9

It appears that most SWF files, if not all are actually swf "archives" containing compressed versions of themselves. I have seen that you can extract the file using a few tools

$ flasm -x player.swf
Flasm configuration file flasm.ini not found, using default values
player.swf successfully decompressed, 206239 bytes

$ 7z x player.swf

7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18

Processing archive: player.swf

Extracting  player~.swf

Everything is Ok

Size:       206239
Compressed: 106427

However I was hoping to extract from these using something a little more "conventional", e.g. tar or gzip

4

1 回答 1

22

Relevant quote from http://www.adobe.com/content/dam/Adobe/en/devnet/swf/pdf/swf_file_format_spec_v10.pdf

The header begins with a three-byte signature of either 0x46, 0x57, 0x53 (“FWS”); or 0x43, 0x57, 0x53 (“CWS”).

  • An FWS signature indicates an uncompressed SWF file;
  • CWS indicates that the entire file after the first 8 bytes (that is, after the FileLength field) was compressed by using the ZLIB open standard. The data format that the ZLIB library uses is described by Request for Comments (RFCs) documents 1950 to 1952. CWS file compression is permitted in SWF 6 or later only.

Update In response to the comment, here's a little bash script that is a literal translation of what the above seems to describe:

#!/bin/bash
for swf in "$@"
do
    signature=$(dd if="$swf" bs=1 count=3 2> /dev/null)
    case "$signature" in
        FWS)
            echo -e "uncompressed\t$swf"
            ;;
        CWS)
            targetname="$(dirname "$swf")/uncompressed_$(basename "$swf")"
            echo "uncompressing to $targetname"

            dd if="$swf" bs=1 skip=8 2>/dev/null |
                (echo -n 'FWS'; 
                 dd if="$swf" bs=1 skip=3 count=5 2>/dev/null;
                 zlib-flate -uncompress) > "$targetname"
            ;;
        *)
            {
                echo -e "unrecognized\t$swf"
                file "$swf"
            } > /dev/stderr
            ;;
    esac

done

Which you'd then run across a set of *.swf files (assume you saved it as uncompress_swf.sh):

uncompress_swf.sh /some/folder/*.swf

It will say stuff like 

uncompressed     /some/folder/a.swf
uncompressed     /some/folder/b.swf
uncompressing to /some/folder/uncompressed_c.swf

If something didn't look like a flash file, at all, it will print an error to stderr.

DISCLAIMER This is just the way I read the quoted spec. I have just checked that using this script resulted in identical output as when I had used 7z x on the input swf.

于 2012-07-27T02:33:54.053 回答