BMP file structure

[From network] The format of the BMP file storage structure can be defined in wingdi. h file in windows. A bmp file consists of four parts: the bitmap file header, bitmap information header, palette, and image data, as shown in table 5-1. Table 5-1 Composition of the BMP file Bitmap-File Header) Bitmap-Information Header) Color Table/color palette) Bitmap data) The following describes the details of each component. 1. Bitmap header) The bitmap-file header contains the image type, image size, image data storage address, and two reserved unused fields. Open the wingdi. h file and search for "bitmapfileheader" to locate the data structure definition of the BMP file's bitmap file header. Typedef struct tagbitmapfileheader { Word bftype; DWORD bfsize; Word bfreserved1; Word bfreserved2; DWORD bfoffbits; } Bitmapfileheader, far * lpbitmapfileheader, * pbitmapfileheader; Table 5-2 lists the meanings of fields in tagbitmapfileheader. Table 5-2 tagbitmapfileheader Structure Segment name Size (unit: bytes) Description Bftype 2 Bitmap category, based on different operations Different systems, in Windows , The value of this field is always 'bm' Bfsize 4 BMP Image File Size Bfreserved1 2 Total 0 Bfreserved2 2 Total 0 Bfoffbits 4 Address of BMP Image Data 2. Bitmap header) The bitmap-Information header contains the size of the bitmap information header, the image width and height, the image color depth, and compression, which indicate the size of the image data and other parameters. Open the wingdi. h file and search for "tagbitmapinfoheader" to locate the data structure definition of the BMP file's bitmap information header. Typedef struct tagbitmapinfoheader { DWORD bisize; Long biwidth; Long biheight; Word biplanes; Word bibitcount; DWORD bicompression; DWORD bisizeimage; Long bixpelspermeter; Long biypelspermeter; DWORD biclrused; DWORD biclrimportant; } Bitmapinfoheader, far * lpbitmapinfoheader, * pbitmapinfoheader; Table 5-3 lists the meanings of fields in tagbitmapfileheader. Table 5-3 tagbitmapfileheader Structure Segment name Size (Unit: Bytes) Description Bisize 4 The size of this structure varies with operating systems. In Windows, the total value of this field is 28 h bytes = 40 bytes. Biwidth 4 BMP image width, in pixels Biheight 4 Total 0 Biplanes 2 Total 0 Bibitcount 2 The color depth of a BMP image, that is, how many bits are used to represent a pixel. common values include 1, 4, 8, 16, 24, and 32, corresponding to monochrome, 16 colors, 256 colors, 16-bit high color, 24-bit real color, and 32-bit enhanced real color Bicompression 4 Compression mode. 0 indicates no compression, 1 indicates rle8 compression, 2 indicates rle4 compression, and 3 indicates that each pixel value is determined by the specified mask. Bisizeimage 4 BMP image data size, which must be a multiple of 4. When the image data size is not a multiple of 4, fill it with 0. Bixpelspermeter 4 Horizontal resolution, in pixels/m Biypelspermeter 4 Vertical Resolution, in pixels/m Biclrused 4 The color used by the BMP image. 0 indicates that all colors are used. For a 256-color bitmap, the value is 100 h = 256. Biclrimportant 4 Number of important colors. If this value is 0, all colors are important. For BMP images using the color palette, this value is used to assist the driver when the video card cannot display all colors.ProgramDisplay color

3. Color Table/color table) Color Table/color table is unique to monochrome, 16-color, and 256-color image files. The corresponding color palette sizes are 2, 16, and 256. The color palette is in 4 bytes, each 4 bytes stores a color value. The image data points to the palette index. You can think of the color palette as an array. The size of each array element is 4 bytes. Assume that the palette data of a 256-color BMP image is: Color Palette [0] = Black, color palette [1] = white, color palette [2] = red, color palette [3] = blue... Color Palette [255] = yellow Image Data 01 00 02 FF indicates that the image color is displayed by calling the data in the palette [1], palette [0], palette [2], and palette [255. In early computers, the video card is relatively backward and may not necessarily display all colors. Therefore, the color data in the color palette should be arranged in order as far as possible, the biclrimportant field in the Bitmap header specifies the number of colors that are important. Each color palette is 4 bytes in size and stores a color value in blue, green, and red. Open the wingdi. h file and search for "tagrgbtriple" to locate the data structure definition of the BMP file palette. Typedef struct tagrgbquad { Byte rgbblue; Byte rgbgreen; Byte rgbred; Byte rgbreserved; } Rgbquad; Table 5-4 lists the meanings of each field in tagrgbtriple. Table 5-4 tagrgbtriple Structure Segment name Size (unit: bytes) Description Rgbblue 1 Blue Value Rgbgreen 1 Green Value Rgbred 1 Red Value Rgbreserved 1 Reserved, total 0 4. Bitmap data) If the image is monochrome, 16, and 256 colors, the bitmap data follows the color palette, And the bitmap data points to the index number of the color palette. If the bitmap is a 16-bit, 24-bit, and 32-bit color, the color palette is not retained in the image file, that is, the color of the image is directly given in the bitmap data. A 16-bit image uses two bytes to store color values. There are two common formats: 5-bit red, 5-Bit green, 5-bit blue, and 5-bit red, 6-Bit green, and 5-bit blue, that is, the 555 format and the 565 format. The 555 format only uses 15 bits, and the last bits are retained, set to 0. The 24-bit image uses three bytes to save the color value. Each byte represents a color, which is arranged in red, green, and blue. The 32-bit image uses 4 bytes to save the color value. Each byte represents a color, in addition to the original red, green, blue, and Alpha channels, that is, the transparent color. If the image has a color palette, you can select compression or not compression as needed. If you select compression, the BMP image is 16 or 256 colors, rle4 or rle8 compression algorithm is used for compression. Rle4 compresses 16-color image data, while rle4 compresses data in the form shown in Table 5-5. Table 5-5 rle4 Compression Method Solutions 1 byte 2 bytes 3 bytes 4 bytes N Bytes A Repeated times Color index       B Set to 0 Valid Color index count Color index Color index Color index... Assume that the following 16-color bitmap data is 20 bytes in total, and the data is compressed using rle4: 05 00 04 05 00 08 09 05 04 00 04 05 08 09 04 08 07 01 00 00 When extracting the data, read 05 first. Because 05 is not equal to 0, select Solution A. According to solution a, 05 indicates the number of Data repeat times, and then read, 00 indicates there are two color indexes, each index occupies four places. The first pixel is in the upper four places, and the second pixel is in the lower four places. That is, the middle and low pixels in a single byte are in the upper position and the high pixels are in the lower position. After 05 00 decompression, It is equal to 00 00 0. Read 04, select solution a, parse according to the above operation, 04 is the number of Data repeat after, 05 is two color indexes, 3rd color indexes are 5, the index of the 4th colors is 0. 04 05. After decompression, It is equal to 05 05. Read 00, select solution B, and read, which indicates the number of valid color indexes. 00 08 decompress the package and the package is equal to 09 05 04 00. Read 04, select solution a, parse according to the above operation, 04 is the number of Data repeat after, 05 is two color indexes. 04 05. After decompression, It is equal to 05 05. Read 08, select solution a, parse according to the above operation, 08 is the number of Data repeat after, 09 is two color indexes. After decompression, It is equal to 09 09 09. Read 04, select Solution A, and parse it according to the above operation. 04 indicates the number of Data repeat times and 08 indicates two color indexes. 04 08. After decompression, It is equal to 08 08. Read 07, select solution a, parse according to the above operation, 07 is the number of Data repeat after, 01 is two color indexes. 07 01 decompress the package to 01 01 01 0. Read 00, select B solution, read, 00 indicates the number of valid color indexes, 0 indicates no, that is, extract a row of data. Based on the above operations, the extracted data is: 00 00 00 50 90 50 40 00 50 90 90 90 80 80 10 10 It seems that the data size is the same as the original data size and does not reflect the compression effect. This is because the above example only selects 20 bytes of data, and there are not many duplicate data in the 20 bytes of data, when RLE is used to compress data with a small amount of duplicate data, the size may be larger than the original data. In fact, when the data is large and repetitive, the RLE compression effect is still ideal. For the rle8 compression method, refer to the preceding rle4 decompression method. The only difference is that rle8 uses one byte to store color indexes, while rle4 uses four-bit to store color indexes. Combined with the analysis of BMP files, the following analyzes the hexadecimal Analysis of BMP images of 256 and 24 colors, and analyzes the file structure in the hexadecimal editor, able to increase the experience of analyzing files. 5-1 and 5-2 are shown in the cat2.bmp and 24-bit BMP images cat1.bmp respectively. The resolution of the cat2.bmp image is 200 × 153, and the file size is 31 680 bytes. The resolution of the cat1.bmp image is 200 × 150, and the file size is 90 056 bytes. Figure 5-1 cat2.bmp Image Figure 5-2 cat1.bmp Image Go to the graph file to analyze cat2.bmp, and open cat2.bmp in winhex, as shown in Figure 5-3. (Click to view the larger image) Figure 5-3 open the cat2.bmp image file in winhex. First, analyze the structure of the bitmap file header, as shown in Figure 5-4. The meanings of fields in the Bitmap header of the cat2.bmp image are analyzed based on the header structure of the BMP file, as shown in table 5-6. (Click to view the larger image) Figure 5-4 cat2.bmp: the bitmap file header of the image file Table 5-6 Definitions of fields in the bitmap file header in cat2.bmp Hexadecimal value Description 42 4d: ASCII value of BM, the BMP File Identifier in Windows C0 7b 00 00 7b c0h = 31680, which is the size of the cat2 File 00 00 00 00 Reserved value, total 0 36 04 00 436 H = 1078, is the address of the image data, that is, the file header + Information header + the length of the palette

Continue to analyze the next data, define the structure of the BMP file, and the next data is the map information header. The contents of the bitmap information header of the cat2.bmp image file are 5-5.

(Click to view the larger image) Figure 5-5 cat2.bmp image bitmap information Header

Table 5-7 represents the meaning of the Bitmap header fields in the cat2.bmp image file.

Table 5-7 definitions of Bitmap header fields in cat2.bmp image files

Hexadecimal value	Description
28 00 00 00:	Size of the Bitmap header of the cat2.bmp Image
C8 00 00 00	00 00 00 C8 = 200, is the width of the cat2 image, in pixels
99 00 00 00	00 00 00 99 = 153, is the height of the cat2 image, in pixels
01 00	Always 1
08 00	00 08 = 8, cat2 image color depth, that is, the 8 power of 2 is equal to 256 colors
00 00 00 00	Compression Method. 0 indicates no compression.
8A 77 00 00	00 00 77 8A = 30602, is the size of the image data of the cat2 image, in bytes
12 0b 00 00	00 00 0b 12 = 2834, horizontal resolution of cat2 images, in pixels/m
12 0b 00 00	00 00 0b 12 = 2834, cat2 image vertical Resolution, in pixels/m
00 00 00 00	The number of colors used by the cat2 image. 0 indicates that all colors are used.
00 00 00 00	Number of important colors in cat2 images. 0 indicates that all colors are important.

Subsequent analysis of the next data, define the structure of the BMP file. Because the cat2.bmp image is a 256-color bitmap, there should be 256 color palette, each of which occupies 4 bytes, and the entire color palette has a total size of 1024 bytes. The color palette data of cat2.bmp image files is shown in Figure 5-6 and Figure 5-7.

(Click to view the big picture) Figure 5-6 cat2.bmp image palette address is stored from 00000036h

(Click to view the big chart) Figure 5-7 cat2.bmp image. The ending address of the color palette data is 00000435 H.

As shown in figures 5-6 and 5-7, the color palette address of cat2.bmp ranges from 00000036h to 00000435 435h, that is, 00000036 H-400 h + 1 = 1024 H = H.

To view the actual display color of the cat2 image palette, open cat2.bmp in Adobe Photoshop csand select "image" → "Mode" → "color table" in the menu bar of Adobe Photoshop CS ", you can view the cat2 palette, as shown in Figure 5-8.

Figure 5-8 view the cat2 palette in Adobe Photoshop CS

The color of the cat2.bmp palette shown in Figure 5-8 corresponds to the hexadecimal data in Figure 5-6. Click the color of any pixel in the Adobe Photoshop CS palette to display the detailed composition of the pixel color. The relationship between cat2.bmp palette and cat2.bmp hexadecimal data is shown in 5-9.

Continue to analyze the following data. According to the definition of the BMP file structure, if an image has a palette, the data that follows the palette is the image data, which is not the actual color value, instead, it refers to the index of the palette array. The color in the palette is obtained based on the index, as shown in 5-10.

(Click to view the big chart) Figure 5-9 correspondence between cat2.bmp color palette and cat2.bmp hexadecimal data

(Click to view the big image) Figure 5-10 image data of cat2.bmp

Because cat2.bmp is a 256-color bitmap, the 8-bit color depth is used as an index pointing to the color palette array. Therefore, we can learn from the data shown in Figure 5-10: 49 49 49 B1 49 49 49 49 49 99347cat2.bmp the color of the 1st pixels in the lower left corner of the bitmap is equal to the color palette [49], and the color of the 2nd pixels is equal to the color palette [49]. the color of 3rd pixels is equal to the color palette [49], and the color of 4th pixels is equal to the color palette [B1]... And so on. After the cat2.bmp image is analyzed, the analysis is cat1.bmp.

The cat1.bmp image is a 24-bit color image. The structure of the BMP file is well known. The cat1.bmp image does not have a color palette. The actual color data is stored in the image data. Each pixel is represented in three bytes, respectively, red, green, and blue. Based on the structure of the map headers and information headers of cat1.bmp and cat2.bmp, the Bitmap header and information header of cat1.bmp can be used to analyze cat2.bmp from the position where the cat1.bmp Bitmap header ends, as shown in Figure 5-11.

(Click to view the big image) Figure 5-11 image data of cat1.bmp Image

From Figure 5-11, we can see the red, green, and Blue values of each pixel, which are stored in reverse mode. Pay attention to this when analyzing the BMP image format.

Through the analysis of the BMP file storage structure, it is found that there is a large amount of repeated data in the bitmap file header and bitmap information header of the BMP file. If you store a large number of BMP bitmaps with the same color and depth, it will inevitably waste a lot of storage space. Therefore, many game programmers will remove the BMP file header and information header and keep only a few necessary information and image data, which of the following fields must be retained in the BMP file header and information header?

Use the winhex file comparison function to compare two 24-bit BMP image files. Observe the differences between the file headers and information headers of the two files, as shown in Figure 5-12.

(Click to view the big image) Figure 5-12 use winhex to compare two 24-bit BMP image files

From Figure 5-12, we can see that there are four different file headers and information headers in two BMP images with the same color depth, they are the file size of the file header, the image width of the Information header, the image height, and the image data size.

Therefore, in many cases, game programmers only retain the file size, image width, image height, and image data size information of image files, and sometimes do not need to retain the file size value, use the image data size value.

when analyzing unknown file storage formats, if you encounter a file with the file header removed, as mentioned above, the BMP file will bring some difficulties to the analysis of unknown file formats. In this case, you need to use the file comparison function of the hex compiler to observe the potential laws of two similar unknown file formats. If the laws are not observed, we can only use the white box analysis method to trace and Debug programs that call this unknown file format. Of course, sometimes inspiration and luck are important.