Announcing: RABCDAsm

RABCDAsm (Robust ABC (ActionScript Bytecode) [Dis-]Assembler) is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.

This package was created due to lack of similar software out there.
Particularly, I needed an utility which would allow me to edit ActionScript 3 bytecode (used in Flash 9 and newer) with the following properties:

  • Speed. Less waiting means more productivity. rabcasm can assemble large projects (>200000 LOC) in under a second on modern machines.
  • Comfortably-editable output. Each class is decompiled to its own file, with files arranged in subdirectories representing the package hierarchy. Class files are #included from the main file.
  • Most importantly – robustness! If the Adobe AVM can load and run the file, then it must be editable – no matter if the file is obfuscated or otherwise mutilated to prevent reverse-engineering. RABCDAsm achieves this by using a textual representation closer to the ABC file format, rather than to what an ActionScript compiler would generate.

Read more on the project’s homepage on GitHub.

81 thoughts on “Announcing: RABCDAsm

  1. Sirmabus

    Hey CyberShadow!

    I went’a googling for something useful in brower game stuff and ended up here with the right search words.
    Great work, and something truly useful for once.

    Email or come by IRC (it changed recently from “.com” to “.info”).
    And ask Viru to send me an email damn it.

    Reply
  2. Celtic

    When running the tool abcexport.exe on a .swf file, I get the error “Range Violation”. Any idea what might be causing this?

    Reply
  3. Geo

    Hi CyberShadow !!!
    Great project !!!

    I have a little problem after successfully disassemble / assemble some swfs without errors and without even change the bytecode, when i load them back i get some errors from the flash debugger like :

    Variable _ZBlackJackModule_mx_core_FlexModuleFactory is not defined.

    Why this happens .. Is there any way to fix this ?

    Thx in advance.

    Reply
    1. CyberShadow Post author

      If you send me the SWF, I can look into it. Make sure you’re using the latest version first, though.

      Reply
        1. CyberShadow Post author

          I’m seeing the same errors when I try to run the original SWF in the stand-alone Flash player. It probably can’t be ran by itself (which would be explained by the “Module” part of the filename).

          Reply
          1. Geo

            I am not running the swf from the standalone player, i m running it via their main interface which loads their original swf successfully (not the one from their server I use a tool like fiddler), then if I disassemble/reassemble the SWF the debugger shows me only this one error.

            Variable _ZBlackJackModule_mx_core_FlexModuleFactory is not defined.

            Is this any kind of protection or something?

            Reply
  4. Lopus

    Hey,

    really cool stuff, u helped me a lot! Is there any way to get abc code into readable as3? I cant decompile it from tools, its flex code and Trillix and stuff like that are crashing.

    Thanks

    Reply
    1. CyberShadow Post author

      That’s what decompilers are for. Decompilation is outside the scope of the RABCDAsm project, and it’s easily possible to write AVM bytecode that is impossible to represent using ActionScript 3 source code. Commercial decompilers exist, but they are often fragile and usually easily defeated by obfuscators.

      Reply
    1. CyberShadow Post author

      Works for me. Did you remember to enclose the file name (which contains a space) in quotes? (The error message should have made that clear.)

      Reply
  5. x

    rabcdasm gives me core.exception.OutOfMemoryError on this one which is the same file but the original compressed version
    (link removed)

    Reply
      1. x

        LOL 1.8.7z <–

        both worked for you?
        what could I be doing wrong?
        I extracted rabcdasm.exe and rabcasm.exe to my path, I opened a command prompt in the dir with the swf
        (links removed)

        Win7 Pro x64 with 4GB ram
        rabc exe's are located in F:\_bin\

        Reply
        1. CyberShadow Post author

          Kindly refer to the usage instructions. You must first extract the ActionScript ByteCode to .abc files using the abcexport program before attempting to disassemble it.

          Reply
  6. x

    this proggie is SWEET :)
    I love how it converts jumps to labels and vice versa. This is so much easier to follow than switching windows in SWFReader and also compiles SO much faster. Thx very much.

    Reply
  7. uzumaki19

    need help i geting error on compiling the swf i edit

    std.file.fileexeption@std\file.d game-0.swf:The system cannot find the file specified.

    Reply
  8. uzumaki19

    abcexport file.swf
    rabcdasm file-0.abc
    rabcasm file-0/file-0.main.asasm
    abcreplace file-0.swf 0 file-0/file-0.main.abc

    i just follow the instruction

    Reply
  9. curiousone

    @CyberShadow: you rock!

    @CyberShadow readership:
    RABCDAsm is meant to make life easier.

    For fast error free disassembling/reassembling, use bat files:
    >> Create 2 text files in your RABCDAsm folder, change extension from “.txt” to “.bat”

    >> You can call your bat files:
    disassemble.bat
    reassemble.bat

    >> inside your “disassemble.bat” type:
    abcexport name.swf
    rabcdasm name-0.abc
    pause

    >> inside your “reassemble.bat” type:
    rabcasm name-0\name-0.main.asasm
    pause
    abcreplace name.swf 0 name-0\name-0.main.abc
    pause
    del /q /f name-0.abc
    pause

    >> You just double click “disassemble.bat” to extract your asasm files, after editing your files double click “reassemble.bat” to update your SWF.

    Note: Your RABCDAsm folder should include 2 bat files, your SWF, abcexport.exe, rabcdasm.exe, abcreplace.exe, rabcasm.exe. You need to put the right SWF name in the bat file. When reassembling: your folder name-0 will remain there, and the file name-0.abc will disappear.

    Reply
    1. CyberShadow Post author

      Is that possible I have a swf file without DoABC tags?

      Yes, if it doesn’t contain any ActionScript 3 code.

      And in that case, how could I disassemble it?

      Use another tool. For ActionScript 1/2, you may want to look at flasm or SWiX.

      Reply
      1. Alex

        Is there a pratical way to recognize which language is the swf written in?

        And maybe it’s a bit off-topic, but I need the help of an expert like you: do you know if it’s possible to decompile/disassemble Shockwave too?

        Reply
        1. CyberShadow Post author

          Is there a pratical way to recognize which language is the swf written in?

          If it’s not ActionScript 3, it’s almost surely ActionScript 2.

          Look at the file with SWiX or other SWF editor. DoABC / DoABC2 tags mean ActionScript3, DoAction tags mean ActionScript 1/2.

          And maybe it’s a bit off-topic, but I need the help of an expert like you: do you know if it’s possible to decompile/disassemble Shockwave too?

          Sorry, I’ve never looked at Shockwave.

          Reply
  10. ehab aboudaya

    This one app is a gift from allah, thank you for all your efforts and time.

    Do you have a donate button?

    Reply
  11. John S Wolter

    Thank you for your work. I’m downloading now. I’m disassembling and re-assembling A-S 2. This is the only such program for the more recent versions of A-S.

    There is another for A-S version 2 but support has dropped. It appears to work well for older A-S versions.
    Disassembler/Compiler
    See: http://www.nowrap.de/flasm.html
    Just disassemble to readable text, useful:
    http://www.nowrap.de/flare.html
    Open Source A-S 2 Compiler, “it’s the source Luke”:
    http://www.mtasc.org/ maybe support

    …then a wild idea, one language compiles to any target platforms bytecodes including FlashVM:
    http://haxe.org/
    http://en.wikipedia.org/wiki/Haxe

    Reply
    1. CyberShadow Post author

      Yes, it is possible to obtain the value of the secureToken, but I will not help you do that.

      Reply
  12. jing

    hey CyberShadow,

    thanks for your answer, but why would you want to give me any info?

    I would be happy

    thx
    Jing

    Reply
    1. CyberShadow Post author

      Because 1) I am not going to do your work (reverse-engineering 3rd-party code) for you, and 2) I do not know your ultimate goal, and how ethical it is. Unless you are a security researcher, I am not going to help you hack Flash files you send me.

      Reply
  13. jing

    hey mate,

    i’m not a security researcher,i am active in a forum and give support
    the secureToken changes often, and i will like to learn how to find secureToken with RABCDAsm

    I would also like to pay as consideration received

    e-mail: dingomingo@hotmail.de

    thx
    Jing

    Reply
  14. DEAD_MAN_WALKING

    @ jing its pretty easy to get the obfuscated secureToken but ill never tell. Also a little birdie tells me your selling a script for €280 to do this if that’s your correct email above you posted.

    Reply
  15. jing

    @D_M_W

    i do not understand, why this theme secureToken is a secret?

    We are all brothers and sisters, you should share with each other the know

    Reply
  16. Ankilla

    Hey CyberShadow,

    After decompiling a swf file i found some part of the code is not decompiled properly.

    Msg displaying under the class is as follows
    ; Error while disassembling method: Don’t know how to decode OP_finddef
    ; body
    ; maxstack 6
    ; localcount 5
    ; initscopedepth 0
    ; maxscopedepth 1
    ; code
    ; 0xD0 0×30 0xD0 0×66 0xD5 0×22 0×66 0xDC 0×03 0×24 0×00 0×13 0x1A 0×00 0×00 0xD0
    ; 0×66 0xD5 0×22 0×24 0×00 0×66 0x8F 0×24 0×80 0xD4 0×22 0×63 0×04 0xD0 0×66 0xD5
    ; 0×22 0x4F 0xDD 0×03 0×00 0×10 0×10 0×00 0×00 0x5F 0xD4 0×22 0xD0 0×66 0xA3 0×23
    ; 0x4A 0xD4 0×22 0×01 0×80 0xD4 0×22 0×63 0×04 0×62 0×04 0×80 0xD4 0×22 0xD7 0xD3
    ; 0xD1 0xD2 0×24 0×00 0×24 0×00 0x2C 0xB6 0×30 0x4F 0×80 0×02 0×05 0xD3 0x4F 0x9F
    ; 0×04 0×00 0×60 0xC0 0×22 0xD3 0x4F 0xCD 0×03 0×01 0×47

    error screen shot: http://i44.tinypic.com/4hfu5w.jpg

    swf File location : http://farm.maxgames.com/LostOutpostMTk5Mw==.swf

    Pls help

    Reply
  17. Ankilla

    While decompiling .swf (http://www.newgrounds.com/portal/view/630383) got the following error.

    2014-01-10 23:09:29.9871|ERROR|WinRABCDAsm|Error disassembling SWF file|System.Exception: CommandLine: D:\WinRABCDAsm10\bin\rabcdasm.exe "D:\WinRABCDAsm10\Work\remodelracing-0.abc", StandardOutput:
    , StandardError: core.exception.OutOfMemoryError

    , ExitCode: 1, Exception:

    what need to be done

    Reply
  18. Raivis

    Is there any way to merge the ABC tags into one with RABCDAsm?
    I have a large .swf that has each class in its own abc tag and when I use it with rabcdasm it creates around 3 thousand folders for each tag.

    Sincerely,
    - Raivis

    Reply
  19. John Johanson

    Hey CyberShadow, there are many SWFs which have attached images.
    Would be cool (and very useful) if you could make a tool to extract those images from the SWFs and replace it (like swfbinexport & swfbinreplace).

    Finally, I want to thank you for doing such amazing tools for SWF editing, they’re very useful for me and many others.

    Sincerely, John.

    Reply
  20. BeStPRoGiE

    Hey cybershadow thanks for all your hard work. Your program is amazing!

    I have a recent problem on a different computer. I reinstalled windows 8 recently and updated all the flash and java that im supposed to. Then i installed your program and ran my batch files on a swf file. It decompiles with no error what so ever and all the files and folders are there. However when i recompile the file it is only 2 megs big. (original is 3.47) At first i thought maybe new security in swf file…but using the same identical files on my other computer that has operating system for almost 5 years….and it recompiles to the proper file size. So my question is….should i be installing some kind of compression program on my system? (like winzip or winrar). Im at a loss of why on new system it will not recompile the file back to its original size and on older system it will when i use the same files. So im thinking im missing something on the computer…..any thoughts or hints would be very much appreciated.

    Thanks in advance…

    BeStPRoGiE.

    Btw…i am using newst update of yours (4/2014)…also i tried for shits and giggles a older version of your program…same results.

    Reply
    1. Vladimir Panteleev Post author

      That’s a rather bizarre problem.

      SWF files can be compressed in three ways: not at all, using zlib (deflate) compression, or using LZMA. zlib compression should be always available, as it is part of the language’s standard library, but availability of LZMA compression is determined during compilation. If you use the released versions, LZMA compression should always be available.

      Now, when updating .swf files, RABCDAsm compresses them using the same format that they were already compressed. The only way to change the compression method would be doing so explicitly using e.g. swfdecompress or swflzmacompress. So I guess what you’re saying would be probable if 1) you compile RABCDAsm from source, 2) your batch files recompress the SWF using LZMA compression when available, and 3) the RABCDAsm version on your new PC has LZMA compression, but not the one on your old PC.

      Assuming this is not the case, you could start troubleshooting the issue by checking if the created files work fine (i.e. aren’t missing any pieces), checking their compression method (the first 3 bytes of the SWF indicate it – FWS, CWS and ZWS for none/zlib/LZMA respectively), etc. The answer would likely also depend on such questions as what exactly your batch files do, whether you built RABCDAsm from source, and the exact versions of RABCDAsm you used.

      Reply
      1. BeStPRoGiE

        Thank you for your quick response bro….really do appreciate it.
        After i posted my question i did some more investigation on the file.
        When i tried to view it in as3 sorcerer it showed it had no actionscript in it what so ever!
        Which of course just stumped the hell out of me as this was a first for me.
        Been playing with swf files now for 4 years and never had seen anything like it before.
        Anyways….after trying almost everything except clucking like a chicken while compiling i was about to give up until i viewed the properties of the file again. When i did, i saw that Windows had a Block on the swf file for some strange reason. (no idea why). It had a option to unblock it which i did and tried recompiling it again and sure enough it worked. Still no clue why or how it got blocked in the first place…but bottom line is that the problem is solved and everything is working normally again on the new system. Once again thank you for your time and quick response.

        Since i am here, i would like to ask another question that i been meaning to get around to. Like i mentioned i have been playing around with swf files now for 4 years. About two years ago i read a article of yours about reverse obfuscation. For the life of me i cant find that article again….when i read it before it was like Chinese to me. But now i understand allot more about action script and feel its time for the next level of learning. |I don’t expect you to hold my hand or anything but if you could direct me to the post of yours about it or any other Good article on reverse obfuscation it would be greatly appreciated. Once again thanks for your time.

        BeStPRoGiE

        Reply
  21. Swanty

    Hello!

    Why are there numbers one the first line of every .script.asasm file?

    Like this:
    script ; 118

    I am trying to compare the differences between same swf (different version), but because of these random numbers git tells me all .script.asasm files are changed and it’s hard to compare if i have to check 2000 files.

    Reply
      1. Swanty

        It would be nice if there was a command line parameter for that in rabcdasm, to just simply not add those comments.
        Also, about these script index comments. Are they used anywhere by rabcdasm or are they just there for informational purposes? I mean can I recompile safely if I remove all those script index comments?

        Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Current ye@r *