Simple AS3 Decompiler Using Tamarin

From FlashSec

Jump to: navigation, search

Note: With Flex 4 there is a more convenient possibility to decompile Flash 9 files, called swfdump (see Disassembling a SWF with swfdump for more information and get the Open Source Flex SDK from the repository to build it from source).

[edit] How to build Tamarin

MacOS X:

cd tamarin-central/core
xcodebuild -project platform/mac/shell/shell.xcodeproj
  • Download and install the Adobe Flex 2 SDK (
  • The ActionScript compiler is found in lib/asc.jar. Copy lib/asc.jar from the Flex SDK installation directory to tamarin-central/utils/
  • Use asc.jar to compile the Tamarin intrinsics into

cd tamarin-central/core
java -ea -DAS3 -Xmx200m -DAVMPLUS \
    -classpath ../utils/asc.jar macromedia.asc.embedding.ScriptCompiler \
    -d -builtin -out builtin

Note: Under MacOS X avmplus is under platform/mac/shell/build/Release/shell. For convenience reasons you can copy shell to utils/avmplus. You can now use asc.jar and to compile applications. Use the -help options of asc.jar and avmplus for more details.

Here's an example for testing your installation. Take a simple AS3 file "":

  print ( "Hello World!" );

Now compile this as file using java -jar asc.jar

java -jar asc.jar, 85 bytes written

Now run avmplus with

Hello World!

Et voilĂ ! Now it's possible to build a AS3 Bytecode Decompiler.

[edit] How to build an AS3 decompiler

java -jar utils/asc.jar core/
java -jar utils/asc.jar shell/
java -jar utils/asc.jar -exe avmplus -import core/ -import shell/ utils/

Note: If there is trouble compiling with an error such as "Error #1017: The definition of base class Object was not found." add the following line to core/ include "../shell/". The import option for shell/ByteArray is not necessary after adding this line.

Now the simple decompiler is ready to use:

utils/abcdump.exe path/to/as3.swf

[edit] References