Difference between revisions of "VMware Video"

From MultimediaWiki
Jump to navigation Jump to search
m (Update samples link)
Line 24: Line 24:
   32bit  encoding type
   32bit  encoding type


Encoding type might be 0 to 5 as found in the [http://www.cl.cam.ac.uk/Research/DTG/attarchive/vnc/rfbproto.pdf RFB Protocol specification], but current samples reveal that type 5 is the most common.
Encoding type might be 0 to 5 as found in the [http://www.cl.cam.ac.uk/Research/DTG/attarchive/vnc/rfbproto.pdf RFB Protocol specification], but current samples reveal that type 5 (HexTile) is the most common and sometimes type 0 (Raw) occur.
 
== WMVi (ServerInitialisation structure) ==


VMware adds special encoding types, abusing the whole structure. VNC '''ServerInitialisation''' is stored in the above format with encoding type set to '''WMVi'''.
VMware adds special encoding types, abusing the whole structure. VNC '''ServerInitialisation''' is stored in the above format with encoding type set to '''WMVi'''.
Line 32: Line 34:
   8bit  depth
   8bit  depth
   8bit  color stored in big endian order
   8bit  color stored in big endian order
  8bit  this is TrueColor (i.e. not requring palette)
  16bits  maximum value of red
  16bits  maximum value of green
  16bits  maximum value of blue
  8bit  red value shift
  8bit  green value shift 
  8bit  blue value shift
  24bit  padding


  However, this is also signaled right in the AVI header.
However, this is also signaled right in the AVI header. This block occurs only in keyframes.


There are other unknown encoding types which were not yet descrambled:
There are other unknown encoding types which were not yet descrambled:
* WMVd
 
== WMVd (cursor data) ==
 
This block contains cursor bits and mask where cursor hot spot is defined by x,y position of image.
 
WMVd data:
  16bit  unknown
  width*height*depth bits - cursor bits
  width*height*depth bits - cursor mask
 
Cursor should be drawn by simple code:
 
  if (mask[i]) dst[i] = mask[i] ^ bits[i];
 
== WMVf (cursor position) ==
 
This block is empty and x,y position defines the new position of cursor hot spot (NOT the top left corner of cursor image).
 
== Still unknown blocks ==
* WMVe
* WMVe
* WMVf
* WMVg
* WMVg
* WMVh
* WMVh

Revision as of 20:08, 5 September 2006

The VMware Workstation (a commercial x86 machine emulator) can record sessions using this codec. Read the brief story behind the reverse engineering of this codec. It is suspected to be a lossless codec.

Cursory investigation details in this blog post: http://codecs.multimedia.cx/?p=9

Bitstream Format

Basically it is just a recorded session of the RFB protocol, which is used by VNC. Probably a VNC server is running on the virtual machine, while a client outside records it.

Bitstream structure (this resembles the VNC FrameBufferUpdate format), everything is big-endian ordered:

 8bit   message type
 8bit   padding
 16bit  number of rectangles coded

For each rectangle:

 16bit  x position
 16bit  y position
 16bit  coded width
 16bit  coded height
 32bit  encoding type

Encoding type might be 0 to 5 as found in the RFB Protocol specification, but current samples reveal that type 5 (HexTile) is the most common and sometimes type 0 (Raw) occur.

WMVi (ServerInitialisation structure)

VMware adds special encoding types, abusing the whole structure. VNC ServerInitialisation is stored in the above format with encoding type set to WMVi.

WMVi data:

 8bit  bits per sample
 8bit  depth
 8bit  color stored in big endian order
 8bit  this is TrueColor (i.e. not requring palette)
 16bits  maximum value of red
 16bits  maximum value of green
 16bits  maximum value of blue
 8bit  red value shift
 8bit  green value shift  
 8bit  blue value shift
 24bit  padding

However, this is also signaled right in the AVI header. This block occurs only in keyframes.

There are other unknown encoding types which were not yet descrambled:

WMVd (cursor data)

This block contains cursor bits and mask where cursor hot spot is defined by x,y position of image.

WMVd data:

 16bit  unknown
 width*height*depth bits - cursor bits
 width*height*depth bits - cursor mask

Cursor should be drawn by simple code:

 if (mask[i]) dst[i] = mask[i] ^ bits[i];

WMVf (cursor position)

This block is empty and x,y position defines the new position of cursor hot spot (NOT the top left corner of cursor image).

Still unknown blocks

  • WMVe
  • WMVg
  • WMVh
  • WMVj