geutebruck/geutebruck-api/specs/002-geviset-file-format/research.md

GeViSet File Format Research Notes

Binary Format Discoveries

Header Analysis

File: setup_config_20251212_122429.dat (281,714 bytes)

Offset  Hex                                          ASCII
0000:   00 13 47 65 56 69 53 6F 66 74 20 50 61 72 61 6D  ..GeViSoft Param
0010:   65 74 65 72 73                                   eters

Structure:

• 00: Optional null byte (not always present)
• 13: Length byte (0x13 = 19 bytes)
• 47 65 56 69 53 6F 66 74 20 50 61 72 61 6D 65 74 65 72 73: "GeViSoft Parameters"

Note: This is NOT a standard Pascal string (no 0x07 marker), just length + data.

Section Structure

Sections appear to follow this pattern:

07 <len> <section_name>    // Pascal string for section name
... items ...
05 52 75 6C 65 73          // "Rules" marker (if rules present)
... rules ...

Rules Marker Pattern

Found 65 occurrences of pattern: 05 52 75 6C 65 73 ("Rules")

Key offsets:

• 252,278 (0x3D976)
• 252,717 (0x3DB2D)
• 253,152 (0x3DCE0)
• ... (65 total)

After "Rules" marker:

05 52 75 6C 65 73  // "Rules"
02 00 00 00        // Count? (2 rules?)
00 01 31           // Unknown metadata
05 00 00 00        // Another count/offset?
07 01 40 ...       // Start of action string

Action String Pattern

Format: 07 01 40 <len_2bytes_LE> <action_data>

Examples from file:

1. At offset 252,291:

07 01 40 1C 00 47 53 43 20 56 69 65 77 65 72 43 6F 6E 6E 65 63 74 4C 69 76 65 20 56 20 3C 2D 20 43
│  │  │  │  │
│  │  │  └──┴─ Length: 0x001C (28 bytes)
│  │  └─ Action marker
│  └─ Subtype
└─ String type

Action: "GSC ViewerConnectLive V <- C"

2. At offset 258,581:

07 01 40 11 00 47 53 43 20 56 69 65 77 65 72 43 6C 65 61 72 20 56
Length: 0x0011 (17 bytes)
Action: "GSC ViewerClear V"

Data Type Markers

Marker	Type	Evidence
0x01	Boolean	Followed by 0x00 or 0x01
0x04	Int32	Followed by 4 bytes (little-endian)
0x07	String	Pascal string:
0x07 0x01 0x40	Action	Special action string format

Section Names Found

From file analysis:

• "Description" (most common - appears 832 times)
• "IpHost"
• "GscAction"
• "GCoreAction"
• "Alarms"
• "Clients"
• "GeViIO"

Action Mappings Extracted

Successfully extracted 64 action mappings from the file:

PTZ Camera Controls (Camera 101027):

1. PanLeft_101027
2. PanRight_101027
3. PanStop_101027
4. TiltDown_101027
5. TiltUp_101027
6. TiltStop_101027
7. ZoomIn_101027
8. ZoomOut_101027
9. ZoomStop_101027
10. FocusFar 128_C101027
11. FocusNear 128_C101027
12. FocusStop_101027
13. IrisOpen_101027
14. IrisClose_101027
15. IrisStop_101027

Preset Positions: 16. MoveToDefaultPostion_101027 17. ClearDefaultPostion_101027 18. SaveDafaultPostion_101027 19. MoveToPresentPostion 20. ClearPresentPostion 21. SavePresentPostion

Viewer Controls: 22. ViewerConnectLive V <- C 23. ViewerConnectLive V <- C_101027 24. ViewerClear V 25. VC live

System Messages: 26-35. Demo mode warnings (100, 90, 80... 10 min) 36. info: licence satisfied 37. info: re_porter mode active 38. error: "GeViIO Client: start of interface failed" 39. error: "GeViIO Client: interface lost" 40. warning: "GeViSoft Server: client warning"

Platform Variations

Actions often have multiple platform-specific versions:

GSC (GeViScope):
  "GSC ViewerConnectLive V <- C"

GNG (G-Net-Guard):
  "GNG ViewerConnectLive V <- C_101027"

GCore:
  "GCore <action>"

Unknown Patterns

Several byte patterns whose purpose is unclear:

1. Pattern: 04 02 40 40 64 00 00 00 00

   • Appears before many action strings
   • Possibly metadata or flags

2. Pattern: 00 00 00 00 00 01 31 05 00 00 00

   • Appears after "Rules" marker
   • Could be counts, offsets, or IDs

3. Pattern: 0C 4D 61 70 70 69 6E 67 52 75 6C 65 73

   • 0C MappingRules (length-prefixed, no 0x07)
   • At offset 252,172
   • Different string format than Pascal strings

Testing Results

Round-Trip Test

✅ SUCCESS!
Original:  281,714 bytes
Parsed:    64 action mappings
Written:   281,714 bytes
Comparison: IDENTICAL (byte-for-byte)

Conclusion: Safe to write back to server with current preservation approach.

SetupClient API Test

✅ Connection successful
✅ Read setup: 281,714 bytes
✅ Write setup: Not tested yet (waiting for full parser)
✅ Password encryption: Working (GeViAPI_EncodeString)

Next Research Areas

1. Trigger Parsing

Need to understand trigger structure:

.VideoInput = True
.InputContact = False

These appear before action strings in rules.

2. Metadata Bytes

The bytes between sections and before/after rules:

• What do they represent?
• Are they counts? Offsets? Flags?
• Can they be modified?

3. Section Relationships

How do sections reference each other?

• Do cameras reference alarm rules?
• Do action mappings reference I/O ports?
• How are IDs assigned?

4. Format Versioning

Does the format change between GeViSoft versions?

• Version 6.0.1.5 (current)
• How to detect version?
• Compatibility considerations?

Tools Used for Analysis

Python Scripts

# Find all "Rules" patterns
import struct
with open('setup_config.dat', 'rb') as f:
    data = f.read()

needle = b'Rules'
pos = 0
while True:
    pos = data.find(needle, pos)
    if pos == -1: break
    print(f'Found at offset {pos} (0x{pos:X})')
    pos += 1

Hex Editors

• HxD
• 010 Editor
• VS Code with hex extension

Binary Analysis

• Custom C# parser
• Grep for pattern matching
• Byte comparison tools

References

• TestMKS.set (279,860 bytes) - Original test file
• setup_config_20251212_122429.dat (281,714 bytes) - Live server config
• GeViSoft SDK Documentation
• GeViProcAPI.h header file

Change Log

Date	Discovery
2024-12-12	Initial binary analysis
2024-12-12	Discovered action string format
2024-12-12	Found 65 "Rules" markers
2024-12-12	Extracted 64 action mappings successfully
2024-12-12	Verified byte-for-byte round-trip