: WARNING - support of the decompiler is now VERY LIMITED. There are no active developers. This means waiting times in the issue tracker are very long and mostly depend on community. Sorry for the inconvenience.
State: closed new: Initial state. As long as issue is in this state, the work on the issue has not yet begun. opened: Opened state means developer started working on the issue. Feature/Fix will probably be in the next release. postponed: This means developer is not working on it now, for some reason it cannot be implemented now. Issue may be opened again in the future. upgraded: Issue is in upgraded state when developer made changes to the program and new version was released. closed: This means the user is satisfied with issue results and no more changes are needed. invalid: These issues cannot be solved. ignored: Developer decided to take no action on this issue. returned: Program changes were made but user is not satisfied and returned the issue.
I'm trying to automate source code or p-code replacements in CLI, so that SWFs are
processed in batch. The CLI says "Sorry, no example found for command replace, Let us know
in issue tracker when you need it."
My current plan is:
1) ./ffdec.sh -format script:pcode -export script ~/script ~/a.swf
2) run my own script (Python etc) that will change the source code files in a few places
3) ./ffdec.sh -replace a.swf b.swf <params>
I'm stuck with 3) - how do I replace the previously exported scripts?
SWFs are a mix of AS2 & 3, so need examples for both.
AS2 (I write windows exmaples, but you can easily convert to linux format):
ffdec.bat -replace as2.swf as2_replaced.swf "\frame 50\DoAction" new.pcode
You can list the available script names (\frame 50\DoAction) with the following command:
ffdec.bat -dumpas2 as2.swf
ffdec.bat -replace as3.swf as3_replaced.swf classes.Test new.pcode 2
classes.Test is the fully qualified classname which contains the method you want to
You can list the available classnames with the following command:
ffdec.bat -dumpas3 as3.swf (ignore the numbers at the end)
2 is the method body index you want to replace
You can see the methodbody id in GUI (or in the exported scripts) if you enable Advanced
Settings/Debug/Show method body id.
FFDec will add a comment, like:
public function testHello() : *
// method body index: 2 method index: 2
You need the first number.
new.pcode should contain the same text which is in the pcode window on the GUI when you
select the method, but you sohuld remove the first (trait) line.