AMF and AMF3 Specification

Question

I am currently working on a small AMF3 Adapter and therefore trying to implement the AMF3 protocol. Unfortunately the specifications available seem to greatly differ from reality (Captre of AMF communication with BlazeDS and look into BlazeDSs source code).

AMF0 Spec: http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf AMF3 Spec: http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf

Unfortunately both don't specify the actual message format (Header, Body, ...). So I searched a little more and came to a Wikipedia article: http://en.wikipedia.org/wiki/Action_Message_Format

This article especially the example parts seem to be describing a totally different format.

When having a look at the communication and stepping through the BlazeDS code I can see that the message claims to be AMF3, but uses the Type codes as defined in AMF0 (0x0a is a strict array instead of an object, as defined in AMF3).

Could anyone please explain this mess to me? Currently I'm propably simply going to use wireshark and the BlazeDS code to somehow reverse-engineer a Protocol description for me, but I don't know why not a single valid spec is availble.

Answer 1

AMF at its core is just an ActionScript object serialization format.

Flash's NetConnection API expands on this format to add basic RPC functionality though a simple header/message body request/response structure that is described in Section 4 of the AMF 0 specification. I think this RPC addition may be confusing you, as it is infrastructure that defines how individual payloads of AMF data are sent and received from a server. This wrapper does not come into play for basic ActionScript object serialization through ByteArray.writeObject, for instance. It is additional logic for NetConnection based communication to a server.

See: http://download.macromedia.com/pub/labs/amf/amf0_spec_121207.pdf

ActionScript data actually sent for header values or message body values are encoded in AMF. All data values start out in AMF 0 for compatibility's sake. This may be another point that trips people up at first when looking at basic AMF serialization versus NetConnection based communication. Thanks to a special extension added to AMF 0, a new 0x11 "AMF 3" mode marker was introduced that switches the serialization mode to AMF 3. Legacy clients that do not support AMF 3 would not understand this new marker and would stop processing the data. This is mentioned in Section 3 of the AMF 0 specification.

The AMF 3 specification is here: http://download.macromedia.com/pub/labs/amf/amf3_spec_121207.pdf

Answer 2

There are two general types of AMF messaging: AMF0 style RPC calls and RTMP. AMF0 RPC calls are composed of a version, list of headers, and list of messages, which roughly equate to methods to call. This is documented at the end of the AMF0 spec and can be used to make AMF0 or AMF3 remoting calls. If you're using Flex RemoteObject, there are some additional wrapper objects that Flex uses in the messaging. The second type, which is what the Wikipedia article you found references, is the message format that RTMP uses, which is a combination of AMF and its own custom format. As far as I know, there are no specs for this format.

As someone who has built a library that can parse AMF and make RPC calls (RocketAMF), I would advise that you use one of the existing libraries rather than write your own if you just need remoting support. Below is a list of some libraries for AMF parsing by language, with many more a simple search away. You might also want to check out Charles, which is capable of deserializing AMF requests that are proxied through it, making reverse engineering a bit easier.

• Python: PyAMF
• Ruby: RocketAMF
• Java: BlazeDS
• PHP: Zend::AMF