Formats, encoding and protocols

File format, identification:

Infos, tools and code for some formats / protocols / encodings

File/data format Posters:

Games files:

Describe binary format

Tables likes:

RECORDHEADER (long):

Field
Type
Comment

TagCodeAndLength

UI16

Tag type and length of 0x3F Packed together as in short header

Length

UI32

Length of tag

[...]

Field
Type
Comment

Header

RECORDHEADER

Tag type = 4

CharacterId

UI16

ID of character to place

Depth

UI16

Depth of character

Matrix

MATRIX

Transform matrix data

ColorTransform (optional)

CXFORM

Color transform data

SWF File Format Specificationarrow-up-right

struct (C)arrow-up-right:

Kaitai Structarrow-up-right:

Synalyze It Grammar:

See also

File signature

010 editor template (look similar to structure definitions in C/C++)

TrID and TrIDScan:

Magic File:

Tcl languagearrow-up-right based definition:

Media type

Aka MIME type / Mimetype (terme used for email "MIME - Multipurpose Internet Mail Extensions" specs), content type

By default application/octet-stream (application/force-download doesn't exist, fallback to the default)

Sources:

The use of text/ for interpreted languages (scripts) is discouraged already by IETF and things like javascript/ecmascript are already migrated to application/*, the legacy text/* definitions being deprecated.

Note: Fonts have now a dedicated type fontarrow-up-right. Instead of using application/x-font-truetype-collection, use font/collection

Script type:

  • Bash: text/x-shellscript

  • Java: text/x-java-source

  • C: text/x-c, text/x-csrc

  • C++: text/x-c++, text/x-c++src

  • Python: text/x-python

Native executable:

  • application/x-msdownload; format=pe32

  • application/x-msdownload;format=pe

  • application/x-dosexec

  • application/exe

  • application/x-exe

  • application/dos-exe

  • vms/exe

  • application/x-winexe

  • application/msdos-windows

  • application/x-msdos-program

Audio & video types:

/etc/mime.types:

Unkown source, could be incorrect:

Protocole specific media type

Used by emails or HTTP

Multipart and stream:

External body examples:

  • message/external-body; access-type=URL; URL="http://www.foo.com/file"

  • message/external-body; access-type=local-file; name="file:/local/path/file.html"

URIs:

Directory media type

  • text/plain

  • vnd.android.document/directory

  • inode/directory, inode/directory;role=remote.net.smb.workgroup

Use multipart/related?

File system

Reverse engineering data

The timestamps could be stored as absolute values since unix epoch, or could be stored as relative to the previous sample, or relative to the start of the profile, and could be stored as floating point values or integers, and those integers might be big endian or small endian.

Sample files

See Sample data

Smallest files

Small video

Sample filesystem hierarchy

Images

See also Compare image

Videos

Test media

Test page, test card, test pattern

Random data

Endianness

Aka little endian and big endian

Last updated