The TIFF iamge file from Windows XP, what is the IFH

Come to this playground, the general idea of how a TIFF file is constructed, to check a TIFF file from the fax template and the HEX dump, simple but effective to see whether Image File Header (IFH) cab be seen from this scratch pad. The fax can be view from the left image, no much dummy but a wonderful sketch itself.

To verify the Image File Header (IFH), uses the good editor with HEX view capability is the most fit. According to previous reading, there will be another INTEL FORMAT indication and so on.

















0x49, 0x49, 0x2a, 0x00, 0x28, 0x16, 0x00, 0x00














This is the very beginning of the file in HEX dump, base on the data structure obtained, it can be interpreted in some way following,

1) 0x49, 0x49
2) 0x00, 0x2a
3) 0x00, 0x00, 0x16, 0x28

further, group this in together as following,

1) 0x4949
2) 0x002a
3) 0x00001628

take a look again with the file header defined, and patch these number into, let's say a final IFH as following

typedef struct _TiffHeader
{
WORD Identifier; /* Byte-order Identifier */
WORD Version; /* TIFF version number (always 2Ah) */
DWORD IFDOffset; /* Offset of the first Image File Directory*/
} TIFHEAD;


typedef struct _TiffHeader
{
WORD Identifier = "II"; /* Byte-order Identifier, "II", Intel format */
WORD Version = 0x002a; /* TIFF version number (always 2Ah) */
DWORD IFDOffset = 0x00001628 = 5672; /* Offset of the first Image File Directory*/
} TIFHEAD;

This is the complete of IFH viewed by HEX editor, it is consistent with the output by TIFF Tage Viewer as following,



The finish of Image File Header review, we now know the 1st page of image data will be there, 0x1628 or 5672, pop for the next, how is image data itself, what does it looks like and where is...