AMF represents ActionScript objects by a single byte representing type, and then by a type-specific byte array that may be of fixed length, may contain length information, or may come with its own end code. The Flash player encodes Actionscript objects according to the following table. The following types have been discovered so far:

Represented as 9 bytes: 1 byte for 0×00 and 8 bytes a double representing the value of the number.

Represented as 2 bytes: 1 byte for 0×01 and a second, 0×00 for false, 0×01 for true.

Represented as 3 bytes + len(String): 1 byte 0×02, then a UTF8 string, including the top two bytes representing string length as a int.

Represented as 1 byte, 0×03, then pairs of UTF8 string, the key, and an amf element, ended by three bytes, 0×00 0×00 0×09.

Implemented in PHP as:

$ret = array(); // init the array
$key = $this->inputStream->readUTF(); // grab the key
for ($type = $this->inputStream->readByte(); $type != 9; $type = $this->inputStream->readByte()) {
    $val = $this->readData($type); // grab the value
    $ret[$key] = $val; // save the name/value pair in the array
    $key = $this->inputStream->readUTF(); // get the next name
}
return $ret; // return the array

MovieClip does not sem to be supported by Remoting. It may be used by other AMF clients such as SharedObjects.

1 single byte, 0×05 indicates null

1 single byte, 0×06 indicates null

When an ActionScript object refers to itself, such this.self = this, or when objects are repeated within the same scope (for example, as the two parameters of the same function called), a code of 0×07 and an int, the reference number, are written.

The reference counter restarts at 0 in every new scope (scope can mean a specific body or header in the context of Remoting), and increments for every passed object, array, mixedArray and typedObject (class). The first object encountered will have reference number 1, the second 2, and so on. There are two suggestions for when you’re not able to deal with references.

• Return null
• Return [unresolved reference #x] (this is what happens in AMFPHP)

These are merely suggestions though. A solution for PHP would be to create an array with references to the objects. (using the reference id as a key).

A MixedArray is indicated by code 0×08, then a Long representing the highest numeric index in the array, or 0 if there are none or they are all negative. After that follow the elements in key : value pairs. Each key is an UTF8 string containing the string length. Numeric keys are represented as strings. A MixedArray is an instance of the ActionScript Array with either of the conditions:

• The array contains floating point or negative indices
• The array contains non-numeric keys

MixedArray ends with an empty UTF8 string (0×00 0×00) and 0×09. It is very similar to an 0×03 Object; however the host should convert numeric looking keys to numeric keys, unlike Object.

An array is indicated by 0x0A, then a Long for array length, then the array elements themselves. Arrays are always sparse; values for inexistant keys are set to null (0×06) to maintain sparsity. Take the following example:

var a = new Array();
a[0] = "something";
a[10000] = "Something else";

Flash will encode this as 0x0A, then length 10001, then the first element, 9999 times 0×06, then the final element, for a total of over 10 KB. For arrays with very large gaps, the user may want to insert a dummy string key so that the array will be forcefully typed as a MixedArray.

Date is represented as 0x0B, then a double, then an int. The double represents the number of milliseconds since 01/01/1970. The int represents the timezone offset in minutes between GMT. Note for the latter than values greater than 720 (12 hours) are represented as 2^16 - the value. Thus GMT+1 is 60 while GMT-5 is 65236.

The Flash player sends a timezone value, however it seems that it does not read it coming back from the server.

LongString is reserved for strings larger then 2^16 characters long. It is represented as 0x0C then a LongUTF.

Trying to send values which don’t make sense, such as prototypes, functions, built-in objects, etc. will be indicated by a single 0x0D byte.

0X0E has been reported as a possible means of transmitting RecordSets. Little information is known about that mechanism however. For the time being, Remoting implementations should stick with the custom class code (0x0A) with the Remoting recordset structure.

The XML element is indicated by 0x0F and followed by a LongUTF containing the string representation of the XML object. The receiving gateway may which to wrap this string inside a language-specific standard XML object, or simply pass as a string.

A typed object is indicated by 0×10, then a UTF string indicating class name, and then the same structure as a normal 0×03 Object. The receiving gateway may use a mapping scheme, or send back as a vanilla object or associative array.

An AMF message sent from an AS3 client such as the Flash 9 player may break out into AMF3 mode. In this case the next byte will be the AMF3 type code and the data will be in AMF3 format until the decoded object reaches it’s logical conclusion (for example, an object has no more keys).

http://www.vanrijkom.org/archives/2005/06/amf_format.html