Mcstruct formats

mcstruct: shipped def-files

Every def-file below is in src/panel-plugins/mcstruct/data/ and is found by the signature or name pattern in stl.als. They are part of mc and come under the GPL-3.0-or-later. Most were written after the format descriptions of the Kaitai Struct formats gallery (the "source" column names the .ksy); data/NOTICE credits those sources. A "partial" file shows the part of the format that STL5 can describe today.

def-file	source	notes
aix_utmp.stl	log/aix_utmp	timestamp with tu64
allegro_dat.stl	game/allegro_dat	properties and object sizes; BMP, RLE and FONT bodies decoded
amlogic_mpt.stl	filesystem/amlogic_emmc_partitions	Amlogic eMMC partition table: version, checksum and the partition entries (name, size, offset, flags)
andes_fw.stl	firmware/andes_firmware	Andes Technology firmware image: header with the ILM and DLM block lengths, versions and build time
android_dto.stl	archive/android_dto	entry size assumed 32 (dt_entry_size is a field
android_img.stl	archive/android_img	header versions 0-2; image positions shown with =x
android_super.stl	filesystem/android_super	slot 0 primary metadata and its partition table
apm.stl	filesystem/apm_partition_table	open at 512; count from the first entry with @u32
applesd.stl	filesystem/apple_single_double	entry table; FinderInfo is a separate structure for F3 (typed body by entry type
asn1_der.stl	serialization/asn1/asn1_der	constructed elements entered, tree listed flat
asus_bootldr.stl	archive/android_bootldr_asus	chunk id validation needs
au.stl	media/au	Sun/NeXT audio header: data offset and size, encoding, sample rate, channels, comment
avantes_roh60.stl	scientific/spectroscopy/avantes_roh60	Avantes spectrometer .roh file: wavelength calibration, pixel range, the spectrum and the acquisition settings
avi.stl	media/avi + common/riff	flat chunk walk, LIST entered, avih/strh decoded
bitcoin_tx.stl	network/bitcoin_transaction	scripts skipped as blocks
blend.stl	media/blender_blend	block headers; the DNA1 catalogue is skipped (nested strz lists)
bson.stl	serialization/bson	one document level, embedded documents as blocks (recursion)
btrfs_stream.stl	filesystem/btrfs_stream	TLV values typed by attribute id and length
cfb.stl	serialization/microsoft_cfb	header and the first directory sector; FILETIME with tf
chg.stl	cad/monomakh_sapr_chg	Monomakh-SAPR .chg container: title and the embedded files (13-byte header and 64-bit size each)
chrome_pak.stl	serialization/chrome_pak	versions 4 and 5
cpio_old.stl	archive/cpio_old_le	mtime shown with =t
cramfs.stl	filesystem/cramfs	root directory only (a tree needs recursion); size/gid split shown with =
dcx.stl	image/pcx_dcx	#include "pcx.stl", jump to PCX per offset
dex.stl	executable/dex	header and string ids with jumps to MUTF-8 strings; other id tables raw
dicom.stl	image/dicom	explicit VR elements, sequences entered; implicit VR data sets and the 4000-line dictionary not carried (a legend per tag)
dime.stl	network/dime_message	4-byte padding with "+ (4 - ^@ % 4) % 4"
dns.stl	network/dns_packet	names label by label, compression pointer shown as m16; typed rdata for A and AAAA only
dune2_pak.stl	game/dune_2_pak	file sizes (next offset - offset) need
edid.stl	hardware/edid	manufacturer letters and gamma need; checksum needs; detailed timing descriptors added beyond the ksy
efi_siglist.stl	security/efivar_signature_list	signature type guid not named (guid legends)
ether.stl	network/ethernet_frame + ipv4_packet + ipv6_packet + tcp_segment + udp_datagram	one flat structure with #if chains instead of imports and switch-on; IPv6 header only
exif.stl	image/exif	TIFF IFD0 with jumps to Exif / GPS / Interop IFDs; values not typed by count
ext2.stl	filesystem/ext2	superblock and group descriptors; inodes and directories need a block-size aware walk
fallout2_dat.stl	game/fallout2_dat	file contents via raw or inflate
fallout_dat.stl	game/fallout_dat	Pascal strings as a length bytec (sp takes the follower as the length, not a maximum)
ftl_dat.stl	game/ftl_dat	records by jump
gbr.stl	image/gimp_brush	GIMP brush: header with size, depth, spacing and name; the pixel block follows
gif.stl	image/gif	sub-block bytes skipped, not listed
glb.stl	3d/gltf_binary	glTF binary: header and the chunk list, the JSON chunk shown as text
glshaders.stl	media/android_opengl_shaders_cache	4-byte alignment with "+ ((^@3) & ~3) - ^@"
gpt.stl	filesystem/gpt_partition_table	open at 512 (alias); header crc needs
gt_vol.stl	game/gran_turismo_vol	offset and size per entry shown with =x and = from the offset table
gzip.stl	archive/gzip	trailer via ". $size - 8"
hashcat_restore.stl	log/hashcat_restore	argv as sc.0a strings
hccap.stl	network/hccap	hashcat WPA handshake records: ESSID, MACs, nonces, EAPOL frame and key MIC, 392 bytes each
hccapx.stl	network/hccapx	hashcat WPA handshake records, .hccapx layout with a magic and message pair flags, 393 bytes each
heaps_pak.stl	game/heaps_pak	root directory only (recursive directories)
homm_agg.stl	game/heroes_of_might_and_magic_agg	name table found through @u32 of the last entry
homm_bmp.stl	game/heroes_of_might_and_magic_bmp	Heroes of Might and Magic sprite: magic, width, height; 8-bit pixels follow
huawei_bootldr.stl	archive/android_bootldr_huawei	Huawei bootloader package: meta header, image version, the image table (name, offset, length)
icc.stl	image/icc_4	header and tag table with a jump to each tag's type signature; tag bodies not typed
icmp.stl	network/icmp_packet	ICMP message header: type and code with legends, checksum, echo id and sequence
ico.stl	image/ico	is_png folded into the jump target (_ICO_image picks PNG or DIB)
id3v1.stl	media/id3v1_1	ID3v1.1 tag, the last 128 bytes of an MP3: title, artist, album, year, comment, track, genre
id3v2.stl	media/id3v2_3 + id3v2_4	synchsafe sizes through @u8 shifts; text frames decoded
ines.stl	firmware/ines	mapper shown with =
iso9660.stl	filesystem/iso9660	PVD, root directory by jump (ISO_DIR follows subdirectories), L path table; both-endian fields listed twice
ivf.stl	media/vp8_duck_ivf	Duck IVF container (VP8/VP9/AV1): header with codec, size, frame rate, then the frame headers
java_class.stl	executable/java_class	constant pool walked with a #set slot counter (Long/Double take two); attributes skipped by length
journal.stl	log/systemd_journal	data, field and entry objects decoded
lnk.stl	windows/windows_lnk_file	shell items inlined (an #include cannot be entered in place), link info, string data; FILETIME with tf
luks.stl	filesystem/luks	LUKS1
lvm2.stl	LVM2 sources	label; LVM2_MDA for the metadata area header via F3
lzh.stl	archive/lzh	header levels 0 and 2, as the ksy
macho.stl	executable/mach_o	header and load commands (segments with sections, dylibs, uuid, build version, main, dyld info, linkedit data)
macho_fat.stl	executable/mach_o_fat	slices not followed into mach_o (not ported yet)
mar.stl	archive/mozilla_mar	Mozilla archive (MAR1): header, signatures, product information block, the index of files
mcap.stl	log/mcap	top-level fields of every record type; chunk contents not entered
md2.stl	game/quake2_md2	frame vertices as a block; GL command list walked
mdl.stl	game/quake_mdl	frame vertices skipped as a block; grouped frames use a #set count
midi.stl	media/standard_midi_file	running status kept in a #set variable
minidump.stl	windows/windows_minidump	stream directory with typed jumps for system info, misc info, thread, memory, memory64 and exception streams
mo.stl	database/gettext_mo	strings by jump from the descriptor; the hash lookup is an algorithm, not a structure
mov.stl	media/quicktime_mov	containers entered, tree listed flat; ftyp, mvhd, tkhd, mdhd, hdlr decoded
msgpack.stl	serialization/msgpack	values listed flat; a map or array row says how many items follow
nanoapp.stl	executable/android_nanoapp_header	Android CHRE nanoapp header: app id, version, flags, hub type, CHRE API version
nitf.stl	image/nitf	file header and segment table; NITF_IMAGE for an image subheader
nt_mdt.stl	scientific/nt_mdt/nt_mdt	frames; MDA calibrations, spectroscopy variables, curves blocks
nt_mdt_pal.stl	scientific/nt_mdt/nt_mdt_pal	per-table counts read back from the meta records with @u8/@u16
ogg.stl	media/ogg	page body length summed over the segment table in a #repeat
op2.stl	media/genmidi_op2	operator settings as 6 raw bytes
openpgp.stl	security/openpgp_message	old and new packet headers, public key, user id, signature and session key bodies
pak.stl	game/quake_pak	Quake PAK archive: header and the file index (name, offset, size) as a grid
pcap.stl	network/pcap	packet bodies raw (imports ethernet_frame:; linktype legend trimmed to common values
pcf.stl	font/pcf_font	table of contents; a table body opens by jump with its format and count
pcx.stl	image/pcx	ZSoft PCX: 128-byte header with the 16-color palette, the 256-color palette at the end of the file
pff2.stl	font/grub2_font	section type chosen by peeking @d against "quoted" literals
pif.stl	image/pif	bits per pixel checked with check
ppi.stl	network/packet_ppi	radio fields; the frame body via F3
protobuf.stl	serialization/google_protobuf + common/vlq_base128_le	one message level; vl is the LEB128 key
pyc27.stl	executable/python_pyc_27	partial; header and the outer code object; the marshal tree is recursive
qcom_bootldr.stl	archive/android_bootldr_qcom	body positions shown with =x from a running #set
rar.stl	archive/rar	RAR 1.5-4.x blocks, v5 detected only
regf.stl	windows/regf	header and the first hbin's cells (nk, vk, lf/lh, li/ri, sk)
respack.stl	archive/respack	RS resource pack: header, JSON index length and MD5, the JSON index as text
rpm.stl	archive/rpm	lead, signature and header index tables; header data values by offset need
rsrc.stl	macos/resource_fork	header, map, type list and reference lists (the per-type reference list offsets are not followed one by one)
rtcp.stl	network/rtcp_payload	SR, RR, SDES, BYE, feedback headers; REMB and transport feedback bodies skipped
rtp.stl	network/rtp_packet	payload type as a bit legend on the marker byte; padding length at the end needs
rtpdump.stl	network/rtpdump	header line with sc.2f and sc.0a, RTP header inlined
rwstream.stl	game/renderware_binary_stream	chunk walk, containers entered; struct bodies not typed (they depend on the parent chunk code: +
shell_items.stl	windows/windows_shell_items	root, volume and file entry bodies; the rest skipped by length
shx.stl	geospatial/shapefile_index	mixed endian header
snd.stl	macos/mac_os_resource_snd	sound header by jump from a buffer command; legends cannot hold negative values
some_ip.stl	network/some_ip/* (5 files)	one structure: header, SD entries and options (importsswitch-on
sparse.stl	archive/android_sparse	chunk length checked with check
specpr.stl	scientific/spectroscopy/specpr	record type from the t32 flag word
ssh_pubkey.stl	security/ssh_public_key	RSA, DSA, ECDSA and Ed25519 blobs by the key type text
stl3d.stl	media/stl	Binary STL mesh: 80-byte header, triangle count, the triangles (normal, three vertices, attribute)
sudoers_ts.stl	log/sudoers_ts	timespec with tu64i32
swf.stl	executable/swf	body via raw or inflate; lzma not decoded
systemtime.stl	windows/windows_systemtime	Windows SYSTEMTIME: year, month, day of week, day, hour, minute, second, milliseconds
tga.stl	image/tga	color map skipped as one block (entry size from a field
tim.stl	image/psx_tim	CLUT and image blocks through one hidden structure (no caption on the row
tls_hello.stl	network/tls_client_hello	SNI and ALPN decoded, other extensions skipped
trdos.stl	filesystem/tr_dos_image	TR-DOS disk image: the file catalog as a grid and the volume info sector (disk type, free sectors, label)
trx.stl	firmware/broadcom_trx	partition sizes shown with =; tail at $size - 64
tsm.stl	database/tsm	index found through the last 8 bytes
ttf.stl	font/ttf	table directory with typed jumps to head, hhea, maxp, OS/2, name; other tables raw
uefi_te.stl	executable/uefi_te	UEFI Terse Executable: header (machine, subsystem, entry point, image base, data directories) and the section table
utmp.stl	log/glibc_utmp	x86-64 layout, 384 byte records
vdi.stl	filesystem/vdi	header version 1.x
vmdk.stl	filesystem/vmware_vmdk	VMware VMDK sparse extent header: version, flags, capacity, grain size, descriptor and grain directory offsets
voc.stl	media/creative_voice_file	sample rate shown with =
vox.stl	media/magicavoxel_vox	flat chunk walk (children not nested)
vpp.stl	game/saints_row_2_vpp_pc	names and extensions are in string blocks whose starts are shown with =x
wad.stl	game/doom_wad	directory; Enter on a lump opens THINGS, LINEDEFS, SIDEDEFS, VERTEXES, SECTORS by name
websocket.stl	network/websocket	loop ends on the FIN bit through a #set variable
winres.stl	windows/windows_resource_file	UTF-16 string ids listed char by char (a NUL-terminated s16 is still missing:; a remark must not contain "word:" at its start
wmf.stl	image/wmf	Windows metafile with the placeable header: bounds, the metafile header, the records with function legends (polyline, colors, modes, window)
xar.stl	archive/xar	TOC via call('inflate')
xm.stl	media/tracker_modules/fasttracker_xm_module	sample data skipped by the summed lengths
xwd.stl	image/xwd	X Window Dump: header (pixmap format, size, depth, masks, visual class, creator) and the color map
zchunk.stl	archive/zchunk	lead, preface, index and chunk table
zisofs.stl	archive/zisofs	block count from #set
zx_tap.stl	filesystem/zx_spectrum_tap	ZX Spectrum tape image: blocks with their flag, header blocks decoded (program, arrays, bytes)

Shipped before the port, not in the gallery table: zip, exe (PE), elf, dbf, mbr, fat_boot, uimage, dtb, png, bmp, wav, sqlite.