Category Archives: Reverse Engineering

Brainstorming and case studies relating to craft of software reverse engineering.

Codec Writers’ Humor

A fellow multimedia hacker, Benjamin L., pointed out that a reverse engineer might find some odd numbers in data tables while poking through binary codecs. For example, 0xbaadc0de and 0xdeadbeef. Sense of humor? Certainly. But why would such nonsense values be there? That is a question worth exploring. They sometimes turn up in codec data tables. Dead spots? Don’t-care values? Strange.

World’s Simplest Vector Quantizer

Vladimir “VAG” Gneushev has uncovered the world’s simplest vector quantizer codec. An FMV format named AVS was used in a 1994 CD-ROM title called Creature Shock. Intraframes carry a vector codebook and vector map; interframes also carry a change map. The audio chunks are actually Creative VOC chunks. Complete details are here.

The strangest thing about this particular VQ codec is that the vectors can have a dimension of 3. For example, the intraframes are comprised of 3×3 pixel vectors. 3 is not divisible by many common video frame resolutions. This game ran on IBM VGAs in 320x200x256 color mode. But the resolution of the movies was actually 318×198. Look carefully at a screenshot from the game:


Creature Shock Screenshot
screenshot courtesy of MobyGames

The top row, bottom row, and 2 right columns are all left undrawn.

So, who wants to implement this format first? If the inspiration strikes you, here are some sample files.

Duck TrueMotion-S

The FOURCC List affords us many scattered bits of intelligence on various codecs used throughout the history of multimedia technology. Duck/On2’s early TrueMotion codecs are assigned a variety of FOURCCs– such as DUCK, TMOT, and PVEZ– which may or may not refer to distinct TrueMotion variants.

Serge van den Boom informed me that the 3DO version of Star Control II made use of some TM variation named TrueMotion-S. The open sourced Star Control II effort includes code to decode this video. The relevant files are dukvid.[ch] in this directory. A sample (logo.tar.bz2) is available in my Duck TM1 samples directory. Interestingly, the bundle actually contains 4 files. The .duk file has all of the video data stuffed together. The .hdr file contains some header information. The .frm file contains the frame offset boundaries for the .duk data file. And the .tbl file apparently contains data for initializing the delta table to use for decoding the data.

I am not yet sure if the data is decoded to 16- or 24-bit video. If someone is willing to jump in and figure this out, it might help us sort out the remaining pieces of the generalized Duck TM1 decoder for FFmpeg. It stands to reason, however, that the data is 16-bit at best since Star Control 2 is such an early game in terms of the multimedia genre. The game is reportedly one of the earliest games that Duck TM1 was used for so it may be on the bottom rung of the Duck predictive evolutionary ladder.