n.kindt - 2013-11-20

Getting started

This page shows how to use PixelDbg to open an unknown archive, go through it, adjust various interpretation parameters and discover an image. This page demonstrates version 0.7 and PixelDbg might change/improve in the future to make pixel hunting easier and more convenient.

1. Opening any file

Following image shows how to open a file from a specified offset. I.e. a bitmap file format has 54 bytes occupied by the file header which can be skipped by specifying 54 bytes in the offset field. This will load the bitmap pixels directly without interpreting the bitmap header as an image.

Opening unknown file

2. Displayed data

Opening any archive will most likely show pixel noise and weird looking images as shown in the image below. The highlighted data field shows the top-left pixels that are displayed in the window on the right. By adding or removing any bytes in the data field the image can shift and change colors. This can help with the reconstruction process as described in 5..

Opened file and it's image

3. Pixel format and scanline size

Current data is interpreted as BGR_888 pixel format with 24 bpp (default settings). This means that after every 3 characters/bytes in the data field a new pixel will follow in the displayed image. The size at which the data stream is shown is specified by the window size. The window size can be resized by using the mouse or typed directly into the width and height fields to adjust the scanline size.

Following image shows the highlighted pixel format and a resized window for an image width of 640 pixels (640 * 3 bytes = 1920 bytes for one scanline). Note how a pattern starts to emerge from the pixel garbage shown before because of the adjusted scanline size (727 -> 640).

Pixel format and stride

4. Experimenting with data interpretation

We now can see something representing an image. Most likely we can't clearly see it because the image uses another pixel format then the one specified. We can try to adjust the pixel format as well and see what happens. We start by telling PixelDbg to interpret the data stream as 16 bpp image. This means that instead of every 3 bytes now every 2 bytes will produce a valid pixel.

There are multiple 16 bpp formats. By typing directly in the RGBA bits field we can try most of them out (i.e. 4.4.4.4, 5.5.5.1 or 5.6.5.0).

Next image shows the data stream interpreted as 5.6.5.0 image. No alpha is set and only 16 bpp are used for each pixel. We can clearly see an image appearing now but yet still in a wrong color set.

Note: Alpha is always ignored and no blending occurs. Alpha can be shown separately with 0.0.0.8 bits and RGBA channel order.

BGR_565 format

5. Shifting data

The image in the archive seems to be stored as 16 bpp and 640 width because it perfectly fits into the displayed image on the right side. To get the final image we might need to remove couple of bytes in the data field as this will move the 16 bpp pixels to correct pixel boundary.

Following image shows the displayed image when some bytes are removed from the data field. We now have a clear image of something.

Removed bytes

6. Setting correct file offset

The image looks correct except that we would like it to be aligned properly to the top-left corner. To do this we simply need to specify the correct file offset where the pixels are located and re-load the file. To find the correct file offset press the CTRL-key and navigate to the image position that should be displayed at the top-left corner. When this happens the offset field becomes yellow and the mouse cursors turns into a cross.

Next image shows where we want our cursor to be in order to move that position to the top-left corner of our image. After picking an offset the file must be reloaded. This can be done automatically if the Auto checkbox is checked. If Auto mode is enabled the file is reloaded every time an offset is picked and CTRL-key released.

Note: It can happen that after picking an offset the loaded data might land on a wrong pixel boundary again. To fix that we just need to remove the appropriate amount of bytes in the data field as described in 5..

Picking file offset

7. Saving the image

We have the image now properly aligned to top-left corner and are ready to save it. The Save image button will save everything that is currently visible on the right side. The image on the right now shows our reconstructed image and another image that follows in the archive. To remove the bits of the next image that follows immediately we can simply change the height of the window to 480.

Next image shows the final result. The located image is thus of size 640x480x2 (16 bpp).

Final image

8. Conclusion
We went from whats displayed on the left to whats displayed on the right.

Conclusion

 

Last edit: n.kindt 2013-11-20