AMF 和 AMF3 规范
我目前正在开发一个小型 AMF3 适配器，因此尝试实现 AMF3 协议。不幸的是，可用的规范似乎与现实有很大不同（Captre AMF 与 BlazeDS 的通信并查看 BlazeDS 源代码）。
AMF0 规范：http://opensource.adobe.com/wiki/download/附件/1114283/amf0_spec_121207.pdf AMF3 规范：http://opensource.adobe.com/wiki/download/ Attachments/1114283/amf3_spec_05_05_08.pdf
不幸的是，两者都没有指定实际的消息格式（标题、正文……）。所以我又搜索了一点，找到了一篇维基百科文章： http://en.wikipedia.org/wiki/ Action_Message_Format
本文尤其是示例部分似乎描述了一种完全不同的格式。
当查看通信并单步执行 BlazeDS 代码时，我可以看到该消息声称是 AMF3，但使用 AMF0 中定义的类型代码（0x0a 是一个严格的数组，而不是 AMF3 中定义的对象）。
有人可以向我解释一下这个烂摊子吗？目前我可能只是简单地使用wireshark 和BlazeDS 代码以某种方式对我的协议描述进行逆向工程，但我不知道为什么没有一个有效的规范可用。
I am currently working on a small AMF3 Adapter and therefore trying to implement the AMF3 protocol. Unfortunately the specifications available seem to greatly differ from reality (Captre of AMF communication with BlazeDS and look into BlazeDSs source code).
AMF0 Spec: http://opensource.adobe.com/wiki/download/attachments/1114283/amf0_spec_121207.pdf
AMF3 Spec: http://opensource.adobe.com/wiki/download/attachments/1114283/amf3_spec_05_05_08.pdf
Unfortunately both don't specify the actual message format (Header, Body, ...). So I searched a little more and came to a Wikipedia article: http://en.wikipedia.org/wiki/Action_Message_Format
This article especially the example parts seem to be describing a totally different format.
When having a look at the communication and stepping through the BlazeDS code I can see that the message claims to be AMF3, but uses the Type codes as defined in AMF0 (0x0a is a strict array instead of an object, as defined in AMF3).
Could anyone please explain this mess to me? Currently I'm propably simply going to use wireshark and the BlazeDS code to somehow reverse-engineer a Protocol description for me, but I don't know why not a single valid spec is availble.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
AMF 的核心只是一种 ActionScript 对象序列化格式。
Flash 的 NetConnection API 对此格式进行了扩展，通过 AMF 0 规范第 4 节中描述的简单标头/消息正文请求/响应结构添加基本 RPC 功能。我认为这个 RPC 添加可能会让您感到困惑，因为它是定义如何从服务器发送和接收 AMF 数据的各个有效负载的基础设施。例如，此包装器对于通过 ByteArray.writeObject 进行的基本 ActionScript 对象序列化不起作用。它是基于 NetConnection 的与服务器通信的附加逻辑。
请参阅：http://download.macromedia.com/pub/labs/amf/amf0_spec_121207 .pdf
实际发送的标头值或消息正文值的 ActionScript 数据以 AMF 进行编码。出于兼容性考虑，所有数据值都从 AMF 0 开始。这可能是人们在考虑基本 AMF 序列化与基于 NetConnection 的通信时首先感到困惑的另一点。由于 AMF 0 添加了特殊扩展，引入了新的 0x11“AMF 3”模式标记，可将序列化模式切换到 AMF 3。不支持 AMF 3 的旧客户端将无法理解此新标记，并将停止处理数据。 AMF 0 规范的第 3 节中提到了这一点。
AMF 3 规范在这里：
http://download.macromedia.com/pub/labs/amf/amf3_spec_121207.pdf
AMF at its core is just an ActionScript object serialization format.
Flash's NetConnection API expands on this format to add basic RPC functionality though a simple header/message body request/response structure that is described in Section 4 of the AMF 0 specification. I think this RPC addition may be confusing you, as it is infrastructure that defines how individual payloads of AMF data are sent and received from a server. This wrapper does not come into play for basic ActionScript object serialization through ByteArray.writeObject, for instance. It is additional logic for NetConnection based communication to a server.
See: http://download.macromedia.com/pub/labs/amf/amf0_spec_121207.pdf
ActionScript data actually sent for header values or message body values are encoded in AMF. All data values start out in AMF 0 for compatibility's sake. This may be another point that trips people up at first when looking at basic AMF serialization versus NetConnection based communication. Thanks to a special extension added to AMF 0, a new 0x11 "AMF 3" mode marker was introduced that switches the serialization mode to AMF 3. Legacy clients that do not support AMF 3 would not understand this new marker and would stop processing the data. This is mentioned in Section 3 of the AMF 0 specification.
The AMF 3 specification is here:
http://download.macromedia.com/pub/labs/amf/amf3_spec_121207.pdf
AMF 消息传递有两种常见类型：AMF0 样式的 RPC 调用和 RTMP。 AMF0 RPC 调用由版本、标头列表和消息列表组成，大致相当于要调用的方法。这记录在 AMF0 规范的末尾，可用于进行 AMF0 或 AMF3 远程调用。如果您使用 Flex RemoteObject，则 Flex 在消息传递中会使用一些其他包装对象。第二种类型，即您找到的维基百科文章引用的内容，是 RTMP 使用的消息格式，它是 AMF 及其自己的自定义格式的组合。据我所知，这种格式没有规范。
作为构建了一个可以解析 AMF 并进行 RPC 调用的库 (RocketAMF) 的人，我建议如果您只需要远程处理支持，您可以使用现有的库之一，而不是编写自己的库。下面是一些用于按语言进行 AMF 解析的库的列表，通过简单搜索即可找到更多库。您可能还想查看 Charles，它能够反序列化通过它代理的 AMF 请求，从而实现反向工程设计更容易一些。
There are two general types of AMF messaging: AMF0 style RPC calls and RTMP. AMF0 RPC calls are composed of a version, list of headers, and list of messages, which roughly equate to methods to call. This is documented at the end of the AMF0 spec and can be used to make AMF0 or AMF3 remoting calls. If you're using Flex RemoteObject, there are some additional wrapper objects that Flex uses in the messaging. The second type, which is what the Wikipedia article you found references, is the message format that RTMP uses, which is a combination of AMF and its own custom format. As far as I know, there are no specs for this format.
As someone who has built a library that can parse AMF and make RPC calls (RocketAMF), I would advise that you use one of the existing libraries rather than write your own if you just need remoting support. Below is a list of some libraries for AMF parsing by language, with many more a simple search away. You might also want to check out Charles, which is capable of deserializing AMF requests that are proxied through it, making reverse engineering a bit easier.