# GeViSet File Format Research Notes

## Binary Format Discoveries

### Header Analysis

**File**: setup_config_20251212_122429.dat (281,714 bytes)

```
Offset  Hex                                          ASCII
0000:   00 13 47 65 56 69 53 6F 66 74 20 50 61 72 61 6D  ..GeViSoft Param
0010:   65 74 65 72 73                                   eters
```

**Structure**:
- `00`: Optional null byte (not always present)
- `13`: Length byte (0x13 = 19 bytes)
- `47 65 56 69 53 6F 66 74 20 50 61 72 61 6D 65 74 65 72 73`: "GeViSoft Parameters"

**Note**: This is NOT a standard Pascal string (no 0x07 marker), just length + data.

### Section Structure

Sections appear to follow this pattern:

```
07 <len> <section_name>    // Pascal string for section name
... items ...
05 52 75 6C 65 73          // "Rules" marker (if rules present)
... rules ...
```

### Rules Marker Pattern

Found 65 occurrences of pattern: `05 52 75 6C 65 73` ("Rules")

Key offsets:
- 252,278 (0x3D976)
- 252,717 (0x3DB2D)
- 253,152 (0x3DCE0)
- ... (65 total)

After "Rules" marker:
```
05 52 75 6C 65 73  // "Rules"
02 00 00 00        // Count? (2 rules?)
00 01 31           // Unknown metadata
05 00 00 00        // Another count/offset?
07 01 40 ...       // Start of action string
```

### Action String Pattern

**Format**: `07 01 40 <len_2bytes_LE> <action_data>`

**Examples from file**:

1. At offset 252,291:
```
07 01 40 1C 00 47 53 43 20 56 69 65 77 65 72 43 6F 6E 6E 65 63 74 4C 69 76 65 20 56 20 3C 2D 20 43
│  │  │  │  │
│  │  │  └──┴─ Length: 0x001C (28 bytes)
│  │  └─ Action marker
│  └─ Subtype
└─ String type

Action: "GSC ViewerConnectLive V <- C"
```

2. At offset 258,581:
```
07 01 40 11 00 47 53 43 20 56 69 65 77 65 72 43 6C 65 61 72 20 56
Length: 0x0011 (17 bytes)
Action: "GSC ViewerClear V"
```

### Data Type Markers

| Marker | Type    | Evidence                                      |
|--------|---------|-----------------------------------------------|
| 0x01   | Boolean | Followed by 0x00 or 0x01                     |
| 0x04   | Int32   | Followed by 4 bytes (little-endian)          |
| 0x07   | String  | Pascal string: <len> <data>                   |
| 0x07 0x01 0x40 | Action | Special action string format         |

### Section Names Found

From file analysis:
- "Description" (most common - appears 832 times)
- "IpHost"
- "GscAction"
- "GCoreAction"
- "Alarms"
- "Clients"
- "GeViIO"

### Action Mappings Extracted

Successfully extracted 64 action mappings from the file:

**PTZ Camera Controls** (Camera 101027):
1. PanLeft_101027
2. PanRight_101027
3. PanStop_101027
4. TiltDown_101027
5. TiltUp_101027
6. TiltStop_101027
7. ZoomIn_101027
8. ZoomOut_101027
9. ZoomStop_101027
10. FocusFar 128_C101027
11. FocusNear 128_C101027
12. FocusStop_101027
13. IrisOpen_101027
14. IrisClose_101027
15. IrisStop_101027

**Preset Positions**:
16. MoveToDefaultPostion_101027
17. ClearDefaultPostion_101027
18. SaveDafaultPostion_101027
19. MoveToPresentPostion
20. ClearPresentPostion
21. SavePresentPostion

**Viewer Controls**:
22. ViewerConnectLive V <- C
23. ViewerConnectLive V <- C_101027
24. ViewerClear V
25. VC live

**System Messages**:
26-35. Demo mode warnings (100, 90, 80... 10 min)
36. info: licence satisfied
37. info: re_porter mode active
38. error: "GeViIO Client: start of interface failed"
39. error: "GeViIO Client: interface lost"
40. warning: "GeViSoft Server: client warning"

### Platform Variations

Actions often have multiple platform-specific versions:

```
GSC (GeViScope):
  "GSC ViewerConnectLive V <- C"

GNG (G-Net-Guard):
  "GNG ViewerConnectLive V <- C_101027"

GCore:
  "GCore <action>"
```

### Unknown Patterns

Several byte patterns whose purpose is unclear:

1. **Pattern**: `04 02 40 40 64 00 00 00 00`
   - Appears before many action strings
   - Possibly metadata or flags

2. **Pattern**: `00 00 00 00 00 01 31 05 00 00 00`
   - Appears after "Rules" marker
   - Could be counts, offsets, or IDs

3. **Pattern**: `0C 4D 61 70 70 69 6E 67 52 75 6C 65 73`
   - `0C MappingRules` (length-prefixed, no 0x07)
   - At offset 252,172
   - Different string format than Pascal strings

## Testing Results

### Round-Trip Test

```
✅ SUCCESS!
Original:  281,714 bytes
Parsed:    64 action mappings
Written:   281,714 bytes
Comparison: IDENTICAL (byte-for-byte)
```

**Conclusion**: Safe to write back to server with current preservation approach.

### SetupClient API Test

```
✅ Connection successful
✅ Read setup: 281,714 bytes
✅ Write setup: Not tested yet (waiting for full parser)
✅ Password encryption: Working (GeViAPI_EncodeString)
```

## Next Research Areas

### 1. Trigger Parsing

Need to understand trigger structure:
```
.VideoInput = True
.InputContact = False
```

These appear before action strings in rules.

### 2. Metadata Bytes

The bytes between sections and before/after rules:
- What do they represent?
- Are they counts? Offsets? Flags?
- Can they be modified?

### 3. Section Relationships

How do sections reference each other?
- Do cameras reference alarm rules?
- Do action mappings reference I/O ports?
- How are IDs assigned?

### 4. Format Versioning

Does the format change between GeViSoft versions?
- Version 6.0.1.5 (current)
- How to detect version?
- Compatibility considerations?

## Tools Used for Analysis

### Python Scripts

```python
# Find all "Rules" patterns
import struct
with open('setup_config.dat', 'rb') as f:
    data = f.read()

needle = b'Rules'
pos = 0
while True:
    pos = data.find(needle, pos)
    if pos == -1: break
    print(f'Found at offset {pos} (0x{pos:X})')
    pos += 1
```

### Hex Editors

- HxD
- 010 Editor
- VS Code with hex extension

### Binary Analysis

- Custom C# parser
- Grep for pattern matching
- Byte comparison tools

## References

- TestMKS.set (279,860 bytes) - Original test file
- setup_config_20251212_122429.dat (281,714 bytes) - Live server config
- GeViSoft SDK Documentation
- GeViProcAPI.h header file

## Change Log

| Date       | Discovery                                    |
|------------|----------------------------------------------|
| 2024-12-12 | Initial binary analysis                      |
| 2024-12-12 | Discovered action string format              |
| 2024-12-12 | Found 65 "Rules" markers                     |
| 2024-12-12 | Extracted 64 action mappings successfully    |
| 2024-12-12 | Verified byte-for-byte round-trip            |