1

I am currently investigating a weird layout for storing of what appears to be strings (medical format).

Looking at the dump for a bunch of those strings here is what I see:

$ hexdump -C out0000 
00000000  df ff 79 17 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y....ISO8859-1|
00000010  02 08 00 30 30 30 30 30  30 30 30                 |...00000000|
0000001b
$ hexdump -C out0001
00000000  df ff 79 19 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y....ISO8859-1|
00000010  02 0a 00 83 74 83 40 83  93 83 67 83 80           |[email protected]..|
0000001d
$ hexdump -C out0009
00000000  df ff 79 21 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y!...ISO8859-1|
00000010  02 12 00 91 71 95 7e 90  ac 90 6c 95 61 83 5a 83  |....q.~...l.a.Z.|
00000020  93 83 5e 81 5b                                    |..^.[|
00000025
$ hexdump -C out0002
00000000  df ff 79 16 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y....ISO8859-1|
00000010  02 07 00 46 41 4e 54 4f  4d 55                    |...FANTOMU|
0000001a
$ hexdump -C out0004
00000000  df ff 79 0f 01 09 00 49  53 4f 38 38 35 39 2d 31  |..y....ISO8859-1|
00000010  02 00 00                                          |...|
00000013

Has anyone seen this format before ? What is this ?


Steps to extract those weird strings:

  1. You need an instance (image) from a Toshiba MRT200SP5,
  2. Extract the Original Data, using eg.:

    gdcmraw -t 700d,1008 toshiba_input.dcm original_data.raw

  3. Use the work in progress dump4.c to process one portion of it (Type = WSTRING)

1
  • 3
    You need to provide more information about how you get these files. For instance, the name of the used software and the kind of data it provides. All I can see here is: df ff 79 seem to be a marker or a magic number. The following byte is the size of the next part. And ISO8859-1 is a character encoding.
    – wisk
    Apr 16, 2019 at 19:53

1 Answer 1

2

with a cursory glance it appears your data is formatted like this
(assumed big endian but the actual data SHORT field appears to be little endian you may need to improvise )

the block is variable sized and the size is embedded prior to the data

typedef struct _FOO {   
BYTE[3]       magic                 \\ dfff79 same in all blocks    
BYTE[1]       siz_exc_magic&siz_fld \\ 17,19,21,16,0f  
int           another_magic         \\ 01090049  
char[8]       encode                \\ ISO8859-1   
BYTE[1]       some_byte             \\ 02 same in all blocks  
short         act_size_of_data      \\ 08,0a,12,7,0   
data[1]       variable_sized_data
}                

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.