The TIFF iamge file from Windows XP, where is the Image data itself

It is time to take a look for the location 0x00001628, that indicated by IFH of which is the first byte of image data itself. Nothing sepcial but a 0x13, however, we when look at the most bottom about the HEX view, notice the 0x1628 is very close to the end of this file, also notice some readable stuff. i.e. Windows NT Fax Server.


In between the 0x00001628 and then end of file, there has very few of data bytes are is presented, does it make sense if our fax has so limited information ?! or we have to look at this in a backward direction according to Right to Left arrangement ?

Let's review the TIFIFD structure and the TIFTAG structure again,

typedef struct _TifIfd
{
WORD NumDirEntries; /* Number of Tags in IFD */
TIFTAG TagList[]; /* Array of Tags */
DWORD NextIFDOffset; /* Offset to next IFD */
} TIFIFD;


typedef struct _TifTag
{
WORD TagId; /* The tag identifier */
WORD DataType; /* The scalar type of the data items */
DWORD DataCount; /* The number of items in the tag data */
DWORD DataOffset; /* The byte offset to the data items */
} TIFTAG;



patch this with our HEX view data

typedef struct _TifIfd
{
WORD NumDirEntries = 0x13, 0x00 = 0x0013; /* Number of Tags in IFD */
TIFTAG TagList[]; /* Array of Tags */
DWORD NextIFDOffset; /* Offset to next IFD */
} TIFIFD;

Obviousely, the first word from [0x00001628] = 0x13, 0x00, it is NumDirEntries, group this into order, it will be 0x0013 or 19 (remember the INTEL FORMAT, group this from Right to Left, hence 0x00 then 0x13). It tells us, there are total 19 TIFF TAGs are stored. so, let's extract the first TIFF TAG out of the 19, and try to understand what is the meaning is,


typedef struct _TifTag
{
WORD TagId = 0xfe, 0x00 = 0x00fe; /* The tag identifier */
WORD DataType = 0x04, 0x00 = 0x0004; /* The scalar type of the data items */
DWORD DataCount = 0x01, 0x00, 0x00, 0x00 = 0x00000001; /* The number of items in the tag data */
DWORD DataOffset = 0x02, 0x00, 0x00, 0x00 = 0x00000002; /* The byte offset to the data items */
} 1st_TIFTAG;