Understanding video file with "infomercial"

[hlloyge]

Hello all.

I have, for testing purposes, one video file which supposedly plays fine with one software, but the software is only for phone.
(yes, it's pr*0n)
The guy who gave it to me claims that file plays fine and that file plays in MXPlayer, which I've tested, and indeed it does. File is in mp4 format, length in whatever player I tried on PC shows 1:37 duration, but the actual playtime is some 15 seconds, and then shows still image and message to install PLAYit to watch full video. Video stops at 22 seconds.
File is some 65 MB in size, so I got curious, but I don't know how to approach the subject. Video plays in MXPlayer even with network disabled, so it is not streaming it from somewhere.
My guess is that something is edited inside the mp4 file to do that, but I don't know how and what. Can you suggest me or help me dissect the video file so I can learn what is it?

My curiosity is purely academic, I do know where to find videos like that :).

[benwaggoner]

What does MediaInfo tell you?

Remuxing with mp4box can sometimes address this kind of issue, if there's a mismatch between the elementary stream and the MP4 wrapper.

[videoh]

My Compression Book Moderator be spamming. Outdated and obsolete. Don't waste your acorns!

Rocky

[hlloyge]

What does MediaInfo tell you?

Remuxing with mp4box can sometimes address this kind of issue, if there's a mismatch between the elementary stream and the MP4 wrapper.

It didn't adress the issue, it extracted only first 22 seconds of file. My main concern is, why MX Player plays whole 1:37 uninterrupted, and VLC plays first 15 seconds and shows still picture for 7 seconds.

Media Info:

General
Complete name : E:\WORK\MP4_analyzer\SL_Cutie.mp4
Format : MPEG-4
Format profile : Base Media
Codec ID : isom (isom/iso2/avc1/mp41/56d3/fbd2/a209)
File size : 67.3 MiB
Duration : 1 min 37 s
Overall bit rate mode : Variable
Overall bit rate : 5 821 kb/s
Writing application : Lavf58.29.100
IsTruncated : Yes

Video
ID : 1
Format : AVC
Format/Info : Advanced Video Codec
Format profile : High@L4
Format settings : CABAC / 4 Ref Frames
Format settings, CABAC : Yes
Format settings, Reference frames : 4 frames
Codec ID : avc1
Codec ID/Info : Advanced Video Coding
Duration : 1 min 37 s
Source duration : 22 s 987 ms
Bit rate : 2 153 kb/s
Width : 1 920 pixels
Height : 1 080 pixels
Display aspect ratio : 16:9
Frame rate mode : Variable
Frame rate : 28.277 FPS
Minimum frame rate : 25.000 FPS
Maximum frame rate : 50.000 FPS
Color space : YUV
Chroma subsampling : 4:2:0
Bit depth : 8 bits
Scan type : Progressive
Bits/(Pixel*Frame) : 0.037
Stream size : 5.90 MiB (9%)
Source stream size : 5.90 MiB (9%)
Writing library : x264 core 157
Encoding settings : cabac=1 / ref=3 / deblock=1:0:0 / analyse=0x3:0x113 / me=hex / subme=7 / psy=1 / psy_rd=1.00:0.00 / mixed_ref=1 / me_range=16 / chroma_me=1 / trellis=1 / 8x8dct=1 / cqm=0 / deadzone=21,11 / fast_pskip=1 / chroma_qp_offset=-2 / threads=3 / lookahead_threads=1 / sliced_threads=0 / nr=0 / decimate=1 / interlaced=0 / bluray_compat=0 / constrained_intra=0 / bframes=3 / b_pyramid=2 / b_adapt=1 / b_bias=0 / direct=1 / weightb=1 / open_gop=0 / weightp=2 / keyint=250 / keyint_min=25 / scenecut=40 / intra_refresh=0 / rc_lookahead=40 / rc=crf / mbtree=1 / crf=23.0 / qcomp=0.60 / qpmin=0 / qpmax=69 / qpstep=4 / ip_ratio=1.40 / aq=1:1.00
mdhd_Duration : 97000
Codec configuration box : avcC

Audio
ID : 2
Format : AAC LC
Format/Info : Advanced Audio Codec Low Complexity
Codec ID : mp4a-40-2
Duration : 15 s 40 ms
Bit rate mode : Variable
Bit rate : 132 kb/s
Maximum bit rate : 158 kb/s
Channel(s) : 2 channels
Channel layout : L R
Sampling rate : 48.0 kHz
Frame rate : 46.875 FPS (1024 SPF)
Compression mode : Lossy
Stream size : 247 KiB (0%)
Default : Yes
Alternate group : 1

[hlloyge]

Come on, are you not curious about that? I have some knowledge, but nearly not enough.

[benwaggoner]

That mp4box and VLC stopped part way through suggests some sort of corruption that MXPlayer is able to compensate for but the others are not.

But it's very likely a problem in the file, not the player.

[hlloyge]

OK, I am really disappointed now in your lack of interest :(.

That is the video file from one of those sites where you can watch porn but only if you buy specific player for some cash. And indeed, when you download the file (this particular one is 65 MB) all standard players you can find on usual Windows or Linux computers plays only first 15 seconds of "action" followed by 7 seconds of static commercial (I am guessing it's embedded inside as video) for PLAYit software, which you should buy to see the whole video. The guy who gave me the video claimed that the video played in full only in MXPlayer (of all other free players), which is true (and the software is free), it plays until the end, for minute and half, and it's not looping the same sequence over and over again.

HOW IS IT POSSIBLE that members of this forum don't have any curiosity for how it's done? Are you freaked out because it's pornographic video?
I am not affiliated with those sites, I am not trying to sell anything to anyone, I just need help in analyzing how it's done.

I've tried:

https://www.onlinemp4parser.com/
http://mp4parser.com/
AtomicParsley
MP4Inspector, which complains of box 0 exceeds than the rest of the file
MP4 Explorer, which fails opening the file

I am no expert at this, but I am curious of how it's made, and what makes players ignore the remainder of file.

[benwaggoner]

If it is porn stuff, it is probably intentionally malformed in some way, potentially with malware.

Not something I or lots of people here would touch with a 10-foot pole.

[Selur]

afaik MXPlayer uses either libav or internal hardware decoder of the device, so usually if MXPlayer can playback the file ffplay should be able to play it too and ffmpeg should be able to reencode the file,..
-> I would recomment to try whether ffplay is able to play the file and what warnings/errors it reports during playback.

[SeeMoreDigital]

@hlloyge,

Try muxing into the .mkv container, using MKVToolNix...

[therube]

curiosity
I dabble in curiosity.
I found (what I'll assume is) a version of the file, 18 MB, so certainly not the same.
The version I looked at did play for 1:37 (in mplayer).

Why not post a link to your file & maybe some curious person can see what they can make of it?

[hlloyge]

Why not post a link to your file & maybe some curious person can see what they can make of it?

OK, for anyone curious enough, here is the file, on gdrive (https://drive.google.com/file/d/1ll19Rjb-gUBE0jbxjaC7Q48QCP0eQLVj/view?usp=sharing).
It's in a zip file, password is "aaaa" (without quotes).
For now, it works only in MXPlayer on Android. I'd really want an information how did they manage to do that, what had to be changed and where, and why MXPlayer plays it, and VLC won't. Tried ffplay, mplayer, same thing.

[therube]

Video plays in MXPlayer even with network disabled, so it is not streaming it from somewhere.
My thought (streamed from somewhere).
Do you think the full video has been cached on your end, so that when you go to "play" it, it plays the cached copy rather then the copy you've posted?

File shows:

Truncated.

Duration : 1 min 37 s
vs
Source duration : 22 s 987 ms

File should be 1:37.
Video plays for 23.sec (of which ~15.sec is actual video & ~8.sec of infomercial).

Audio is 15.sec (not 23.sec nor 1:37).

Based on the bitrate & the expected duration (1:37), the (video) stream size doesn't calculate.

Copying into different containers made no difference. (ffmpeg -i xxx.mp4 -c copy out.mp4)
Transcoding made no difference. (ffmpeg -i xxx.mp4 out.mp4)
Dropping the audio made no difference. (ffmpeg -i xxx.mp4 -c copy -an out.mp4)
(All copy/transcodes output to ~6 MB file which coincides to the video stream size.)
Different media players made no difference. (mplayer, ffplay, mpv, mpc-be)
Avidemux gives you 15.sec of actual video, then 23.sec of total length. (no key frame after the 15.sec)

To me, it is a 23.sec video clip with 15.sec of actual video.
(Granted, I don't really understand this stuff, but that's what it looks like to me.)

MediaInfo shows the clip to be Truncated.
Perhaps that too is playing into what is being seen?
Or maybe the file is purposely "incorrect", so reports as Truncated to MediaInfo?

Yours on left, mine on right:

https://i.postimg.cc/mgbyZFjx/SL-Cutie-yours-vs-mine.png (https://postimg.cc/6ymvYqFz)

[benwaggoner]

Try mp4box

[therube]

Yes that was mentioned.
And I did try an (ancient) version of mp4boxgui, but got nothing better then anything else I had tried.

Not really familiar with mp4box.
Hints as to what to try?


(current gpac)

C:\mp4box\Z>mp4box -add xxx.mp4 -new out.mp4

[iso file] Unknown top-level box type 9B7F1157
[iso file] Incomplete box 9B7F1157 - start 6457021 size 1588206295
[iso file] Incomplete file while reading for dump - aborting parsing
IsoMedia import xxx.mp4 - track ID 1 - Video (size 1920 x 1080)
IsoMedia import xxx.mp4 - track ID 2 - Audio (SR 48000 - 2 channels)
Saving out.mp4: 0.500 secs Interleaving


Once again, a 6 MB 23.sec output file.



gpac -i xxx.mp4 enc:c=avc -o out.mp4

70 MB file, 15.sec of video, then the "infomercial", Length shows as 1:37.

[hlloyge]

My thought (streamed from somewhere).
Do you think the full video has been cached on your end, so that when you go to "play" it, it plays the cached copy rather then the copy you've posted?


No. I've copied the video via USB onto my mobile phone, disabled wifi and data so there would be no internet connection and then played the file, and it went till the end. I, too, suspected it is streaming the file from somewhere, but that is not the case.
If you have android mobile phone, you can try it too, software is free and on Google Store, doesn't need some shady installation method or anything.

[benwaggoner]

Here's the official mp4box link. Try a current version. Some verbose modes could probably give you some info.

There's a good chance this is an intentionally malformed elementary stream to complicate piracy.

[Balling]

Starting with bytes 0x627C911F it is obviously encrypted since there is almost no 0x00 bytes there.

[therube]

I'm not following?
The file is 67 MB so there wouldn't be any 0x627C911F?

[Balling]

This is not an offset, these are bytes inside.

[rwill]

I think I know what Balling wants to say:

The original .mp4 provided checks out legit. As far as I can tell there is
no real problem with the structure. The mp4 container ends at offset 0x6286bd
(6457021 bytes) which is tailed by 64.124.488 bytes of unknown payload. So it
appears the juicy (heh) parts of the clip are in the unknown payload.

Regarding the video track, its two x264 streams appended to each other. One ~15
sec content and one ~8 seconds "informercial". Audio track ends at around ~15 sec.

Non standard compatible brands flagged in Mp4 are:
compatible_brand_4: 56d3
compatible_brand_5: fbd2
compatible_brand_6: a209

This might be a hint to MXPlayer. My guess is that MXPlayer, for whatever reason,
shares code/mechanics with the Pr0n players in the AppStore so it knows how to
handle the unknown payload. On the MXPlayer website there is some code available
from the open source libraries included but I have not looked into it further.

'For what I know the content might be looping in MXPlayer, it seems very repetitive.'

Starting at offset 0x434fbd4 there can be seen some structure in the unknown
payload. But really, I wont investigate further, could be anything. I am too old
for this.