0 Replies Latest reply on Jan 18, 2015 1:50 PM by Xalkavia

    What is this? DefineBinaryData swf tag, "PAME" / "PAMU" FourCC header

    Xalkavia

      (Edit: found the answer shortly after. These binaries are associated with Clickteam Fusion / The Games Factory / Multimedia Fusion, a third-party proprietary encoding. A few people attempted to decode it a few years ago but apparently didn't get far.)


      I am developing an application which works with the internal structure of arbitrary Flash .swf files. I have been encountering a number of files in the wild, particularly games utilizing ActionScript 3, which store most of their assets -- graphics, sprites, dialogue, scripting -- in binaries contained in DefineBinaryData tags. These binaries begin with a FourCC of "PAME" or "PAMU", with the apparent difference that PAME uses single-byte character strings, whereas PAMU uses wide characters. According to the host swf Metadata, these files were recently created using Adobe Flex 3.


      I'm interested in knowing the structure of these binaries. I have no experience with Flex, and have been unable to find any information about these data structures. Are these something that Flex creates, or are they part of some third-party library? Are they documented or am I looking at a proprietary encoding?


      There's little variation in the first 128 bytes of these binaries. A typical one looks something like this:

      50 41 4D 45 02 03 00 00 03 00 00 00 01 01 00 00 | PAME............

      23 22 00 00 70 00 00 00 70 00 00 00 09 A5 00 08 | #"..p...p.......

      04 00 81 40 00 02 E0 01 FF FF FF FF FC FF FF FF | ...@............

      05 00 05 00 05 00 05 00 26 00 28 00 25 00 27 00 | ........&.(.%.'.

      10 00 11 00 20 00 0D 00 26 00 28 00 25 00 27 00 | .... ...&.(.%.'.

      10 00 11 00 20 00 0D 00 26 00 28 00 25 00 27 00 | .... ...&.(.%.'.

      10 00 11 00 20 00 0D 00 26 00 28 00 25 00 27 00 | .... ...&.(.%.'.

      10 00 11 00 20 00 0D 00 FF FF FF 00 01 00 00 00 | .... ...........

      3C 00 00 00 00 00 00 00 24 22 00 00 0D 00 00 00 | <.......$"......

      This is followed by three null-terminated strings; the name of the binary and two local file paths. In this case, "zeldapreload", "C:\Users\Owner\AppData\Local\Temp\Fla269.tmp\Preloader.ccf", and "C:\Users\Owner\AppData\Local\Temp\Fla269.tmp\Preloader.mfa". Scattered through the binaries are FourCC codes of "SPRI", "TEXT", "CNTR", "ERG3", "ER>>", "ERes", "ERev", names of fonts, and file names ending in ".mfx".