VMware Video

From MultimediaWiki
Revision as of 13:56, 30 June 2006 by Alex (talk | contribs)
Jump to navigation Jump to search

The VMware Workstation (a commercial x86 machine emulator) can record sessions using this codec. Read the brief story behind the reverse engineering of this codec. It is suspected to be a lossless codec.

Cursory investigation details in this blog post: http://codecs.multimedia.cx/?p=9

Bitstream Format

Basically it is just a recorded session of the RFB protocol, which is used by VNC. Probably a VNC server is running on the virtual machine, while a client outside records it.

Bitstream structure (this resembles the VNC FrameBufferUpdate format), everything is big-endian ordered:

 8bit   message type
 8bit   padding
 16bit  number of rectangles coded

For each rectangle:

 16bit  x position
 16bit  y position
 16bit  coded width
 16bit  coded height
 32bit  encoding type

Encoding type might be 0 to 5 as found in the RFB Protocol specification, but current samples reveal that type 5 is the most common.

VMware adds special encoding types, abusing the whole structure. VNC ServerInitialisation is stored in the above format with encoding type set to WMVi.

WMVi data:

 8bit  bits per sample
 8bit  depth
 8bit  color stored in big endian order
 However, this is also signaled right in the AVI header.

There are other unknown encoding types which were not yet descrambled:

  • WMVd
  • WMVe
  • WMVf
  • WMVg
  • WMVh
  • WMVj