Announcing: RABCDAsm

RABCDAsm (Robust ABC (ActionScript Bytecode) [Dis-]Assembler) is a collection of utilities including an ActionScript 3 assembler/disassembler, and a few tools to manipulate SWF files.

This package was created due to lack of similar software out there.
Particularly, I needed an utility which would allow me to edit ActionScript 3 bytecode (used in Flash 9 and newer) with the following properties:

  • Speed. Less waiting means more productivity. rabcasm can assemble large projects (>200000 LOC) in under a second on modern machines.
  • Comfortably-editable output. Each class is decompiled to its own file, with files arranged in subdirectories representing the package hierarchy. Class files are #included from the main file.
  • Most importantly – robustness! If the Adobe AVM can load and run the file, then it must be editable – no matter if the file is obfuscated or otherwise mutilated to prevent reverse-engineering. RABCDAsm achieves this by using a textual representation closer to the ABC file format, rather than to what an ActionScript compiler would generate.

Read more on the project’s homepage on GitHub.

72 thoughts on “Announcing: RABCDAsm

  1. Sirmabus

    Hey CyberShadow!

    I went’a googling for something useful in brower game stuff and ended up here with the right search words.
    Great work, and something truly useful for once.

    Email or come by IRC (it changed recently from “.com” to “.info”).
    And ask Viru to send me an email damn it.

    Reply
  2. Celtic

    When running the tool abcexport.exe on a .swf file, I get the error “Range Violation”. Any idea what might be causing this?

    Reply
  3. Geo

    Hi CyberShadow !!!
    Great project !!!

    I have a little problem after successfully disassemble / assemble some swfs without errors and without even change the bytecode, when i load them back i get some errors from the flash debugger like :

    Variable _ZBlackJackModule_mx_core_FlexModuleFactory is not defined.

    Why this happens .. Is there any way to fix this ?

    Thx in advance.

    Reply
    1. CyberShadow Post author

      If you send me the SWF, I can look into it. Make sure you’re using the latest version first, though.

      Reply
        1. CyberShadow Post author

          I’m seeing the same errors when I try to run the original SWF in the stand-alone Flash player. It probably can’t be ran by itself (which would be explained by the “Module” part of the filename).

          Reply
          1. Geo

            I am not running the swf from the standalone player, i m running it via their main interface which loads their original swf successfully (not the one from their server I use a tool like fiddler), then if I disassemble/reassemble the SWF the debugger shows me only this one error.

            Variable _ZBlackJackModule_mx_core_FlexModuleFactory is not defined.

            Is this any kind of protection or something?

            Reply
  4. Lopus

    Hey,

    really cool stuff, u helped me a lot! Is there any way to get abc code into readable as3? I cant decompile it from tools, its flex code and Trillix and stuff like that are crashing.

    Thanks

    Reply
    1. CyberShadow Post author

      That’s what decompilers are for. Decompilation is outside the scope of the RABCDAsm project, and it’s easily possible to write AVM bytecode that is impossible to represent using ActionScript 3 source code. Commercial decompilers exist, but they are often fragile and usually easily defeated by obfuscators.

      Reply
    1. CyberShadow Post author

      Works for me. Did you remember to enclose the file name (which contains a space) in quotes? (The error message should have made that clear.)

      Reply
  5. x

    rabcdasm gives me core.exception.OutOfMemoryError on this one which is the same file but the original compressed version
    (link removed)

    Reply
      1. x

        LOL 1.8.7z <–

        both worked for you?
        what could I be doing wrong?
        I extracted rabcdasm.exe and rabcasm.exe to my path, I opened a command prompt in the dir with the swf
        (links removed)

        Win7 Pro x64 with 4GB ram
        rabc exe's are located in F:\_bin\

        Reply
        1. CyberShadow Post author

          Kindly refer to the usage instructions. You must first extract the ActionScript ByteCode to .abc files using the abcexport program before attempting to disassemble it.

          Reply
  6. x

    this proggie is SWEET :)
    I love how it converts jumps to labels and vice versa. This is so much easier to follow than switching windows in SWFReader and also compiles SO much faster. Thx very much.

    Reply
  7. uzumaki19

    need help i geting error on compiling the swf i edit

    std.file.fileexeption@std\file.d game-0.swf:The system cannot find the file specified.

    Reply
  8. uzumaki19

    abcexport file.swf
    rabcdasm file-0.abc
    rabcasm file-0/file-0.main.asasm
    abcreplace file-0.swf 0 file-0/file-0.main.abc

    i just follow the instruction

    Reply
  9. curiousone

    @CyberShadow: you rock!

    @CyberShadow readership:
    RABCDAsm is meant to make life easier.

    For fast error free disassembling/reassembling, use bat files:
    >> Create 2 text files in your RABCDAsm folder, change extension from “.txt” to “.bat”

    >> You can call your bat files:
    disassemble.bat
    reassemble.bat

    >> inside your “disassemble.bat” type:
    abcexport name.swf
    rabcdasm name-0.abc
    pause

    >> inside your “reassemble.bat” type:
    rabcasm name-0\name-0.main.asasm
    pause
    abcreplace name.swf 0 name-0\name-0.main.abc
    pause
    del /q /f name-0.abc
    pause

    >> You just double click “disassemble.bat” to extract your asasm files, after editing your files double click “reassemble.bat” to update your SWF.

    Note: Your RABCDAsm folder should include 2 bat files, your SWF, abcexport.exe, rabcdasm.exe, abcreplace.exe, rabcasm.exe. You need to put the right SWF name in the bat file. When reassembling: your folder name-0 will remain there, and the file name-0.abc will disappear.

    Reply
    1. CyberShadow Post author

      Is that possible I have a swf file without DoABC tags?

      Yes, if it doesn’t contain any ActionScript 3 code.

      And in that case, how could I disassemble it?

      Use another tool. For ActionScript 1/2, you may want to look at flasm or SWiX.

      Reply
      1. Alex

        Is there a pratical way to recognize which language is the swf written in?

        And maybe it’s a bit off-topic, but I need the help of an expert like you: do you know if it’s possible to decompile/disassemble Shockwave too?

        Reply
        1. CyberShadow Post author

          Is there a pratical way to recognize which language is the swf written in?

          If it’s not ActionScript 3, it’s almost surely ActionScript 2.

          Look at the file with SWiX or other SWF editor. DoABC / DoABC2 tags mean ActionScript3, DoAction tags mean ActionScript 1/2.

          And maybe it’s a bit off-topic, but I need the help of an expert like you: do you know if it’s possible to decompile/disassemble Shockwave too?

          Sorry, I’ve never looked at Shockwave.

          Reply
  10. ehab aboudaya

    This one app is a gift from allah, thank you for all your efforts and time.

    Do you have a donate button?

    Reply
  11. John S Wolter

    Thank you for your work. I’m downloading now. I’m disassembling and re-assembling A-S 2. This is the only such program for the more recent versions of A-S.

    There is another for A-S version 2 but support has dropped. It appears to work well for older A-S versions.
    Disassembler/Compiler
    See: http://www.nowrap.de/flasm.html
    Just disassemble to readable text, useful:
    http://www.nowrap.de/flare.html
    Open Source A-S 2 Compiler, “it’s the source Luke”:
    http://www.mtasc.org/ maybe support

    …then a wild idea, one language compiles to any target platforms bytecodes including FlashVM:
    http://haxe.org/
    http://en.wikipedia.org/wiki/Haxe

    Reply
    1. CyberShadow Post author

      Yes, it is possible to obtain the value of the secureToken, but I will not help you do that.

      Reply
  12. jing

    hey CyberShadow,

    thanks for your answer, but why would you want to give me any info?

    I would be happy

    thx
    Jing

    Reply
    1. CyberShadow Post author

      Because 1) I am not going to do your work (reverse-engineering 3rd-party code) for you, and 2) I do not know your ultimate goal, and how ethical it is. Unless you are a security researcher, I am not going to help you hack Flash files you send me.

      Reply
  13. jing

    hey mate,

    i’m not a security researcher,i am active in a forum and give support
    the secureToken changes often, and i will like to learn how to find secureToken with RABCDAsm

    I would also like to pay as consideration received

    e-mail: dingomingo@hotmail.de

    thx
    Jing

    Reply
  14. DEAD_MAN_WALKING

    @ jing its pretty easy to get the obfuscated secureToken but ill never tell. Also a little birdie tells me your selling a script for €280 to do this if that’s your correct email above you posted.

    Reply
  15. jing

    @D_M_W

    i do not understand, why this theme secureToken is a secret?

    We are all brothers and sisters, you should share with each other the know

    Reply
  16. Ankilla

    Hey CyberShadow,

    After decompiling a swf file i found some part of the code is not decompiled properly.

    Msg displaying under the class is as follows
    ; Error while disassembling method: Don’t know how to decode OP_finddef
    ; body
    ; maxstack 6
    ; localcount 5
    ; initscopedepth 0
    ; maxscopedepth 1
    ; code
    ; 0xD0 0×30 0xD0 0×66 0xD5 0×22 0×66 0xDC 0×03 0×24 0×00 0×13 0x1A 0×00 0×00 0xD0
    ; 0×66 0xD5 0×22 0×24 0×00 0×66 0x8F 0×24 0×80 0xD4 0×22 0×63 0×04 0xD0 0×66 0xD5
    ; 0×22 0x4F 0xDD 0×03 0×00 0×10 0×10 0×00 0×00 0x5F 0xD4 0×22 0xD0 0×66 0xA3 0×23
    ; 0x4A 0xD4 0×22 0×01 0×80 0xD4 0×22 0×63 0×04 0×62 0×04 0×80 0xD4 0×22 0xD7 0xD3
    ; 0xD1 0xD2 0×24 0×00 0×24 0×00 0x2C 0xB6 0×30 0x4F 0×80 0×02 0×05 0xD3 0x4F 0x9F
    ; 0×04 0×00 0×60 0xC0 0×22 0xD3 0x4F 0xCD 0×03 0×01 0×47

    error screen shot: http://i44.tinypic.com/4hfu5w.jpg

    swf File location : http://farm.maxgames.com/LostOutpostMTk5Mw==.swf

    Pls help

    Reply
  17. Ankilla

    While decompiling .swf (http://www.newgrounds.com/portal/view/630383) got the following error.

    2014-01-10 23:09:29.9871|ERROR|WinRABCDAsm|Error disassembling SWF file|System.Exception: CommandLine: D:\WinRABCDAsm10\bin\rabcdasm.exe "D:\WinRABCDAsm10\Work\remodelracing-0.abc", StandardOutput:
    , StandardError: core.exception.OutOfMemoryError

    , ExitCode: 1, Exception:

    what need to be done

    Reply
  18. Raivis

    Is there any way to merge the ABC tags into one with RABCDAsm?
    I have a large .swf that has each class in its own abc tag and when I use it with rabcdasm it creates around 3 thousand folders for each tag.

    Sincerely,
    - Raivis

    Reply
  19. John Johanson

    Hey CyberShadow, there are many SWFs which have attached images.
    Would be cool (and very useful) if you could make a tool to extract those images from the SWFs and replace it (like swfbinexport & swfbinreplace).

    Finally, I want to thank you for doing such amazing tools for SWF editing, they’re very useful for me and many others.

    Sincerely, John.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Current day month ye@r *