⚡ SWF → HTML5 Toolkit

flash-swf-to-html5-toolkit

Flash is dead. Its attack surface isn't.

Decompile a legacy Adobe Flash .swf and rebuild it as a faithful HTML5 + vanilla JS app.
A disposable Docker sandbox — JPEXS ffdec + ffmpeg + Python, plus a Claude Code skill that drives the whole port.
No Flash Player. No Ruffle emulation. No untrusted binary ever touching your host.

🌐 Project page

---

Flash reached end-of-life in December 2020, but the .swf files never left. They still run in intranets, kiosks, VPN portals, e-learning platforms and government sites, on an unsupported plugin, with source code nobody has anymore. This toolkit opens that black box statically, without ever running the binary in a player, and rebuilds it as something a browser will still run in a decade.

  01 ──────────▶ 02 ──────────▶ 03 ──────────▶ 04 ──────────▶ 05
 .swf           decompile       extract        reverse         HTML5
 read-only      ffdec →         frames ·       AS2 → JS        coordinate-exact
 input          ActionScript    sprites ·      state machine   rebuild
                                sounds

Scope: AS2-era SWFs (Flash 6-8). AS3 / Flash 9+ (.abc bytecode) needs a different decompilation workflow, see Limitations.

Quick start

git clone https://github.com/sv1sjp/flash-swf-to-html5-toolkit
cd flash-swf-to-html5-toolkit

# Build the sandbox (Kali host? use: DOCKERFILE=Dockerfile.kali docker compose up -d --build)
docker compose up -d --build

# Drop the target in - it mounts read-only
cp /path/to/target.swf ./swf/

# Decompile & extract (output lands in ./output/)
docker exec swf-tools ffdec -export script /output/scripts/ /swf/target.swf   # ActionScript
docker exec swf-tools ffdec -export frame  /output/frames/  /swf/target.swf   # visuals
docker exec swf-tools ffdec -export sound  /output/sounds/  /swf/target.swf   # audio
docker exec swf-tools ffdec -export image  /output/images/  /swf/target.swf   # bitmaps

Everything you extract stays in ./output/. The container never gets write access to your SWFs.

Let the agent drive the whole port

The repo ships an installable skill at .claude/skills/port-swf/. Run Claude inside the repo and invoke it:

claude

/port-swf

Claude follows the full phased methodology — recon → asset extraction → coordinate mapping → AS2→JS translation → HTML5 assembly — driving the Docker container the whole way, and bootstraps a task list so multi-session work resumes exactly where it stopped. Prefer to work by hand? SKILL.md reads as a step-by-step guide.

What's in the sandbox

The swf-tools container (Ubuntu 24.04, or Kali via Dockerfile.kali):

Add anything mid-session without a rebuild:

docker exec swf-tools apt-get install -y <package>

The output

An old 2003 Greek Flash application, decompiled and completely rewritten as HTML5 + JS. No emulation.

Limitations

• AS3 / Flash 9+ (.abc bytecode, mx.*): class-based OOP, a different workflow.
• Physics engines: need reimplementation, not translation.
• Encrypted / obfuscated SWFs: cannot be decompiled reliably.
• Non-ASCII fonts (Greek, CJK flagged as ShiftJIS): extract as rendered PNG, not text.

Legal & ethical use

Authorized use only. For migration, digital preservation and security assessment of software you own or are permitted to test. Decompiling and re-platforming third-party SWFs may be governed by copyright and licensing, get authorization before you touch anything you do not own.

License

GNU General Public License v3.0 © Dimitris Vagiakakos (sv1sjp)