Hi Matt, On Fri, Sep 17, 2004 at 03:43:34PM +0100, Matt wrote: > Daniel Lord wrote: > > 0xFFFE is the comment Marker in a JPEG. So it's not that bad to > > detect. It ist followed by the length field. With is where the > > Problem occures. So you have to detect the following sequence from > > the beginning of the JPEG. > > > > ffd8 <- SoI marker > > ffe0 <- APP0 marker > > 0010 <- lenght of APP0 including those 2 Bytes. > > 4a46 4946 00 <- string JFIF terminated with 0x00 > > 010[012] <- common Version number. (May differ) -> 0?0? > > 0[012] <- NA; p/" ; p/cm -> 0? > > 0010 <- vertical resolution -> ???? > > 0010 <- horizontal resolution -> ???? > > 0000 <- preview resolution -> ???? > > fffe <- comment marker > > 000[01] <- bad comment length -> 000? > > I'm going to have to ask, what base system util will extract the info > from a jpeg to allow you to examine for these strings?
Not shure if I got your question right. Hexedit is the tool to get the bytes (not strings). The rest is knowlegde of the JFIF fileformat. And some (>20000) samples to prove that the format is implemented widely this way. :) Greetings Daniel -- "Golden rule of Sourcecode: 50% are comments, and the other 50% bugs!" ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Clamav-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/clamav-users
