I have a file that I'm trying to reverse engineer that is generated by an application. The file itself is fairly simple, but there are 4 bytes whose purpose I can't determine. The file consists of a header followed by the mystery bytes, followed by a JPEG image and finally some plain text.

The file looks like this:

00000000: beca beca cc19 0000 ffd8 ffe0 0010 4a46 ..............JF
00000670: 028a 28a0 028a 28a0 0fff d90d 0a63 6f6c  ..(...(......col
00000680: 6f72 2074 6578 7475 7265 2022 6465 6361  or texture "deca
00000870: 2269 6e76 6572 745f 6d61 736b 2220 206f  "invert_mask"  o
00000880: 6666 20                                  ff

The header is the first 4 bytes and is always the same in every file. After the 4 mystery bytes, the JPEG starts at ffd8 and continues until ffd9 and then the text content begins.

In the application, you select an image file, and adjust some settings and can then save the results, which creates a file like the one above.

Some experimentation has shown that the JPEG image in the file is always 256x256 pixels. It is essentially a thumbnail created from the selected image. The file above was created using an image with a single black pixel, and the generated thumbnail is a 256x256 black square.

The first two bytes are affected by the source image size. If I try images with more pixels in a single row, the second mystery byte will change, but not in an obvious (to me) fashion. For example:

    1 x 1 0x19
    1 x 2 0x11
    1 x 3 0x0f
    1 x 4 0x0d
    1 x 5 0x0d
    1 x 6 0x0c
    1 x 7 0x0c
    1 x 8 0x0b
    1 x 9 0x0b
   1 x 10 0x0b
   1 x 11 0x0b
   1 x 12 0x0b
   1 x 13 0x0b
   1 x 14 0x0b
   1 x 15 0x0b
   1 x 16 0x0a
   1 x 32 0x0a
   1 x 64 0x0a
  1 x 128 0x0a
  1 x 256 0x0a

Growing the image in height instead of width yields the same values, so a 2 x 1 image is 0x11, a 3 x 1 image is 0x0F and so on. Any square image will have the same value as the 1x1 image (0x19) even if the original image is larger than the generated 256x256 thumbnail. The first mystery byte gets involved sometimes as well. For a large image (1803 x 1087), the first mystery bytes are 7c 86. The last two mystery bytes have been 00 00 in every file that I have checked. I can say that it seems to be an offset of some sort, because if I set the two bytes equal to one byte more than the file length, the application will complain with a seek error.

This kind of thing isn't part of my day job, so I'm hoping than posting here will put some eyes on it that immediately see whatever it is that I'm missing, or will generate some ideas on further tests I can do to try to figure out what these bytes are doing.

  • Is the application a public one? Sometimes its easier to figure out what a file does by dissecting the program creating it.
    – masterX244
    Commented Mar 21, 2023 at 8:28
  • Unfortunately it is not a publicly available application.
    – Jim S.
    Commented Mar 21, 2023 at 12:37


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.