Whilst using the Hex editor what does one search for if there explore a file for potential images packaged inside.? Header types, I'm not too keen on programming, but I'm here to learn and once I do I can continue to grow. I have a specific file that I believe has images with the file type tim2 (ps2 image) packaged inside. the file type I'm dealing is of .as7. Any aid is appreciated thank you.
Asked
Active
Viewed 2,131 times
2 Answers
1
Imagine an image viewer. If it's given a file, it could evaluate the file suffix to choose the proper image loader. A much better method is, to read a certain amount of the first bytes. Most image file formats (actually, all I know personally) contain a certain sequence of bytes which can be used for identification. (These are often called “magic code”.)
Hence, I googled for "tim2 image files" to find a description of the file format. (I must admit I've never heard about it before.) I found: TM2 TIM2 on wiki.xentax.com:
Format Specifications
// Specs based off "Rainbow" from https://github.com/marco-calautti/Rainbow/ // IMAGE HEADER 4 - Header (TIM2) 2 - Version 2 - Number of Images
Converting the ASCIIs of TIM2 to hex-values (using an ASCII table), these are the values:
54 49 4D 32
So, this is a sequence to search for. Though, the occurrence of this sequence is no garanty to start a TIM2 image, it's at least an indicator for the possibility.
A bit more from the above link:
// Specs based off "Rainbow" from https://github.com/marco-calautti/Rainbow/
// IMAGE HEADER
4 - Header (TIM2)
2 - Version
2 - Number of Images
// IMAGE DATA
// for each Image
4 - Total Image Length
4 - Palette Length
4 - Image Data Length
2 - Header Length
2 - Color Entries
1 - Image Format (0=8bpp paletted?)
1 - Mipmap Count
1 - CLUT Format
1 - Bits Per Pixel (1=16bbp, 2=24bpp, 3=32bbp, 4=4bbp, 5=8bpp)
2 - Image Width
2 - Image Height
8 - GsTEX0
8 - GsTEX1
4 - GsRegs
4 - GsTexClut
X - User Data (optional) (length = HeaderLength-48)
I would use the following algorithm:
- Search binary for
"\x54\x49\x4D\x32". - Read version (2 bytes → std::uint16_t)
- Read number of images (2 bytes → std::uint16_t)
for (std::uint16_t i = 0; i < nImages; ++i)- Read total image length (2 bytes → std::uint32_t)
- Read (total image length - 4) additional bytes
Thereby, it may happen that the data which is read isn't actually such TIM2 image. Thus, the read may result in an amount of garbage bytes. It even may attempt to exceed the end of total binary data. The latter case would be a clear indicator for a wrong attempt which has to be discarded.
Some of the header entries seem to allow only specific values e.g. Bits Per Pixel which seems to allow values in the range [1, 5] only. This could be used as additional indicator whether (or not) data is actually a TIM2 image.
All read data has to be written as is to a new file. As mentioned in Marks comment, a suitable image viewer can be used to probe the data (whether) it forms a valid TIM2 image.
Scheff's Cat
- 19,528
- 6
- 28
- 56
-
thanks Scheff for the aid! So I found the hex value 54 49 4D 32 in the file; in fact, multiple of them in the file. Giving that I've found these hex values here, and that are 12 of them, I can suspect now there are such .tm2 image files in them. – Dwight Nov 12 '18 at 08:34
-
@Dwight Not sure. (_Though, the occurrence of this sequence is no garanty to start a TIM2 image_) It could also be just a string `"TIM2"`. The latter would probably be suffixed by a `00` as C strings usually end with `'\0'` (which is implicitly added to C string constants by the compiler). To increase the probability that you really found a TIM2 image, you could evaluate the following bytes according to the format specification. – Scheff's Cat Nov 12 '18 at 08:55
-
@Dwight Btw. the format specification denotes a _Number of Images_ field. I guess, TIM2 is a container format (like e.g. TIFF and other image formats) i.e. there might be multiple images in a TIM2 image file. Somewhere else, I read _Little endian_. I.e. the value of the 6th byte + 256 * the value of the 7th byte provides the number of images. – Scheff's Cat Nov 12 '18 at 08:57
-
Since there is indeed a .tm2 in this file, what process would I take to potentially extract such from this archive? – Dwight Nov 13 '18 at 00:39
-
-
A similar technique is used in this answer so you can see how to look for the byte offset and extract the image https://stackoverflow.com/a/53105237/2836621 – Mark Setchell Nov 13 '18 at 07:22
-
Note also that most image editors will just ignore extraneous data after the end of an image file, maybe just emitting a warning, so you could probably copy from the start of image marker all the way to the end of file and the first time you open the image the spare data will get discarded. – Mark Setchell Nov 13 '18 at 07:38
-
**ImageMagick** appears to be able to read TIM files, not sure if that implies TIM2 as well. If you provide a link to your file, I can check very easily for you. – Mark Setchell Nov 13 '18 at 07:40
-
@MarkSetchell _you could probably copy from the start of image marker all the way to the end of file_ This is what I head in mind. (May be, I should've written it also.) ;-) – Scheff's Cat Nov 13 '18 at 07:41
-
Thanks for the extended answer, Mark. ImageMagick cannot read .tm2 images in particular. @Scheff I am going to try that now. This is the file archive: https://drive.google.com/file/d/1NOgLhAPWDMYI2zxgslqYQKhbOUSLe1Zv/view?usp=sharing – Dwight Nov 14 '18 at 04:26
-
I don't mean to detract from or compete with your answer, I just wanted to add what I know and it is too much for a simple comment. I hope you understand. – Mark Setchell Nov 14 '18 at 15:46
0
You can look for the TIM2 markers in the file (as suggested in @Scheff's excellent answer) like this:
grep -abo TIM2 *as7
Output
12393:TIM2
161807:TIM2
363423:TIM2
506898:TIM2
698326:TIM2
844032:TIM2
1053892:TIM2
1242285:TIM2
1454184:TIM2
1580438:TIM2
1817300:TIM2
1944930:TIM2
This tells you the byte offsets of where the TIM2 markers are. You can then extract the first file with:
dd if=file.as7 bs=12393 skip=1 > 1.tm2
and the second with:
dd if=file.as7 bs=161807 skip=1 > 2.tm2
and so on.
If you then dump the first TIM2 file in hex you get this:
xxd 1.tm2
Output
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 027c 9c7c 9c7c ...2e..;.`.|.|.|
00000030: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
00000040: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
I can't find a viewer for the moment, but may continue adding anything I come up with here.
I looked at the first few bytes of all 12 TIM2 files and it appears to me that they are all version 4 not version 2 because they all start with:
5449 4d32 0400
which makes TIM2 followed by 4.
10.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 022c 9c80 9a06 ...2e..;.`.,....
00000030: fd07 0002 ed0a ef0a f30a d295 98c9 c9da ................
00000040: f7fc fcfc fcfc fcfb fbfb faf9 f9f7 f3f0 ................
11.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 027c 9c7c 9c7c ...2e..;.`.|.|.|
00000030: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
00000040: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
12.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 022c 9c1e e30e ...2e..;.`.,....
00000030: e380 990a f8ff a0a0 c0c0 e0f0 f4f3 f4f3 ................
00000040: f3f3 f7ee eff3 efee dee7 efe8 eff7 e7ef ................
2.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 022c 9c9c ae8a ...2e..;.`.,....
00000030: a2b7 8a68 80a2 807a 807a 8a6c 546c 806c ...h...z.z.lTl.l
00000040: 7048 545d 160d 1012 1419 1001 9e01 709d pHT]..........p.
3.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 027c 9c7c 9c7c ...2e..;.`.|.|.|
00000030: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
00000040: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
4.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 022c 9c97 f2f2 ...2e..;.`.,....
00000030: f2f2 f2ed ede6 e0d4 cfca b982 6553 4c4c ............eSLL
00000040: 3f3f 53b1 b0a2 0360 829f 9e9e 0152 0d57 ??S....`.....R.W
5.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 027c 9c7c 9c7c ...2e..;.`.|.|.|
00000030: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
00000040: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
6.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 022c 9cff 4f6f ...2e..;.`.,..Oo
00000030: 8a90 7e90 b7b3 adb3 d7e4 c26b 3838 455e ..~........k88E^
00000040: b5df bca8 5e31 1f39 6f6f 1e2b 351c 231e ....^1.9oo.+5.#.
7.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 025c 9c0b 1903 ...2e..;.`.\....
00000030: 1c07 200b cb0b dc9e 5758 594b 3f3f 3e37 .. .....WXYK??>7
00000040: 9a7f 9894 7b66 3c28 201b 5b86 a2a4 b3bc ....{f<( .[.....
8.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 022c 9cff f6f6 ...2e..;.`.,....
00000030: f6f6 f5f5 f6f6 f6f4 f4f6 f4f4 f4ea ecec ................
00000040: eaea ecf1 fcfc fcfc fcfc fcfc fcfa fcfa ................
9.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 027c 9c7c 9c7c ...2e..;.`.|.|.|
00000030: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
00000040: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
a.tm2
00000000: 5449 4d32 0400 0118 9c85 3004 0400 0004 TIM2......0.....
00000010: 043b 9204 0030 0000 0100 0103 0500 0200 .;...0..........
00000020: 0200 0032 6502 003b 8160 027c 9c7c 9c7c ...2e..;.`.|.|.|
00000030: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
00000040: 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c 9c7c .|.|.|.|.|.|.|.|
Mark Setchell
- 191,897
- 31
- 273
- 432
-
Mark, this tool can view .tm2 images and provide format info: https://drive.google.com/file/d/1z4cIOHyNZHXbQAHvX-y8fDi1EgLLwudn/view?usp=sharing – Dwight Nov 15 '18 at 01:15
-
He didn't show me how to dump/extract the file with that line. "dd if=file.as7 bs=12393 skip=1 > 1.tm2" – Dwight Nov 15 '18 at 20:46
-
-
I have extracted one for you and put it at http://thesetchells.com/StackOverflow/1.tm2 – Mark Setchell Nov 15 '18 at 21:06
-
Do I use that command in cmd? The extracted 1.tm2 is invalid; as in 'illegal bit depth'. I'd also like to read the compression data from the .tm2 file. – Dwight Nov 15 '18 at 23:56
-
Yes, you would run that in a Linux Terminal, but no need, I have done it already and looked at all the files for you. I am pretty sure we are extracting the correct thing but I guess your viewer maybe cannot deal with v4 files. – Mark Setchell Nov 16 '18 at 08:10
-
all .tm2 tools cannot view or open that 1.tm2, it had illegal data and bit depth. And I'm not running Linux, I'm running Windows. I don't see instructions to run that command in cmd. – Dwight Nov 16 '18 at 22:49
-
also, the version of these .tm2 is "216". https://i.postimg.cc/Kc56mDcT/format.png – Dwight Nov 16 '18 at 22:52
-