Flash Curation

This page goes over some of the advanced techniques specific to Flash curation. If you know of any advanced tips and tricks for curating Flash games, please add a section to this article!

Using old Flash versions

Some Flash games may be broken in the latest Flash Player version and require an old Flash Player version to work properly. For example, Hi Hi Puffy AmiYumi: Dish It Out compares only the first digit of the Flash Player version to the version it expects. This means that only Flash Player versions 6 through 9 will work for this game. So Flash Player 9 is used, and the Application Path is FPSoftware\Flash\flashplayer9r277_win_sa.exe.

Another common problem with Flash games is lagging when moving the mouse cursor. If this problem occurs, the game may need to be run in Flash Player 19 or earlier.

Finding the right Flash version

Sometimes, it's not so simple to find the right Flash Player version for a game. For example, when Shopping Mall Parking is played in the latest Flash version, your car will take damage constantly and refuse to move. To find the right Flash version for the game, follow these steps:

1. Install JPEXS Free Flash Decompiler.
2. Right-click the SWF and click "Open with FFDec".
3. Click the "header" section in the tree view on the left.
4. Translate the SWF version shown in JPEXS to its equivalent Flash Player version.
   • If the SWF version is below 9, the Flash Player version will be the same as the SWF version.
   • If the SWF version is 9 or above, use this chart to find the equivalent Flash Player version.
5. In Flashpoint, open the FPSoftware\Flash folder. Find the executable for the Flash Player version that the game needs. Copy the name of the executable and use it as the Application Path for the game.
6. Test whether the problem with the game is fixed!

In the example above, the SWF version of Shopping Mall Parking is 13, and the equivalent Flash Player version is 11.0. Thus, you would try this Application Path: FPSoftware\Flash\flashplayer11_9r900_152_win_sa_debug.exe

crossdomain.xml

Some Flash games may request a file called crossdomain.xml. This file permits access to domains other than the site the SWF is being hosted on. It will often look like the universal crossdomain.xml, found in the Legacy/htdocs directory of previous versions of Flashpoint:

<?xml version="1.0" ?>
<cross-domain-policy>
  <site-control permitted-cross-domain-policies="master-only"/>
  <allow-access-from domain="*"/>
  <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

The universal crossdomain.xml allows an SWF to access any and all domains, but others found on specific websites may only permit access from certain websites, such as Sploder's crossdomain.xml:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
	<allow-access-from domain="sploder.com" />
	<allow-access-from domain="*.sploder.com" />
	<allow-access-from domain="127.0.0.11" />
	<allow-access-from domain="*" />
</cross-domain-policy>
 

If a game requests a crossdomain.xml, but it's missing from the web, you can use the universal crossdomain.xml in its place.

Flashvars

Flashvars are additional variables added to an SWF's Launch Command in order to load the game properly. Flashvars are added to the Launch Command by putting a "?" after the filename of the .swf, followed by any variables in the style name=value, separated with &.

For example, the game Spyhounds: Crack This Code! has a Launch Command of http://www-tc.pbskids.org/fetch/spyhounds/poodlediamond/swf/code_breaker_3KB.swf?spyday=2. Note the ? after the .swf file extension, which means the SWF here calls for the flashvars of spyday, set to 2. Changing this to another number such as spyday=4 or spyday=9 is necessary to make the SWF play the other versions of the game.

In addition, flashvars can be part of a game's embed code (see below for more info on embeds). For example, viewing the HTML source code of this Newgrounds game page reveals the following JavaScript code, which many Newgrounds games have a similar version of:

{ swfobject.embedSWF("https://uploads.ungrounded.net/650000/650656_gridgame.swf?1419422088", "swfobject_embed", "720", "540", "9.0.0", null, {"NewgroundsAPI_PublisherID":1,"NewgroundsAPI_SandboxID":"5e057c3239505","NewgroundsAPI_SessionID":"","NewgroundsAPI_UserName":"<deleted>","NewgroundsAPI_UserID":0,"ng_username":"<deleted>"}

This code will generate the following Flash embed:

<object id="swfobject_embed" type="application/x-shockwave-flash" data="https://uploads.ungrounded.net/650000/650656_gridgame.swf?1419422088" style="visibility: visible;" width="720" height="540"><param name="wmode" value="direct"><param name="allowscriptaccess" value="never"><param name="allowfullscreen" value="true"><param name="allowfullscreeninteractive" value="true"><param name="flashvars" value="NewgroundsAPI_PublisherID=1&NewgroundsAPI_SandboxID=5e057ff9668f3&NewgroundsAPI_SessionID=&NewgroundsAPI_UserName=&lt;deleted&gt;&NewgroundsAPI_UserID=0&ng_username=&lt;deleted&gt;"></object>

Note this section in particular:

<param name="flashvars" value="NewgroundsAPI_PublisherID=1&NewgroundsAPI_SandboxID=5e057ff9668f3&NewgroundsAPI_SessionID=&NewgroundsAPI_UserName=&lt;deleted&gt;&NewgroundsAPI_UserID=0&ng_username=&lt;deleted&gt;">

Even the Flashpoint Proxy can't get past this game's sitelock with the SWF alone, meaning these additional flashvars are required. Adding the flashvars in the format as explained above gives us the following Launch Command, which indeed makes the game work:

http://uploads.ungrounded.net/650000/650656_gridgame.swf?NewgroundsAPI_PublisherID=1&NewgroundsAPI_SandboxID=5de02ce828e08&NewgroundsAPI_SessionID=&NewgroundsAPI_UserName=<deleted>&NewgroundsAPI_UserID=0&ng_username=<deleted>

Using the Plugin Projector

Some Flash games check whether they are running in an internet browser and refuse to run if they are not. For example, Neon Maze displays the below message when run in the standard Flash projector:

For games like this you can use the "plugin" projector, which pretends to be a Flash browser plugin instead of a projector. Just change the Application Path to FPSoftware\Flash\flashplayer_32_plugin.exe and the problem should be fixed! [Editor's Note: The plugin projector is not yet available in Infinity. Remove this note once it is added, please!]

Using the Debug Flash Player

Some games may constantly open blank browser windows, may fail to load without any 404 messages on the Logs tab, or may have buttons that don't do anything when clicked. For example, if you load this curation of the game Calibration into your copy of Flashpoint Infinity, you'll notice that clicking the "Control with Computer" button does nothing and the gameplay will not start. To figure out what the problem is, you can use the debug projector by changing the curation's Application Path to FPSoftware\Flash\flashplayer_32_sa_debug.exe.

Continuing with the example above, when clicking the "Control with Computer" button you'll now get an error popup with the following message:

Error: Error #2067: The ExternalInterface is not available in this container. ExternalInterface requires Internet Explorer ActiveX, Firefox, Mozilla 1.7.5 and greater, or other browsers that support NPRuntime.
	at Error$/throwError()
	at flash.external::ExternalInterface$/addCallback()
	at com.robo::Instructions/selectComputer()

If you see an error message that mentions ExternalInterface, that is your clue that the game needs to be run in a web browser instead of the Flash projector. See the Using HTML Embed Codes for instructions.

Using the Debug Plugin

In addition to the debug projector, in the future we will also include a debug Flash plugin for Flashpoint Navigator in Flashpoint Infinity. For now you can download the debug plugin from here. To use it, extract the 7z file, rename the extracted folder to Flash-Debug, and place the folder in Flashpoint's FPSoftware\BrowserPlugins folder. Then open FPSoftware\fpnavigator-portable\FPNavigator.ini and change the following line:

FP_FLASH_PATH=%FP_BROWSER_PLUGINS%\Flash

To this:

FP_FLASH_PATH=%FP_BROWSER_PLUGINS%\Flash-Debug

Flashpoint Navigator will now load the debug plugin instead of the standard plugin. To undo this, just revert the same line of FPNavigator.ini.

Using the Flashlog

The debug player is also useful for advanced tasks such as reimplementing game servers or recreating missing XML assets, where you need more info about what data the game expects to receive. Often in these cases, the info you need will be contained in a warning message, not an error. To see log/warning messages and more detailed errors, you will need to activate the flashlog by creating an mm.cfg file in your user folder:

1. Create a plain text file called mm.cfg (not .txt; if you are using Notepad, save as "All Files", not "Text Documents") with the following contents:

   ErrorReportingEnable=1
   TraceOutputFileEnable=1
   

2. Place the file in your %USERPROFILE% folder. (To open this folder, press Windows-R to open the Run box, then paste in %USERPROFILE%)
3. When you run an SWF, a file called flashlog.txt will appear in this folder: %APPDATA%\Macromedia\Flash Player\Logs
4. Open the file to see any errors, warnings and log messages that the SWF generated so far. Messages will be cleared each time you close and reopen the Flash projector (or reload the page in FPNavigator).

Using HTML Embed Codes

Some Flash games require browser-only features such as JavaScript. For example, Zuma (in Flashpoint) constantly opens blank browser windows when loaded in the Flash projector because it is trying to call JavaScript functions. For games like this, you'll need to use FPNavigator instead of one of the Flash projectors. You'll need to embed the game in an HTML. Follow the steps below:

1. Navigate to the webpage containing the game.
2. Right-click the page and click "Inspect Element." (Don't right-click on the game, right-click somewhere else on the page.)
3. Click the arrow button on the top-left of the Developer Tools window. Then click the Flash game. This should highlight the game's embed code.
   • If you're using FPNavigator, it may not allow you to select the Flash game. Instead, you'll need to click a nearby element, then move your selection slightly to highlight the actual embed code.
4. Press Ctrl-C to copy the highlighted embed code.
5. Open a text editor such as Notepad and paste the embed code into it.
6. Save the file as an HTML ("all files" on the Notepad dropdown menu).
7. Place the HTML and the SWF it references at their original URLs in the content folder.
8. Change the game's Application Path to FPSoftware\fpnavigator-portable\FPNavigator.exe.
9. Change the game's Launch Command to a URL matching the path to the HTML inside the content folder. Continue with the curation as normal.

Fixing the Embed Code

Embedding a Flash game in an HTML can occasionally cause problems with the game that did not previously exist. If a 3D game you are curating suddenly stops working when embedded in an HTML, or strange visual glitches appear in the game, you likely need to fix your embed code. Fortunately, the fix is very simple.

When you are embedding a Flash game in an HTML file, you should nearly always use the direct wmode parameter. For example, let's say you noticed visual glitches in a game with the following embed code. Changing transparent to direct would fix the problem.

<embed src="someGame.swf" width="900" height="450" wmode="transparent"></embed>

Finally, if you are curating a 3D Flash game using an HTML embed, you should always use the direct wmode, because Stage3D (Flash's 3D engine) only works reliably in this mode. For example, if you had a 3D Flash game with this embed code:

<embed src="someGame.swf" width="800" height="600"></embed>

You would change it to something like this:

<embed src="someGame.swf" width="800" height="600" wmode="direct"></embed>

Creating New Embed Codes

Sometimes, only an SWF is available, and there is no webpage to copy an embed code from. If the SWF does not run correctly in the Flash projector, you will need to create an embed code from scratch. Start with the template embed code below:

<object type="application/x-shockwave-flash" data="example.swf" width="640" height="480"><param name="allowscriptaccess" value="always"><param name="allowfullscreen" value="true"><param name="allowfullscreeninteractive" value="true"><param name="allownetworking" value="all"><param name="wmode" value="direct"></object>

Open the SWF in JPEXS Free Flash Decompiler. Click the "header" section in the tree view on the left. Next to "Display rect", you will see the width and height of the SWF indicated in twips and pixels. Ignore twips; pixels are what you are looking for. In the example below, the width of the SWF is 640 pixels and the height is 480 pixels.

Next, replace the width and height in the template embed code with the SWF width and height that you just found. Finally, replace example.swf with the filename of your SWF.

You can also add or change additional properties of the embed as desired. See this page for a reference of those properties.

Once you have your embed code, complete the curation by following steps 5-9 above.

Finding SWZ Assets

Some games require Adobe Flex libraries, which are files with a .swz extension. These are particularly difficult to deal with for several reasons:

• Sometimes a game may request these assets from fpdownload.adobe.com, while other times it may request them from the game's own website.
• By default, Flash Player caches SWZ files on your computer at the following location: %APPDATA%\Adobe\Flash Player\AssetCache\. If Flash Player already has an SWZ file cached, the file will never be requested again, so you may not even know that a game requires SWZ files!

To make sure that Flash Player's cache doesn't hide a game's dependency on SWZs, you will need to change your Flash Player settings:

1. Visit the Flash Player Settings Manager's Global Storage Settings panel using a Flash-enabled browser such as Basilisk Portable With Flash Player.
2. Uncheck the box for "Store common Flash components to reduce download times".

With the SWZ cache deactivated, you will now see requests for .swz files whenever a game requires them. In the future, we plan to set this option automatically in Flashpoint Infinity to alleviate issues with cached SWZ files.

In Flashpoint Infinity, all known SWZ files are already included in the fpdownload.adobe.com folder inside Legacy\htdocs.

If a game uses a SWZ, always make sure to include it within the game's content folders. Not everyone will have SWZs already in their cache, and titles will fail to work without them.

An example of a game that uses SWZ files is Josefina's Fiesta. If you run the game (after changing the setting mentioned earlier) you should see some requests for SWZ files on Flashpoint Launcher's Logs tab. And you can see more clues that the game requires SWZ files when opening its main SWF file in JPEXS Flash Decompiler:

• In the tree on the left, expand "others" and click the "Metadata" item. You'll see some XML data, including:

  <dc:title>Adobe Flex 4 Application</dc:title>
  <dc:description>http://www.adobe.com/products/flex</dc:description>
  

  Both of these lines indicate that the game was made in Adobe Flex, and thus may require Flex libraries (SWZs).

• If you search the game's ActionScript for .swz using the "Text Search" dialog, some results will appear. This should include the full SWZ URLs, which you can download manually if you want.

Decrypting MochiCrypt

Mochi Media was a game publishing network that allowed developers to conceal their games in an encryption called MochiCrypt. Unfortunately, since Mochi Media is long defunct, some games encrypted using MochiCrypt will no longer work, often displaying nothing but a blank screen. As an example, Wizard Smash is a Ninja Kiwi game encrypted using MochiCrypt that suffers the fate of a blank screen, both on the Ninja Kiwi website and in Flashpoint Infinity. To get the game working in Flashpoint, we'll have to extract the decrypted, playable SWF from memory, using either JPEXS Free Flash Decompiler or MochiCryptUnpacker.

Using JPEXS

An example list of SWFs found by searching in memory using JPEXS. In this case, the largest SWF isn't actually the decrypted game, but the second-largest works in Flashpoint as a MochiCrypt-free version of the game.

1. Install and open JPEXS.
2. Open the game's SWF in Flash Player.
3. Go to the Tools tab and click "Search SWFs in memory".
4. Search through the list on the left for Flash Player, likely named flashplayer_32_sa.exe. Use the "Refresh list" button if you need to.
5. Click "Select" to search through Flash Player's memory to find SWFs. You'll see lots of SWFs on the right, but the ones with game content are typically the ones with the larger file sizes.
6. Click "Save" to save a SWF, then run it in Flashpoint Infinity using the original SWF's Launch Command. If it doesn't work, try another SWF found in Flash Player's memory until you find the decrypted, playable SWF.

Using MochiCryptUnpacker

1. Find the Releases section to the right of MochiCryptUnpacker's GitHub page.
2. Click on v1.0, then Release.zip to download the program.
3. Extract the ZIP and open MochiCryptUnpacker.exe.
4. Drag the game's SWF over the MochiCryptUnpacker window. The decrypted SWF will appear in the same folder as the original SWF.
5. Run the decrypted SWF in Flashpoint Infinity using the original SWF's Launch Command.

Regardless of which method you use, once you find the decrypted version of the SWF and ensure that it works properly, you should do two more things: change the game's Status to Hacked with an explanation in the curation's Notes field that the SWF was decrypted, and make sure to include the original, encrypted SWF as part of your curation. Afterwards, continue with your curation as usual.

Site-specific Guides

Some Flash game sites pose a particular challenge to curate. This section provides tips on how to curate from those sites.

Candystand

Candystand.com no longer exists, having been absorbed into Publishers Clearing House in 2016. Additionally, many Candystand Flash games use a special preloader animation called a "stinger" and will refuse to load without it. If you are trying to curate a Candystand game, but it requests a stinger.swf file and gets stuck on a blank screen, you will need to find the game's original webpage on Candystand via the Wayback Machine. The easiest way to do that is to visit the old Candystand blog, which includes the original release announcements for many of the Candystand Flash games. Use the Search bar on the right of the page to search for the game's title. We'll use Fashion Star as an example - here is the original release announcement from 2008. The release announcement will include a link to the game - copy that link and paste it into the Wayback Machine to find the archived game page. Choose a capture from around 2010 - later captures tend not to work correctly.

Once you've found a capture of the game's original webpage, you'll need to find the main SWF file's URL (if you don't have it already), as well as the stinger file's URL. The easiest way is to load the page in a Flash-enabled browser such as Basilisk Portable With Flash Player and use the Network tab of the browser's Developer Tools. Open the Developer Tools, type swf into the "filter URLs" box, and look for the main game SWF and one with "stinger" in the name. Download these SWFs and place them in your curation as normal. Continuing the Fashion Star example, if you visit this capture in a Flash-enabled browser, you'll see it load these URLs:

https://web.archive.org/web/20100125191002/http://www.candystand.com/games/fashion_star/fashion_star.swf
https://web.archive.org/web/20100125183943/http://www.candystand.com/games/stingers_as3/stinger_mouse.swf

If you have trouble loading a Candystand page in a Flash-enabled browser, another option is to right-click the page and click "View Page Source". Then you can search for ".swf" to find the SWF URLs manually. Note that the page source uses relative URLs, so you will need to add http://www.candystand.com to the beginning of each URL in order to download it.

Now that you have the SWFs downloaded, you'll need to add a bit of code to your launch command to tell the game to load the stinger file. Add ?swlist= to the end of the launch command, followed by the URL of the stinger, minus the http://www.candystand.com part. For example, you would add ?swlist=/games/stingers_as3/stinger_mouse.swf to the end of the launch command for Fashion Star. The final launch command would be:

http://www.candystand.com/games/fashion_star/fashion_star.swf?swlist=/games/stingers_as3/stinger_mouse.swf

That's it! Your Candystand game curation should load fine now!

Miniclip

Some Miniclip games cannot be loaded directly and must instead be loaded via the Miniclip Gameloader. If you have a Miniclip SWF that shows a blank screen and refuses to load, follow the steps below to load it using the Miniclip Gameloader:

1. Download the Miniclip Gameloader from Flashpoint's servers (or grab it from Flashpoint Ultimate if you prefer).
2. Place the file inside a www.miniclip.com folder within your curation.
3. Create a launch command pointing to the game's main SWF.
   • Here is an example: http://www.miniclip.com/games/game-name/en/gamename.swf.
4. Between www.miniclip.com/ and games/, insert gameloader.swf?fn=/. This new launch command will launch the Miniclip Gameloader and tell it to load the main game SWF.
   • The example launch command from above would now be: http://www.miniclip.com/gameloader.swf?fn=/games/game-name/en/gamename.swf

With any luck, the game will now load and play properly!

4399.com

4399.com is a Chinese webgame site with many rare and interesting games. But because of China's new "anti-indulgence" gaming regulations, the games have become more difficult to access. You will need a Flash-enabled browser with uBlock Origin installed. We suggest following the steps below:

1. Download and install Basilisk Portable With Flash Player if you don't have it yet.
2. Within Basilisk, visit the uBlock Origin for Firefox Legacy GitHub page.
3. Click the .xpi link under the "Assets" heading to download and install the add-on. Or if the link does not appear, copy the following link and paste it into Basilisk's address bar:
   

   https://github.com/gorhill/uBlock-for-firefox-legacy/releases/download/firefox-legacy-1.16.4.30/uBlock0_1.16.4.30.firefox-legacy.xpi

4. Once the add-on is installed, click its icon in Basilisk's toolbar, then click the "Open the dashboard" icon (the small icon with 3 lines).
5. On the dashboard page, click the "Filter Lists" tab. Scroll down and expand the "Annoyances" category, then check the box next to "uBlock Filters - Annoyances".
6. Click the "Update Now" button. 4399.com Flash games should play fine now!

Spil Games

Spil Games is a publisher which owns many webgame sites, the most popular of which are Agame.com, A10.com, and GirlsGoGames.com. Many games published by them use their API, which makes them somewhat tricky to curate. You'll know a game uses it when it fails to load and you have a 404 for http://api.configar.org/crossdomain.xml in your Logs. Do not use MAD4FP to curate these games, it will not download the required files and may add them to your cache, making curating more difficult. To curate a game that requires the Spil Games API, follow these steps:

1. Download this zip file of the universal files needed for all games using the API. Add the contents of all three folders into your curation's Content folder.
2. Run the game again and check your Logs. You'll have a 404 for http://api.configar.org/cf/pb/1/settings/0/0/ followed by a long string of letters and numbers. Copy that URL and download it using cURLsDownloader. If it asks you if you want to rename the file, enter 1 to rename it. After adding this file to your curation, run the game again.
3. You will most likely have multiple 404s in the Logs, copy the URLs for any crossdomain.xml files and .swf files. Download these using cURLsDownloader and add them to your Content folder. You may need to repeat this step multiple times until they have all been downloaded.

It should be noted that the game may work without all of these files, however they will likely be missing images, logos, or language translations. Since we want the games to be as complete as possible, all of these files need to be added to the curation.

DeviantArt

DeviantArt is a fairly straight forward site to curate from as all games tend to be single asset with no sitelocks in place or other dependencies, but unless the deviation is directly available for download, the only way to acquire the game files is through the Wayback Machine and knowledge of old URL structures.

Identifying Flash Deviations

Due to DeviantArt being primarily an art site, and the fact that after the flash kill switch there is no clear indication of what deviation may have originally been a flash file or not, it is often difficult to find flash deviations in a gallery unless the preview made by the author indicates so. Other ways of identifying flash deviations are:

• Links to other flash portals like Newgrounds, Kongregate, or a dedicated site for the content, or links to file hosting services like Google Drive or Dropbox. The deviation sometimes only serves to advertise the game on those platforms. Additionally, DeviantArt allows uploading archive files, which could mean that games could be included in those.
• Tags like "swf", "flash", "game".
• Word of mouth from the comments.
• The originalFile object which is only accessibly in the page source as part of other JSON data. This object holds information like the file dimensions, size, and the type (extension), but only the file dimensions and file size are displayed normally. This tends to be the best way to determine whether an undownloadble deviation is or is not a swf. Not to be confused with the content object accessible via the DeviantArt API, which has the metadata for the deviation preview, not the original file.

Note: There are very rare cases where the author has changed the content of the deviation to another file, in this case originalFile will reflect that change. This content change was not done retroactively by DeviantArt on the flash kill switch, it must be done manually by the author, which makes it exceedingly unlikely to happen.

Currently unviable ways to identify flash deviations:

• DeviantArt categories were a mechanism for authors to categorize deviations in a hierarchy of ranging specificity. One of these categories was flash and its corresponding categories flash/animations, flash/interactive, etc., these are still accessible through the DeviantArt API, but all category information always returns an empty string as of version 20240701 despite no mentions of such in the changelog. Using earlier versions of the API does not fix this. It is unknown whether this is a bug or whether they are being phased out.

Finding Deviations on the Wayback Machine

Modern DeviantArt URLs have the format: www.deviantart.com/artist/art/deviation. However, the old URL structure before ~2018 was www.artist.deviantart.com/art/deviation. The old URL structure is far more likely to have Wayback Machine snapshots with working deviations, but there still is a short period after the change to the new URL structure and before flash deviations became unplayable where it is still possible to find working flash deviations.

Note: While on the Wayback Machine, it is a good idea to check snapshots of the artist's account and gallery for the possibility of deviations which have been deleted. When doing so, beware that DeviantArt likes to include tracking information in links which can throw off Wayback Machine and show that no snapshots are available for the URL. These are appended onto the URL and begin with a question mark ? as a query string. This information should be deleted in order to receive the accurate snapshots for a page.

If there are snapshots for a deviation, then there are two possibilities:

1. The swf loads and is directly playable in the browser through ruffle. In this case the swf can easily be downloaded via ruffle, or by inspecting the page source or the network tab inside the browser.
2. Ruffle fails loading the swf or a DeviantArt page displaying an account named "Sandbox" is embedded in the browser in place of it. In this case a different snapshot should be checked because it may have a working link.

If all snapshots fail loading or return the Sandbox account, the link to a working swf can be acquired from the live web with information from the snapshot. This trick only works if the account or deviation haven't been deleted.

1. Inspect the page source or the network tab for the link to the https://www.deviantart.com/sandbox which is embedded in the page in place of the main deviation's content. This is usually contained in an iframe with the class flashtime. The sandbox link usually follows the format http://sandbox.deviantart.com/?fileheight=<N>&filewidth=<N>&filename=<NAME>, where <N> is a number representing the dimensions of the file and <NAME> is a seemingly arbitrary string or a modified version of the deviation's prettyName. The string after the filename parameter is a relative URL structure to the swf.
2. Copy the string after the filename parameter (without the equals sign =) and decode it if it isn't already with an online tool. You will know if the string is not decoded if it contains percent signs % followed by two hexadecimal digits, which is how unsafe ASCII characters that are part of the URL get encoded. Once the string is decoded it will resemble a relative URL path. The good qualified filename may look like this fs71:f/2013/272/f/d/fdad4bb4dbb5b168bc015abe5e6c7e10-d67l7zn.swf or fs71:f/2013/272/f/d/my_deviation_by_cooldeviant-d67l7zn.swf, but the only important part is what comes after the first slash 2013/272/f/d/fdad4bb4dbb5b168bc015abe5e6c7e10-d67l7zn.swf, f/2013/272/f/d/my_deviation_by_cooldeviant-d67l7zn.swf
3. Append the string achieved in the last step to https://orig07.deviantart.net/fs71:f/, go to the achieved URL on the live web and the swf file should get downloaded.

Note: If there are multiple snapshots for a deviation which all fail to load and the method above does not work for a given snapshot, other snapshots should be checked because it has been observed that on rare occasions the sandbox link embedded in the deviation has changed with time, which sometimes leads to the previous links becoming invalid. This is presumed to be because of DeviantArt moving things around on the backend, though there isn't any information to confirm this.

Note: When checking snapshots of the modern URL structure, it is possible you will come across sandbox links of the format wixmp:f/9dab1276-30ec-4ed6-a098-bfc5b0b35b63/d8dslbo-9d4a777d-d830-4d4a-bcb2-c8b63ed3c8c1.swf. It is not yet known if or how these can be used to reverse engineer a game. These do not seem to invalidate the old links however, so those should still be checked if they exist.

The orig links adhere to the following format with the following properties:

https://orig<00-15>.deviantart.net/<*>/f/<year>/<day>/<hexDigit>/<hexDigit>/<filename>

Note: You may find orig links which use <*>:f in place of <*>/f. These two formats are interchangeable and will both always work.

• <00-15> is any character sequence ranging from 00 through 15. Any will work, but the leading zero must be preserved. A singular digit such as 7 will not work, 07 does however work.
• <*> is any sequence of 4 characters, presumably representing the file server where the deviation is stored. However, any sequence of 4 characters will work, regardless of link, although you will usually only find fs70 or fs71. You may sometimes find files or s3orig in place of this, in which case you can safely replace it with one of the aforementioned strings or with any other 4 character string.
• <filename> can take multiple formats which may or may not be mutually exclusive:
  • <UUID>-d<base36ID>.swf
  • <modifiedPrettyName>.swf

<UUID>

An unknown 32 character UUID which seems to only be acquirable through orig links from Wayback Machine snapshots. There are very rare cases where this has changed between snapshots together with the <year> and <day>, which cause the previous links to become invalid.

<base36ID>

A persistent 6 character identifier encoded in base36 which has remained constant across time.

<modifiedPrettyName>

A slightly modified version of the prettyName value available in the deviation page source. It includes the aforementioned <base36ID> id after the last underscore character _. The modification required is changing the underscore _ between the <base36ID> and the rest of the prettyName to a hyphen -.

Note: On some occasions the prettyName in the filename will heavily differ from the actual prettyName available on the deviation's page. It is unknown why this happens and in this case the only way to get the prettyName is to wildly guess or to have a Wayback snapshot which reveals it.

• <hexDigit> is a hexadecimal digit (0 through 9, a through f). These two digits always represent the first and respectively the second characters of the aforementioned unknown <UUID>.
• <year> and <day> are numbers representing the year in which the deviation was uploaded and respectively the day of the year in which the deviation was uploaded (e.g. April 20th is the 110th day of the year, meaning the <day> would be 110). However, the <day> may not always match the actual day of the year in which the deviation released, it may either be off by one or possible more, or it may be seemingly completely random. Regardless, there always seems to be a consistent offset between the <day> of deviations made by the same creator, give or take a couple days, meaning that it can be estimated using snapshots of other, unrelated deviations. There are very rare cases where this has changed between snapshots together with the <filename>, causing previous links to become invalid.

Knowing that some parts of the orig links are constant or interchangeable, the format can be simpified to:

https://orig07.deviantart.net/fs70/f/<year>/<day>/<hexDigit>/<hexDigit>/<filename>

Brute Forcing Orig Links

It has been proven that it is possible to acquire the swf of a deviation which is undownloadable and has no Wayback Machine snapshots by brute forcing the <modifiedPrettyName> format of orig links as long as the deviation has not been deleted. The two <hexDigit>s must be brute forced, as without a Wayback Machine snapshot the <UUID> can't be acquired and therefore neither can the <hexDigit>s (if there was a snapshot with a valid orig link, there would be no need to brute force it anyway). One difficult part is guessing the <day>, which usually matches the day of the year, give or take a few days, or it may be unrelated to the upload date and require Wayback Machine snapshots of other deviations in order to approximate it. In either case, adjacent days will likely need to be bruteforced as well. Even when brute forcing the days, it is not guaranteed that the deviation's valid orig link will match the prettyName as shown in the deviation's page source, it may be a variation of it, making it harder if not impossible to guess, or it may use the <UUID> format, making it a lost cause, though which format of filename any given deviation uses seems to be completely random and is not known except by trying.