Skip to content
Discussion options

You must be logged in to vote

APP1 in JPEG is just a container. JPEG itself only defines:

  • Marker FF E1
  • A 2-byte length
  • Then raw payload bytes

JPEG does not define what is inside that payload.

In almost all real-world JPEGs, APP1 contains EXIF metadata. And EXIF is defined as:

"Exif\0\0"
+ a complete TIFF file structure

So when you start seeing things like:

  • IFD entry counts
  • 12-byte directory entries
  • A 4-byte “next IFD offset” that is 0x00000000

You are no longer parsing “JPEG structure”. You are parsing a TIFF-style structure embedded inside APP1. That is by design, not a coincidence.

Now to your actual issue:

After the 4-byte 0x00000000 “no more IFDs” field, you see two 0x00 bytes that do not seem to belong.

That…

Replies: 1 comment 2 replies

Comment options

You must be logged in to vote
2 replies
@markolbert
Comment options

@JimBobSquarePants
Comment options

Answer selected by markolbert
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
None yet
2 participants