AS2 Push

So I was arguing a long time ago with one of the mods here how push works, and I kind of had to look it up to work on a new aob, so I figured I would finally write up how push works in AS2/AVM1(0?) if for no reason other than to have it written down in one easy to find spot.

lets just dive into a sample push

push 65535

96 05 00 07 ff ff 00 00 0c
op -len-- ----data------
So, what does these numbers mean?
96 =push
05 00 = 5 {00 05}(length of data, short)
07 = int {signed} (datatype)
ff ff 00 00 = 65535 {00 00 ff ff} (data)

pay special attention to that 07. It is a flag that tells flash that an integer object is being pushed onto the stack. there are 9 different object flags for push.

00 - string
01 - float
02 - null
03 - undefined or NaN or something like that
04 - variable/constant pool item
05 - boolean
06 - double
07 - integer
08 - dictionary item

Each of these flags has a set datalength except string which is null terminated, youll need to know these for the length part of the push instruction
flag--# of bytes
00  --  strlen+1
01  --  8 (?unsure here)
02  --  0
03  --  0
04  --  1
05  --  1
06  --  8
07  --  4
08  --  1
[hr:kgotpf7h][/hr:kgotpf7h][hr:kgotpf7h][/hr:kgotpf7h]

ok so lets see push in action
c_pistol_score=so.data.c_pistol_score

//96 04 00 08 17 08 04
_push "c_pistol_score" "so"
//1c
_getVariable
//96 02 00 08 08
_push "data"
//4e
_getMember
//96 02 00 08 17
_push "c_pistol_score"
//4e
_getMember
//1d
_setVariable
thats no fun, i need 50 000 for the badge, lets make it
c_pistol_score=50000;//50000==0x0000c350

//96 07 00 08 17 07 50 c3 00 00
_push "c_pistol_score" 50000
//1d
_setVariable
//02 02 02 02 02 02 02 02 02 02
NOP NOP NOP NOP NOP ... NOP
painless.

oh and here is string. its tricky, because the null termination is 00 not 02. so dont get snagged.

op -len- str_k _o _l _o _n _e _l _k _a _d _a _t null-termination
96 0e 00 00 6B 6F 6C 6F 6E 65 6C 6B 61 64 61 74 00
_push "kolonelkadat"
happy hacking.

Hey nice tutorial, now AS2 can be made easier for Usaio (broken image removed)

Great writeup. I've always used http://www.m2osw.com/swf_action_pushdata as reference on as2 push.

jesus... I spent like an hour googling trying to find something like that.... found nothing....

Hey nice tutorial, now AS2 can be made easier for Usaio (broken image removed)

Hey! I can do AS2! The AoBs are just way too long and gross. I don't like it. The hell...

well since you guys are all pros at this maybe you can help me out with this mess i cant wrap my head around.

I dont remember what it was exactly, but it was basically
this.finalscore = some long ass bullshit

so i changed it to this. cutting out all that long ass bull shit and making the score 10 000.

_push "finalscore" 10000 "this"
_getVariable
_setMemberbut it doesnt work... odd well maybe I got the stack wrong...I know it should be this but....

"this"
10000
"finalscore"

_getVariable => pop dx ?i guess i dunno, register doesnt really matter, pretty sure nothing is pushed onto the stack?
_setMember => pop ax cx; mov ds:cx,ax ?again assumption?

but anyways what ended up working was

_push "this"
_getVariable
_push "finalscore"
_push 10000
_setMember
I dont inderstand... stack is the same as the last time....

karma to whoever points out my major malfunction.

_push "this"
_getVariableMeans "I want to access the 'this' variable."

_push "finalscore"Means I want to reference the finalscore variable INSIDE the 'this' variable.

The rest should be obvious. setMember, as opposed to setVariable, sets a variable inside an object and calls it a member. As opposed to that, setVariable sets an "independent" variable. The same process goes with the getMember/getVariable.

Now, the push function when pushing several things works in reverse. It's incredibly weird, but it makes sense. Let's take an example scenario:

_root.hello = _root.world;

It'd look something like:

_push "_root"
_getVariable
_push "hello" "_root"
_getVariable
_push "world"
_getMember
_setMember

(broken image removed)
Hopefully the image makes sense...

right. i still dont get why

_push "finalscore" 10000 "this"
_getVariable
_setMemberdoesnt work.

right. i still dont get why

Code: [Select]

_push "finalscore" 10000 "this"
_getVariable
_setMemberdoesnt work.

Let's see what you do here, from the interpreter's point of view.
push finalscore
push 1000
push this
getVariable this
setMember 1000 (broken image removed)

What you want it to see is "I want to access the finalscore member of the this variable and push 1000 in it."
To do that, you need to see that the interpreter needs to be specifically told what to access and where.

but why isnt finalscore accessible?

It's accessible, you just didn't access it. You can access it by doing this:
_push "this"
_getVariable
_push "finalscore"
_getMember

Or, if you want to set it,
_push "this"
_getVariable
_push "finalscore"
//calculations here
_setMember

See what I did there? I first specifically told him to get the object "this", then to go to the member "finalscore".

That still doesn't explain why the given code doesn't work, Zirak, only why yours does. The real question is... if the stack contains just a reference to any member, why does "this" have to come first? What is it about the handling of the stack that makes this incorrect?

If we break the code into

_push "finalscore"
_push 10000
_push "this"
_getVariable
_setMember
we are still first telling the game to get "this", then store some information in the "finalscore" member, just relying on the stack to maintain the information.


Unsubstantiated hypothesis that I just thought up... _getVariable pulls information off the stack, then adds more information on top. So, when the above code gets to the _setMember, the stack looks like:

[unknown information]
10000
"finalscore"

When the _setMember gets executed, the top of the stack should be the value, the second should be the member, and the third should be what the member is part of. Clearly we don't have this, so the _setMember op bugs.

Thinking about it, the "unknown information" is likely a reference to the instance of the class we're using (a memory address). Mostly likely "finalscore" is treated as a constant offset for each instance of the class.

So, we want

value
variable offset
instance address

but the code KK used gives

instance address
value
variable offset

Basically the arguments for the _setMember "function" are given in the wrong order.

I read tutorials whole day and i am trying to test what i learned so i have a test.swf with code below

//96 02 00 08 24
_push "updateUserMoney"
//1c
_getVariable
//96 03 00 09 4a 04
_push "this"
//1c
_getVariable
//96 09 00 08 24 07 03 00 00 00 08 29
_push "updateUserMoney" 3 "flash"
//1c
_getVariable
//96 02 00 08 2a
_push "external"

So would u please someone let me know  how can i find the  aob code of  the value that i want to add.

In this code i want to add for example 10000 to this so as to add 10000 to "updateUserMoney".I am i wrong? the reference is "this" so first of all i have to try to act it.
i tried several ways but  doesnt work

for example i try nto use the aob values that i see in this post

//96 07 00 08 17
_push "c_pistol_score"
----------------------------------------------------
//96 07 00 08 17 07 50 c3 00 00
_push "c_pistol_score" 50000

===========================> so 50000 = 07 50 c3 00 00  ( am i wrong? )

and try this

//96 02 00 08 24
_push "updateUserMoney"
//1d
_setVariable
//96 03 00 09 4a 04 07 50 c3 00 00
_push "this" 50000
//1d
_setVariable
//96 09 00 08 24 07 03 00 00 00 08 29
_push "updateUserMoney" 3 "flash"
//1d
_setVariable
//96 02 00 08 2a
_push "external"

but again not works.Huh help will be appreciated.Ty