They've xor'd the stco (frame offsets) atom/chunk of the 'vide' track with the creation timestamp (in the mvhd atom) of the file. In the case of the sample zraw file above, it's 0xDC286E56. If you reverse the process by repeating the xor, it's a valid file and you can then access the frame data directly. There are some non-standard atoms, but it's a normal QuickTime file otherwise. One of the non-standard atoms at the start of the file is 'jpeg', a thumbnail.
Taking a look at the first 8 frames there are a few interesting things. The first frame is 20b larger than the next 7, and its first 20b are 'PVVVMVVV~VVV[VVV[VVV' which looks a lot like some kind of header. Does anybody recognize that from a compression/encoding/encryption format? The next 3b of the first frame are 'rVY'. The first 3b of the next 7 frames are all 'WVx' where x is 'S', 'Q', ']', 'Y', 'Z', 'Y', 'B'. Taking a quick look at a few random frames and they all continue the pattern of 'WVx', and x is always a printable ascii character but not necessarily alphanumeric. The 4th byte is rarely a printable character however.
Another observation is that each frame has a 0x2904 byte chunk preceeding it that appears some kind of descriptor. Notable atoms at the start of that chunk are 'ptsb', and 'n3a ' (which is a 0x28A8 atom with 'IMVT' at bytes 4-8; ImageVision Technology is the company behind Z Cam).
Here's the xor'd stco atom to save everyone the work (offsets start after the 0x6C; 108 frames):
- Code: Select all
00000000 0000006C 000445F8 002B8445
0052C27E 007A00B7 00A13EF0 00C87D29
00EFBB62 0116F99B 013E37D4 0165760D
018CB446 01B3F27F 01DCC1C4 0203FFFD
022B3E36 02527C6F 0279BAA8 02A41B2B
02CB5964 02F30ED1 031B246E 034656D1
036FFDA8 039AA1D6 03C74B97 03F2B271
041E1228 044AA8B7 04775924 04A2B5C6
04CED117 04FB3E6D 05279727 05531080
057F3085 05AB6C6C 05D78024 0604CAF4
0630F5A5 065D21DB 0689393B 06B4FC43
06E0E17A 070D417C 07396A9C 0764F410
07912FB0 07BD93D6 07E989EC 081CD36C
084B492B 08779639 08A3B5EA 08CFB496
08FBCE00 0927DCEB 09541467 097FFE87
09ABECCE 09D7DD93 0A03D68C 0A2FA370
0A5BC6AC 0A89B3BE 0AB5BC6C 0AE1CE92
0B0DDD1C 0B39FF50 0B662C9F 0B922267
0BBE1BEE 0BEA1856 0C162F16 0C4B464F
0C77DD48 0CA4411E 0CD2065E 0CFDB2EE
0D29D162 0D55F2D4 0D82499E 0DAEA0AD
0DDAFF65 0E06F6C9 0E3314F5 0E5F021C
0E8B8CAD 0EB7E7C2 0EE59E7D 0F116DD9
0F3DBBB9 0F69D613 0F9626C1 0FC1CF93
0FEDFC32 1019D681 1045F95B 107B1556
10A7B4F2 10D3C81C 11003E22 112D9C93
1159AAC3 1185C584 11B1B255 11DD8B52
1209BE2F 1235EFA5
HW: AMD Ryzen 9 3900X, 64GB DDR4 3600 CL16 RAM, 3x2TB NVMe SSDs (1xGen4, 2xGen3), 8GB Nvidia GeForce RTX 2070 Super, dual monitor (4k, 1080P)
SW: DaVinci Resolve Studio 17b7, Win10 Pro 20H2, Nvidia Studio Driver 460.89, latest BIOS/chipset/drivers/etc.