Fact-checked by Grok 2 weeks ago

Action Message Format

The Action Message Format (AMF) is a compact binary format developed by Systems Incorporated for serializing object graphs, enabling the persistence of application state across sessions or the transmission of strongly typed data between client-side applications and server-side services. Primarily utilized in Rich Internet Applications (RIAs) built with and Flex, AMF facilitates remote procedure calls (RPC) over protocols such as HTTP or RTMP by encoding complex data structures like numbers, strings, arrays, and objects into an efficient, type-preserving representation. Introduced as AMF 0 with Flash Player 6 in 2001, the format provided foundational support for 16 core data types and object references to manage redundancy and circular dependencies in serialized graphs. AMF 3 followed in 2006 alongside Flash Player 9 and ActionScript 3.0, enhancing efficiency through optimizations like variable-length integer encoding, reference tables for strings and traits, and expanded type support including XML documents, byte arrays, vectors, and dictionaries. These versions ensured , with AMF 0 remaining supported for legacy applications while AMF 3 addressed the demands of more advanced scripting features. AMF's design emphasized compactness and type fidelity, making it suitable for real-time data exchange in environments like video streaming via (RTMP) or web service integrations. Although tied to the Adobe Flash ecosystem, which reached end-of-life in 2020, AMF continues to be referenced in legacy systems and open-source implementations.

Introduction

Purpose and Applications

The Action Message Format (AMF) is a compact format designed for serializing object graphs, XML data, and messages to facilitate communication between clients and servers. It enables the efficient persistence and retrieval of application state across sessions or between endpoints, supporting strongly typed data exchange in a lightweight manner. AMF's primary applications lie in remoting scenarios, where it powers asynchronous data exchange between applications and remote services, such as invoking server-side operations from code. In streaming protocols like (RTMP), AMF transmits structured payloads efficiently over networks, minimizing usage for applications like video streaming and live feeds. AMF0 and AMF3 represent the core versions, with AMF3 offering optimizations like integer compression and for enhanced performance. Compared to text-based formats such as XML or , AMF provides superior compactness and serialization speed, as its binary encoding reduces payload size and parsing overhead, making it ideal for binary transport in resource-constrained environments. This efficiency supports (RPC)-style interactions in , where developers specify target URIs for operations and handle responses via callback mechanisms, streamlining client-server integration without verbose markup.

Historical Context

The Action Message Format (AMF) originated in 2002 when released Flash Player 6 on March 15, introducing AMF0 as a mechanism to support 1.0 object graphs in Flash Remoting for client-server communication. This format enabled efficient exchange of structured data between Flash applications and backend services, addressing the limitations of text-based protocols at the time. AMF0 retained strong typing and object structure, making it suitable for early rich internet applications. In June 2006, —following its acquisition of in 2005—introduced AMF3 with Flash Player 9 and ActionScript 3.0, enhancing performance through new data types like traits for dynamic classes and optimizations such as variable-length encoding and reference tables to reduce payload sizes for . This evolution improved efficiency in handling complex data structures, aligning with the growing demands of interactive multimedia. Key milestones in the 2000s included AMF's integration into the (RTMP), developed by in 2002 for Flash Media Server to enable real-time video streaming, where AMF encoded headers, commands, and for low-latency delivery. AMF also gained traction in enterprise environments, notably through Flex Data Services (later rebranded as LiveCycle Data Services), released by in March 2004 to provide Java-based remoting and data synchronization using AMF for Flex applications. In December 2007, Adobe open-sourced BlazeDS, a high-performance built on AMF for messaging and remoting in Java backends, further promoting its adoption in scalable web services. After announced the end-of-life for on December 31, 2020, AMF transitioned to status, with support ceasing for browser-based but persisting in server-side and non-browser contexts. As of , AMF remains in use for niche applications, particularly in RTMP-based for handling and in backward-compatible systems like ColdFusion integrations for Flex components.

Format Specifications

Packet Structure

The Action Message Format (AMF) packet is a self-contained stream designed for efficient and transmission of ActionScript object graphs. It begins with a 2-byte identifier in unsigned 16-bit integer (U16) format, which specifies the AMF encoding : 0x0000 for AMF0 and 0x0003 for AMF3. This header ensures compatibility and directs the decoder to the appropriate value encoding rules for the remainder of the packet. The packet structure follows the version with a 2-byte unsigned indicating the number of optional context headers (up to ), each serving as for the session. A typical header includes a UTF-8 encoded name, a 1-byte "must-understand" , a 4-byte unsigned for the length, and the AMF-encoded itself. After all headers, a 2-byte unsigned denotes the number of (also up to ), with each comprising a UTF-8 target , a UTF-8 response (potentially empty), a 4-byte message length, and the AMF-encoded . This layout allows AMF packets to encapsulate multiple independent in a single . Within headers and messages, the AMF-encoded values form the core payload, consisting of one or more 1-byte type markers followed by variable-length data tailored to the marker's type, such as IEEE-754 double-precision numbers or UTF-8 strings. These markers enable the representation of complex, nested structures like objects and arrays, where properties or elements recursively contain further AMF values, terminated by specific end markers (e.g., 0x09 for object end). The format supports object graphs by allowing arbitrary nesting without predefined schema, facilitating the serialization of hierarchical data in a compact binary form. Packet boundaries are enforced through the explicit length fields in headers and messages, ensuring reliable without additional delimiters. This also accommodates multi-message , enabling protocols like RTMP to transmit several AMF-encoded operations in one packet for streamlined communication. While the overall packet organization is consistent across versions, AMF3 introduces efficiencies such as for repeated structures, reducing redundancy compared to AMF0.

AMF0 Details

The Action Message Format version 0 (AMF0) is identified by a 16-bit unsigned version header set to 0, encoded as the bytes 0x00 0x00 at the beginning of an AMF packet. This format was designed to serialize object graphs from 1.0 and 2.0, preserving strong type information while enabling efficient binary transmission over networks. AMF0 employs strict typing through a set of 16 core type markers, each a single byte (U8) that precedes the encoded data and indicates the type, such as 0x00 for numbers or 0x02 for strings. Strings in AMF0 are encoded in format, prefixed by a -bit length indicator for strings up to bytes or a 32-bit length for longer ones. Numeric values use the double-precision floating-point representation, consisting of 8 bytes to handle a wide range of real numbers with sufficient precision for typical applications. Objects in AMF0 are serialized as a sequence of key-value pairs, where each key is a string followed by its corresponding value encoded according to its type marker. The object terminates with an key (two zero bytes for the length, followed by no characters) and an end-of-object marker (0x09). Unlike later formats, AMF0 lacks class traits for defining object structures, requiring full re-encoding of for each instance, and while it supports object references via a 16-bit index (up to 65,535 unique objects), this mechanism is limited to avoiding duplication within a single context. A key limitation of AMF0 is its lack of support for XML literals, such as those introduced in 3.0's E4X syntax, and it does not accommodate advanced types from 3.0, restricting its use to earlier language versions. This results in verbose encoding for complex object graphs, as repeated structures must be fully expanded without shared trait definitions, increasing payload size and processing overhead in scenarios involving deeply nested or shared data.

AMF3 Details

AMF3 represents an evolution of the Action Message Format, specifically tailored for 3.0 and the Plus (AVM+), enabling more efficient of complex object graphs including new language features. It introduces optimizations such as variable-length encoding and reference mechanisms to reduce size compared to earlier versions, while maintaining through distinct version identification. The AMF3 packet is identified by its version header, consisting of the two bytes 0x00 0x03, which precede the encoded types and specify the use of AMF3 rules for interpretation. This header ensures decoders can apply the appropriate encoding scheme, supporting class-based objects that align with 3.0's object-oriented paradigm, including typed classes with both static and dynamic properties. A core enhancement in AMF3 is the adoption of unsigned 29-bit integers (U29) for encoding sizes, lengths, and markers, allowing values up to 2^29 - 1 (approximately 536 million) in a compact variable-length format that minimizes byte usage for smaller numbers. To further optimize , AMF3 employs three implicit reference tables—one for strings, one for objects, and one for —that track previously serialized items, enabling subsequent references via dedicated markers rather than full re-encoding, thus avoiding duplication in object graphs. definitions, encoded with a name followed by a count of sealed (static) properties and optional dynamic member names, facilitate the representation of structures; these can themselves be referenced to reuse definitions across multiple instances. For arrays, AMF3 unifies handling under a single type marker (0x09), distinguishing between dense arrays—where elements are accessed via ordinal numeric indices—and (maps) based on the structure following the marker. A dense array begins with a U29-encoded length, followed by inline values for indices 0 to length-1; if the initial U29 is 0, it signals an associative array, where alternating string keys (U29 length + ) and values follow until an key terminates the sequence. This approach allows flexible representation of both array types without separate markers, leveraging U29 for efficient length indication. AMF3 also provides native support for serializing E4X XML nodes directly as a distinct type (marker 0x0B), encoding the XML document in format while preserving structure and allowing references to avoid redundant transmission, in contrast to AMF0's limitation to string representations of XML.

Data Types and Encoding

Core Data Types

The Action Message Format (AMF) supports a range of core data types, each identified by a one-byte marker that precedes the encoded representation, enabling compact binary serialization of values. AMF0 and AMF3 define overlapping yet distinct sets of types, with AMF3 introducing optimizations like integer types and reference mechanisms to reduce redundancy in object graphs. In AMF0, there are 11 primary data types, plus reserved markers, designed for basic ActionScript serialization such as numbers, strings, and objects. The following table summarizes the AMF0 core data types, their markers, and basic representations:
Marker (Hex)Type NameBasic Representation
0x00Number8-byte IEEE-754 double-precision floating-point value.
0x011-byte unsigned integer (0x00 for false, non-zero for true).
0x022-byte unsigned length (U16) followed by UTF-8 bytes (up to bytes).
0x03ObjectSequence of property name-value pairs ended by Object End marker.
0x05No additional data.
0x06No additional data.
0x072-byte unsigned index (U16) to a prior object.
0x08ECMA Array4-byte unsigned count (U32) followed by name-value pairs like an Object.
0x0AStrict Array4-byte unsigned count (U32) followed by that many values.
0x0BDate8-byte milliseconds since Unix epoch (double) plus 2-byte timezone offset (reserved).
0x0FXMLDocument4-byte unsigned length (U32) followed by XML bytes.
Special types in AMF0 include the ECMA Array, which handles mixed associative arrays with string keys and supports dynamic property counts up to 4,294,967,295, and XMLDocument for embedding XML as a long . Reserved markers like 0x04 (Movieclip) and 0x0E (Recordset) are not used for , while 0x10 (Typed Object) allows class aliases by prefixing a class name before . AMF3 extends AMF0 with 18 markers, adding support for integers, byte arrays, and vectors while using a compact U29 variable-length encoding for sizes and references to prior values in tables for strings, objects, and traits. The following table outlines the AMF3 core data types, markers, and representations:
Marker (Hex)Type NameBasic Representation
0x00No additional data.
0x01No additional data.
0x02falseNo additional data.
0x03trueNo additional data.
0x04Signed 29-bit integer via U29 encoding (values beyond range use double).
0x058-byte IEEE-754 double-precision floating-point value.
0x06stringU29 length followed by UTF-8 bytes or U29 reference index.
0x07XMLDocumentU29 length followed by UTF-8 bytes or reference index.
0x08dateU29 milliseconds since or reference index (no timezone).
0x09arrayU29 count for dense portion, then associative pairs, or reference.
0x0AobjectTraits info (U29) followed by properties, or reference to traits/object table.
0x0BXMLU29 length followed by E4X UTF-8 bytes or reference index.
0x0CByteArrayU29 length followed by raw bytes or reference index.
0x0Dvector-intFixed-type vector of 32-bit integers with U29 length.
0x0Evector-uintFixed-type vector of unsigned 32-bit integers with U29 length.
0x0Fvector-doubleFixed-type vector of doubles with U29 length.
0x10vector-objectFixed-type vector of objects with class name and U29 length.
0x11U29 weak keys flag, U29 length, then key-value pairs or reference.
Notable AMF3 additions include the XML type for E4X-compliant XML serialization as UTF-8 strings and ByteArray for arbitrary binary data, both supporting object table references for efficiency. Type extensibility in AMF3 occurs through the object marker's traits, where a dynamic class name string can alias custom ActionScript classes before encoding properties. AMF3 briefly differs from AMF0 by integrating boolean values as distinct markers rather than a single type and omitting long string support in favor of U29-sized strings.

Encoding and Decoding Mechanisms

The encoding process in Action Message Format (AMF) begins with a single-byte type marker that identifies the , followed by a type-specific containing the serialized data. For basic types in AMF0, such as numbers, the consists of an 8-byte IEEE-754 double-precision floating-point encoded in byte order (big-endian). Booleans use a single byte where zero indicates false and any non-zero indicates true, while are prefixed with a 16-bit unsigned length (in byte order) followed by UTF-8 encoded characters, limited to 65,535 bytes. Complex structures like objects and arrays are handled recursively: objects consist of zero or more name- pairs ( followed by ), terminated by an marker (0x00 0x00 0x09), and arrays include a 32-bit count followed by the elements. In AMF3, the encoding introduces optimizations for compactness, including U29 (unsigned 29-bit ) representation for lengths, counts, and references. U29 values are encoded in 1 to 4 variable-length bytes, where the most significant bit of each byte (except the last) is set to 1 to indicate continuation, and the lower 7 bits carry ; the maximum value is $2^{29} - [1](/page/1) (536,870,911). To decode a U29, bytes are read sequentially until a byte with the high bit cleared is encountered, then the value is computed as \sum_{k=0}^{m-1} ((b_k \land 0x7F) \times 128^{m-1-k}), where b_k are the m bytes read (with the first byte b_0 being the most significant chunk). For example, integers in AMF3 use U29 for values up to \pm 2^{28} - [1](/page/1), with larger values encoded as doubles in network byte order; strings use a U29 length prefix followed by UTF-8 , supporting up to $2^{28} - [1](/page/1) bytes. Nesting in AMF3 remains recursive, but objects and arrays leverage reference tables to avoid duplication, encoding references as U29 indices into string, object, or traits tables. Decoding in both AMF versions starts by reading the AMF version from the packet header (a 16-bit unsigned in network byte order) to determine compatibility, followed by sequential parsing of type markers and payloads. Each marker dictates the payload length and format: for instance, after reading a number marker (0x00), 8 bytes are consumed directly as a , while for objects, pairs are read until the end marker. In AMF3, deserializers maintain three tables (for strings, objects, and traits) during parsing; a U29 with its high bit cleared signals a , which is resolved by indexing the appropriate table to reconstruct shared structures without re-encoding duplicates. Incomplete payloads, such as truncated strings or unterminated objects, result in deserialization failures, often throwing exceptions like range errors for oversized U29 values or invalid markers. Unsupported markers (e.g., 0x0D in AMF0) may be skipped or cause errors depending on the , ensuring robust handling of legacy or mixed-version streams.

Usage and Legacy

Integration with Flash and RTMP

The Action Message Format (AMF) plays a central role in Flash Remoting, enabling remote procedure calls (RPC) between ActionScript applications and server-side services through the NetConnection class. In this context, AMF serializes method invocations, parameters, and responses into binary packets, allowing asynchronous communication over HTTP or RTMP protocols without requiring XML or intermediaries. For instance, an ActionScript client can invoke a server method like getUserData by passing the method name and arguments via NetConnection.call(), with AMF handling the encoding to preserve ActionScript types such as objects, arrays, and dates. In the (RTMP), AMF serves as the format for command and messages within chunked streams, facilitating real-time exchange in video and audio applications. AMF-encoded packets are embedded in RTMP messages with type 20 for AMF0 and type 17 for AMF3, allowing clients and servers to negotiate connections, control streams, and transmit descriptive data like stream (e.g., duration, framerate). These messages are divided into chunks of configurable size (default 128 bytes) for efficient transmission over , with each chunk header indicating the message type and . A key application involves commands, such as play and pause, where AMF encodes parameters like names, , and to manage playback in Flash-based players. For example, a "play" command might serialize a string identifier, a numeric start time, and a reset into an AMF body, which the server acknowledges with a status response like NetStream.Play.Start; similarly, a "pause" command includes a and to halt or resume the , ensuring synchronized audio/video delivery. This integration supports low-latency interactions in scenarios, with AMF's compact binary structure minimizing overhead compared to text-based alternatives. Flash Player implementations provide built-in AMF support starting with version 6, which introduced automatic serialization for AMF0 during NetConnection operations, ensuring compatibility for ActionScript 1.0 and 2.0 applications. From Flash Player 9 onward, AMF3 support was added alongside ActionScript 3.0, with negotiation occurring via a version header in AMF packets (e.g., using the avmplus-object-marker 0x11 to switch formats) and the ObjectEncoding property set to AMF3 for optimized encoding of complex objects. This backward compatibility allows seamless fallback to AMF0 if the server does not support AMF3, maintaining interoperability across Flash Player versions 6 through the final release.

Modern Support and Deprecation

The end-of-life of on December 31, 2020, significantly reduced native support for the Action Message Format (AMF), as browsers and major platforms ceased enabling Flash plugins and related protocols. However, AMF continues to persist in legacy systems, particularly within (RTMP) servers that handle metadata for video streaming, with implementations like the RTMP module remaining viable for such purposes as of 2025. This module supports RTMP streams that embed AMF data for cue points and timed metadata, enabling ongoing use in non-Flash environments. Several third-party libraries maintain AMF compatibility across languages, facilitating remoting and in legacy or hybrid applications. For , AMFPHP provides remoting services with AMF encoding and decoding, supporting integration with web frameworks despite limited recent updates. In , BlazeDS offers AMF for Spring-based applications, with its core contributed to the Apache Royale project for continued AMF handling in messaging channels. GraniteDS serves as an alternative for AMF3 deserialization in rich applications, though it requires careful to avoid persistence issues. Python developers rely on PyAMF or its Python 3 Py3AMF for AMF support in web services, including integration with frameworks like . For and , the infomaniac-amf/js library enables binary AMF and deserialization, suitable for server-side processing of legacy Flash-era data. Security concerns with AMF primarily revolve around deserialization vulnerabilities, where untrusted input can lead to remote code execution through gadget chains in object graphs. Research presented at USA 2012 highlighted these risks in AMF implementations like BlazeDS, demonstrating how tools such as Blazer could uncover input validation flaws and unauthenticated operations. Similar issues have been identified in other libraries, including XXE attacks in PyAMF and external entity parsing errors in GraniteDS. Mitigations include strict input validation, whitelisting allowed classes during deserialization, and avoiding direct processing of unverified AMF payloads to prevent exploitation. In current use cases as of 2025, AMF finds niche application in video streaming servers for handling timed metadata, such as cue points in live RTMP ingest. , for instance, supports AMF onTextData events for conversion to formats like tags or CEA-708 captions in HLS outputs, aiding broadcast workflows. It also enables in enterprise systems migrating from Flash-dependent architectures, where AMF ensures seamless data exchange in RTMP-based pipelines without full protocol overhauls.

References

  1. [1]
    [PDF] Action Message Format – AMF 0
    Action Message Format (AMF) is a compact binary format that is used to serialize ActionScript object graphs. Once serialized an AMF encoded object graph may be ...
  2. [2]
    [PDF] Adobe Systems Inc. AMF 3 Specification Category
    Action Message Format (AMF) is a compact binary format that is used to serialize. ActionScript object graphs. Once serialized an AMF encoded object graph may be ...
  3. [3]
    A Nostalgic Rummage Through the History of Flash | Envato Tuts+
    Dec 31, 2010 · Flash Player 6: Added an event handling model, accessibility controls and support for switch. The first version with support for the AMF and ...
  4. [4]
    Adobe Ships Flash Player 9 - CIO
    Jun 28, 2006 · Adobe has released Flash Player 9 for Mac and Windows systems ... It uses ActionScript 3.0, which makes it 10 times faster performing ...
  5. [5]
    RTMP (Real-Time Messaging Protocol) - How Does It Work
    Mar 9, 2021 · A comprehensive guide to RTMP - RealTime Messaging Protocol that is used for live streaming video and audio. Learn about the history, ...
  6. [6]
    Adobe Flex | Adobe Wiki | Fandom
    LiveCycle Data Services (previously called Flex Data Services) is a server-side complement to the main Flex SDK and Flex Builder IDE and is part of a family of ...
  7. [7]
    Adobe opens up AMF, liberates source for remoting framework used ...
    Dec 15, 2007 · Adobe announced this week plans to release the source code of BlazeDS, a high-performance data and messaging framework based on Adobe ...
  8. [8]
    What is RTMP? The Real-Time Messaging Protocol Explained
    Apr 22, 2025 · Action Message Format (AMF) is a binary serialization format ... As of 2025, AMF is rarely used in modern streaming workflows. With ...
  9. [9]
    Data & Services - Flex Integration | ColdFusion Administrator
    Oct 27, 2025 · Flash Remoting allows Flash/Flex applications to invoke ColdFusion components (CFCs) using the Action Message Format (AMF) protocol. Enable ...
  10. [10]
    None
    ### Summary of AMF0 Specification (http://download.macromedia.com/pub/labs/amf/amf0_spec_121207.pdf)
  11. [11]
    NetConnection - ActionScript 3.0 Language Reference - AIR SDK
    The NetConnection class creates a two-way connection between a client and a server. The client can be a Flash Player or AIR an AIR application.
  12. [12]
    [PDF] rtmp_specification_1.0.pdf - Real-Time Messaging Protocol (RTMP)
    Dec 21, 2012 · Command messages carry the AMF-encoded commands between the client and the server. These messages have been assigned message type value of 20 ...
  13. [13]
    ObjectEncoding - ActionScript 3.0 Language Reference - AIR SDK
    Adobe AIR and Flash Player 9 can serialize in two different formats: AMF3 and AMF0. AMF3, the default serialization developed for ActionScript 3.0, provides ...
  14. [14]
    Flash Player end-of-life (EOL) | Impact in Reader and Acrobat
    Oct 30, 2023 · Adobe will end support for Flash Player at the end of 2020 and encourages content creators to migrate any existing Flash content to new open formats.
  15. [15]
    arut/nginx-rtmp-module: NGINX-based Media Streaming ... - GitHub
    Module supports multi-worker live streaming through automatic stream pushing to nginx workers. This option is toggled with rtmp_auto_push directive.
  16. [16]
    How to use nginx rtmp module to create a simple dynamic overlay ...
    Sep 30, 2016 · In Wowza I could receive the rtmp AMF metadata data in the onTextData event and config a dynamic overlay. It's nothing complex, just some dynamic text.Missing: Media | Show results with:Media
  17. [17]
    silexlabs/amfphp-2.0: Simple Remoting for Web Applications - GitHub
    Amfphp is free and open source software, and an essential brick for the development of Web Applications. Amfphp is used in projects that cover a wide ...
  18. [18]
    Spring BlazeDS Integration Reference Guide
    Enhanced AMF Support. 5.1. Customizing AMF Conversion. While BlazeDS provides excellent support for serialization/deserialization between Java beans and AMF ...
  19. [19]
    GraniteDS Flex Reference Guide
    May 5, 2014 · GraniteDS is an event-driven, cross-framework, Application Client Container (ACC), for building Flex, JavaFX and native Android client applications.
  20. [20]
    StdCarrot/Py3AMF: AMF for Python3 - GitHub
    PyAMF provides Action Message Format (AMF) support for Python that is compatible with the Adobe Flash Player. It includes integration with Python web ...
  21. [21]
    infomaniac-amf/js: AMF serialization/deserialization for JS - GitHub
    AMF (Action Message Format) is a binary data serialization protocol. Simply put, it transforms objects in memory into a binary string, and can reverse this ...
  22. [22]
    [PDF] AMF TESTING MADE EASY! - Media.blackhat.com…
    Jul 23, 2012 · Since its introduction in 2002, Action Message Format (AMF) has attracted the interest of devel- opers and bug-hunters.
  23. [23]
    VU#279472 - Granite Data Services AMF framework fails to properly ...
    Mar 24, 2016 · Granite Data Services AMF framework fails to properly parse XML input containing a reference to external entities. Vulnerability Note VU#279472.Missing: infomaniac- js
  24. [24]
    AMF – Another Malicious Format - CODE WHITE
    Apr 4, 2017 · The Action Message Format version 3 (AMF3) is a binary message format mainly used by Flash applications for communicating with the back end.
  25. [25]
    Wowza Streaming Engine 4.9.2 Release Notes
    Feb 26, 2025 · Support for AMF onTextData conversion to CEA-708 captions. With Wowza Streaming Engine 4.9.2, we added support for converting AMF onTextData ...
  26. [26]
    About timed metadata in Wowza live streaming workflows
    Jul 10, 2024 · In a Wowza streaming workflow, AMF metadata can be received with an ingested source stream over RTMP or WOWZ. AMF metadata can also be injected ...Missing: Nginx- | Show results with:Nginx-