Codecs with extended information

From MultimediaWiki
Revision as of 08:13, 28 February 2006 by Merbanan (talk | contribs) (Added link to wmal2pcm.exe)
Jump to navigation Jump to search

For these codecs there exists extra information beside the binaries. It can be binaries with debug information in them, SDKs or something other that would help the reverse engineering process. This list doesn't cover codecs for which specifications (e.g. Windows Media Video 9) or source (e.g. Monkey's Audio) can be found.

VQF/TwinVQ

For this codec a Linux/win32 SDK was released and some code from VQF in AAC was also found on the net, the TwinVQ entry has more details.

WMA Pro, WMA Lossless, WMA Speech

Linspire licensed some Windows Media codecs and bundled them with their distribution. They made shared object files of them and loaded them from MPlayer. The gluecode can be found in the MPlayer packages on the Linspire site, the files with the gluecode are in libavcodec/ wmv3dec.c, wmv2dec.c and wma3dec.c. To get the binaries download the torrent file from the Linspire site. The codecs should reside in /usr/lib with the name libwm*.so. These files have lots of debug information in them and they seam to not have been compiled with a high optimization level. Some work has been done on libwma3.so and this library has code to decode wmastdv1, wmastdv2, wmapro and wmalossless. But the gluecode only activates wmapro and wmalossless. Libwma2.so and libwma3.so seem to share some of the constants. Mike's blog mentions some libs with debug info in them, these also contain Windows Media Audio Voice. They seem to be based on the same source as the Linspire ones and a rudimentary check supports that. The code seams to be abit more optimized also. The diffrent objects in the library makes it easy to divide the diffrent codecs (the tables and code). So correlation of all these sources would probably yeild the best result. There is also program called wmal2pcm.exe from the Micro$oft itself [1], which unpacks WMA Lossless to PCM. It does not require additional libraries as it contains demuxer and decoder code.

Indeo 4 and Indeo 5

XAnim has external so libs for these codecs on its website. Some version of these binaries has a lot of debug information in it. There has also been some work on an Indeo 5 decoder.

VP5 and VP6

On On2's website there is a Truemotion streaming applet. This applet has contained a non-obfuscated VP5 Java decoder. They later obfuscated it and changed it to VP6. The Java binary can easily be decompiled. The result looks very poor but it is better than x86 assembly. Some work has been done to reconstruct the VP5 decoder.

Sipro, Atrac, RV30 and RV40

Real has sometimes in the past released versions that had binaries with a lot of debug information. The versions in question are version 5, 7 and a Helix Linux beta version. Version 5 can be found here and 7 can be found here.

  • Sipro debug info can be found in version 5, 7 and the debug build.
  • Atrac debug info slipped into a Helixplayer beta version. The so binary doesn't work but the signatures can be transferred to the RealPlayer 10 atrac.dll. Other versions don't seem to use the same source code.
  • RV30 debug info can be found in version 7 and the debug build.
  • RV40 debug info can be found in the debug build.

Bink

RAD Game Tools released a player for Linux that contained a lot of debug information.

QCELP

Qualcomm shared its source for QCELP during the development of the codec. Sometime along the development Apple licenced the codec for QuickTime. The code doesn't match the binary completely but will help an eventual RE effort.