zoukankan      html  css  js  c++  java
  • 多媒体文件格式探测⑨

    [时间:2016-07] [状态:Open]

    1. 引言

    前边整理了很多关于标准容器的资料,有点偏重理论化,本篇整理下实际点的,并结合ffmpeg的probe机制,分析下如何实现多媒体格式的探测(probe)。
    希望读完本文后,读者可以理解ffmpeg对avi、rm/rmvb、mkv、mp4、asf/wmv、ts、flv等文件探测的实现原理。

    注意本文引用的FFmpeg 3.1,其他版本可能源码目录不太一样,但原理基本一致。

    2. FFmpeg探测机制

    探测的前提是我们有一段媒体数据,基本原理就是根据媒体封装格式的特点,对全部已知的格式进行判断并设置一个分值,取其中最高的分值。
    FFmpeg中实现探测的函数是av_probe_input_buffer2av_probe_input_format3。其核心代码如下:

    // code in av_probe_input_format3 (segment)
    while ((fmt1 = av_iformat_next(fmt1))) {
        if (!is_opened == !(fmt1->flags & AVFMT_NOFILE) && strcmp(fmt1->name, "image2"))
            continue;
        score = 0;
        if (fmt1->read_probe) {
            score = fmt1->read_probe(&lpd);
            if (score)
                av_log(NULL, AV_LOG_TRACE, "Probing %s score:%d size:%d
    ", fmt1->name, score, lpd.buf_size);
            if (fmt1->extensions && av_match_ext(lpd.filename, fmt1->extensions)) {
                switch (nodat) {
                case NO_ID3:
                    score = FFMAX(score, 1);
                    break;
                case ID3_GREATER_PROBE:
                case ID3_ALMOST_GREATER_PROBE:
                    score = FFMAX(score, AVPROBE_SCORE_EXTENSION / 2 - 1);
                    break;
                case ID3_GREATER_MAX_PROBE:
                    score = FFMAX(score, AVPROBE_SCORE_EXTENSION);
                    break;
                }
            }
        } else if (fmt1->extensions) {
            if (av_match_ext(lpd.filename, fmt1->extensions))
                score = AVPROBE_SCORE_EXTENSION;
        }
        if (av_match_name(lpd.mime_type, fmt1->mime_type)) {
            if (AVPROBE_SCORE_MIME > score) {
                av_log(NULL, AV_LOG_DEBUG, "Probing %s score:%d increased to %d due to MIME type
    ", fmt1->name, score, AVPROBE_SCORE_MIME);
                score = AVPROBE_SCORE_MIME;
            }
        }
        if (score > score_max) {
            score_max = score;
            fmt       = fmt1;
        } else if (score == score_max)
            fmt = NULL;
    }
    

    上面代码的原理就是优先使用demuxer的read_probe函数,然后参考文件名的后缀。至于AVInputFormat的定义,建议参考http://ffmpeg.org/doxygen/3.1/structAVInputFormat.html。

    read_probe实现

    一般probe有两种情况。
    对于在文件开头存在特征码的封装格式,比如avi、rm/rmvb、flv、mkv、asf可以直接使用特征码。
    AVI的特征码是RIFF AVI ,下面是FFmpeg中的avi探测函数实现:

    // from libavformat/avidec.c
    static const char avi_headers[][8] = {
        { 'R', 'I', 'F', 'F', 'A', 'V', 'I', ' '  },
        { 'R', 'I', 'F', 'F', 'A', 'V', 'I', 'X'  },
        { 'R', 'I', 'F', 'F', 'A', 'V', 'I', 0x19 },
        { 'O', 'N', '2', ' ', 'O', 'N', '2', 'f'  },
        { 'R', 'I', 'F', 'F', 'A', 'M', 'V', ' '  },
        { 0 }
    };
    static int avi_probe(AVProbeData *p)
    {
        int i;
    
        /* check file header */
        for (i = 0; avi_headers[i][0]; i++)
            if (AV_RL32(p->buf    ) == AV_RL32(avi_headers[i]    ) &&
                AV_RL32(p->buf + 8) == AV_RL32(avi_headers[i] + 4))
                return AVPROBE_SCORE_MAX;
    
        return 0;
    }
    

    rm/rmvb文件的特征码是.RMF.ra,下面是FFmpeg中rm探测函数:

    // from libavformat/rmdec.c
    static int rm_probe(AVProbeData *p)
    {
        /* check file header */
        if ((p->buf[0] == '.' && p->buf[1] == 'R' &&
             p->buf[2] == 'M' && p->buf[3] == 'F' &&
             p->buf[4] == 0 && p->buf[5] == 0) ||
            (p->buf[0] == '.' && p->buf[1] == 'r' &&
             p->buf[2] == 'a' && p->buf[3] == 0xfd))
            return AVPROBE_SCORE_MAX;
        else
            return 0;
    }
    

    flv文件的特征码是FLV ,下面是FFmpeg中flv探测函数:

    // from libavformat/flvdec.c
    static int probe(AVProbeData *p, int live)
    {
        const uint8_t *d = p->buf;
        unsigned offset = AV_RB32(d + 5);
    
        if (d[0] == 'F' &&
            d[1] == 'L' &&
            d[2] == 'V' &&
            d[3] < 5 && d[5] == 0 &&
            offset + 100 < p->buf_size &&
            offset > 8) {
            int is_live = !memcmp(d + offset + 40, "NGINX RTMP", 10);
    
            if (live == is_live)
                return AVPROBE_SCORE_MAX;
        }
        return 0;
    }
    
    static int flv_probe(AVProbeData *p)
    {
        return probe(p, 0);
    }
    

    mkv的特征码就是EBML_Header_ID和已知的DocType,下面是FFmpeg的mkv探测函数:

    // from libavformat/matroskadec.c
    /* top-level master-IDs */
    #define EBML_ID_HEADER             0x1A45DFA3
    static int matroska_probe(AVProbeData *p)
    {
        uint64_t total = 0;
        int len_mask = 0x80, size = 1, n = 1, i;
    
        /* EBML header? */
        if (AV_RB32(p->buf) != EBML_ID_HEADER)
            return 0;
    
        /* length of header */
        total = p->buf[4];
        while (size <= 8 && !(total & len_mask)) {
            size++;
            len_mask >>= 1;
        }
        if (size > 8)
            return 0;
        total &= (len_mask - 1);
        while (n < size)
            total = (total << 8) | p->buf[4 + n++];
    
        /* Does the probe data contain the whole header? */
        if (p->buf_size < 4 + size + total)
            return 0;
    
        /* The header should contain a known document type. For now,
         * we don't parse the whole header but simply check for the
         * availability of that array of characters inside the header.
         * Not fully fool-proof, but good enough. */
        for (i = 0; i < FF_ARRAY_ELEMS(matroska_doctypes); i++) {
            size_t probelen = strlen(matroska_doctypes[i]);
            if (total < probelen)
                continue;
            for (n = 4 + size; n <= 4 + size + total - probelen; n++)
                if (!memcmp(p->buf + n, matroska_doctypes[i], probelen))
                    return AVPROBE_SCORE_MAX;
        }
    
        // probably valid EBML header but no recognized doctype
        return AVPROBE_SCORE_EXTENSION;
    }
    

    ASF/WMV文件的特征码就是ASF_HEADER_GUID,下面是FFmpeg中asf探测函数:

    // from libavformat/asfdec_f.c
    const ff_asf_guid ff_asf_header = {
        0x30, 0x26, 0xB2, 0x75, 0x8E, 0x66, 0xCF, 0x11, 0xA6, 0xD9, 0x00, 0xAA, 0x00, 0x62, 0xCE, 0x6C
    };
    static int asf_probe(AVProbeData *pd)
    {
        /* check file header */
        if (!ff_guidcmp(pd->buf, &ff_asf_header))
            return AVPROBE_SCORE_MAX;
        else
            return 0;
    }
    

    MP4文件是由不同BOX构成的,需要根据box type来探测实际类型,FFmpeg中mp4探测函数(也包括mov,m4a,3gp,3g2)如下:

    static int mov_probe(AVProbeData *p)
    {
        int64_t offset;
        uint32_t tag;
        int score = 0;
        int moov_offset = -1;
    
        /* check file header */
        offset = 0;
        for (;;) {
            /* ignore invalid offset */
            if ((offset + 8) > (unsigned int)p->buf_size)
                break;
            tag = AV_RL32(p->buf + offset + 4);
            switch(tag) {
            /* check for obvious tags */
            case MKTAG('m','o','o','v'):
                moov_offset = offset + 4;
            case MKTAG('m','d','a','t'):
            case MKTAG('p','n','o','t'): /* detect movs with preview pics like ew.mov and april.mov */
            case MKTAG('u','d','t','a'): /* Packet Video PVAuthor adds this and a lot of more junk */
            case MKTAG('f','t','y','p'):
                if (AV_RB32(p->buf+offset) < 8 &&
                    (AV_RB32(p->buf+offset) != 1 ||
                     offset + 12 > (unsigned int)p->buf_size ||
                     AV_RB64(p->buf+offset + 8) == 0)) {
                    score = FFMAX(score, AVPROBE_SCORE_EXTENSION);
                } else if (tag == MKTAG('f','t','y','p') &&
                           (   AV_RL32(p->buf + offset + 8) == MKTAG('j','p','2',' ')
                            || AV_RL32(p->buf + offset + 8) == MKTAG('j','p','x',' ')
                        )) {
                    score = FFMAX(score, 5);
                } else {
                    score = AVPROBE_SCORE_MAX;
                }
                offset = FFMAX(4, AV_RB32(p->buf+offset)) + offset;
                break;
            /* those are more common words, so rate then a bit less */
            case MKTAG('e','d','i','w'): /* xdcam files have reverted first tags */
            case MKTAG('w','i','d','e'):
            case MKTAG('f','r','e','e'):
            case MKTAG('j','u','n','k'):
            case MKTAG('p','i','c','t'):
                score  = FFMAX(score, AVPROBE_SCORE_MAX - 5);
                offset = FFMAX(4, AV_RB32(p->buf+offset)) + offset;
                break;
            case MKTAG(0x82,0x82,0x7f,0x7d):
            case MKTAG('s','k','i','p'):
            case MKTAG('u','u','i','d'):
            case MKTAG('p','r','f','l'):
                /* if we only find those cause probedata is too small at least rate them */
                score  = FFMAX(score, AVPROBE_SCORE_EXTENSION);
                offset = FFMAX(4, AV_RB32(p->buf+offset)) + offset;
                break;
            default:
                offset = FFMAX(4, AV_RB32(p->buf+offset)) + offset;
            }
        }
        if(score > AVPROBE_SCORE_MAX - 50 && moov_offset != -1) {
            /* moov atom in the header - we should make sure that this is not a
             * MOV-packed MPEG-PS */
            offset = moov_offset;
    
            while(offset < (p->buf_size - 16)){ /* Sufficient space */
                   /* We found an actual hdlr atom */
                if(AV_RL32(p->buf + offset     ) == MKTAG('h','d','l','r') &&
                   AV_RL32(p->buf + offset +  8) == MKTAG('m','h','l','r') &&
                   AV_RL32(p->buf + offset + 12) == MKTAG('M','P','E','G')){
                    av_log(NULL, AV_LOG_WARNING, "Found media data tag MPEG indicating this is a MOV-packed MPEG-PS.
    ");
                    /* We found a media handler reference atom describing an
                     * MPEG-PS-in-MOV, return a
                     * low score to force expanding the probe window until
                     * mpegps_probe finds what it needs */
                    return 5;
                }else
                    /* Keep looking */
                    offset+=2;
            }
        }
    
        return score;
    }
    

    对于像TS这种流媒体格式,通常通过0x47同步字节和pid判断,FFmpeg中ts的探测函数如下:

    // from libavformat/mpegts.c
    static int analyze(const uint8_t *buf, int size, int packet_size,
                       int probe)
    {
        int stat[TS_MAX_PACKET_SIZE];
        int stat_all = 0;
        int i;
        int best_score = 0;
    
        memset(stat, 0, packet_size * sizeof(*stat));
    
        for (i = 0; i < size - 3; i++) {
            if (buf[i] == 0x47) {
                int pid = AV_RB16(buf+1) & 0x1FFF;
                int asc = buf[i + 3] & 0x30;
                if (!probe || pid == 0x1FFF || asc) {
                    int x = i % packet_size;
                    stat[x]++;
                    stat_all++;
                    if (stat[x] > best_score) {
                        best_score = stat[x];
                    }
                }
            }
        }
    
        return best_score - FFMAX(stat_all - 10*best_score, 0)/10;
    }
    static int mpegts_probe(AVProbeData *p)
    {
        const int size = p->buf_size;
        int maxscore = 0;
        int sumscore = 0;
        int i;
        int check_count = size / TS_FEC_PACKET_SIZE;
    #define CHECK_COUNT 10
    #define CHECK_BLOCK 100
    
        if (!check_count)
            return 0;
    
        for (i = 0; i<check_count; i+=CHECK_BLOCK) {
            int left = FFMIN(check_count - i, CHECK_BLOCK);
            int score      = analyze(p->buf + TS_PACKET_SIZE     *i, TS_PACKET_SIZE     *left, TS_PACKET_SIZE     , 1);
            int dvhs_score = analyze(p->buf + TS_DVHS_PACKET_SIZE*i, TS_DVHS_PACKET_SIZE*left, TS_DVHS_PACKET_SIZE, 1);
            int fec_score  = analyze(p->buf + TS_FEC_PACKET_SIZE *i, TS_FEC_PACKET_SIZE *left, TS_FEC_PACKET_SIZE , 1);
            score = FFMAX3(score, dvhs_score, fec_score);
            sumscore += score;
            maxscore = FFMAX(maxscore, score);
        }
    
        sumscore = sumscore * CHECK_COUNT / check_count;
        maxscore = maxscore * CHECK_COUNT / CHECK_BLOCK;
    
        ff_dlog(0, "TS score: %d %d
    ", sumscore, maxscore);
    
        if        (check_count > CHECK_COUNT && sumscore > 6) {
            return AVPROBE_SCORE_MAX   + sumscore - CHECK_COUNT;
        } else if (check_count >= CHECK_COUNT && sumscore > 6) {
            return AVPROBE_SCORE_MAX/2 + sumscore - CHECK_COUNT;
        } else if (check_count >= CHECK_COUNT && maxscore > 6) {
            return AVPROBE_SCORE_MAX/2 + sumscore - CHECK_COUNT;
        } else if (sumscore > 6) {
            return 2;
        } else {
            return 0;
        }
    }
    

    3. 总结

    说白了,媒体文件封装格式的探测都是通过其标准定义的特征字段及结构进行匹配检索。只要对封装格式有所了解基本上可以快速的确定文件封装格式。

  • 相关阅读:
    吾爱破解 培训第十课:探寻逆向新航标x64平台脱壳与破解实战 笔记
    吾爱破解 培训第八、九课:短兵相接深入浅出探讨脱壳细节 笔记
    十大经典排序算法(转自 www.runoob.com)
    吾爱破解 培训第一课:破解基础知识之介绍常见工具和壳的特征 笔记
    吾爱破解 培训第三课:改头换面之修改版权和资源 笔记
    吾爱破解 软件虚拟机保护分析资料整理 笔记
    吾爱破解 新手脱壳破解常见问题 笔记
    吾爱破解 培训第七课:手把手教你从实例看如何攻破常见的网络验证 笔记
    吾爱破解 培训第五课:反击作者的挑衅实战解除程序重启验证 笔记
    GDB基础
  • 原文地址:https://www.cnblogs.com/tocy/p/media_container_9-probe-utility.html
Copyright © 2011-2022 走看看