3

I am currently working on a small AMF3 Adapter and therefore trying to implement the AMF3 protocol. Unfortunately the specifications available seem to greatly differ from reality (Captre of AMF communication with BlazeDS and look into BlazeDSs source code).

AMF0 Spec: http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf AMF3 Spec: http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf

Unfortunately both don't specify the actual message format (Header, Body, ...). So I searched a little more and came to a Wikipedia article: http://en.wikipedia.org/wiki/Action_Message_Format

This article especially the example parts seem to be describing a totally different format.

When having a look at the communication and stepping through the BlazeDS code I can see that the message claims to be AMF3, but uses the Type codes as defined in AMF0 (0x0a is a strict array instead of an object, as defined in AMF3).

Could anyone please explain this mess to me? Currently I'm propably simply going to use wireshark and the BlazeDS code to somehow reverse-engineer a Protocol description for me, but I don't know why not a single valid spec is availble.

Christofer Dutz
  • 2,305
  • 1
  • 23
  • 34
  • May I ask why are you writing your own adapter? Are you using some exotic language? – Cornel Creanga Dec 13 '11 at 11:31
  • 1
    I am trying to create an adapter that runs on J2ME ... couldn't find any solution that works here. I could have started migrating the incompatible parts of an existing stack, but I need only a small portion of the full blown stack and I wanted to keep the implementation as simple and small (bytecode size) as possible. – Christofer Dutz Dec 14 '11 at 12:00

2 Answers2

3

AMF at its core is just an ActionScript object serialization format.

Flash's NetConnection API expands on this format to add basic RPC functionality though a simple header/message body request/response structure that is described in Section 4 of the AMF 0 specification. I think this RPC addition may be confusing you, as it is infrastructure that defines how individual payloads of AMF data are sent and received from a server. This wrapper does not come into play for basic ActionScript object serialization through ByteArray.writeObject, for instance. It is additional logic for NetConnection based communication to a server.

See: http://download.macromedia.com/pub/labs/amf/amf0_spec_121207.pdf

ActionScript data actually sent for header values or message body values are encoded in AMF. All data values start out in AMF 0 for compatibility's sake. This may be another point that trips people up at first when looking at basic AMF serialization versus NetConnection based communication. Thanks to a special extension added to AMF 0, a new 0x11 "AMF 3" mode marker was introduced that switches the serialization mode to AMF 3. Legacy clients that do not support AMF 3 would not understand this new marker and would stop processing the data. This is mentioned in Section 3 of the AMF 0 specification.

The AMF 3 specification is here: http://download.macromedia.com/pub/labs/amf/amf3_spec_121207.pdf

Pete
  • 46
  • 2
  • Thanks for that explanation. As I posted some time ago, I finally seemed to have understood the format and even managed to create a parser to do the deserialization on a J2ME system (Just a simple POC). But you were right ... the NetConnection stuff was the stuff confusing me ;-) – Christofer Dutz Sep 06 '12 at 14:34
1

There are two general types of AMF messaging: AMF0 style RPC calls and RTMP. AMF0 RPC calls are composed of a version, list of headers, and list of messages, which roughly equate to methods to call. This is documented at the end of the AMF0 spec and can be used to make AMF0 or AMF3 remoting calls. If you're using Flex RemoteObject, there are some additional wrapper objects that Flex uses in the messaging. The second type, which is what the Wikipedia article you found references, is the message format that RTMP uses, which is a combination of AMF and its own custom format. As far as I know, there are no specs for this format.

As someone who has built a library that can parse AMF and make RPC calls (RocketAMF), I would advise that you use one of the existing libraries rather than write your own if you just need remoting support. Below is a list of some libraries for AMF parsing by language, with many more a simple search away. You might also want to check out Charles, which is capable of deserializing AMF requests that are proxied through it, making reverse engineering a bit easier.

warhammerkid
  • 955
  • 5
  • 6
  • I haven't done any AMF with PHP recently, but last I heard the developer of AMFPHP was working with Zend on Zend::AMF. So... AMFPHP is dead, but it should be living on as Zend::AMF. – warhammerkid Dec 06 '11 at 15:49
  • I've red here on StackOverflow that AMFPHP is 5x faster. Sounds incredible. – AsTheWormTurns Dec 06 '11 at 15:50
  • Well on the one side I simply wanted to understand the protocol. On the other side, I am sort of fedup with all those full blown solutions, that do a lot more than I need and have a lot of quirks that are a nightmare to debug. I am particularly interested in Streaming Connections and would like to have a little more optimized Java Side deserialization (Blazeds Deserializes bytes as Bytes for example. Fortunately I managed to find out how the protocol works. I even began documenting it on my wiki. Hopefully this document will give others the vital parts of information- – Christofer Dutz Dec 07 '11 at 22:50