Hack 83 ASnative( ) Back Door

All ActionScript method calls are mapped to a table of internal functions built into the Flash Player. Directly access the internal function table via the undocumented ASnative( ) method.

The Flash Player supports methods that are not exposed in the ActionScript API. That is, not only are some functions undocumented, they don't even have names! Instead, they are stored in a function table and accessed by indexing into that table.

The undocumented ASnative( ) function can access internal ActionScript methods, including those not findable using ASSetPropFlags( ) [Hack #82] . It appears to access functions in a lookup table by using two indexes:

ASnative(a, b);

or, in some cases, an optional argument list:

ASnative(a, b)(args);

where index a is an integer correlated to an ActionScript class, index b is an integer correlated to a method within the class, and args is one or more argument(s) associated with the method.

For example, using 200 for index a seems to access the Math class, so varying index b offers access to the Math class's methods. Try these:

trace(ASnative(200, 0)(-4.567)); // Displays 4.567

trace(ASnative(200, 9)(144));    // Displays 12

From these tests, you can conclude that ASnative(200, 0) accesses the Math.abs( ) method, and ASnative(200, 9) accesses the Math.sqrt( ) method. That's fine, but why would we want to use a cryptic ASnative( ) call to access documented ActionScript methods?

Most (a, b) indexes into ASnative( ) yield something that is exactly equivalent to a documented method of a documented class. However, some indexes have no exposed ActionScript equivalent, in which case the only way you can access them is via the ASnative( ) back door.

ASnative(800, b) is one such set of indexes. Index 800 seems to access input/output functions, including undocumented methods of the Mouse class [Hack #62] .

Final Thoughts

The "find the undocumented Flash Player features before Macromedia tells us about them" game is a favorite among longtime Flash users. See the FlashCoders Wiki (http://chattyfig.figleaf.com/flashcoders-wiki/index.php?ASNative) for a blow-by-blow account of this hunt to date and additional insights into the ASnative( ) method and the parameters it accepts.