SWF Decompression Perl One-liner

Flash seems to be the popular way of playing videos online. This is a bit better than the bad old days of online video where a user had to select from a few buggy media player plug-ins. Things have improved.

However, if you don't use Flash, or if you want to watch the videos in your own media player, you are stuck. A download link for the video is almost never provided. The video is always somewhere, though, to be fetched via http. I mentioned this before for downloading YouTube videos using youtube-dl.

The trick is finding the URL. Sometimes you can derive it from the HTML code, sometimes you have to dig a little deeper by inspecting the Flash player itself. strings can be invaluable here.

There could be an extra layer of stuff to work out, which is explained below. My main reason for posting this is so I can refer back to it later when I need to do it again.

So, the other day I ran into a Flash video player that contained part of the URL of its video. I began by studying the embed tag in the HTML, which gave me some information about where to find the video (the video ID number). I downloaded the Flash player SWF file for the purpose of running strings on it.

I ran into a problem here. I wasn't finding any non-garbage strings inside the file. file told me it was compressed.

$ file player.swf
player.swf: Macromedia Flash data (compressed), version 9

Searching online quickly revealed that a compressed Flash file is just zlib compression after an 8-byte header. Decompression can actually be done with a Perl one-liner,

perl -MCompress::Zlib -0777 -e \
      'print uncompress substr <>, 8;' player.swf > player

I ran strings and greped for "http", revealing the location of the video. That was it!

I actually came across a Java program that does the same thing. It is 115 lines of code. Java programs always seem to be bloated like this.

I hope you find this useful!

Have a comment on this article? Start a discussion in my public inbox by sending an email to ~skeeto/public-inbox@lists.sr.ht [mailing list etiquette] , or see existing discussions.

This post has archived comments.

null program

Chris Wellons

wellons@nullprogram.com (PGP)
~skeeto/public-inbox@lists.sr.ht (view)