I have just made version 1.2.0 of my SWF reverse engineering tools collection SWFRETools available for download. This release focused on improving the disassembly quality of ActionScript 2 code after a user reported some issues last Friday. Specifically the changes I made are:
- Feature: Made parsing of files more robust. This became necessary after the recent spike in obfuscated ActionScript code malware.
- Feature: Unknown ActionScript 2 instructions are now shown in the GUI with their action code.
- Feature: In ActionScript 2 code, the jump target of ActionIf instructions shown in the GUI is now the adjusted address instead of the raw relative address. This makes it easier for the user to find out where a jump is going.
- Feature: In ActionScript 2 code, the jump target of ActionJump instructions shown in the GUI is now the adjusted address instead of the raw relative address. This makes it easier for the user to find out where a jump is going.
- Feature: Strings defined in ActionScript 2 ConstantPool actions are now surrounded by quotes to make them more readable.
- Feature: When ActionScript 2 code is shown in the GUI, registers pushed by ActionPush are now easily distinguished from pushed integers.
- Feature: When ActionScript 2 code is shown in the GUI, constants pushed by ActionPush are now easily distinguished from pushed integers.
- Feature: When ActionScript 2 code is shown in the GUI, strings pushed by ActionPush are now easily distinguished from pushed integers.
- Bugfix: In previous versions, the ActionScript 2 actions belonging to a DoAction tag were not shown in the Flash Dissector tree. This has been fixed.
- Bugfix: In previous versions, the ActionScript 2 actions belonging to a DoInitAction tag were not shown in the Flash Dissector tree. This has been fixed.
- Bugfix: The constant list defined by an ActionScript 2 ConstantPool instruction is now better formatted for improved readability.
- Bugfix: ActionScript 2 Push instructions were previously not shown in the GUI.
- Bugfix: ActionScript 2 PushDuplicate instructions were previously not shown in the GUI.
- Bugfix: ActionScript 2 Pop instructions were previously not shown in the GUI.
- Bugfix: ActionScript 2 Play instructions were previously not shown in the GUI.
- Bugfix: ActionScript 2 PreviousFrame instructions were previously not shown in the GUI.
- Bugfix: ActionScript 2 RandomNumber instructions were previously not shown in the GUI.
- Bugfix: ActionScript 2 RemoveSprite instructions were previously not shown in the GUI.
- Bugfix: ActionScript 2 Return instructions were previously not shown in the GUI.
Happy using and please use GitHub to open tickets for problems or feature requests you encounter. Or alternatively shoot me an email.
