12.07.2015 Views

Bug Hunter Diary

Bug Hunter Diary

Bug Hunter Diary

SHOW MORE
SHOW LESS
  • No tags were found...

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Step 1: Find a Sample 4X Movie File with a Valid strk ChunkI used the following to get a sample file from http://samples.mplayerhq.hu/.linux$ wget -q http://samples.mplayerhq.hu/game-formats/4xm/TimeGatep01s01n01a02_2.4xm→After downloading the file, I renamed it original.4xm.Step 2: Learn About the Layout of the strk ChunkAccording to the 4X movie file format description, a strk chunk hasthe following structure:bytes 0-3 fourcc: 'strk'bytes 4-7 length of strk structure (40 or 0x28 bytes)bytes 8-11 track numberbytes 12-15 audio type: 0 = PCM, 1 = 4X IMA ADPCMbytes 16-35 unknownbytes 36-39 number of audio channelsbytes 40-43 audio sample ratebytes 44-47 audio sample resolution (8 or 16 bits)The strk chunk of the downloaded sample file starts at file offset0x1a6, as shown in Figure 4-4:&header[i](1) (2) (3)000001a0h: 32 2E 77 61 76 00 73 74 72 6B 28 00 00 00 00 00 ; 2.wav.strk(.....000001b0h: 00 00 00 00 00 00 00 00 04 00 D1 07 00 00 2F 00 ; ..........Ñ.../.(4)Figure 4-4: A strk chunk from the 4X movie sample file I downloaded. The numbersshown are referenced in Table 4-1.Table 4-1 describes the layout of the strk chunk illustrated inFigure 4-4.Table 4-1: Components of strk Chunk Layout Shown in Figure 4-4Reference Header offset Description(1) &header[i] fourcc: 'strk'(2) &header[i+4] length of strk structure (0x28 bytes)(3) &header[i+8] track number (this is the current_track variable fromFFmpeg source code)(4) &header[i+12] audio type (this is the value that gets written at thefirst dereferenced memory location)NULL Pointer FTW 57

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!