Flash Player的 mm.cfg文件

http://jpauclair.net/mm-cfg-secrets/

 

(鉴于有些国外网站有时候突然就不能访问了，为了保险起见，还是复制过来了)

 

 

I knew for a long time now that flash had undocumented features, little part of flash that could help speed up process (like the memory opcodes) or make interaction easy with right click and that kind of things. But I never thought that FlashPlayer would hide data that could help find bugs, or give better knowledge of how flash is interpreted.

As you may know, The mm.cfg files is located in:

Windows; C:\Documents and Settings\username\mm.cfg

OSX; /Library/Application Support/Macromedia/mm.cfg

Linux; home/username/mm.cfg

This file is interpreted when a Flash Player instance launches a SWF and gives indication of what should or shouldn’t be done.
For example, most people use this file to set tracing parameters:
ErrorReportingEnable=1
TraceOutputFileEnable=1
TraceOutputFileName=c:\logs\flashlogs.txt
MaxWarnings=50

Many other options are specified in the Adobe FlashPlayer Admin Guide… but most of is NOT DOCUMENTED!

There is a LOT of thing to talk about and many cutting edge tools to improve your understanding of flash.

So let’s get into it

The Treasure

The complete list of features of mm.cfg is at the end of the post, but first lets talk about what’s most interesting.
I took my favorite 7 features and made detailed explanation with example for each one so here they are:

TraceOutputBuffered = 1|0

This feature is essential to the rest of all the cool features because they output A LOT of lines in the flashlog

This is a very simple features but it change everything. Did you ever had problem tracing to many information and losing half of it in the flashlog?
Well this is a known bug. If you make a loop of 1 000 000 and you trace the iterator, the flashlog will skip thousand of entries and will take 100% of your CPU while writing to disk.
If you set this variable to true, the traces will be buffered and the write to disk will output multiple lines in one access.
Performance? By default (without this feature), I’m able to trace 3600 line in 6 seconds and my CPU is at 100%.
If I turn the features on, I can trace 1 000 000 lines in the same time! And my CPU is not even near 100%.

AS3Verbose = 1|0

This one is totally crazy.
It traces detailed information about SWF ByteCode structure and Runtime parsing of the bytecode!
You don’t need any software… no special framework to bind in your own SWF… just this one flag!

01 verify Main/CallFoo()
02     define incoming args
03        @0  arg   0
04        @1  arg   0
05        @2  arg   0
06        @3  arg   0
07        @4  arg   0
08        @5  arg   0
09     alloc local traits
10        @6  alloc 4
11        @7  alloc 8
12     alloc CallStackNode
13        @8  alloc 48
14     param 0
15        @9  ldop  0(@5)
16        @10               imm   4
17     debug_enter
18        @11               imm   0
19        @12               imm   1
20        @13               lea   0(@7)
21        @14               lea   0(@8)
22        @15               lea   0(@6)
23     save state
24        @16               def   @9
25        @17               imm   165651400
26        @18               st    0(@6) <- @17
27        @19               usea  @16
28        @20               st    0(@7) <- @19
29        @21               def   @10
30                 cse   @11
31        @22               st    4(@7) <- @11
32        @23               cm    MethodEnv::debugEnter (@3, @4, @5, @15, @12, @14, @13, @11)
33        @26               ld    164427072(0)
34                 cse   @11
35        @27               ucmp  @26 @11
36        @28               jne   @27 -> 0
37        @29               alloc 0
38                         stack:
39                         scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$]
40                          locals: Main@16
41   0:debugfile "C:\Dev\src;;Main.as"
42        @30               imm   164421632
43        @31               ldop  44(@30)
44        @32               imm   165988864
45     save state
46        @33               cm    Debugger::debugFile (@31, @32)
47                         stack:
48                         scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$]
49                          locals: Main@16
50   2:debugline 29
51                 cse   @30
52                 cse   @31
53        @35               imm   29
54     save state
55        @36               cm    Debugger::debugLine (@31, @35)
56                         stack:
57                         scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$]
58                          locals: Main@16
59   4:getlocal0
60        @38               use   @16 [0]
61                         stack: Main@38
62                         scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$]
63                          locals: Main@38
64   5:pushscope
65                         stack:
66                         scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$] Main@38
67                          locals: Main@38
68   6:debugline 31
69                 cse   @30
70                 cse   @31
71        @39               imm   31
72     save state
73        @40               def   @38
74        @41               use   @40 [0]
75        @42               st    4(@7) <- @41
76        @43               cm    Debugger::debugLine (@31, @39)
77                         stack:
78                         scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$] Main@40
79                          locals: Main@16
80   8:pushbyte 3
81        @45               imm   3
82                         stack: int@45
83                         scope: [global Object$ flash.events::EventDispatcher$ flash.display::DisplayObject$ flash.display::InteractiveObject$ flash.display::DisplayObjectContainer$ flash.display::Sprite$ Main$] Main@40
84                          locals: Main@16
85   10:returnvalue
86                 cse   @14
87     save state
88        @46               def   @45
89        @47               cm    MethodEnv::debugExit (@3, @14)
90        @49               use   @46 [2]
91        @50               ret   @49
92        @51               bb

AS3Trace = 1|0

This one is also very useful for debugging
It trace every single call to any function that is being called in the SWF at runtime!
It’s like expending the StackTrace to the full software run time.

If you got a crash hard to find, you can turn this on and you will see ALL the last function executed that leaded to the crash.

You can even see Timer Call and Events callbacks!

01 1255552 AVMINF: MTHD ProfilerAgent/stopProfiling () @ 0x05DA35A0
02 1255552 AVMINF: MTHD global/flash.sampler::stopSampling () @ 0x0A8C2B20
03 1255553 AVMINF: MTHD flash.display::DisplayObject/get root () @ 0x0A8C06B0
04 1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
05 1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
06 1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
07 1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
08 1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
09 1255553 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
10 1255553 AVMINF: MTHD flash.net::Socket/flush () @ 0x0A8C2AD0
11 1255553 AVMINF: MTHD flash.net::Socket/close () @ 0x0A8C2B70
12 1255553 AVMINF: MTHD flash.net::Socket/_init () @ 0x0A8C0DF0
13 1255553 AVMINF: MTHD flash.utils::Timer/stop () @ 0x0A8C2CB0
14 1255554 AVMINF: MTHD flash.utils::Timer/reset () @ 0x0A8C1B20
15 1255554 AVMINF: MTHD flash.utils::Timer/get running () @ 0x0A8C1C30
16 1255554 AVMINF: MTHD flash.net::Socket/internalClose () @ 0x0A8C2D00
17 1255554 AVMINF: MTHD flash.events::EventDispatcher/removeEventListener () @ 0x0A8C2110
18 1255554 AVMINF: MTHD flash.utils::Timer/stop () @ 0x0A8C2CB0
19 1255554 AVMINF: MTHD flash.system::System$/resume () @ 0x0A8C2D50
20 1256675 AVMINF: MTHD flash.utils::Timer/tick () @ 0x0A8C2DA0
21 1256675 AVMINF: MTHD flash.utils::Timer/_timerDispatch () @ 0x0A8C2FF0
22 1256675 AVMINF: MTHD flash.events::TimerEvent () @ 0x0A8C3040
23 1256675 AVMINF: MTHD flash.events::Event () @ 0x0A8C1AC0
24 1256675 AVMINF: MTHD Main/OnTimer () @ 0x00B70910
25 1256675 AVMINF: MTHD global/trace () @ 0x0A8C2170
26 MyTimer
27 1258705 AVMINF: MTHD flash.utils::Timer/tick () @ 0x0A8C2DA0
28 1258705 AVMINF: MTHD flash.utils::Timer/_timerDispatch () @ 0x0A8C2FF0
29 1258705 AVMINF: MTHD flash.events::TimerEvent () @ 0x0A8C3040
30 1258705 AVMINF: MTHD flash.events::Event () @ 0x0A8C1AC0
31 1258705 AVMINF: MTHD Main/OnTimer () @ 0x00B70910
32 1258705 AVMINF: MTHD global/trace () @ 0x0A8C2170
33 MyTimer

AS3StaticProfile = 1|0

This flag enable Just in Time Compiler (NanoJIT) logs.

It gives detailed information on function conversion, bytecode conversion, MIR (machine-dependent intermediate representation) created, memory used and many others.
At the end of execution, it also output a summary of all bytecode processed (For each opcode you have the number of occurrence, relatives importance, etc)

01 size profile Main/CallFoo
02   abc 12 mir 880 md 204
03   1773K mir/s  74K md/s  96% in compile during 854 micros
04   204 bytes from 55 MIR instructions 61 MD. max span 0 cse 7 dead 0
05   76 bytes of stack with 5 spills 5 steals 5 remats using 0 times
06 size profile Main/CallFooBar
07   abc 23 mir 1088 md 262
08   2386K mir/s  85K md/s  96% in compile during 921 micros
09   262 bytes from 68 MIR instructions 76 MD. max span 0 cse 10 dead 0
10   88 bytes of stack with 8 spills 7 steals 5 remats using 0 times

01 verified instructions 3395
02 verified code size 7441
03 cpool size 0
04 cpool int size 1
05 cpool uint size 0
06 cpool double size 0
07 cpool string size 568
08 cpool namespacesize 12
09 cpool namespace set size 0
10 cpool multiname size 75
11 methods size 20100
12 instances size 39
13 classes size 2
14 scripts size 8
15 bodies size 82873
16
17 18  0 % 36 B    0 %  kill
18 5   0 % 5 B 0 %  label
19 1   0 % 4 B 0 %  ifngt
20 10  0 % 40 B    0 %  jump
21 6   0 % 24 B    0 %  iftrue
22 22  0 % 88 B    1 %  iffalse
23 4   0 % 16 B    0 %  ifeq
24 4   0 % 16 B    0 %  ifne
25 2   0 % 8 B 0 %  iflt
26 2   0 % 2 B 0 %  pushwith
27 93  2 % 93 B    1 %  popscope
28 2   0 % 2 B 0 %  nextname
29 16  0 % 16 B    0 %  pushnull
30 2   0 % 2 B 0 %  pushundefined
31 79  2 % 158 B   2 %  pushbyte
32 6   0 % 19 B    0 %  pushshort
33 9   0 % 9 B 0 %  pushtrue
34 6   0 % 6 B 0 %  pushfalse
35 1   0 % 1 B 0 %  pushnan
36 50  1 % 50 B    0 %  pop
37 21  0 % 21 B    0 %  dup
38 2   0 % 2 B 0 %  swap
39 113 3 % 331 B   4 %  pushstring
40 43  1 % 86 B    1 %  pushint
41 11  0 % 22 B    0 %  pushdouble
42 202 5 % 202 B   2 %  pushscope
43 1   0 % 2 B 0 %  pushnamespace
44 2   0 % 6 B 0 %  hasnext2
45 143 4 % 382 B   5 %  newfunction
46 60  1 % 216 B   2 %  callproperty
47 102 3 % 102 B   1 %  returnvoid
48 9   0 % 9 B 0 %  returnvalue
49 13  0 % 26 B    0 %  constructsuper
50 9   0 % 30 B    0 %  constructprop
51 49  1 % 173 B   2 %  callpropvoid
52 4   0 % 8 B 0 %  newobject
53 5   0 % 10 B    0 %  newarray
54 2   0 % 2 B 0 %  newactivation
55 45  1 % 114 B   1 %  newclass
56 391 11 %    1011 B  13 %     findpropstrict
57 119 3 % 290 B   3 %  findproperty
58 96  2 % 197 B   2 %  getlex
59 158 4 % 432 B   5 %  setproperty
60 18  0 % 36 B    0 %  getlocal
61 18  0 % 36 B    0 %  setlocal
62 2   0 % 2 B 0 %  getglobalscope
63 9   0 % 18 B    0 %  getscopeobject
64 365 10 %    938 B   12 %     getproperty
65 174 5 % 443 B   5 %  initproperty
66 2   0 % 4 B 0 %  getslot
67 102 3 % 204 B   2 %  setslot
68 6   0 % 6 B 0 %  convert_i
69 11  0 % 11 B    0 %  convert_u
70 11  0 % 11 B    0 %  convert_b
71 6   0 % 14 B    0 %  coerce
72 3   0 % 3 B 0 %  coerce_a
73 7   0 % 7 B 0 %  coerce_s
74 1   0 % 1 B 0 %  negate
75 2   0 % 2 B 0 %  increment
76 6   0 % 6 B 0 %  not
77 6   0 % 6 B 0 %  add
78 4   0 % 4 B 0 %  subtract
79 1   0 % 1 B 0 %  multiply
80 5   0 % 5 B 0 %  divide
81 1   0 % 1 B 0 %  lshift
82 3   0 % 3 B 0 %  rshift
83 2   0 % 2 B 0 %  bitand
84 2   0 % 2 B 0 %  bitor
85 6   0 % 6 B 0 %  equals
86 2   0 % 2 B 0 %  lessthan
87 2   0 % 2 B 0 %  greaterequals
88 1   0 % 1 B 0 %  increment_i
89 275 8 % 275 B   3 %  getlocal0
90 49  1 % 49 B    0 %  getlocal1
91 36  1 % 36 B    0 %  getlocal2
92 17  0 % 17 B    0 %  getlocal3
93 13  0 % 13 B    0 %  setlocal1
94 14  0 % 14 B    0 %  setlocal2
95 11  0 % 11 B    0 %  setlocal3
96 23  0 % 144 B   1 %  abs_jump
97 54  1 % 330 B   4 %  debug
98 168 4 % 456 B   6 %  debugline
99 19  0 % 50 B    0 %  debugfile

AS3DynamicProfile = 1|0

This one give dynamic information about the opcodes being called and gives statistic for each.
The statistics include count, cycles, %count, %times and CPI

My question is: Having access to the CPI (Cycle per instruction) will we be able to conclude all
fights between what operation is faster that the others? Cycle counts does not lies (on the same platform…)
* Request for Jackson Dunstan: Wanna work on that?  *
But there is a problem with this one, it crash all the time.
My guess is it can’t process “Flash Object” like Movieclip, Event, and all the other and only support operation valid in tamarin.

01 total count=278 cycles=35508249 avg CPI=127727
02 user      1.9%
03 gc        0%
04 decoder  97.7%
05 verifier  1.6%
06 codegen   0.2%
07 count       cycles        %count    %time     CPI       opcode
08 -----       --------      -------   -------   ---       ------
09 2           34714742       0.7      97.7      17357371  decode
10 211         602237        75.8       1.6      2854      verifyop
11 6           89138          2.1       0.2      14856     codegenop
12 3           78305          1.0       0.2      26101     newclass
13 7           4813           2.5       0.0      687       findpropstrict
14 6           3922           2.1       0.0      653       setslot
15 4           3260           1.4       0.0      815       initproperty
16 4           2724           1.4       0.0      681       getproperty
17 9           1859           3.2       0.0      206       getlocal0
18 4           1639           1.4       0.0      409       verifypass
19 2           1190           0.7       0.0      595       returnvoid
20 1           755            0.3       0.0      755       pushnamespace
21 3           745            1.0       0.0      248       abs_jump
22 2           550            0.7       0.0      275       findproperty
23 5           527            1.7       0.0      105       pushscope
24 1           403            0.3       0.0      403       pushnull
25 2           382            0.7       0.0      191       pushbyte
26 1           331            0.3       0.0      331       popscope
27 1           331            0.3       0.0      331       pushundefined
28 2           238            0.7       0.0      119       pushint
29 2           158            0.7       0.0      79        pushdouble

LogGPU = 1|0

This enable logging GPU information about current SWF while it runs.
Use GPULogOutputFileName = [path] to specify where to output that log.
Use DisplayGPUBlend = 1 to display the little green square while GPU runs
use ForceGPUBlend = 1 (At your own risk) to force GPU event if your videocard is not officially listed as valid for Flash GPU.

01 [GPU-BLEND] SUCEEDED to create D3D device
02
03 [GPU-BLEND]0x1161000 MONITOR/DEVICE SWITCH, old=0x0, new=0x18fd00
04
05 [GPU-BLEND]0x1161000 Started (wMode=GPU) on device 10de 402 (6.14.11.9062) NVIDIA GeForce 8600 GT  mem:free=718, used=0
06
07 [GPU-BLEND]Begin render aa=4.  Free TextureMem=712 Mb, Used = 5
08 [GPU-BLEND]Using 0x13b7080 as RT vp= 0 0 800 600, aa = 4
09 [GPU-BLEND]Clearing buffer 0x13b7080 { 0 0 800 600 } with color ffffffff
10 [GPU-BLEND]Filling border & background on 0x13b7080 3 3 11 11 with bo:ffffffff, ba:ff00ff00
11 [GPU-BLEND]Using 0x13b7080 as RT vp= 0 0 800 600, aa = 4
12 [GPU-BLEND]End render
13
14 [GPU-BLEND]0x1161000 Started (wMode=GPU) on device 10de 402 (6.14.11.9062) NVIDIA GeForce 8600 GT  mem:free=716, used=0
15
16 [GPU-BLEND]Begin render aa=4.  Free TextureMem=712 Mb, Used = 5
17 [GPU-BLEND]Using 0x11b7080 as RT vp= 0 0 800 600, aa = 4
18 [GPU-BLEND]Clearing buffer 0x11b7080 { 0 0 800 600 } with color ffffffff
19 [GPU-BLEND]Filling border & background on 0x11b7080 3 3 11 11 with bo:ffffffff, ba:ff00ff00
20 [GPU-BLEND]Using 0x11b7080 as RT vp= 0 0 800 600, aa = 4
21 [GPU-BLEND]End render

PreloadSwf?flashvar1=value&…

This is mainly used by the FlashBuilder Profiler. When you launch a SWF profiling, FlashBuilder add this line to mm.cfg to make it run another SWF before the one you profile.
The default file is: C:/Documents and Settings/{USER}/My Documents/Flex Builder 3/.metadata/.plugins/com.adobe.flash.profiler/ProfilerAgent.swf?host=localhost&port=9999
The profiler agent is a SWF that use the as3 sampling classes to collect information and send them all over a socket connection to FlashBuilder.
FlashBuilder is only interpreting that data received from the SWF
By changing localhost by any other machine name you can connect to a remote FlashBuilder Profiler. On the Remote profiler you need to check the “wait for application” box and then start the local SWF on the other machine.

This one is just crazy powerful: See: One SWF to rule them all! and New visual Profiler

The Full List

undocumented features will be written in bold

AllowUserLocalTrust = 1|0

Lets you prevent users from designating any files on local file systems as trusted.

AS3AllocationTracking = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Allocation in FlexBuilder anymore)

AS3AutoStartSampling = 1|0

Specify if we need a feedback before starting the profiler or we start right away.

AS3CSE = 1|0

CSE is an acronym for “Common Subexpression Elimination”. It seems plausible that these may be employed by the Flash virtual machine to optimize the byte-code before executing

AS3DCE = 1|0

DCE is an acronym for “Dead Code Elimination”. It seems plausible that these may be employed by the Flash virtual machine to optimize the byte-code before executing

AS3DynamicProfile = 1|0

When enabling this (you might crash half the time) the flash player is going to collect precious profiling information on opcodes used in the Swf (count/Time/%/Cycles)

AS3MIR = 1|0

Enable/Disable Profiling information (if turned off, FlashPlayer won’t keep information on Machine-dependant intermediate representation – NanoJIT)

AS3Sampling = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile in FlexBuilder anymore)

AS3SSE = 1|0

*My guess is it turns on and off SSE optimization

AS3StaticProfile = 1|0

Information Generated by NanoJit (just in time compiler used in Tamarin), including a lot of statistic on code conversion, time to process and memory use

AS3Trace = 1|0

If turned on, ALL function called (at runtime) will be outputed in the flashlogs!
You should always use in conjonction with TraceOutputBuffered=1

AS3Turbo = 1|0

??

AS3Verbose = 1|0

Trace detailed information about SWF ByteCode structure and Runtime parsing of the bytecode!

AssetCacheSize=X

Lets you specify a hard limit, in MB, on the amount of local storage that Flash Player uses for the storage of common Flash components.

AutoUpdateDisable = 1|0

Lets you prevent Flash Player from automatically checking for and installing updated versions.

AutoUpdateInterval = X

Lets you specify how often to check for an updated version of Flash Player.

AutoUpdateVersionUrl = [URL]

Lets you specify a precise server to look up for new flash version

AVHardwareDisable = 1|0

Lets you prevent SWF files from accessing webcams or microphones.

CodeSignLogFile

??

CodeSignRootCert = 1|0

??

Convert8kAnd16kAudio = 1|0

??

CrashLogEnable = 1|0

??

DisableAVM1Loading = 1|0

If turned on, no SWF of version 8 and earlier can be loaded.

DisableDeviceFontEnumeration = 1|0

Lets you prevent information on installed fonts from being displayed.

DisableIncrementalGC = 1|0

Lets you enable/disable Garbage Collector Incremental policies (more info on the GC)

DisableMulticoreRenderer = 1|0

Lets you turn off multiple core rendering

DisableNetworkAndFilesystemInHostApp = 1|0

Lets you prevent networking or file system access of any kind.

DisableProductDownload = 1|0

Lets you prevent native code applications that are digitally signed and delivered by Adobe from being downloaded.

DisableSockets = 1|0

Lets you enable or disable the use of the Socket.connect() and XMLSocket.connect() methods.

DisplayGPUBlend = 1|0

If set to 1, it will prevent GPU use even if the SWF context is setted to use GPU and your card support it.

EnableIncrementalValidation = 1|0

??

EnableLeakFile = 1|0

??

EnableSocketsTo = [address]

Lets you create a whitelist of servers to which socket connections are allowed.
EnableSocketsTo = localhost.localdomain
EnableSocketsTo = 127.0.0.1

EnforceLocalSecurityInActiveXHostApp = 1|0

Lets you enforce local security rules for a specified application.

ErrorReportingEnable = 1|0

Set the ErrorReportingEnable property to 1 to enable the debugger version of Flash Player to write error messages to the log file.

FileDownloadDisable = 1|0

Lets you prevent the ActionScript FileReference API from performing file downloads.

FileUploadDisable = 1|0

Lets you prevent the ActionScript FileReference API from performing file uploads.

ForceGPUBlend = 1|0

Force GPU blending even if you video card is not officialy supported (At your own risk!)

FrameProfilingEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Frames in FlexBuilder anymore)

FullScreenDisable = 1|0

Lets you disable SWF files playing via a browser plug-in from being displayed in full-screen mode.

GCStats = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile GC in FlexBuilder anymore)

GPULogOutputFileName

Lets you specify the output file for the GPU informations

HeapProfilingAS3Enable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile Heap in FlexBuilder anymore)

LegacyDomainMatching = 1|0

Lets you specify whether SWF files produced for Flash Player 6 and earlier can execute an operation that has been restricted in a newer version of Flash Player.

LocalFileLegacyAction = 1|0

Lets you specify how Flash Player determines whether to execute certain local SWF files that were originally produced for Flash Player 7 and earlier.

LocalFileReadDisable = 1|0

Lets you prevent local SWF files from having read access to files on local hard drives.

LocalStorageLimit = X

Lets you specify a hard limit on the amount of local storage that Flash Player uses (per domain) for persistent shared objects.

LogGPU = 1|0

Lets you specify if you want to output debug GPU log

MaxWarnings = X

The default value of the MaxWarnings property is 100. After 100 messages, the debugger version of Flash Player writes a message to the file stating that further error messages will be suppressed.

OverrideGPUValidation = 1|0

Overrides validation of the requirements needed to implement GPU compositing.

OverrideUserInvokedActions = 1|0

??

PolicyFileLog = 1|0

Enables the logging of policy file messages.

PolicyFileLogAppend = 1|0

Set the PolicyFileLogAppend property to 1 to save previous policy file log entries

PreloadSwf?flashvar1=value&…

Lets you specify a SWF to be loaded before the main swf.This is the profiler agent, a little flash app (ProfilerAgent.swf) that connect to the FlexBuilder Profiler via socket (localhost:9999).
FlexBuilder is only interpreting that data.
PreloadSwf=C:/Documents and Settings/{USER}/My Documents/Flex Builder 3/.metadata/.plugins/com.adobe.flash.profiler/ProfilerAgent.swf?host=localhost&port=9999
By changing localhost by any other machine name you can connect to a remote FlashBuilder Profiler. On the Remote profiler you need to check the “wait for application” box and then start the local SWF on the other machine.

ProductDisabled = 1|0

Creates a list of ProductManager applications that users are not permitted to install or launch.

ProductDownloadBaseUrl

??

ProfileFunctionEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile function in FlexBuilder anymore)

ProfilingOutputDirectory = [path]

Specify where to save the ProfilerData file

ProfilingOutputFileEnable = 1|0

Specify if we want to create a file containing all the profiler data (flashprof_1265745253708.dat)

RendererProfilingEnable = 1|0

Enable/Disable Profiling information (if turned off, we can’t profile in FlexBuilder anymore)

RTMFPP2PDisable = 1|0

Specifies how the NetStream constructor connects to a server when a value is specified for peerID, the second parameter passed to the constructor.

RTMFPTURNProxy = 1|0

Lets Flash Player make RTMFP connections through the specified TURN server in addition to normal UDP sockets.

ScriptStuckTimeout = X

Lets you specify the time after what the timeout (too much time running a script) exception will popup

SecurityDialogReportingEnable = 1|0

Lets you specify whether the Security dialog should be visible or not.

SuppressDebuggerExceptionDialogs = 1|0

Lets you specify whether the Error dialog should be visible or not.

ThirdPartyStorage

Lets you specify whether third-party SWF files can read and write locally persistent shared objects.

TraceOutputBuffered = 1|0

Specify the flash player to use a buffer before writing to disk. If you had problem when tracing tousands of lines and line were skipped, this solve the thing. It’s also a lot faster (1000000 trace in 7 seconds instead of 3200 trace in 7 sec!)

TraceOutputFileEnable = 1|0

Set TraceOutputFileEnable to 1 to enable the debugger version of Flash Player to write trace messages to the log file.

TraceOutputFileName= [path]

(Before Flash 9) Sets the location of the log file. By default, the debugger version of Flash Player writes error messages to a file named flashlog.txt, located in the same directory in which the mm.cfg file is located.

UseBrokerProcess = 1|0

Lets you specify if you want to use elevated privileges or not (See the FlashPlayer update)

WindowlessDisable = 1|0

Lets you disable Floating Flash (ex: Ads)

Conclusion

This whole thing opens a new playground for hardcore programmer like me.
A lot can be done with this new information:

Custom Profiling tool using AS3Verbose and AS3Trace modes

Custom Profiling tool using .dat generated by FlashProfiler

Automatic Code performance warning using NanoJIT structure analysis

Guide to performance using CPI (cycle per instruction)

Mapping of profiler using the PreloadSwf features (instead of localhost put any other host that have a valid profiler)

I didn’t have time to work extensively on each features and I may have interpreted incorrectly certain things.
If it’s the case please tell me and I’ll modify this post. If you do test or benchmark using this post information please post them as comment here and I’ll add the benchmark later in the post.