Analysis of RealAudio file header

Discussion in 'Computer Information' started by Ed, Oct 8, 2004.

  1. Ed

    Ed Guest

    HEADER SECTION:

    1. Real Media File Format tag: .RMF [Real Media File] (File header)

    2. Header Blocks:-
    PROP Properties block
    CONT Content description block [for Title / Author / Copyright]
    MDPR Media Properties Block (incl. MIME type)
    [NB: The order of these three Blocks is arbitrary]


    3. DATA SECTION:
    DATA Data block [Audio data]
    INDX Index Block [located at the END of the file]

    -----------------------------------------------------------------------

    Headers in a Real Media file:

    1. File
    2. Properties
    3. Media
    4. Content
    5. Data Chunk
    6. Data Packet
    7. Index Section
    8. Index Record

    EDITING can be done using any hex editor
    http://www.cheatmonster.pwp.blueyonder.co.uk/Downloads/Hexeditor.zip

    -----------------------------------------------------------------------

    HEADER SECTION


    File Header Block (First 18 bytes):

    Bytes Name Description
    ----- ------ -----------
    4 Object ID ID of block [MUST be .RMF]
    4 Size Size of File Header block
    (NB: Always 18 bytes [12h])
    2 Object version The version of the File Header object
    (NB: This is always zero)
    4 File version The PN version of the file
    (NB: This can be either zero or 1)
    4 Num headers The number of headers [blocks] which
    follow, and which make up the file
    (NB: Always 5 [PROP, MDPR, CONT,
    DATA, INDX])


    Properties Block [PROP]:

    Bytes Name Description
    ----- ------ ------------
    4 Object ID ID of block [MUST be PROP]
    4 Size Size of Properties block (in hex)
    (NB: Always 50 bytes [32h])
    2 Object version Version number (NB: Always zero)
    4 Max bit rate Maximum data transmission rate (in hex)
    (NB: AC44 = 44,100 [bps])
    4 Avg bit rate Average data transmission rate
    4 Max packet size Maximum packet size (640 bytes [280 hex])
    4 Avg packet size Average packet size (640 bytes [280 hex])
    4 Num packets Number of data packets [in the DATA block]
    4 Duration Duration of the audio stream, in milliseconds
    (NB: Divide by 60,000 to convert to
    Minutes)
    4 Preroll Duration of buffering before starting
    playback, in milliseconds (usually zero)
    4 Index offset Offset to start of the index block, in bytes
    (NB: Identifies start of INDX block)
    4 Data offset Offset of the data block (in hex)
    (NB: Identifies start of DATA block)
    2 Num streams Number of streams (1=Audio only,
    2=Audio+Video)
    2 Flags Sets the characteristics of the file:
    0001 = save enabled [Allows save]
    0002 = perfect-play enabled
    [Extra buffering]
    0004 = live broadcast


    Media Properties block [MDPR]:

    Bytes Name Description
    ----- ------ ------------
    4 Object ID ID of block [MUST be MDPR]
    4 Size Size of MDPR block (in hex)
    2 Object version Version number (NB: Always zero)
    2 Stream Number Stream ID number
    (NB: Audio stream is always Stream 0)
    4 Max bit rate Maximum data transmission rate (in hex)
    (NB: AC44 = 44,100 [bps] )
    4 Avg bit rate Average data transmission rate
    4 Max pack size Largest packet size (640 [280h])
    (NB: Must agree with Max packet size
    in PROP)
    4 Avg pack size Average packet size (640 [280h])
    (NB: Must agree with Avg packet size
    in PROP)
    4 Starting time Starting time of audio stream
    (NB: Always starts at zero minutes)
    4 Preroll Duration of buffering, in milliseconds
    (NB: Must agree with Preroll in PROP)
    4 Duration Duration of the audio stream, in milliseconds
    (NB: Must agree with Duration in PROP)
    1 Stream name size - Length of stream name, in bytes [2D hex]
    n Stream name Name of stream (length as above)
    (NB: 45 bytes [2D hex] =
    audio/x-pn-multirate-realaudio logical stream)
    1 MIME type size Length of MIME type, in bytes [14 hex]
    n MIME type MIME type of stream (length as above)
    (NB: 20 bytes [14 hex] = audio/x-pn-realaudio)
    4 Type-dep. size Length of type-dependent Data, in bytes
    [NB: 5E hex = 94 bytes]
    n Type-dep. data Type-dependent data
    [NB: Includes .ra, .ra5, genrcook]


    Content Description block [CONT]:

    Bytes Name Description
    ----- ------ ------------
    4 Object ID ID of block [MUST be CONT]
    4 Size Size of CONT block (in hex)
    2 Object version Version number (NB: Always zero)
    2 Title size Length of Title description, in bytes
    n Title Title description
    2 Author size Length of Author description, in bytes
    n Author Author description
    2 Copyright size Length of Copyright description, in bytes
    n Copyright Copyright description
    2 Comment size Length of Comment, in bytes
    (NB: Always zero)
    n Comment Comment (NB: Actually, no bytes are alloted
    to this, as comment length is zero)

    -----------------------------------------------------------------------

    DATA SECTION

    Data block [DATA]:

    Bytes Name Description
    ----- ------ -----------
    4 Object ID ID of block [MUST be DATA]
    4 Size Size of DATA block (in hex)
    (NB: Must it agree with size in PROP?)
    2 Object version Version number (NB: Always zero)
    4 Num packets Number of data packets in file
    4 Next data header Offset of next DATA header
    (NB: Always zero - there is only
    one DATA chunk in a file)


    Data Packet header:

    Bytes Name Description
    ----- ------ -----------
    2 Object ID ID of block
    2 Length Length of packet, in bytes
    2 Stream number Stream ID number
    (NB: Audio stream is always Stream 0)
    4 Timestamp Timestamp of packet, in milliseconds
    1 Reserved Reserved
    1 Flag Sets the characteristics of the file:
    0001 = Reliable flag
    0002 = Keyframe flag
    n Data Media data


    -----------------------------------------------------------------------

    Index Section


    Index Header:

    Bytes Name Description
    ----- ------ ------------
    4 Object ID ID of block [MUST be INDX]
    4 Size Size of INDX block, in bytes (hex)
    2 Object version Version number (NB: Always zero)
    4 Num indices Number of Indices in the INDX block
    2 Stream number Stream ID number
    (NB: Audio stream is always Stream 0)
    4 Next index header - Offset of next Index header


    Index Record:

    Bytes Name Description
    ----- ------ -----------
    2 Object version Version number (NB: Always zero)
    4 Timestamp Timestamp of packet, in milliseconds
    4 Offset Offset of Data packets
    4 Packet count Packet number


    [All headers are required except the Index Header]
     
    Ed, Oct 8, 2004
    #1
    1. Advertising

  2. Ed

    Matt Pascoe Guest

    Very interesting

    "Ed" <> wrote in message
    news:EAw9d.169$...
    > HEADER SECTION:
    >
    > 1. Real Media File Format tag: .RMF [Real Media File] (File header)
    >
    > 2. Header Blocks:-
    > PROP Properties block
    > CONT Content description block [for Title / Author / Copyright]
    > MDPR Media Properties Block (incl. MIME type)
    > [NB: The order of these three Blocks is arbitrary]
    >
    >
    > 3. DATA SECTION:
    > DATA Data block [Audio data]
    > INDX Index Block [located at the END of the file]
    >
    > -----------------------------------------------------------------------
    >
    > Headers in a Real Media file:
    >
    > 1. File
    > 2. Properties
    > 3. Media
    > 4. Content
    > 5. Data Chunk
    > 6. Data Packet
    > 7. Index Section
    > 8. Index Record
    >
    > EDITING can be done using any hex editor
    > http://www.cheatmonster.pwp.blueyonder.co.uk/Downloads/Hexeditor.zip
    >
    > -----------------------------------------------------------------------
    >
    > HEADER SECTION
    >
    >
    > File Header Block (First 18 bytes):
    >
    > Bytes Name Description
    > ----- ------ -----------
    > 4 Object ID ID of block [MUST be .RMF]
    > 4 Size Size of File Header block
    > (NB: Always 18 bytes [12h])
    > 2 Object version The version of the File Header object
    > (NB: This is always zero)
    > 4 File version The PN version of the file
    > (NB: This can be either zero or 1)
    > 4 Num headers The number of headers [blocks] which
    > follow, and which make up the file
    > (NB: Always 5 [PROP, MDPR, CONT,
    > DATA, INDX])
    >
    >
    > Properties Block [PROP]:
    >
    > Bytes Name Description
    > ----- ------ ------------
    > 4 Object ID ID of block [MUST be PROP]
    > 4 Size Size of Properties block (in hex)
    > (NB: Always 50 bytes [32h])
    > 2 Object version Version number (NB: Always zero)
    > 4 Max bit rate Maximum data transmission rate (in hex)
    > (NB: AC44 = 44,100 [bps])
    > 4 Avg bit rate Average data transmission rate
    > 4 Max packet size Maximum packet size (640 bytes [280 hex])
    > 4 Avg packet size Average packet size (640 bytes [280 hex])
    > 4 Num packets Number of data packets [in the DATA block]
    > 4 Duration Duration of the audio stream, in milliseconds
    > (NB: Divide by 60,000 to convert to
    > Minutes)
    > 4 Preroll Duration of buffering before starting
    > playback, in milliseconds (usually zero)
    > 4 Index offset Offset to start of the index block, in bytes
    > (NB: Identifies start of INDX block)
    > 4 Data offset Offset of the data block (in hex)
    > (NB: Identifies start of DATA block)
    > 2 Num streams Number of streams (1=Audio only,
    > 2=Audio+Video)
    > 2 Flags Sets the characteristics of the file:
    > 0001 = save enabled [Allows save]
    > 0002 = perfect-play enabled
    > [Extra buffering]
    > 0004 = live broadcast
    >
    >
    > Media Properties block [MDPR]:
    >
    > Bytes Name Description
    > ----- ------ ------------
    > 4 Object ID ID of block [MUST be MDPR]
    > 4 Size Size of MDPR block (in hex)
    > 2 Object version Version number (NB: Always zero)
    > 2 Stream Number Stream ID number
    > (NB: Audio stream is always Stream 0)
    > 4 Max bit rate Maximum data transmission rate (in hex)
    > (NB: AC44 = 44,100 [bps] )
    > 4 Avg bit rate Average data transmission rate
    > 4 Max pack size Largest packet size (640 [280h])
    > (NB: Must agree with Max packet size
    > in PROP)
    > 4 Avg pack size Average packet size (640 [280h])
    > (NB: Must agree with Avg packet size
    > in PROP)
    > 4 Starting time Starting time of audio stream
    > (NB: Always starts at zero minutes)
    > 4 Preroll Duration of buffering, in milliseconds
    > (NB: Must agree with Preroll in PROP)
    > 4 Duration Duration of the audio stream, in milliseconds
    > (NB: Must agree with Duration in PROP)
    > 1 Stream name size - Length of stream name, in bytes [2D hex]
    > n Stream name Name of stream (length as above)
    > (NB: 45 bytes [2D hex] =
    > audio/x-pn-multirate-realaudio logical stream)
    > 1 MIME type size Length of MIME type, in bytes [14 hex]
    > n MIME type MIME type of stream (length as above)
    > (NB: 20 bytes [14 hex] = audio/x-pn-realaudio)
    > 4 Type-dep. size Length of type-dependent Data, in bytes
    > [NB: 5E hex = 94 bytes]
    > n Type-dep. data Type-dependent data
    > [NB: Includes .ra, .ra5, genrcook]
    >
    >
    > Content Description block [CONT]:
    >
    > Bytes Name Description
    > ----- ------ ------------
    > 4 Object ID ID of block [MUST be CONT]
    > 4 Size Size of CONT block (in hex)
    > 2 Object version Version number (NB: Always zero)
    > 2 Title size Length of Title description, in bytes
    > n Title Title description
    > 2 Author size Length of Author description, in bytes
    > n Author Author description
    > 2 Copyright size Length of Copyright description, in bytes
    > n Copyright Copyright description
    > 2 Comment size Length of Comment, in bytes
    > (NB: Always zero)
    > n Comment Comment (NB: Actually, no bytes are alloted
    > to this, as comment length is zero)
    >
    > -----------------------------------------------------------------------
    >
    > DATA SECTION
    >
    > Data block [DATA]:
    >
    > Bytes Name Description
    > ----- ------ -----------
    > 4 Object ID ID of block [MUST be DATA]
    > 4 Size Size of DATA block (in hex)
    > (NB: Must it agree with size in PROP?)
    > 2 Object version Version number (NB: Always zero)
    > 4 Num packets Number of data packets in file
    > 4 Next data header Offset of next DATA header
    > (NB: Always zero - there is only
    > one DATA chunk in a file)
    >
    >
    > Data Packet header:
    >
    > Bytes Name Description
    > ----- ------ -----------
    > 2 Object ID ID of block
    > 2 Length Length of packet, in bytes
    > 2 Stream number Stream ID number
    > (NB: Audio stream is always Stream 0)
    > 4 Timestamp Timestamp of packet, in milliseconds
    > 1 Reserved Reserved
    > 1 Flag Sets the characteristics of the file:
    > 0001 = Reliable flag
    > 0002 = Keyframe flag
    > n Data Media data
    >
    >
    > -----------------------------------------------------------------------
    >
    > Index Section
    >
    >
    > Index Header:
    >
    > Bytes Name Description
    > ----- ------ ------------
    > 4 Object ID ID of block [MUST be INDX]
    > 4 Size Size of INDX block, in bytes (hex)
    > 2 Object version Version number (NB: Always zero)
    > 4 Num indices Number of Indices in the INDX block
    > 2 Stream number Stream ID number
    > (NB: Audio stream is always Stream 0)
    > 4 Next index header - Offset of next Index header
    >
    >
    > Index Record:
    >
    > Bytes Name Description
    > ----- ------ -----------
    > 2 Object version Version number (NB: Always zero)
    > 4 Timestamp Timestamp of packet, in milliseconds
    > 4 Offset Offset of Data packets
    > 4 Packet count Packet number
    >
    >
    > [All headers are required except the Index Header]
    >
    >
    >
    >
     
    Matt Pascoe, Oct 8, 2004
    #2
    1. Advertising

  3. Ed

    jason Guest

    "Ed" <> wrote in
    news:EAw9d.169$:

    > HEADER SECTION:
    >
    > 1. Real Media File Format tag: .RMF [Real Media File] (File header)


    Interesting...but could you put this information into context for us? I'm
    not exactly sure how we're supposed to use this information. Thanks!



    --
    Cheers,
    jason
     
    jason, Oct 9, 2004
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Joel Rubin

    Great RealAudio reading for American Independence Day

    Joel Rubin, Jul 2, 2003, in forum: Computer Support
    Replies:
    0
    Views:
    996
    Joel Rubin
    Jul 2, 2003
  2. Frank

    MiniDump file analysis

    Frank, Apr 27, 2004, in forum: Computer Support
    Replies:
    8
    Views:
    12,577
    Frank
    Apr 28, 2004
  3. Rob Slade, doting grandpa of Ryan and Trevor

    REVIEW: "File System Forensic Analysis", Brian Carrier

    Rob Slade, doting grandpa of Ryan and Trevor, Aug 8, 2005, in forum: Computer Security
    Replies:
    0
    Views:
    553
    Rob Slade, doting grandpa of Ryan and Trevor
    Aug 8, 2005
  4. Ed

    Analysis of RealAudio file header

    Ed, Jun 30, 2005, in forum: Computer Information
    Replies:
    3
    Views:
    781
  5. Ed

    RealAudio file header

    Ed, Jun 30, 2005, in forum: Computer Information
    Replies:
    0
    Views:
    1,185
Loading...

Share This Page