3

Good afternoon,

I am looking to try me skills at extracting some data from a proprietary format. I have made some progress but I wanted to contact the experts to see if I could gain some insights. The format in question is the '.clip' format created by the software 'clip studio paint'. Specifically this is a raster graphics editor (Photoshop-like) which I would like to get the image data from. There should, in the most basic usage, be a bunch of layers, each being an image. (For raster graphics, not vector)

The format seems to be not encrypted or compressed, but rather split up in some kind of archive format. All regular archive tools I have tried can't make any sense of it (zip, tar, etc). It might be an archive format more common to windows which I am not as familiar with.

Manually parsing the file with python I was able to find a raw sequence near the end which is in sqlite3 format. I was able to extract this and read the tables which contain the majority of the metadata. Unfortunately this does not shed much light on a way to extract the image data. I was able to split on a few delimiters I found in the file but still I would not find any image algorithm which was able to make sense of the delimited parts.

Outer delimiters in the file seem to look like:

b'CHNKHead' b'CHNKFoot' b'CHNKExta' b'CHNKSQL'

And there are also many inner delimiters in some of these chunks like:

b'B\x00l\x00o\x00c\x00k\x00D\x00a\x00t\x00a\x00B\x00e\x00g\x00i\x00n\x00C\x00h\x00u\x00n\x00k' b'B\x00l\x00o\x00c\x00k\x00D\x00a\x00t\x00a\x00E\x00n\x00d\x00C\x00h\x00u\x00n\x00k'

(I am guessing the special null byte separation to reduce the chance that this sequence matches other binary data?)

Anyway I am attaching my little python split and save script and the sample CSP file I am trying to read, incase anyone was interested in taking a look. http://s000.tinyupload.com/index.php?file_id=04264848249049623399

4
  • The extra null bytes look like simple Unicode text – Igor Skochinsky Nov 20 '19 at 0:17
  • Yeah, I had started to see the null byte separated strings in a lot of formats over the past few days, so I see it has no special meaning, we should just treat all found raw strings as two bytes per character? I am still learning. =P – Rboreal_Frippery Nov 20 '19 at 0:25
  • These null bytes are indicative of UCS-2 or UTF-16 – Botje Nov 29 '19 at 12:12
  • 1
    One note about the structure: 0x50 contains "CHUNKEXTa", and 0x5c contains "00004edf4". This looks to be the size of the chunk payload, as the next CHNKExta starts at 0x4ee54, or 0x60+0x4edf4. (0x60 is the address right after the size) – Botje Nov 29 '19 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.