;
  protected health: number = 100;

  constructor(initialX: number, initialY: number) {
    this.x = initialX;
    this.y = initialY;
  }

  public takeDamage(amount: number): boolean {
    this.health = Math.max(0, this.health - amount);
    return this.health > 0;
  }
}

This automated transpilation guarantees 100% preservation of mathematical algorithms, physics collision equations, and business rules, enabling rapid deployment onto modern web architectures.

Frequently Asked Questions