FAQ

FFDec Frequently asked questions (FAQ)

"Invalid SWF file, wrong signature" on opening file with .swf extension, what's that?

This message means that you are opening file which is not really the SWF. FFDec can process only valid SWF files - those which can be played in Flash player. SWF file extension is not enough - also file structure must be compliant with SWF standard - it needs to start with FWS, CWS or ZWS bytes. If you are 100% sure there is something SWF related inside your file, then it probably needs some kind of decryption/unpacking routine first. Go where you got the file and search for an unpacking routine (loader), maybe you find something. FFDec cannot help you with this since decryption routine can be literally anything.

Direct editation of ActionScript gives me an error, what can I do?

Direct editation of AS is experimental - it might damage your SWF file. You can try to report such kind of error to our issue tracker, always attach your SWF file. Then we can take a look.

Can you implement new feature for me?

Try asking in the issue tracker. Decompiler is opensource, you can also implement feature yourself.

Do you fix bugs?

I try to fix them. Please use issue tracker to report them.

Is there a documentation for FFDec library?

Actually, there is some info on Library page.

What's that thing with § character in scripts?

A) Variable identifiers which have invalid characters in their name are displayed in the form §name§ (for example §s-r/rg§ ). This allows easier direct editation.

B) Also, there exist few special instructions/functions with prefix §§:

• §§push(item) - pushes item on stack
• §§pop() - pops from stack
• §§dup() - duplicates value on stack
• §§goto(label) - jump to address1 (not compilable)
• §§constant(number) - unresolved constant in AS1/2 (unknown constantpool)
• §§multiname(index) - unresolved multiname in AS3 (not compilable)
• §§hasnext(object,index) - hasnext or hasnext2 AS3 instruction
• §§newactivation() - newactivation AS3 instruction
• §§nextname(index,object) - nextname AS3 instruction
• §§nextvalue(index,object) - nextvalue AS3 instruction
• §§enumeration() - generated by ActionEnumerate or ActionEnumerate2 in AS1/2 (not compilable)
• §§enum_assign() - used by enumeration in AS1/2 (not compilable)
• §§findproperty(name) - findproperty call in AS3 (not compilable)
• object.§§slot[index] - unresolved slot index on object in AS3 (not compilable)
• §§newclass(name,baseType) - newclass AS3 instruction (not compilable)
• §§method(index) - newfunction AS3 instruction which was detected as recursive (not compilable)

These functions usually pop out when you try to decompile some obfuscated / unstructured code. You can try Settings/Automatic deobfuscation option for handle some kinds of this code properly.

What's that weird escape sequence \{NN}C, \{120}H, etc.?

To avoid displaying long obfuscated names, FFDec can use so called repeating escape sequence \{NN}C, for example \{50}K means 50 K characters in a row.

These escape sequences are used in obfuscated names (like § bad\{75} - *name§) and also in P-code for all strings (like "string of \{150}L").

Default limit is 20 consequent characters - all above will be shortened with the escape. The limit can be raised in Advanced settings / Limits.

This is the way to safely display and edit long obfuscated identifiers consisting of same characters.