Home/ Questions/Q 3999206

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T07:37:38+00:00

while testing my own implementation of a DoABC tag parser (Actionscript bytecode) i ran

  • 0

while testing my own implementation of a DoABC tag parser (Actionscript bytecode) i ran across a swf file that had something strange in it. There is a method with bytecode that makes little to no sense (even opcodes that are not defined!).

I have found some more swf files that have such a method. Strangely enough, this method seems to have always the same length and is always the last one defined, but the bytecode varies from file to file. However it seems the swf file is not in any way affected by this method, since it works fine. I figured that maybe this method is not called, but I cannot verify that at the moment.

Does anyone have an idea what the purpose of this method is?
For reference, one such file is here: http://swf.tubechop.com/tubechop.swf

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This swf has some very strange things, I’m pretty sure it’s been obfuscated.
    For example, this appears at the start of every method:

    #1    pushbyte  byteValue: 37
#2    pushbyte  byteValue: 34
#3    ifne  reference: #6

    Which decompiles into 

    if(37 != 34)

    As for the method you’ve found, it looks like it’s just full of jibberish. There are no references to it, so the verifier will never even look at the code. Definitely a good technique to stop decompliation.

    I checked it out with my own app: http://swfwire.com/inspector

    • 0