3

I have an MPEG file which starts like this:

   0:  00 0f 6d 79 5f 66 69 6c  65 6e 61 6d 65 2e 6d 70  ..my_filename.mp
  10:  67 00 04 fc 00 00 f0 00  b2 10 39 a8 b2 10 39 ad  g.........9...9.
  20:  0f 6d 79 5f 66 69 6c 65  6e 61 6d 65 2e 6d 70 67  .my_filename.mpg
  30:  03 92 3b 40 00 00 00 00  03 7a b5 7c 03 7a d7 d0  ..;@.....z.|.z..
  40:  00 4d 6f 6f 56 54 56 4f  44 01 00 01 2a 00 80 00  .MooVTVOD...*...
  50:  00 00 00 00 36 b2 83 00  00 04 fc b2 10 39 a8 b2  ....6........9..
  60:  10 39 ad 00 00 00 00 00  00 00 00 00 00 00 00 00  .9..............
  70:  00 00 00 00 00 00 00 00  00 00 81 81 35 d3 00 00  ............5...
  80:  00 36 b2 83 6d 64 61 74  00 00 01 ba 21 00 01 00  .6..mdat....!...
  90:  05 80 2b 81 00 00 01 bb  00 0c 80 2f d9 04 e1 ff  ..+......../....
  a0:  c0 c0 20 e0 e0 2e 00 00  01 c0 07 ea ff ff ff ff  .. .............

What is the file format of the beginning of the file (first 0x80 bytes), and how do I parse it?

I've run a Google search on MooVTVOD, it looks like something related to QuickTime and iTunes.

What I understand already:

  • There is 4 bytes of big endian file size in front mdat, according to the QuickTime .mov file format when the .mov contains an MPEG.

  • Right after mdat there is the MPEG-PS header 00 00 01 ba. Shortly after there is the MPEG-PES header 00 00 01 c0 indicating an audio stream.

  • However, the first 0x80 bytes in this file seem to be in a different file file format (not QuickTime .mov, not MPEG-PS, not MPEG-PES), and in this question I'm only interested in the file format of the first 0x80 bytes.

  • Media players such as VLC routinely ignore junk at the beginning of the file, and start playing the MPEG-PS stream at offset 0x80. However, I'm interested in the 0x80 bytes they ignore.

pts
  • 80,836
  • 20
  • 110
  • 183
  • Possible duplicate of [Tools to help me learning Apple Quick time file format?](https://stackoverflow.com/questions/7898475/tools-to-help-me-learning-apple-quick-time-file-format) – chiliNUT Oct 21 '19 at 01:59

2 Answers2

0

The file format is "Quicktime movie atom," that contains meta information about the media file, or the media itself. mdat is a Media Data atom.

Media atoms describe and define a track’s media type and sample data.

the spec is here: https://developer.apple.com/library/archive/documentation/QuickTime/QTFF/QTFFChap2/qtff2.html

You can parse it with this python script: https://github.com/kzahel/quicktime-parse

or this software, mentioned in the linked question: https://archive.codeplex.com/?p=mp4explorer

chiliNUT
  • 18,989
  • 14
  • 66
  • 106
  • Thank you for giving links to the QuickTime file format docs. However, the first 0x80 bytes I'm asking about in this question seem to be of a different file format. In the QuickTime format the size of the atom is 4-byte big endian, and I can't see any of those in the first 0x80 bytes. (This this answer doesn't answer the question.) – pts Oct 21 '19 at 11:01
0

The file format of the first 0x80 bytes in the question is MacBinary II.

Based on the file format description https://github.com/mietek/theunarchiver/wiki/MacBinarySpecs , it's not MacBinary I, because MacBinary II has data[0x7a] == '\x81' and data[0x7b] == '\x81' (and MacBinary I has data[0x7a] == '\x00', and MacBinary III has data[0x7a] == '\x82'); and it's also not MacBinary III, because that one has data[0x66 : 0x6a] == 'mBIN'.

The CRC value data[0x7c : 0x7e] is incorrect because the filename was modified before posting to StackOverflow. FYI The CRC algorithm used is CRC16/XMODEM (on https://crccalc.com/), also implemented as CalcCRC in MacBinary.c.

The data[0x41 : 0x45] == 'MooV' is the file type code. According to the Excel spreadsheet downloadable from TCDB, it means QuickTime movie (video and maybe audio).

The data[0x45 : 0x49] == 'TVOD' is the file creator code. TCDB and this database indicate that it means QuickTime Player.

More info and links about MacBinary: http://fileformats.archiveteam.org/wiki/MacBinary

Please note that all these headers are unnecessary to play the video: by removing the first 0x88 bytes we get an MPEG-PS video file, which many video players can play (not only QuickTime Player, and not only players running on macOS).

pts
  • 80,836
  • 20
  • 110
  • 183