How to Inspect VOB Pack Headers with a Hex Editor

This article provides a practical guide on using a hex editor to manually locate, parse, and verify the pack headers of an unencrypted Video Object (VOB) file. VOB files are fundamentally MPEG-2 Program Streams segmented into fixed-size sectors. By navigating file offsets and decoding individual byte fields, you can diagnose synchronization issues, check authoring standard compliance, and detect data corruption directly at the binary level.

Understanding the VOB Sector and Pack Architecture

Standard DVD-Video VOB files are organized into uniform sectors of 2,048 bytes (0x800 in hexadecimal). Each sector typically contains a single MPEG-2 Program Stream pack, which begins with a 14-byte (or larger, if stuffing bytes are present) pack header, followed by a system header or a packetized elementary stream (PES) packet.

Because unencrypted VOB files do not contain Content Scramble System (CSS) obfuscation, their payload and headers remain in plaintext binary, making them directly accessible via any standard hex editor (such as HxD, ImHex, or 010 Editor).

Locating Pack Headers

1. Open the File: Load the unencrypted .VOB file into your hex editor.
2. Align to Sector Boundaries: Navigate to offset 0x00000000. Because VOB packs align with physical DVD sectors, subsequent packs should appear at exact increments of 0x800 (e.g., 0x800, 0x1000, 0x1800, 0x2000).
3. Identify the Start Code: Inspect the first four bytes of the sector. A valid MPEG-2 pack header always begins with the 32-bit prefix 00 00 01 BA.

If 00 00 01 BA does not align at an offset divisible by 0x800, the file structure is either non-standard, malformed, or preceded by arbitrary container metadata.

Decoding and Verifying the Pack Header Bytes

An MPEG-2 pack header consists of a minimum of 14 bytes (offsets 0x00 through 0x0D relative to the pack start). Inspect each field sequentially:

1. Pack Start Code (Bytes 0–3)

• Value: 00 00 01 BA
• Verification: Confirms the boundary of an MPEG-2 Program Stream pack. Any deviation indicates data corruption or misaligned sector padding.

2. System Clock Reference (SCR) and Marker Bits (Bytes 4–9)

MPEG-2 packs encode the System Clock Reference across six bytes to synchronize audio, video, and sub-picture streams.

• Byte 4: The two most significant bits must be binary 01 (hexadecimal mask 0xC0, value 0x40). This identifies the header as MPEG-2 rather than MPEG-1 (which uses 0010).
• SCR Base and Extension: The remaining bits of Byte 4 through Byte 9 encode the 33-bit SCR base, marker bits, and the 9-bit SCR extension.
• Verification: Check Byte 4. If the top bits are not 01 (i.e., the byte does not fall within 0x40–0x7F), the header is invalid or improperly formatted. Ensure marker bits interleaved throughout these bytes equal 1 to prevent emulation of start codes.

3. Program Mux Rate (Bytes 10–12)

• Bit Allocation: A 22-bit integer specifying the rate at which the stream was multiplexed, measured in units of 50 bytes per second.
• Marker Bits: The two least significant bits of Byte 12 must both be 1 (binary xx11).
• Verification: Inspect Byte 12. The lowest two bits must evaluate to 0x03 when isolated (Byte & 0x03 == 0x03).

4. Pack Stuffing Length (Byte 13)

• Bit Allocation: The first five bits are reserved (typically set to 11111), and the last three bits define the pack_stuffing_length (0 to 7 bytes).
• Verification: Isolate the lowest three bits (Byte & 0x07). This reveals how many padding bytes follow immediately after Byte 13. For example, if Byte 13 is F8, the stuffing length is 0. If it is FD, the stuffing length is 5.

5. Stuffing Bytes (Byte 14 to 14 + N)

• If pack_stuffing_length is greater than 0, check the subsequent bytes. Each stuffing byte must be FF.
• Verification: Ensure that exactly N bytes of FF exist before the start of the next header (usually a PES packet starting with 00 00 01 E0 for video or 00 00 01 BD for private streams like AC-3 audio).

Common Irregularities to Detect

• Sector Drift: If searching for 00 00 01 BA returns offsets not ending in 000 or 800, streams within the VOB have lost sector synchronization, which can lead to read errors on hardware players.
• MPEG-1 Legacy Headers: If Byte 4 begins with binary 0010 (0x20–0x2F), the file contains MPEG-1 pack headers, which violate DVD-Video specifications.
• Non-Monotonic SCR: While inspectable across consecutive packs, the calculated SCR value should generally advance smoothly. Jumps backward or massive gaps between adjacent packs point to splice defects or dropped sectors.