Skip to content

AS3 hidden treasure in the mm.cfg file. Revealing and documenting many Flash secrets!

February 10, 2010

*Update: 9 dec 2011*
Using a few of these hidden features, TheMiner let you analyse memory, performances, DisplayList, loaders and a lot more!


*end update*

When I found this, I just could not believed it.

In the past few weeks I did many articles greatly appreciated by the community: FlashPlayer Security, FlashPlayer Memory, AS3 Array under the hood, Optimized Base64 Encoding. But this one, I think, will rule them all!

I knew for a long time now that flash had undocumented features, little part of flash that could help speed up process (like the memory opcodes) or make interaction easy with right click and that kind of things. But I never thought that FlashPlayer would hide data that could help find bugs, or give better knowledge of how flash is interpreted.

As you may know, The mm.cfg files is located in:

  • Windows; C:\Documents and Settings\username\mm.cfg
  • OSX; /Library/Application Support/Macromedia/mm.cfg
  • Linux; home/username/mm.cfg

This file is interpreted when a Flash Player instance launches a SWF and gives indication of what should or shouldn’t be done.
For example, most people use this file to set tracing parameters:
ErrorReportingEnable=1
TraceOutputFileEnable=1
TraceOutputFileName=c:\logs\flashlogs.txt
MaxWarnings=50

Many other options are specified in the Adobe FlashPlayer Admin Guide… but most of is NOT DOCUMENTED!

There is a LOT of thing to talk about and many cutting edge tools to improve your understanding of flash.

So let’s get into it

The Treasure

The complete list of features of mm.cfg is at the end of the post, but first lets talk about what’s most interesting.
I took my favorite 7 features and made detailed explanation with example for each one so here they are:

TraceOutputBuffered = 1|0

This feature is essential to the rest of all the cool features because they output A LOT of lines in the flashlog

This is a very simple features but it change everything. Did you ever had problem tracing to many information and losing half of it in the flashlog?
Well this is a known bug. If you make a loop of 1 000 000 and you trace the iterator, the flashlog will skip thousand of entries and will take 100% of your CPU while writing to disk.
If you set this variable to true, the traces will be buffered and the write to disk will output multiple lines in one access.
Performance? By default (without this feature), I’m able to trace 3600 line in 6 seconds and my CPU is at 100%.
If I turn the features on, I can trace 1 000 000 lines in the same time! And my CPU is not even near 100%.

AS3Verbose = 1|0

This one is totally crazy.
It traces detailed information about SWF ByteCode structure and Runtime parsing of the bytecode!
You don’t need any software… no special framework to bind in your own SWF… just this one flag!

verify Main/CallFoo()
    define incoming args
       @0  arg   0
       @1  arg   0
       @2  arg   0
       @3  arg   0
       @4  arg   0
       @5  arg   0
    alloc local traits
       @6  alloc 4
       @7  alloc 8
    alloc CallStackNode
       @8  alloc 48
    param 0
       @9  ldop  0(@5)
       @10               imm   4
    debug_enter
       @11               imm   0
       @12               imm   1
       @13               lea   0(@7)
       @14               lea   0(@8)
       @15               lea   0(@6)
    save state
       @16               def   @9
       @17               imm   165651400
       @18               st    0(@6) <- @17
       @19               usea  @16
       @20               st    0(@7) <- @19
       @21               def   @10
                cse   @11
       @22               st    4(@7) <- @11
       @23               cm    MethodEnv::debugEnter (@3, @4, @5, @15, @12, @14, @13, @11)
       @26               ld    164427072(0)
                cse   @11
       @27               ucmp  @26 @11
       @28               jne   @27 -> 0
       @29               alloc 0
                        stack:
                        scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$]
                         locals: Main@16
  0:debugfile "C:\Dev\src;;Main.as"
       @30               imm   164421632
       @31               ldop  44(@30)
       @32               imm   165988864
    save state
       @33               cm    Debugger::debugFile (@31, @32)
                        stack:
                        scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$]
                         locals: Main@16
  2:debugline 29
                cse   @30
                cse   @31
       @35               imm   29
    save state
       @36               cm    Debugger::debugLine (@31, @35)
                        stack:
                        scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$]
                         locals: Main@16
  4:getlocal0
       @38               use   @16 [0]
                        stack: Main@38
                        scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$]
                         locals: Main@38
  5:pushscope
                        stack:
                        scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$] Main@38
                         locals: Main@38
  6:debugline 31
                cse   @30
                cse   @31
       @39               imm   31
    save state
       @40               def   @38
       @41               use   @40 [0]
       @42               st    4(@7) <- @41
       @43               cm    Debugger::debugLine (@31, @39)
                        stack:
                        scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$] Main@40
                         locals: Main@16
  8:pushbyte 3
       @45               imm   3
                        stack: int@45
                        scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$] Main@40
                         locals: Main@16
  10:returnvalue
                cse   @14
    save state
       @46               def   @45
       @47               cm    MethodEnv::debugExit (@3, @14)
       @49               use   @46 [2]
       @50               ret   @49
       @51               bb

AS3Trace = 1|0

This one is also very useful for debugging
It trace every single call to any function that is being called in the SWF at runtime!
It’s like expending the StackTrace to the full software run time.

If you got a crash hard to find, you can turn this on and you will see ALL the last function executed that leaded to the crash.

You can even see Timer Call and Events callbacks!

1255552 AVMINF: MTHD ProfilerAgent/stopProfiling () @ 0x05DA35A0
1255552 AVMINF: MTHD global/flash.sampler::stopSampling () @ 0x0A8C2B20
1255553 AVMINF: MTHD flash.display::DisplayObject/get root () @ 0x0A8C06B0
1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
1255553 AVMINF: MTHD flash.net::Socket/flush () @ 0x0A8C2AD0
1255553 AVMINF: MTHD flash.net::Socket/close () @ 0x0A8C2B70
1255553 AVMINF: MTHD flash.net::Socket/_init () @ 0x0A8C0DF0
1255553 AVMINF: MTHD flash.utils::Timer/stop () @ 0x0A8C2CB0
1255554 AVMINF: MTHD flash.utils::Timer/reset () @ 0x0A8C1B20
1255554 AVMINF: MTHD flash.utils::Timer/get running () @ 0x0A8C1C30
1255554 AVMINF: MTHD flash.net::Socket/internalClose () @ 0x0A8C2D00
1255554 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
1255554 AVMINF: MTHD flash.utils::Timer/stop () @ 0x0A8C2CB0
1255554 AVMINF: MTHD flash.system::System$/resume () @ 0x0A8C2D50
1256675 AVMINF: MTHD flash.utils::Timer/tick () @ 0x0A8C2DA0
1256675 AVMINF: MTHD flash.utils::Timer/_timerDispatch () @ 0x0A8C2FF0
1256675 AVMINF: MTHD flash.events::TimerEvent () @ 0x0A8C3040
1256675 AVMINF: MTHD flash.events::Event () @ 0x0A8C1AC0
1256675 AVMINF: MTHD Main/OnTimer () @ 0x00B70910
1256675 AVMINF: MTHD global/trace () @ 0x0A8C2170
MyTimer
1258705 AVMINF: MTHD flash.utils::Timer/tick () @ 0x0A8C2DA0
1258705 AVMINF: MTHD flash.utils::Timer/_timerDispatch () @ 0x0A8C2FF0
1258705 AVMINF: MTHD flash.events::TimerEvent () @ 0x0A8C3040
1258705 AVMINF: MTHD flash.events::Event () @ 0x0A8C1AC0
1258705 AVMINF: MTHD Main/OnTimer () @ 0x00B70910
1258705 AVMINF: MTHD global/trace () @ 0x0A8C2170
MyTimer

AS3StaticProfile = 1|0

This flag enable Just in Time Compiler (NanoJIT) logs.

It gives detailed information on function conversion, bytecode conversion, MIR (machine-dependent intermediate representation) created, memory used and many others.
At the end of execution, it also output a summary of all bytecode processed (For each opcode you have the number of occurrence, relatives importance, etc)

size profile Main/CallFoo
  abc 12 mir 880 md 204
  1773K mir/s  74K md/s  96% in compile during 854 micros
  204 bytes from 55 MIR instructions 61 MD. max span 0 cse 7 dead 0
  76 bytes of stack with 5 spills 5 steals 5 remats using 0 times
size profile Main/CallFooBar
  abc 23 mir 1088 md 262
  2386K mir/s  85K md/s  96% in compile during 921 micros
  262 bytes from 68 MIR instructions 76 MD. max span 0 cse 10 dead 0
  88 bytes of stack with 8 spills 7 steals 5 remats using 0 times

 

verified instructions 3395
verified code size 7441
cpool size 0
cpool int size 1
cpool uint size 0
cpool double size 0
cpool string size 568
cpool namespacesize 12
cpool namespace set size 0
cpool multiname size 75
methods size 20100
instances size 39
classes size 2
scripts size 8
bodies size 82873

18	0 %	36 B	0 %	 kill
5	0 %	5 B	0 %	 label
1	0 %	4 B	0 %	 ifngt
10	0 %	40 B	0 %	 jump
6	0 %	24 B	0 %	 iftrue
22	0 %	88 B	1 %	 iffalse
4	0 %	16 B	0 %	 ifeq
4	0 %	16 B	0 %	 ifne
2	0 %	8 B	0 %	 iflt
2	0 %	2 B	0 %	 pushwith
93	2 %	93 B	1 %	 popscope
2	0 %	2 B	0 %	 nextname
16	0 %	16 B	0 %	 pushnull
2	0 %	2 B	0 %	 pushundefined
79	2 %	158 B	2 %	 pushbyte
6	0 %	19 B	0 %	 pushshort
9	0 %	9 B	0 %	 pushtrue
6	0 %	6 B	0 %	 pushfalse
1	0 %	1 B	0 %	 pushnan
50	1 %	50 B	0 %	 pop
21	0 %	21 B	0 %	 dup
2	0 %	2 B	0 %	 swap
113	3 %	331 B	4 %	 pushstring
43	1 %	86 B	1 %	 pushint
11	0 %	22 B	0 %	 pushdouble
202	5 %	202 B	2 %	 pushscope
1	0 %	2 B	0 %	 pushnamespace
2	0 %	6 B	0 %	 hasnext2
143	4 %	382 B	5 %	 newfunction
60	1 %	216 B	2 %	 callproperty
102	3 %	102 B	1 %	 returnvoid
9	0 %	9 B	0 %	 returnvalue
13	0 %	26 B	0 %	 constructsuper
9	0 %	30 B	0 %	 constructprop
49	1 %	173 B	2 %	 callpropvoid
4	0 %	8 B	0 %	 newobject
5	0 %	10 B	0 %	 newarray
2	0 %	2 B	0 %	 newactivation
45	1 %	114 B	1 %	 newclass
391	11 %	1011 B	13 %	 findpropstrict
119	3 %	290 B	3 %	 findproperty
96	2 %	197 B	2 %	 getlex
158	4 %	432 B	5 %	 setproperty
18	0 %	36 B	0 %	 getlocal
18	0 %	36 B	0 %	 setlocal
2	0 %	2 B	0 %	 getglobalscope
9	0 %	18 B	0 %	 getscopeobject
365	10 %	938 B	12 %	 getproperty
174	5 %	443 B	5 %	 initproperty
2	0 %	4 B	0 %	 getslot
102	3 %	204 B	2 %	 setslot
6	0 %	6 B	0 %	 convert_i
11	0 %	11 B	0 %	 convert_u
11	0 %	11 B	0 %	 convert_b
6	0 %	14 B	0 %	 coerce
3	0 %	3 B	0 %	 coerce_a
7	0 %	7 B	0 %	 coerce_s
1	0 %	1 B	0 %	 negate
2	0 %	2 B	0 %	 increment
6	0 %	6 B	0 %	 not
6	0 %	6 B	0 %	 add
4	0 %	4 B	0 %	 subtract
1	0 %	1 B	0 %	 multiply
5	0 %	5 B	0 %	 divide
1	0 %	1 B	0 %	 lshift
3	0 %	3 B	0 %	 rshift
2	0 %	2 B	0 %	 bitand
2	0 %	2 B	0 %	 bitor
6	0 %	6 B	0 %	 equals
2	0 %	2 B	0 %	 lessthan
2	0 %	2 B	0 %	 greaterequals
1	0 %	1 B	0 %	 increment_i
275	8 %	275 B	3 %	 getlocal0
49	1 %	49 B	0 %	 getlocal1
36	1 %	36 B	0 %	 getlocal2
17	0 %	17 B	0 %	 getlocal3
13	0 %	13 B	0 %	 setlocal1
14	0 %	14 B	0 %	 setlocal2
11	0 %	11 B	0 %	 setlocal3
23	0 %	144 B	1 %	 abs_jump
54	1 %	330 B	4 %	 debug
168	4 %	456 B	6 %	 debugline
19	0 %	50 B	0 %	 debugfile

AS3DynamicProfile = 1|0

This one give dynamic information about the opcodes being called and gives statistic for each.
The statistics include count, cycles, %count, %times and CPI

My question is: Having access to the CPI (Cycle per instruction) will we be able to conclude all
fights between what operation is faster that the others
? Cycle counts does not lies (on the same platform…)
* Request for Jackson Dunstan: Wanna work on that? :) *
But there is a problem with this one, it crash all the time.
My guess is it can’t process “Flash Object” like Movieclip, Event, and all the other and only support operation valid in tamarin.

total count=278 cycles=35508249 avg CPI=127727
user      1.9%
gc        0%
decoder  97.7%
verifier  1.6%
codegen   0.2%
count       cycles        %count    %time     CPI       opcode
-----       --------      -------   -------   ---       ------
2           34714742       0.7      97.7      17357371  decode
211         602237        75.8       1.6      2854      verifyop
6           89138          2.1       0.2      14856     codegenop
3           78305          1.0       0.2      26101     newclass
7           4813           2.5       0.0      687       findpropstrict
6           3922           2.1       0.0      653       setslot
4           3260           1.4       0.0      815       initproperty
4           2724           1.4       0.0      681       getproperty
9           1859           3.2       0.0      206       getlocal0
4           1639           1.4       0.0      409       verifypass
2           1190           0.7       0.0      595       returnvoid
1           755            0.3       0.0      755       pushnamespace
3           745            1.0       0.0      248       abs_jump
2           550            0.7       0.0      275       findproperty
5           527            1.7       0.0      105       pushscope
1           403            0.3       0.0      403       pushnull
2           382            0.7       0.0      191       pushbyte
1           331            0.3       0.0      331       popscope
1           331            0.3       0.0      331       pushundefined
2           238            0.7       0.0      119       pushint
2           158            0.7       0.0      79        pushdouble

LogGPU = 1|0

This enable logging GPU information about current SWF while it runs.
Use GPULogOutputFileName = [path] to specify where to output that log.
Use DisplayGPUBlend = 1 to display the little green square while GPU runs
use ForceGPUBlend = 1 (At your own risk) to force GPU event if your videocard is not officially listed as valid for Flash GPU.

[GPU-BLEND] SUCEEDED to create D3D device

[GPU-BLEND]0x1161000 MONITOR/DEVICE SWITCH, old=0x0, new=0x18fd00

[GPU-BLEND]0x1161000 Started (wMode=GPU) on device 10de 402 (6.14.11.9062) NVIDIA GeForce 8600 GT  mem:free=718, used=0

[GPU-BLEND]Begin render aa=4.  Free TextureMem=712 Mb, Used = 5
[GPU-BLEND]Using 0x13b7080 as RT vp= 0 0 800 600, aa = 4
[GPU-BLEND]Clearing buffer 0x13b7080 { 0 0 800 600 } with color ffffffff
[GPU-BLEND]Filling border & background on 0x13b7080 3 3 11 11 with bo:ffffffff, ba:ff00ff00
[GPU-BLEND]Using 0x13b7080 as RT vp= 0 0 800 600, aa = 4
[GPU-BLEND]End render

[GPU-BLEND]0x1161000 Started (wMode=GPU) on device 10de 402 (6.14.11.9062) NVIDIA GeForce 8600 GT  mem:free=716, used=0

[GPU-BLEND]Begin render aa=4.  Free TextureMem=712 Mb, Used = 5
[GPU-BLEND]Using 0x11b7080 as RT vp= 0 0 800 600, aa = 4
[GPU-BLEND]Clearing buffer 0x11b7080 { 0 0 800 600 } with color ffffffff
[GPU-BLEND]Filling border & background on 0x11b7080 3 3 11 11 with bo:ffffffff, ba:ff00ff00
[GPU-BLEND]Using 0x11b7080 as RT vp= 0 0 800 600, aa = 4
[GPU-BLEND]End render

PreloadSwf?flashvar1=value&…

This is mainly used by the FlashBuilder Profiler. When you launch a SWF profiling, FlashBuilder add this line to mm.cfg to make it run another SWF before the one you profile.
The default file is: C:/Documents and Settings/{USER}/My Documents/Flex Builder 3/.metadata/.plugins/com.adobe.flash.profiler/ProfilerAgent.swf?host=localhost&port=9999
The profiler agent is a SWF that use the as3 sampling classes to collect information and send them all over a socket connection to FlashBuilder.
FlashBuilder is only interpreting that data received from the SWF
By changing localhost by any other machine name you can connect to a remote FlashBuilder Profiler. On the Remote profiler you need to check the “wait for application” box and then start the local SWF on the other machine.

This one is just crazy powerful: See: One SWF to rule them all! and New visual Profiler

The Full List

undocumented features will be written in bold

AllowUserLocalTrust = 1|0

Lets you prevent users from designating any files on local file systems as trusted.

AS3AllocationTracking = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Allocation in FlexBuilder anymore)

AS3AutoStartSampling = 1|0

Specify if we need a feedback before starting the profiler or we start right away.

AS3CSE = 1|0

CSE is an acronym for “Common Subexpression Elimination”. It seems plausible that these may be employed by the Flash virtual machine to optimize the byte-code before executing

AS3DCE = 1|0

DCE is an acronym for “Dead Code Elimination”. It seems plausible that these may be employed by the Flash virtual machine to optimize the byte-code before executing

AS3DynamicProfile = 1|0

When enabling this (you might crash half the time) the flash player is going to collect precious profiling information on opcodes used in the Swf (count/Time/%/Cycles)

AS3MIR = 1|0

Enable/Disable Profiling information (if turned off, FlashPlayer won’t keep information on Machine-dependant intermediate representation – NanoJIT)

AS3Sampling = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile in FlexBuilder anymore)

AS3SSE = 1|0

*My guess is it turns on and off SSE optimization

AS3StaticProfile = 1|0

Information Generated by NanoJit (just in time compiler used in Tamarin), including a lot of statistic on code conversion, time to process and memory use

AS3Trace = 1|0

If turned on, ALL function called (at runtime) will be outputed in the flashlogs!
You should always use in conjonction with TraceOutputBuffered=1

AS3Turbo = 1|0

??

AS3Verbose = 1|0

Trace detailed information about SWF ByteCode structure and Runtime parsing of the bytecode!

AssetCacheSize=X

Lets you specify a hard limit, in MB, on the amount of local storage that Flash Player uses for the storage of common Flash components.

AutoUpdateDisable = 1|0

Lets you prevent Flash Player from automatically checking for and installing updated versions.

AutoUpdateInterval = X

Lets you specify how often to check for an updated version of Flash Player.

AutoUpdateVersionUrl = [URL]

Lets you specify a precise server to look up for new flash version

AVHardwareDisable = 1|0

Lets you prevent SWF files from accessing webcams or microphones.

CodeSignLogFile

??

CodeSignRootCert = 1|0

??

Convert8kAnd16kAudio = 1|0

??

CrashLogEnable = 1|0

??

DisableAVM1Loading = 1|0

If turned on, no SWF of version 8 and earlier can be loaded.

DisableDeviceFontEnumeration = 1|0

Lets you prevent information on installed fonts from being displayed.

DisableIncrementalGC = 1|0

Lets you enable/disable Garbage Collector Incremental policies (more info on the GC)

DisableMulticoreRenderer = 1|0

Lets you turn off multiple core rendering

DisableNetworkAndFilesystemInHostApp = 1|0

Lets you prevent networking or file system access of any kind.

DisableProductDownload = 1|0

Lets you prevent native code applications that are digitally signed and delivered by Adobe from being downloaded.

DisableSockets = 1|0

Lets you enable or disable the use of the Socket.connect() and XMLSocket.connect() methods.

DisplayGPUBlend = 1|0

If set to 1, it will prevent GPU use even if the SWF context is setted to use GPU and your card support it.

EnableIncrementalValidation = 1|0

??

EnableLeakFile = 1|0

??

EnableSocketsTo = [address]

Lets you create a whitelist of servers to which socket connections are allowed.
EnableSocketsTo = localhost.localdomain
EnableSocketsTo = 127.0.0.1

EnforceLocalSecurityInActiveXHostApp = 1|0

Lets you enforce local security rules for a specified application.

ErrorReportingEnable = 1|0

Set the ErrorReportingEnable property to 1 to enable the debugger version of Flash Player to write error messages to the log file.

FileDownloadDisable = 1|0

Lets you prevent the ActionScript FileReference API from performing file downloads.

FileUploadDisable = 1|0

Lets you prevent the ActionScript FileReference API from performing file uploads.

ForceGPUBlend = 1|0

Force GPU blending even if you video card is not officialy supported (At your own risk!)

FrameProfilingEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Frames in FlexBuilder anymore)

FullScreenDisable = 1|0

Lets you disable SWF files playing via a browser plug-in from being displayed in full-screen mode.

GCStats = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile GC in FlexBuilder anymore)

GPULogOutputFileName

Lets you specify the output file for the GPU informations

HeapProfilingAS3Enable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Heap in FlexBuilder anymore)

LegacyDomainMatching = 1|0

Lets you specify whether SWF files produced for Flash Player 6 and earlier can execute an operation that has been restricted in a newer version of Flash Player.

LocalFileLegacyAction = 1|0

Lets you specify how Flash Player determines whether to execute certain local SWF files that were originally produced for Flash Player 7 and earlier.

LocalFileReadDisable = 1|0

Lets you prevent local SWF files from having read access to files on local hard drives.

LocalStorageLimit = X

Lets you specify a hard limit on the amount of local storage that Flash Player uses (per domain) for persistent shared objects.

LogGPU = 1|0

Lets you specify if you want to output debug GPU log

MaxWarnings = X

The default value of the MaxWarnings property is 100. After 100 messages, the debugger version of Flash Player writes a message to the file stating that further error messages will be suppressed.

OverrideGPUValidation = 1|0

Overrides validation of the requirements needed to implement GPU compositing.

OverrideUserInvokedActions = 1|0

??

PolicyFileLog = 1|0

Enables the logging of policy file messages.

PolicyFileLogAppend = 1|0

Set the PolicyFileLogAppend property to 1 to save previous policy file log entries

PreloadSwf?flashvar1=value&…

Lets you specify a SWF to be loaded before the main swf.This is the profiler agent, a little flash app (ProfilerAgent.swf) that connect to the FlexBuilder Profiler via socket (localhost:9999).
FlexBuilder is only interpreting that data.
PreloadSwf=C:/Documents and Settings/{USER}/My Documents/Flex Builder 3/.metadata/.plugins/com.adobe.flash.profiler/ProfilerAgent.swf?host=localhost&port=9999
By changing localhost by any other machine name you can connect to a remote FlashBuilder Profiler. On the Remote profiler you need to check the “wait for application” box and then start the local SWF on the other machine.

ProductDisabled = 1|0

Creates a list of ProductManager applications that users are not permitted to install or launch.

ProductDownloadBaseUrl

??

ProfileFunctionEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile function in FlexBuilder anymore)

ProfilingOutputDirectory = [path]

Specify where to save the ProfilerData file

ProfilingOutputFileEnable = 1|0

Specify if we want to create a file containing all the profiler data (flashprof_1265745253708.dat)

RendererProfilingEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile in FlexBuilder anymore)

RTMFPP2PDisable = 1|0

Specifies how the NetStream constructor connects to a server when a value is specified for peerID, the second parameter passed to the constructor.

RTMFPTURNProxy = 1|0

Lets Flash Player make RTMFP connections through the specified TURN server in addition to normal UDP sockets.

ScriptStuckTimeout = X

Lets you specify the time after what the timeout (too much time running a script) exception will popup

SecurityDialogReportingEnable = 1|0

Lets you specify whether the Security dialog should be visible or not.

SuppressDebuggerExceptionDialogs = 1|0

Lets you specify whether the Error dialog should be visible or not.

ThirdPartyStorage

Lets you specify whether third-party SWF files can read and write locally persistent shared objects.

TraceOutputBuffered = 1|0

Specify the flash player to use a buffer before writing to disk. If you had problem when tracing tousands of lines and line were skipped, this solve the thing. It’s also a lot faster (1000000 trace in 7 seconds instead of 3200 trace in 7 sec!)

TraceOutputFileEnable = 1|0

Set TraceOutputFileEnable to 1 to enable the debugger version of Flash Player to write trace messages to the log file.

TraceOutputFileName= [path]

(Before Flash 9) Sets the location of the log file. By default, the debugger version of Flash Player writes error messages to a file named flashlog.txt, located in the same directory in which the mm.cfg file is located.

UseBrokerProcess = 1|0

Lets you specify if you want to use elevated privileges or not (See the FlashPlayer update)

WindowlessDisable = 1|0

Lets you disable Floating Flash (ex: Ads)

Conclusion

This whole thing opens a new playground for hardcore programmer like me.
A lot can be done with this new information:

  • Custom Profiling tool using AS3Verbose and AS3Trace modes
  • Custom Profiling tool using .dat generated by FlashProfiler
  • Automatic Code performance warning using NanoJIT structure analysis
  • Guide to performance using CPI (cycle per instruction)
  • Mapping of profiler using the PreloadSwf features (instead of localhost put any other host that have a valid profiler)

I didn’t have time to work extensively on each features and I may have interpreted incorrectly certain things.
If it’s the case please tell me and I’ll modify this post. If you do test or benchmark using this post information please post them as comment here and I’ll add the benchmark later in the post.

By the way, I am now on twitter: jpauclair

add to del.icio.usAdd to Blinkslistadd to furlDigg itadd to ma.gnoliaStumble It!add to simpyseed the vineTailRankpost to facebook

References

Adobe MM.cfg documentation
Adobe Flash Player Admin Guide (containing mm.cfg information)

About these ads

From → actionscript, general

111 Comments
  1. That’s awesome Jean, thanks for sharing!

    Here is some more official info on the PreloadSwf tag and custom profilers:
    http://livedocs.adobe.com/flex/3/langref/flash/sampler/package.html

    I’m guessing OverrideUserInvokedActions just bypasses the FP security model requirements for user-initiated events such as entering fullscreen mode.

    Congratulations on the blog and your excellent technical posts ;)

  2. Very useful, thanks for sharing

  3. This is amazing, thanks for sharing! I can definitely see custom profiling tools coming up (FDT, hint hint..)

  4. zwetan permalink

    that’s a hell lot of hidden features :)

    thanks for all that!!

  5. martial permalink

    How weird ?

    I don’t have any mm.cfg file on my system –
    Is this really up-to-date with FP10 and CS4 ?

    As well It’s hard to believe to found this file on a “macromedia” folder.

    Any tips ?

  6. pleclech permalink

    Great post,

    Big thanks for all the infos provided.

  7. Andre permalink

    Nice one!

    Thanks for this :)

  8. Alex permalink

    Unbelievable!

    Thanks!

  9. ddrouin permalink

    Wow, very nice finding. Beau boulot.

  10. JPM permalink

    Question about TraceOutputBuffered = 1|0

    It does not seem to work with plugins for FlashDev like FDtracer or FlashLog. I’m getting a Warning about the the file being used by another proccess…

    Any idea on how to turn on TraceOutputBuffered and still be able to access it at runtime from a log viewer?

  11. Wow, a treasure trove indeed! How did you find all of these? As per your request regarding AS3DynamicProfile, I think I will take a look. I’ll certainly let you know what I find.

    Thanks for the documentation!

  12. Joey Parrish permalink

    I think these might be wrong:

    AS3CSE = 1|0
    AS3DCE = 1|0
    Enable/Disable Profiling information (if turned off, we can’t profile in FlexBuilder anymore)

    CSE and DCE are acronyms for common compiler optimization techniques. It seems plausible that these may be employed by the Flash virtual machine to optimize the byte-code before executing. If this is the case, though, I can’t guess why this would affect your ability to profile. So I might be crazy.

    http://en.wikipedia.org/wiki/Common_subexpression_elimination
    http://en.wikipedia.org/wiki/Dead_code_elimination

    • Thanks a lot, this make a lot of sense! I updated the post.
      I didn’t had that much time to try everything but still… thanks!

  13. this is for very advanced users, but I guess some people will always dig for ‘undocumented stuff’ :)

  14. Absolutely incredible stuff!! How, may I ask, did you discover all of this awesomeness?

  15. Excellent post.

    AS3Turbo :)

  16. makc permalink

    ProductDownloadBaseUrl seems like nice target for malware authors

  17. Thank you!

    ~o__O~

    So much properties!

  18. TraceOutputBuffered is an interesting one; it would appear that it locks the flashlog so that only one instance of the player can write to it at a time; for me this meant if I had a browser open with a Flash App in one of the tabs, my standalone debug player would no longer output to the tracelog.

  19. ProductDownloadBaseUrl:

    I’ll wager that this sets the base url for loading the air.swf when installing/updaing AIR apps from a Flash badge… among other things.

  20. Awesome information, thanks for the explanation- especially the first two you introduced: TraceOutputBuffered & AS3Verbose
    Already helping me work better =)

  21. Rezmason permalink

    How did you find this stuff out? I ask because the list of mmcfg flags will probably change over time, and knowing your source would let me keep an eye on it when the player’s updated.

  22. Wow, these are sweet. I wonder if some of these (particularly AS3StaticProfile) could be combined with a unit testing framework to get very some very detailed low level optimizations going where needed.

  23. Wow! very nice! A true wealth of information!
    Can a swf find out about the mm.cfg info somehow at run time?

  24. Sri Sankaran permalink

    Thank you very much for this compilation. I found it very useful.

    However, for the longest time, I was stumped by the fact that the log file was not being created even though I had the proper settings in the mm.cfg.

    Then I came across a post (http://flashgamedevblog.blogspot.com/2007/06/debugging-flash-player-9-with-logfile.html) which said that Flash Player 9 ignored any customization of the log file location. Sure enough the file was there (Windows 7: %userprofile%\AppData\Roaming\Macromedia\Flash Player\Logs).

    Thanks again

  25. Harry permalink

    Are some of these features possible in AS2? i tried AS2Trace = 1 but it only logs my traces, i don’t see any list of functions

  26. Nick permalink

    Is this incorrect?

    DisplayGPUBlend = 1|0

    If set to 1, it will prevent GPU use even if the SWF context is setted to use GPU and your card support it.

    You’ve written above that it displays a green box when it’s being used… but below you write that it disables it. Are you sure it’s not supposed to be DisableGPUBlend along with DisplayGPUBlend?

  27. Thanks for sharing some great info

  28. Realy heavy! Maybe sometimes usefull!

  29. Swah permalink

    So was anything found about the crash that occurs when using AS3DynamicProfile ? I could _really_ use that function, but the debug player (started from FlashDevelop) crashes on startup when that flag is set.

  30. thienhaflash permalink

    Wow, wow, wow, wow … This post rule !!!

  31. Danny permalink

    Nice

  32. Flash permalink

    Hi Sankaran,

    I looked inside my windows XP SP3 After installing Flash Professional CS5 and I did not file the mm.cfg
    I then did a windows search for *.cfg and no luck. Any ideas on how do I get Flash CS5 professional to generate this mm.cfg file automatically

    • I think that it is not generated by default anymore. Still you can create it by hand in your DocumentsAndSettings/ProfileName/mm.cfg

  33. ravi permalink

    thanks for the post man. I’ve updated my flash player 10 debugger today and it started crashing/ responding slowly. I’ve modified the mm.cfg file and it’s working properly now. but I’m a facing a problem now. I’m not able to see any server communication details(php echos) in the output console. Is there any setting for this? Any help would be much appreciated.
    cheers.

  34. Does anyone see anything in this list that will suppress warning messages, but not error messages? I’ve looked, but didn’t see anything, but my little brain doesn’t quite grasp everything in this list.

    I get the warning: “Warning” ‘flash has no property ‘prototype’ all the time – often multiple times per file – and it’s driving me crazy.

    • Thom Allen permalink

      Josh have you found a solution to this problem yet? I am having it on every Mac that I set up and I can’t believe that people are just ignoring it.

  35. peace.lion permalink

    i’m on mac osx snow leopard. Latest flash debug player installed and no mm.cfg file on /Library/Application Support/Macromedia !!! the file is not present on my hard drive. Does someone encountered the same problem ? Thanks.

  36. Samuel Crank permalink

    Here’s some info on CrashLogEnable from Adobe:
    http://kb2.adobe.com/cps/839/cpsid_83973.html

  37. Jan Weber permalink

    I freshly installed a CS5 and get several traces “[..] AVMINF: MTHD [..]“. Unfortunately I cannot find a way to disable them. The mm.cfg file was not located on my windows xp under “C:\Documents and Settings\$myuser” so i created one, added the var “AS3Trace=0″ and restarted flash but still traces. Please advise… :)

  38. the latest flash debugger caused a HUGE problem for me! (I’m on mac osx 10.6.3)

    I was not able to turn off the logging of all functions by adding AS3Trace = 0 to the mm.cfg file (I added it but it did not work)

    I had to revert back by downloading adobe’s flash debugger archive.

    the first thing you need to do is uninstall flash player by downloading adobe flash player uninstaller: http://www.wargeek.net/uninstall-flash-player-windows-mac-adobe-flash-player-uninstaller.html

    next get adobe’s debugger archive here: http://kb2.adobe.com/cps/142/tn_14266.html

    Flash Player 10 (debugger versions) (141 MB)

    MAKE SURE YOU USE THE DEBUGGER PLAYER IN THE FOLDER: 10r32_18. I went through several folders working my way back in versions to find a debugger that:
    a. didn’t have the excessive trace problem
    b. didnt unpack another dmg file which in turn unpacked another dmg.zip….. ad infinitum

    unpack: flashplayer10r32_18_ub_mac_debug.dmg.zip

    and then run: Install Flash Player 10 UB.dmg

    that should fix the problem

    • Hi,
      Am using flash cs5 trail version,and went through your post as per that i searched
      mm.cfg but was not able to find it.Please let me know where can i find that am using Windows XP.Thanx in advance.

      • Jan Weber permalink

        I also had problems locating the mm.cfg file but I found it in the root directory of the folder which is assigned by the domain controller. So it was not in the “My Documents” folder or somewhere else

  39. To all the over commentors. Blogs could be a lot much better to read when you can keep Your feedback uncomplicated and also to the stage. No-one likes to learn giant feedback when the idea can be conveyed utilizing a not as long comment

  40. jack permalink

    I am not sure if this is related, but below is a snippet of what I get when I first open up a file I have been working on. At first it only appeared when I tested the movie and only on the first time I did it. It severely slowed my computer down.

    Running CS4 on an HP Intel Xeon CPU 3.06GHz (2 processors) 2 GB RAM

    Is this something useful?
    I am not sure how it was even turned on?!

    812630 AVMINF: MTHD global$init ()
    812638 AVMINF: MTHD Object$cinit ()
    812639 AVMINF: MTHD Class$cinit ()
    812640 AVMINF: MTHD Function$/emptyCtor () @ 0x05D40000
    812641 AVMINF: MTHD Function$cinit ()
    812642 AVMINF: MTHD Class/get prototype () @ 0x05D40120
    812643 AVMINF: MTHD Class/get prototype () @ 0x05D40120
    812644 AVMINF: MTHD Class/get prototype () @ 0x05D40120
    812645 AVMINF: MTHD Class/get prototype () @ 0x05D40120
    812645 AVMINF: MTHD Class/get prototype () @ 0x05D40120
    812647 AVMINF: MTHD Object$/_dontEnumPrototype () @ 0x05D40160
    812648 AVMINF: MTHD Object$/_setPropertyIsEnumerable () @ 0x05D40380
    812649 AVMINF: MTHD Object$/_setPropertyIsEnumerable () @ 0x05D40380
    812650 AVMINF: MTHD Object$/_setPropertyIsEnumerable () @ 0x05D40380
    812651 AVMINF: MTHD Object$/_setPropertyIsEnumerable () @ 0x05D40380
    812652 AVMINF: MTHD Function$/emptyCtor () @ 0x05D40000
    812653 AVMINF: MTHD MethodClosure$cinit ()
    812654 AVMINF: MTHD Namespace$cinit ()
    812655 AVMINF: MTHD Class/get prototype () @ 0x05D40120
    812656 AVMINF: MTHD Class/get prototype () @ 0x05D40120
    812657 AVMINF: MTHD Class/get prototype () @ 0x05D40120
    812658 AVMINF: MTHD Object$/_dontEnumPrototype () @ 0x05D40160
    812659 AVMINF: MTHD Object$/_setPropertyIsEnumerable () @ 0x05D40380
    812660 AVMINF: MTHD Object$/_setPropertyIsEnumerable () @ 0x05D40380
    812660 AVMINF: MTHD Boolean$cinit ()

  41. Great stuff. Nice work.

  42. Extremely good content. I basically stumbled upon an individual’s webpage together with desired that will express the fact that I have extremely liked looking through an individual’s blog site together with threads. Anyway I’ll get following an individual’s provide for together with That i intend that will read an individual’s blog site for a second time.

  43. Netcom permalink

    Hi,

    I have a huge application in AS3 and facing a crash problem since some time. I tried using AS3Trace=1 in mm.cfg with and without TraceOutputBuffered=1, but I cannot see all the logs in flashlog as the file size keeps increasing and goes in GBs over time, causing my computer to slow down. Can you please advice as how do I use it properly in order to investigate my crash problem.

  44. fo-ol permalink

    WONDERFUL!!! thanks a lot! I’d like to ask: I can’t get any flash debug player version more than 10.1 (10.3.181.23 is actual now) to work – it plays flash content but doesn’t debug flashlog. I’ve tried many versions but everytime I must return back to 10.1 version that works.
    Does anyone know where is the problem? Has anyone same problem?

  45. awesome article, need to get deeper into it but I am wondering about the phrase from first paragraph about undocumented ability to enable right mouse button in Flash Player. Have anyone any clues?

  46. Hi good publish , Thanks for sharing this info

  47. Hi i try the parameter ScriptStuckTimeout to setup to 6000 but it don’t work. HAve you tried this one? I hvae the same error #1502 on 60 secods

  48. Thanks for the list and the explanation of all those parameters.
    I’ve digged into the current version of the debug Flash Player (Linux, 32-bit, 11.2.202.233) and found a couple of changes. Some parameters are missing (not supported … but this might be only due to the platform differences … I guess you analyzed the Windows version) and a few were added.
    If somebody is interested, you can take a look at it here:
    http://pastebin.com/d13D01gG

    I’m not sure whether all of these actually work. I just grabbed from the Flash Player shared lib (libflashplayer.so) all strings that were in the same bunch as some known mm.cfg parameters and looked as if they could be parameters themselves. :-)
    If just somebody would take the effort to go over them and test each … ;-)

  49. eason.zhang permalink

    Hi,
    I have a problem!
    I set “AS3Verbose=1″ in mm.cfg file
    but there is no log in flashlog.txt
    why?

  50. I really enjoy thiss specific blog. It is like a secret haven where I always learn something that
    intrigues and amazes me.

  51. I’ve been surfing online more than three hours lately, but I never found any interesting article like yours.
    It’s beautiful value sufficient for me. In my opinion,
    if all webmasters and bloggers made excellent content as
    you did, the web shall be a lot more helpful than ever before.

  52. video lucu banget bikin ngakak motor permalink

    This is really fascinating, You’re an overly skilled blogger.
    I’ve joined your rss feed and look ahead to in quest of more of your fantastic post.
    Additionally, I have shared your web site in my social networks, http://goo.gl/9BRBg8

  53. people are awesome sport edition permalink

    It is perfect time to make a few plans for the future and it’s time to be happy.
    I’ve learn this post and if I could I wish to counsel you some interesting issues
    or suggestions. Perhaps you can write subsequent articles referring to this article.
    I want to read more issues approximately it!, http://goo.gl/dwBlpL

  54. It’s remarkable to pay a visit this website and reading the views of all friends regarding
    this piece of writing, while I am also zealous of getting familiarity.

Trackbacks & Pingbacks

  1. SOS Flash Log Tail – Kristof Neirynck
  2. links for 2010-02-11 « Mandarine
  3. What Else You Should Know About Flash/Flex at Jozef Chúťka's blog
  4. JP Auclair finds treasure in mm.cfg « Tripped Out
  5. mm.cfg file!
  6. Most Tweeted Articles by Adobe Experts
  7. Секреты файла mm.cfg « Flash Team
  8. Weekly Shared Items – 16. February, 2010 | TOXIN LABS - weblog of a german design student from wuerzburg
  9. Weekly Digest for February 16th — Hello. My name is Václav Vančura.
  10. Flash player advanced configuration
  11. One SWF to rule them all : The Almighty PreloadSWF « jpauclair
  12. AS3 Conversion
  13. subobjective21 interactive » mm.cfg hidden treasures.
  14. Flash Assembler (not ByteCode) : And you thought it couldn’t get faster « jpauclair
  15. AZ13 >> Mit Flash Player Einstellungen arbeiten: mms.cfg
  16. Flash CS5 output messages: AS3Trace « Flashscript.biz
  17. Links: AS3 code to use « Sergein Info Blog
  18. jpauclair.net: 6 Months – Articles recap. « jpauclair
  19. mm.cfg revealed! | sephiroth.it - flash world
  20. Some neat mm.cfg options | http://piotr.buda.li
  21. The power of mm.cfg at distriqt // labs
  22. Profiling Flash Player Rendering - ByteArray.org
  23. Sweet hidden debug information… « Avocado Blog
  24. Swf.hu 2.0 – flash és webfejlesztés » Heti link gyűjtemény 2
  25. Philippe.me » AS3 – Hacking PreloadSwf for fun and profit
  26. Flash security: Protecting against PreloadSWF (SWF Hijacking) « jpauclair
  27. Blimey! « Deceptive Resolution
  28. Parameters in Flash configuration file mm.cfg « ZhengPing's web site (consturcting…)
  29. Тыща и одно дело
  30. ТЕСТ | Тыща и одно дело
  31. Apukeittiö.fi » Blog Archive » Uusin Flash Player päivitys tulostaa kaiken
  32. Debugging and Error Logging in Deployed AIR Applications - The Back Room
  33. » AS3 flash.trace.Trace Hidden Class Eli Atlas | Flash blog
  34. mm.cfg hidden treasures. | Paratrooper Digital
  35. mm.cfg Secrets « Michael.Huang's Blog
  36. Thaylin… that's me! » code reviewing and tons of debugging info!
  37. I am Error (silent crashes) « BaconTech
  38. Overcome Flash Profiler Security sandbox violation error « The Mini's View
  39. [备忘] 查看浏览器中flash swf的trace调试输出 - SmithFox | Dai Zheng
  40. Reverse engineering AMF3 Vector for Java | Parabolic Evidence
  41. AVM_AS3_debugging | Annotary
  42. 神奇的PreloadSwf | Kanefan 开饭哥
  43. flashplayerdebugger版本不报错问题 - HTML/CSS - 开发者第1444533个问答
  44. 小佳的部落格-Flex記憶體監控程式-Profile
  45. Flex記憶體監控程式-Profile | 夢想家創意分享甘苦談

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 34 other followers

%d bloggers like this: