The open source Tamarin project includes a reference table for the opcodes used in the ABC format.
See SWF9Tools wiki page for some tools that can help with the reverse engineering of the opcodes.
See SWF9DIS wiki page for the main page of this project.
See http://labs.macromedia.com/wiki/index.php/ActionScript_3 and http://livedocs.macromedia.com/labs/1/flex/langref/index.html for more information about ActionScript 3.
Will invent names of opcodes similar to those of MSIL. See ECMA-335: CLI Partition III - CIL on http://msdn.microsoft.com/netframework/ecma/ for documentation on MSIL instruction set.
03 : throw
04 : getsuper
05 : setsuper
08 XX : regreset ??
09 : nop
0C XX YY ZZ : bge - branch on greater than or equal. ZZYYXX is offset in bytes.
0D XX YY ZZ : bgt - branch on greater than. ZZYYXX is offset in bytes.
0E XX YY ZZ : ble - branch on less than or equal. ZZYYXX is offset in bytes.
0F XX YY ZZ : blt - branch on less than. ZZYYXX is offset in bytes.
10 XX YY ZZ : br - unconditional branch. ZZYYXX is offset in bytes.
11 XX YY ZZ : brtrue - branch on true. ZZYYXX is offset in bytes.
12 XX YY ZZ : brfalse - branch on false. ZZYYXX is offset in bytes. Seen with logical-or ||.
13 XX YY ZZ : beq - branch on equal. ZZYYXX is offset in bytes.
14 XX YY ZZ : bne - branch on not equal. ZZYYXX is offset in bytes.
15 XX YY ZZ : bnge - branch on not greater than or equal
16 XX YY ZZ : bngt - branch on not greater than
17 XX YY ZZ : bnle - branch on not less than or equal
18 XX YY ZZ : bnlt - branch on not less than
19 XX YY ZZ : bseq - branch on strict equal
1A XX YY ZZ : bsne - branch on strict not equal
1B : switch
1C : xmlop3
1D : popscope
1E : forin
20 : null
21 : undef
23 : foreach
24 XX : ldc.8s - load 8-bit signed integer constant XX on stack, where -128 ⇐ XX ⇐ 127
25 XX YY : ldc.15u - load 15-bit unsigned integer constant with value (YY « 7) + (XX & 0x7f) on stack
I.e. XX always has the high bit set, and only delivers 7 bits of information. Examples: 0x0080 -> 25 80 01 0180 0x0081 -> 25 81 01 0181 0x00FF -> 25 FF 01 01FF 0x0100 -> 25 80 02 0280 0x012c -> 25 ac 02 02ac 0x015e -> 25 de 02 02de 0x017f -> 25 ff 02 02ff 0x0180 -> 25 08 03 0380 0x0190 -> 25 90 03 0390 0x7530 -> 25 b0 ea eab0 0x7fff -> 25 ff ff ffff
26 : ldtrue - load Boolean constant true.
27 : ldfalse - load Boolean constant false.
28 : ldnan
29 : pop - remove the top element of the stack.
2A XX : dup ?
2B : catchdone ?
2C XX : ldc.string - load string constant #XX on stack.
2D : ldc.intref
2F : ldc.float
5D XX : ?
62 XX : ?
63 XX : ?
66 XX : load type?
"foo = NaN;" can become 5D 03 66 03 6F 01
6E XX : ldloca.number(?) - load reference to Number variable #XX on stack.
6F XX : ldloca.string - load reference to String variable #XX on stack
80 02 : st - store or assign (
.
"foo = 2;" migh be translated to 6F 01 (push reference to variable foo) 24 02 (push integer constant 2) 80 02 (store)
87 : convert - type conversion? Seen with “as” keyword
90 : neg
91 : inc - increment ++
93 : dec - decrement –
96 : not - Boolean not !
97 : bnot - binary not/bitwise complement ~
A0 : add - addition of numbers and string concatenation +
A1 : sub
A2 : mul
A3 : div - division /
A4 : mod - modulo %
A5 : shl - shift left «
A6 : shr - signed shift right »
A7 : shr.u - unsigned shift right »>
A8 : and - &
A9 : or - |
AA : xor - ^
AB : ceq - compare equal ==
AC : cseq - compare strict equal (no type coercion) ===
AD : clt - compare less than <
AE : cle - compare less than or equal ⇐
AF : cgt - compare greater than >
B0 : cge - compare greater than or equal >=
B3 : is ? is seen with use of “is” keyword
B4 : in
C0 : inc.i
C1 : dec.i
C5 : add.number - addition of numbers +
C6 : sub - subtract -
C7 : mul - multiply *