Mcstruct formats

mcstruct: shipped def-files

Every def-file below is in src/panel-plugins/mcstruct/data/ and is found by the signature or name pattern in stl.als. Most were written after the Kaitai Struct formats gallery (the "source" column names the .ksy); the license is the one of that source. A "partial" file shows the part of the format that STL5 can describe today.

def-file	source	license	notes
aix_utmp.stl	log/aix_utmp	CC0-1.0	timestamp with tu64
allegro_dat.stl	game/allegro_dat	CC0-1.0	properties and object sizes; typed bodies by the last property need a string compare
amlogic_mpt.stl	filesystem/amlogic_emmc_partitions	CC0-1.0
andes_fw.stl	firmware/andes_firmware	CC0-1.0
android_dto.stl	archive/android_dto	CC0-1.0	entry size assumed 32 (dt_entry_size is a field
android_img.stl	archive/android_img	CC0-1.0	header versions 0-2; image positions shown with =x
android_super.stl	filesystem/android_super	CC0-1.0	slot 0 primary metadata and its partition table
apm.stl	filesystem/apm_partition_table	CC0-1.0	open at 512; count from the first entry with @u32
applesd.stl	filesystem/apple_single_double	CC0-1.0	entry table; FinderInfo is a separate structure for F3 (typed body by entry type
asn1_der.stl	serialization/asn1/asn1_der	CC0-1.0	constructed elements entered, tree listed flat
asus_bootldr.stl	archive/android_bootldr_asus	CC0-1.0	chunk id validation needs
au.stl	media/au	CC0-1.0
avantes_roh60.stl	scientific/spectroscopy/avantes_roh60	CC0-1.0
avi.stl	media/avi + common/riff	CC0-1.0	flat chunk walk, LIST entered, avih/strh decoded
bitcoin_tx.stl	network/bitcoin_transaction	MIT	scripts skipped as blocks
blend.stl	media/blender_blend	CC0-1.0	block headers; the DNA1 catalogue is skipped (nested strz lists)
bson.stl	serialization/bson	CC0-1.0	one document level, embedded documents as blocks (recursion)
btrfs_stream.stl	filesystem/btrfs_stream	CC0-1.0	TLV values typed by attribute id and length
cfb.stl	serialization/microsoft_cfb	CC0-1.0	header and the first directory sector; FILETIME with tf
chg.stl	cad/monomakh_sapr_chg	CC0-1.0
chrome_pak.stl	serialization/chrome_pak	CC0-1.0	versions 4 and 5
cpio_old.stl	archive/cpio_old_le	CC0-1.0	mtime shown with =t
cramfs.stl	filesystem/cramfs	MIT	root directory only (a tree needs recursion); size/gid split shown with =
dcx.stl	image/pcx_dcx	CC0-1.0	#include "pcx.stl", jump to PCX per offset
dex.stl	executable/dex	CC0-1.0	header and string ids with jumps to MUTF-8 strings; other id tables raw
dicom.stl	image/dicom	CC0-1.0	explicit VR elements, sequences entered; implicit VR data sets and the 4000-line dictionary not carried (a legend per tag)
dime.stl	network/dime_message	CC0-1.0	4-byte padding with "+ (4 - ^@ % 4) % 4"
dns.stl	network/dns_packet	CC0-1.0	names label by label, compression pointer shown as m16; typed rdata for A and AAAA only
dune2_pak.stl	game/dune_2_pak	CC0-1.0	file sizes (next offset - offset) need
edid.stl	hardware/edid	CC0-1.0	manufacturer letters and gamma need; checksum needs; detailed timing descriptors added beyond the ksy
efi_siglist.stl	security/efivar_signature_list	CC0-1.0	signature type guid not named (guid legends)
ether.stl	network/ethernet_frame + ipv4_packet + ipv6_packet + tcp_segment + udp_datagram	CC0-1.0	one flat structure with #if chains instead of imports and switch-on; IPv6 header only
exif.stl	image/exif	CC0-1.0	TIFF IFD0 with jumps to Exif / GPS / Interop IFDs; values not typed by count
ext2.stl	filesystem/ext2	CC0-1.0	superblock and group descriptors; inodes and directories need a block-size aware walk
fallout2_dat.stl	game/fallout2_dat	CC0-1.0	file contents via raw or inflate
fallout_dat.stl	game/fallout_dat	CC0-1.0	Pascal strings as a length bytec (sp takes the follower as the length, not a maximum)
ftl_dat.stl	game/ftl_dat	CC0-1.0	records by jump
gbr.stl	image/gimp_brush	CC0-1.0
gif.stl	image/gif	CC0-1.0	sub-block bytes skipped, not listed
glb.stl	3d/gltf_binary	MIT
glshaders.stl	media/android_opengl_shaders_cache	Apache-2.0	4-byte alignment with "+ ((^@3) & ~3) - ^@"
gpt.stl	filesystem/gpt_partition_table	CC0-1.0	open at 512 (alias); header crc needs
gt_vol.stl	game/gran_turismo_vol	CC0-1.0	offset and size per entry shown with =x and = from the offset table
gzip.stl	archive/gzip	CC0-1.0	trailer via ". $size - 8"
hashcat_restore.stl	log/hashcat_restore	CC0-1.0	argv as sc.0a strings
hccap.stl	network/hccap	Unlicense
hccapx.stl	network/hccapx	Unlicense
heaps_pak.stl	game/heaps_pak	MIT	root directory only (recursive directories)
homm_agg.stl	game/heroes_of_might_and_magic_agg	CC0-1.0	name table found through @u32 of the last entry
homm_bmp.stl	game/heroes_of_might_and_magic_bmp	CC0-1.0
huawei_bootldr.stl	archive/android_bootldr_huawei	CC0-1.0
icc.stl	image/icc_4	CC0-1.0	header and tag table with a jump to each tag's type signature; tag bodies not typed
icmp.stl	network/icmp_packet	CC0-1.0
ico.stl	image/ico	CC0-1.0	is_png folded into the jump target (_ICO_image picks PNG or DIB)
id3v1.stl	media/id3v1_1	CC0-1.0
id3v2.stl	media/id3v2_3 + id3v2_4	CC0-1.0	synchsafe sizes through @u8 shifts; text frames decoded
ines.stl	firmware/ines	WTFPL	mapper shown with =
iso9660.stl	filesystem/iso9660	CC0-1.0	PVD, root directory by jump (ISO_DIR follows subdirectories), L path table; both-endian fields listed twice
ivf.stl	media/vp8_duck_ivf	CC0-1.0
java_class.stl	executable/java_class	CC0-1.0	constant pool walked with a #set slot counter (Long/Double take two); attributes skipped by length
journal.stl	log/systemd_journal	CC0-1.0	data, field and entry objects decoded
lnk.stl	windows/windows_lnk_file	CC0-1.0	shell items inlined (an #include cannot be entered in place), link info, string data; FILETIME with tf
luks.stl	filesystem/luks	CC0-1.0	LUKS1
lvm2.stl	LVM2 sources	GPL-2.0	label; LVM2_MDA for the metadata area header via F3
lzh.stl	archive/lzh	CC0-1.0	header levels 0 and 2, as the ksy
macho.stl	executable/mach_o	CC0-1.0	header and load commands (segments with sections, dylibs, uuid, build version, main, dyld info, linkedit data)
macho_fat.stl	executable/mach_o_fat	CC0-1.0	slices not followed into mach_o (not ported yet)
mar.stl	archive/mozilla_mar	CC0-1.0
mcap.stl	log/mcap	Apache-2.0	top-level fields of every record type; chunk contents not entered
md2.stl	game/quake2_md2	CC0-1.0	frame vertices as a block; GL command list walked
mdl.stl	game/quake_mdl	CC0-1.0	frame vertices skipped as a block; grouped frames use a #set count
midi.stl	media/standard_midi_file	CC0-1.0	running status kept in a #set variable
minidump.stl	windows/windows_minidump	CC0-1.0	stream directory with typed jumps for system info, misc info, thread, memory, memory64 and exception streams
mo.stl	database/gettext_mo	BSD-2-Clause	strings by jump from the descriptor; the hash lookup is an algorithm, not a structure
mov.stl	media/quicktime_mov	CC0-1.0	containers entered, tree listed flat; ftyp, mvhd, tkhd, mdhd, hdlr decoded
nanoapp.stl	executable/android_nanoapp_header	Apache-2.0
nt_mdt_pal.stl	scientific/nt_mdt/nt_mdt_pal	Unlicense	per-table counts read back from the meta records with @u8/@u16
ogg.stl	media/ogg	CC0-1.0	page body length summed over the segment table in a #repeat
op2.stl	media/genmidi_op2	CC0-1.0	operator settings as 6 raw bytes
openpgp.stl	security/openpgp_message	CC0-1.0	old and new packet headers, public key, user id, signature and session key bodies
pak.stl	game/quake_pak	CC0-1.0
pcap.stl	network/pcap	CC0-1.0	packet bodies raw (imports ethernet_frame:; linktype legend trimmed to common values
pcf.stl	font/pcf_font	CC0-1.0	table of contents; a table body opens by jump with its format and count
pcx.stl	image/pcx	CC0-1.0
pff2.stl	font/grub2_font	CC0-1.0	section type chosen by peeking @d against "quoted" literals
pif.stl	image/pif	LGPL-2.1	bits per pixel checked with check
ppi.stl	network/packet_ppi	CC0-1.0	radio fields; the frame body via F3
protobuf.stl	serialization/google_protobuf + common/vlq_base128_le	MIT	one message level; vl is the LEB128 key
pyc27.stl	executable/python_pyc_27	CC0-1.0	partial; header and the outer code object; the marshal tree is recursive
qcom_bootldr.stl	archive/android_bootldr_qcom	CC0-1.0	body positions shown with =x from a running #set
rar.stl	archive/rar	CC0-1.0	RAR 1.5-4.x blocks, v5 detected only
regf.stl	windows/regf	CC0-1.0	header and the first hbin's cells (nk, vk, lf/lh, li/ri, sk)
respack.stl	archive/respack	CC0-1.0
rpm.stl	archive/rpm	CC0-1.0	lead, signature and header index tables; header data values by offset need
rsrc.stl	macos/resource_fork	MIT	header, map, type list and reference lists (the per-type reference list offsets are not followed one by one)
rtcp.stl	network/rtcp_payload	CC0-1.0	SR, RR, SDES, BYE, feedback headers; REMB and transport feedback bodies skipped
rtp.stl	network/rtp_packet	Unlicense	payload type as a bit legend on the marker byte; padding length at the end needs
rtpdump.stl	network/rtpdump	Unlicense	header line with sc.2f and sc.0a, RTP header inlined
rwstream.stl	game/renderware_binary_stream	CC0-1.0	chunk walk, containers entered; struct bodies not typed (they depend on the parent chunk code: +
shell_items.stl	windows/windows_shell_items	CC0-1.0	root, volume and file entry bodies; the rest skipped by length
shx.stl	geospatial/shapefile_index	CC0-1.0	mixed endian header
snd.stl	macos/mac_os_resource_snd	MIT	sound header by jump from a buffer command; legends cannot hold negative values
some_ip.stl	network/some_ip/* (5 files)	CC0-1.0	one structure: header, SD entries and options (importsswitch-on
sparse.stl	archive/android_sparse	CC0-1.0	chunk length checked with check
specpr.stl	scientific/spectroscopy/specpr	Unlicense	record type from the t32 flag word
ssh_pubkey.stl	security/ssh_public_key	CC0-1.0	key type chosen by comparing the name bytes in the expression
stl3d.stl	media/stl	CC0-1.0
sudoers_ts.stl	log/sudoers_ts	CC0-1.0	timespec with tu64i32
swf.stl	executable/swf	CC0-1.0	body via raw or inflate; lzma not decoded
systemtime.stl	windows/windows_systemtime	CC0-1.0
tga.stl	image/tga	CC0-1.0	color map skipped as one block (entry size from a field
tim.stl	image/psx_tim	CC0-1.0	CLUT and image blocks through one hidden structure (no caption on the row
tls_hello.stl	network/tls_client_hello	MIT	SNI and ALPN decoded, other extensions skipped
trdos.stl	filesystem/tr_dos_image	CC0-1.0
trx.stl	firmware/broadcom_trx	GPL-2.0-or-later	partition sizes shown with =; tail at $size - 64
tsm.stl	database/tsm	MIT	index found through the last 8 bytes
ttf.stl	font/ttf	CC0-1.0	table directory with typed jumps to head, hhea, maxp, OS/2, name; other tables raw
uefi_te.stl	executable/uefi_te	CC0-1.0
utmp.stl	log/glibc_utmp	CC0-1.0	x86-64 layout, 384 byte records
vdi.stl	filesystem/vdi	GPL-3.0-or-later	header version 1.x
vmdk.stl	filesystem/vmware_vmdk	CC0-1.0
voc.stl	media/creative_voice_file	CC0-1.0	sample rate shown with =
vox.stl	media/magicavoxel_vox	MIT	flat chunk walk (children not nested)
vpp.stl	game/saints_row_2_vpp_pc	MIT	names and extensions are in string blocks whose starts are shown with =x
wad.stl	game/doom_wad	CC0-1.0	directory listed; THINGS, LINEDEFS, SIDEDEFS, VERTEXES, SECTORS are separate structures applied with F3 (typing a lump by its name from the directory needs the entry's labels in the jump target: +
websocket.stl	network/websocket	CC0-1.0	loop ends on the FIN bit through a #set variable
winres.stl	windows/windows_resource_file	CC0-1.0	UTF-16 string ids listed char by char (a NUL-terminated s16 is still missing:; a remark must not contain "word:" at its start
wmf.stl	image/wmf	CC0-1.0
xar.stl	archive/xar	CC0-1.0	TOC via call('inflate')
xm.stl	media/tracker_modules/fasttracker_xm_module	Unlicense	sample data skipped by the summed lengths
xwd.stl	image/xwd	CC0-1.0
zisofs.stl	archive/zisofs	CC0-1.0	block count from #set
zx_tap.stl	filesystem/zx_spectrum_tap	CC0-1.0

Shipped before the port, not in the gallery table: zip, exe (PE), elf, dbf, mbr, fat_boot, uimage, dtb, png, bmp, wav, sqlite.

Not ported

format	source	why
dcmp_0/1/2	macos/resource_compression/*	blocked: decompression algorithms, not structures-like)
helpers	common/bytes_with_io, vlq_base128_be/le, utf16_with_bom, utf8_string, dos_datetime, bcd	n/a: building blocks, not formats: v, vl, td, s16 cover them
msgpack	serialization/msgpack	blocked: recursive value tree with no fixed layout
nitf	image/nitf	deferred: 823-line fixed-width text header; nothing missing in the language, not done yet
nt_mdt	scientific/nt_mdt/nt_mdt	deferred: 789-line frame catalogue; nothing missing in the language, not done yet
php_serialized	serialization/php_serialized_value	blocked: text grammar with decimal lengths
protocol_body	network/protocol_body	covered: TCP/UDP/ICMP selection is inside ether.stl
python_pickle	serialization/python_pickle	blocked: opcode stream with a stack, not a structure
ruby_marshal	serialization/ruby_marshal	blocked: recursive value tree
zchunk	archive/zchunk	blocked: compressed integers with an inverted continuation bit (neither v nor vl)