_ Git - youtube-dl/blob - youtube_dl/swfinterp.py

   1 from __future__ import unicode_literals
   2
   3 import collections
   4 import io
   5 import zlib
   6
   7 from .utils import (
   8     compat_str,
   9     ExtractorError,
  10     struct_unpack,
  11 )
  12
  13
  14 def _extract_tags(file_contents):
  15     if file_contents[1:3] != b'WS':
  16         raise ExtractorError(
  17             'Not an SWF file; header is %r' % file_contents[:3])
  18     if file_contents[:1] == b'C':
  19         content = zlib.decompress(file_contents[8:])
  20     else:
  21         raise NotImplementedError(
  22             'Unsupported compression format %r' %
  23             file_contents[:1])
  24
  25     # Determine number of bits in framesize rectangle
  26     framesize_nbits = struct_unpack('!B', content[:1])[0] >> 3
  27     framesize_len = (5 + 4 * framesize_nbits + 7) // 8
  28
  29     pos = framesize_len + 2 + 2
  30     while pos < len(content):
  31         header16 = struct_unpack('<H', content[pos:pos + 2])[0]
  32         pos += 2
  33         tag_code = header16 >> 6
  34         tag_len = header16 & 0x3f
  35         if tag_len == 0x3f:
  36             tag_len = struct_unpack('<I', content[pos:pos + 4])[0]
  37             pos += 4
  38         assert pos + tag_len <= len(content), \
  39             ('Tag %d ends at %d+%d - that\'s longer than the file (%d)'
  40                 % (tag_code, pos, tag_len, len(content)))
  41         yield (tag_code, content[pos:pos + tag_len])
  42         pos += tag_len
  43
  44
  45 class _AVMClass_Object(object):
  46     def __init__(self, avm_class):
  47         self.avm_class = avm_class
  48
  49     def __repr__(self):
  50         return '%s#%x' % (self.avm_class.name, id(self))
  51
  52
  53 class _ScopeDict(dict):
  54     def __init__(self, avm_class):
  55         super(_ScopeDict, self).__init__()
  56         self.avm_class = avm_class
  57
  58     def __repr__(self):
  59         return '%s__Scope(%s)' % (
  60             self.avm_class.name,
  61             super(_ScopeDict, self).__repr__())
  62
  63
  64 class _AVMClass(object):
  65     def __init__(self, name_idx, name):
  66         self.name_idx = name_idx
  67         self.name = name
  68         self.method_names = {}
  69         self.method_idxs = {}
  70         self.methods = {}
  71         self.method_pyfunctions = {}
  72
  73         self.variables = _ScopeDict(self)
  74
  75     def make_object(self):
  76         return _AVMClass_Object(self)
  77
  78     def __repr__(self):
  79         return '_AVMClass(%s)' % (self.name)
  80
  81     def register_methods(self, methods):
  82         self.method_names.update(methods.items())
  83         self.method_idxs.update(dict(
  84             (idx, name)
  85             for name, idx in methods.items()))
  86
  87
  88 class _Multiname(object):
  89     def __init__(self, kind):
  90         self.kind = kind
  91
  92     def __repr__(self):
  93         return '[MULTINAME kind: 0x%x]' % self.kind
  94
  95
  96 def _read_int(reader):
  97     res = 0
  98     shift = 0
  99     for _ in range(5):
 100         buf = reader.read(1)
 101         assert len(buf) == 1
 102         b = struct_unpack('<B', buf)[0]
 103         res = res | ((b & 0x7f) << shift)
 104         if b & 0x80 == 0:
 105             break
 106         shift += 7
 107     return res
 108
 109
 110 def _u30(reader):
 111     res = _read_int(reader)
 112     assert res & 0xf0000000 == 0
 113     return res
 114 _u32 = _read_int
 115
 116
 117 def _s32(reader):
 118     v = _read_int(reader)
 119     if v & 0x80000000 != 0:
 120         v = - ((v ^ 0xffffffff) + 1)
 121     return v
 122
 123
 124 def _s24(reader):
 125     bs = reader.read(3)
 126     assert len(bs) == 3
 127     last_byte = b'\xff' if (ord(bs[2:3]) >= 0x80) else b'\x00'
 128     return struct_unpack('<i', bs + last_byte)[0]
 129
 130
 131 def _read_string(reader):
 132     slen = _u30(reader)
 133     resb = reader.read(slen)
 134     assert len(resb) == slen
 135     return resb.decode('utf-8')
 136
 137
 138 def _read_bytes(count, reader):
 139     assert count >= 0
 140     resb = reader.read(count)
 141     assert len(resb) == count
 142     return resb
 143
 144
 145 def _read_byte(reader):
 146     resb = _read_bytes(1, reader=reader)
 147     res = struct_unpack('<B', resb)[0]
 148     return res
 149
 150
 151 StringClass = _AVMClass('(no name idx)', 'String')
 152
 153
 154 class SWFInterpreter(object):
 155     def __init__(self, file_contents):
 156         self._patched_functions = {}
 157         code_tag = next(tag
 158                         for tag_code, tag in _extract_tags(file_contents)
 159                         if tag_code == 82)
 160         p = code_tag.index(b'\0', 4) + 1
 161         code_reader = io.BytesIO(code_tag[p:])
 162
 163         # Parse ABC (AVM2 ByteCode)
 164
 165         # Define a couple convenience methods
 166         u30 = lambda *args: _u30(*args, reader=code_reader)
 167         s32 = lambda *args: _s32(*args, reader=code_reader)
 168         u32 = lambda *args: _u32(*args, reader=code_reader)
 169         read_bytes = lambda *args: _read_bytes(*args, reader=code_reader)
 170         read_byte = lambda *args: _read_byte(*args, reader=code_reader)
 171
 172         # minor_version + major_version
 173         read_bytes(2 + 2)
 174
 175         # Constant pool
 176         int_count = u30()
 177         for _c in range(1, int_count):
 178             s32()
 179         uint_count = u30()
 180         for _c in range(1, uint_count):
 181             u32()
 182         double_count = u30()
 183         read_bytes(max(0, (double_count - 1)) * 8)
 184         string_count = u30()
 185         self.constant_strings = ['']
 186         for _c in range(1, string_count):
 187             s = _read_string(code_reader)
 188             self.constant_strings.append(s)
 189         namespace_count = u30()
 190         for _c in range(1, namespace_count):
 191             read_bytes(1)  # kind
 192             u30()  # name
 193         ns_set_count = u30()
 194         for _c in range(1, ns_set_count):
 195             count = u30()
 196             for _c2 in range(count):
 197                 u30()
 198         multiname_count = u30()
 199         MULTINAME_SIZES = {
 200             0x07: 2,  # QName
 201             0x0d: 2,  # QNameA
 202             0x0f: 1,  # RTQName
 203             0x10: 1,  # RTQNameA
 204             0x11: 0,  # RTQNameL
 205             0x12: 0,  # RTQNameLA
 206             0x09: 2,  # Multiname
 207             0x0e: 2,  # MultinameA
 208             0x1b: 1,  # MultinameL
 209             0x1c: 1,  # MultinameLA
 210         }
 211         self.multinames = ['']
 212         for _c in range(1, multiname_count):
 213             kind = u30()
 214             assert kind in MULTINAME_SIZES, 'Invalid multiname kind %r' % kind
 215             if kind == 0x07:
 216                 u30()  # namespace_idx
 217                 name_idx = u30()
 218                 self.multinames.append(self.constant_strings[name_idx])
 219             elif kind == 0x09:
 220                 name_idx = u30()
 221                 u30()
 222                 self.multinames.append(self.constant_strings[name_idx])
 223             else:
 224                 self.multinames.append(_Multiname(kind))
 225                 for _c2 in range(MULTINAME_SIZES[kind]):
 226                     u30()
 227
 228         # Methods
 229         method_count = u30()
 230         MethodInfo = collections.namedtuple(
 231             'MethodInfo',
 232             ['NEED_ARGUMENTS', 'NEED_REST'])
 233         method_infos = []
 234         for method_id in range(method_count):
 235             param_count = u30()
 236             u30()  # return type
 237             for _ in range(param_count):
 238                 u30()  # param type
 239             u30()  # name index (always 0 for youtube)
 240             flags = read_byte()
 241             if flags & 0x08 != 0:
 242                 # Options present
 243                 option_count = u30()
 244                 for c in range(option_count):
 245                     u30()  # val
 246                     read_bytes(1)  # kind
 247             if flags & 0x80 != 0:
 248                 # Param names present
 249                 for _ in range(param_count):
 250                     u30()  # param name
 251             mi = MethodInfo(flags & 0x01 != 0, flags & 0x04 != 0)
 252             method_infos.append(mi)
 253
 254         # Metadata
 255         metadata_count = u30()
 256         for _c in range(metadata_count):
 257             u30()  # name
 258             item_count = u30()
 259             for _c2 in range(item_count):
 260                 u30()  # key
 261                 u30()  # value
 262
 263         def parse_traits_info():
 264             trait_name_idx = u30()
 265             kind_full = read_byte()
 266             kind = kind_full & 0x0f
 267             attrs = kind_full >> 4
 268             methods = {}
 269             if kind in [0x00, 0x06]:  # Slot or Const
 270                 u30()  # Slot id
 271                 u30()  # type_name_idx
 272                 vindex = u30()
 273                 if vindex != 0:
 274                     read_byte()  # vkind
 275             elif kind in [0x01, 0x02, 0x03]:  # Method / Getter / Setter
 276                 u30()  # disp_id
 277                 method_idx = u30()
 278                 methods[self.multinames[trait_name_idx]] = method_idx
 279             elif kind == 0x04:  # Class
 280                 u30()  # slot_id
 281                 u30()  # classi
 282             elif kind == 0x05:  # Function
 283                 u30()  # slot_id
 284                 function_idx = u30()
 285                 methods[function_idx] = self.multinames[trait_name_idx]
 286             else:
 287                 raise ExtractorError('Unsupported trait kind %d' % kind)
 288
 289             if attrs & 0x4 != 0:  # Metadata present
 290                 metadata_count = u30()
 291                 for _c3 in range(metadata_count):
 292                     u30()  # metadata index
 293
 294             return methods
 295
 296         # Classes
 297         class_count = u30()
 298         classes = []
 299         for class_id in range(class_count):
 300             name_idx = u30()
 301
 302             cname = self.multinames[name_idx]
 303             avm_class = _AVMClass(name_idx, cname)
 304             classes.append(avm_class)
 305
 306             u30()  # super_name idx
 307             flags = read_byte()
 308             if flags & 0x08 != 0:  # Protected namespace is present
 309                 u30()  # protected_ns_idx
 310             intrf_count = u30()
 311             for _c2 in range(intrf_count):
 312                 u30()
 313             u30()  # iinit
 314             trait_count = u30()
 315             for _c2 in range(trait_count):
 316                 trait_methods = parse_traits_info()
 317                 avm_class.register_methods(trait_methods)
 318
 319         assert len(classes) == class_count
 320         self._classes_by_name = dict((c.name, c) for c in classes)
 321
 322         for avm_class in classes:
 323             u30()  # cinit
 324             trait_count = u30()
 325             for _c2 in range(trait_count):
 326                 trait_methods = parse_traits_info()
 327                 avm_class.register_methods(trait_methods)
 328
 329         # Scripts
 330         script_count = u30()
 331         for _c in range(script_count):
 332             u30()  # init
 333             trait_count = u30()
 334             for _c2 in range(trait_count):
 335                 parse_traits_info()
 336
 337         # Method bodies
 338         method_body_count = u30()
 339         Method = collections.namedtuple('Method', ['code', 'local_count'])
 340         for _c in range(method_body_count):
 341             method_idx = u30()
 342             u30()  # max_stack
 343             local_count = u30()
 344             u30()  # init_scope_depth
 345             u30()  # max_scope_depth
 346             code_length = u30()
 347             code = read_bytes(code_length)
 348             for avm_class in classes:
 349                 if method_idx in avm_class.method_idxs:
 350                     m = Method(code, local_count)
 351                     avm_class.methods[avm_class.method_idxs[method_idx]] = m
 352             exception_count = u30()
 353             for _c2 in range(exception_count):
 354                 u30()  # from
 355                 u30()  # to
 356                 u30()  # target
 357                 u30()  # exc_type
 358                 u30()  # var_name
 359             trait_count = u30()
 360             for _c2 in range(trait_count):
 361                 parse_traits_info()
 362
 363         assert p + code_reader.tell() == len(code_tag)
 364
 365     def patch_function(self, avm_class, func_name, f):
 366         self._patched_functions[(avm_class, func_name)] = f
 367
 368     def extract_class(self, class_name):
 369         try:
 370             return self._classes_by_name[class_name]
 371         except KeyError:
 372             raise ExtractorError('Class %r not found' % class_name)
 373
 374     def extract_function(self, avm_class, func_name):
 375         p = self._patched_functions.get((avm_class, func_name))
 376         if p:
 377             return p
 378         if func_name in avm_class.method_pyfunctions:
 379             return avm_class.method_pyfunctions[func_name]
 380         if func_name in self._classes_by_name:
 381             return self._classes_by_name[func_name].make_object()
 382         if func_name not in avm_class.methods:
 383             raise ExtractorError('Cannot find function %s.%s' % (
 384                 avm_class.name, func_name))
 385         m = avm_class.methods[func_name]
 386
 387         def resfunc(args):
 388             # Helper functions
 389             coder = io.BytesIO(m.code)
 390             s24 = lambda: _s24(coder)
 391             u30 = lambda: _u30(coder)
 392
 393             registers = [avm_class.variables] + list(args) + [None] * m.local_count
 394             stack = []
 395             scopes = collections.deque([
 396                 self._classes_by_name, avm_class.variables])
 397             while True:
 398                 opcode = _read_byte(coder)
 399                 if opcode == 16:  # jump
 400                     offset = s24()
 401                     coder.seek(coder.tell() + offset)
 402                 elif opcode == 17:  # iftrue
 403                     offset = s24()
 404                     value = stack.pop()
 405                     if value:
 406                         coder.seek(coder.tell() + offset)
 407                 elif opcode == 18:  # iffalse
 408                     offset = s24()
 409                     value = stack.pop()
 410                     if not value:
 411                         coder.seek(coder.tell() + offset)
 412                 elif opcode == 19:  # ifeq
 413                     offset = s24()
 414                     value2 = stack.pop()
 415                     value1 = stack.pop()
 416                     if value2 == value1:
 417                         coder.seek(coder.tell() + offset)
 418                 elif opcode == 20:  # ifne
 419                     offset = s24()
 420                     value2 = stack.pop()
 421                     value1 = stack.pop()
 422                     if value2 != value1:
 423                         coder.seek(coder.tell() + offset)
 424                 elif opcode == 32:  # pushnull
 425                     stack.append(None)
 426                 elif opcode == 36:  # pushbyte
 427                     v = _read_byte(coder)
 428                     stack.append(v)
 429                 elif opcode == 38:  # pushtrue
 430                     stack.append(True)
 431                 elif opcode == 39:  # pushfalse
 432                     stack.append(False)
 433                 elif opcode == 42:  # dup
 434                     value = stack[-1]
 435                     stack.append(value)
 436                 elif opcode == 44:  # pushstring
 437                     idx = u30()
 438                     stack.append(self.constant_strings[idx])
 439                 elif opcode == 48:  # pushscope
 440                     new_scope = stack.pop()
 441                     scopes.append(new_scope)
 442                 elif opcode == 66:  # construct
 443                     arg_count = u30()
 444                     args = list(reversed(
 445                         [stack.pop() for _ in range(arg_count)]))
 446                     obj = stack.pop()
 447                     res = obj.avm_class.make_object()
 448                     stack.append(res)
 449                 elif opcode == 70:  # callproperty
 450                     index = u30()
 451                     mname = self.multinames[index]
 452                     arg_count = u30()
 453                     args = list(reversed(
 454                         [stack.pop() for _ in range(arg_count)]))
 455                     obj = stack.pop()
 456
 457                     if isinstance(obj, _AVMClass_Object):
 458                         func = self.extract_function(obj.avm_class, mname)
 459                         res = func(args)
 460                         stack.append(res)
 461                         continue
 462                     elif isinstance(obj, _ScopeDict):
 463                         if mname in obj.avm_class.method_names:
 464                             func = self.extract_function(obj.avm_class, mname)
 465                             res = func(args)
 466                         else:
 467                             res = obj[mname]
 468                         stack.append(res)
 469                         continue
 470                     elif isinstance(obj, compat_str):
 471                         if mname == 'split':
 472                             assert len(args) == 1
 473                             assert isinstance(args[0], compat_str)
 474                             if args[0] == '':
 475                                 res = list(obj)
 476                             else:
 477                                 res = obj.split(args[0])
 478                             stack.append(res)
 479                             continue
 480                     elif isinstance(obj, list):
 481                         if mname == 'slice':
 482                             assert len(args) == 1
 483                             assert isinstance(args[0], int)
 484                             res = obj[args[0]:]
 485                             stack.append(res)
 486                             continue
 487                         elif mname == 'join':
 488                             assert len(args) == 1
 489                             assert isinstance(args[0], compat_str)
 490                             res = args[0].join(obj)
 491                             stack.append(res)
 492                             continue
 493                     elif obj == StringClass:
 494                         if mname == 'String':
 495                             assert len(args) == 1
 496                             assert isinstance(args[0], (int, compat_str))
 497                             res = compat_str(args[0])
 498                             stack.append(res)
 499                             continue
 500                         else:
 501                             raise NotImplementedError(
 502                                 'Function String.%s is not yet implemented'
 503                                 % mname)
 504                     raise NotImplementedError(
 505                         'Unsupported property %r on %r'
 506                         % (mname, obj))
 507                 elif opcode == 72:  # returnvalue
 508                     res = stack.pop()
 509                     return res
 510                 elif opcode == 74:  # constructproperty
 511                     index = u30()
 512                     arg_count = u30()
 513                     args = list(reversed(
 514                         [stack.pop() for _ in range(arg_count)]))
 515                     obj = stack.pop()
 516
 517                     mname = self.multinames[index]
 518                     assert isinstance(obj, _AVMClass)
 519
 520                     # We do not actually call the constructor for now;
 521                     # we just pretend it does nothing
 522                     stack.append(obj.make_object())
 523                 elif opcode == 79:  # callpropvoid
 524                     index = u30()
 525                     mname = self.multinames[index]
 526                     arg_count = u30()
 527                     args = list(reversed(
 528                         [stack.pop() for _ in range(arg_count)]))
 529                     obj = stack.pop()
 530                     if mname == 'reverse':
 531                         assert isinstance(obj, list)
 532                         obj.reverse()
 533                     else:
 534                         raise NotImplementedError(
 535                             'Unsupported (void) property %r on %r'
 536                             % (mname, obj))
 537                 elif opcode == 86:  # newarray
 538                     arg_count = u30()
 539                     arr = []
 540                     for i in range(arg_count):
 541                         arr.append(stack.pop())
 542                     arr = arr[::-1]
 543                     stack.append(arr)
 544                 elif opcode == 93:  # findpropstrict
 545                     index = u30()
 546                     mname = self.multinames[index]
 547                     for s in reversed(scopes):
 548                         if mname in s:
 549                             res = s
 550                             break
 551                     else:
 552                         res = scopes[0]
 553                     if mname not in res and mname == 'String':
 554                         stack.append(StringClass)
 555                     else:
 556                         stack.append(res[mname])
 557                 elif opcode == 94:  # findproperty
 558                     index = u30()
 559                     mname = self.multinames[index]
 560                     for s in reversed(scopes):
 561                         if mname in s:
 562                             res = s
 563                             break
 564                     else:
 565                         res = avm_class.variables
 566                     stack.append(res)
 567                 elif opcode == 96:  # getlex
 568                     index = u30()
 569                     mname = self.multinames[index]
 570                     for s in reversed(scopes):
 571                         if mname in s:
 572                             scope = s
 573                             break
 574                     else:
 575                         scope = avm_class.variables
 576                     # I cannot find where static variables are initialized
 577                     # so let's just return None
 578                     res = scope.get(mname)
 579                     stack.append(res)
 580                 elif opcode == 97:  # setproperty
 581                     index = u30()
 582                     value = stack.pop()
 583                     idx = self.multinames[index]
 584                     if isinstance(idx, _Multiname):
 585                         idx = stack.pop()
 586                     obj = stack.pop()
 587                     obj[idx] = value
 588                 elif opcode == 98:  # getlocal
 589                     index = u30()
 590                     stack.append(registers[index])
 591                 elif opcode == 99:  # setlocal
 592                     index = u30()
 593                     value = stack.pop()
 594                     registers[index] = value
 595                 elif opcode == 102:  # getproperty
 596                     index = u30()
 597                     pname = self.multinames[index]
 598                     if pname == 'length':
 599                         obj = stack.pop()
 600                         assert isinstance(obj, (compat_str, list))
 601                         stack.append(len(obj))
 602                     elif isinstance(pname, compat_str):  # Member access
 603                         obj = stack.pop()
 604                         assert isinstance(obj, (dict, _ScopeDict)), \
 605                             'Accessing member %r on %r' % (pname, obj)
 606                         stack.append(obj[pname])
 607                     else:  # Assume attribute access
 608                         idx = stack.pop()
 609                         assert isinstance(idx, int)
 610                         obj = stack.pop()
 611                         assert isinstance(obj, list)
 612                         stack.append(obj[idx])
 613                 elif opcode == 115:  # convert_
 614                     value = stack.pop()
 615                     intvalue = int(value)
 616                     stack.append(intvalue)
 617                 elif opcode == 128:  # coerce
 618                     u30()
 619                 elif opcode == 133:  # coerce_s
 620                     assert isinstance(stack[-1], (type(None), compat_str))
 621                 elif opcode == 160:  # add
 622                     value2 = stack.pop()
 623                     value1 = stack.pop()
 624                     res = value1 + value2
 625                     stack.append(res)
 626                 elif opcode == 161:  # subtract
 627                     value2 = stack.pop()
 628                     value1 = stack.pop()
 629                     res = value1 - value2
 630                     stack.append(res)
 631                 elif opcode == 164:  # modulo
 632                     value2 = stack.pop()
 633                     value1 = stack.pop()
 634                     res = value1 % value2
 635                     stack.append(res)
 636                 elif opcode == 171:  # equals
 637                     value2 = stack.pop()
 638                     value1 = stack.pop()
 639                     result = value1 == value2
 640                     stack.append(result)
 641                 elif opcode == 175:  # greaterequals
 642                     value2 = stack.pop()
 643                     value1 = stack.pop()
 644                     result = value1 >= value2
 645                     stack.append(result)
 646                 elif opcode == 208:  # getlocal_0
 647                     stack.append(registers[0])
 648                 elif opcode == 209:  # getlocal_1
 649                     stack.append(registers[1])
 650                 elif opcode == 210:  # getlocal_2
 651                     stack.append(registers[2])
 652                 elif opcode == 211:  # getlocal_3
 653                     stack.append(registers[3])
 654                 elif opcode == 212:  # setlocal_0
 655                     registers[0] = stack.pop()
 656                 elif opcode == 213:  # setlocal_1
 657                     registers[1] = stack.pop()
 658                 elif opcode == 214:  # setlocal_2
 659                     registers[2] = stack.pop()
 660                 elif opcode == 215:  # setlocal_3
 661                     registers[3] = stack.pop()
 662                 else:
 663                     raise NotImplementedError(
 664                         'Unsupported opcode %d' % opcode)
 665
 666         avm_class.method_pyfunctions[func_name] = resfunc
 667         return resfunc
 668