TM2X: some details

Funny how I started this blog more than 10 years ago mostly to talk about TrueMotion 2 and now it’s TrueMotion 2X time.

First of all, an existing binary specification (feel free to ask Baidu for some other materials for this codec, I’m pretty sure you’ll receive a lot) is weird and half of it is not well decompilable. It looks like the compiler did something inverse to inlining and split out some parts of code into separate functions without usual prologue and simply accesses variables somewhere deep on stack:

  1. sub_10037110    proc near               ; DATA XREF: .data:1005ECF8o
  2.  arg_2A4         = dword ptr  2A8h
  3.  arg_2A8         = dword ptr  2ACh
  4.  arg_2B4         = dword ptr  2B8h
  5.  arg_2B8         = dword ptr  2BCh
  6.  arg_2C0         = byte ptr  2C4h
  7.  arg_11DC        = dword ptr  11E0h
  8.  arg_11E0        = dword ptr  11E4h
  9.  arg_11E4        = dword ptr  11E8h
  10.  arg_11E8        = dword ptr  11ECh
  11.  arg_11FC        = dword ptr  1200h
  12.  arg_1210        = dword ptr  1214h
  13.  arg_1214        = dword ptr  1218h
  14.  arg_1260        = dword ptr  1264h
  16.                  test    eax, 10h
  17.                  jz      loc_100371D2
  18.                  mov     edx, [ebx+4]
  19.                  nop
  20.                  test    eax, 80h
  21.                  jz      loc_100371C5
  22.                  test    eax, 40h
  23.                  jz      short loc_10037149
  24.                  sar     edx, 3
  25.                  xor     eax, eax
  26.                  mov     [esp+arg_11E0], eax
  27.                  mov     [esp+arg_11E4], eax
  28.                  jmp     loc_100371C9
  29. ...
  30.                  mov     ebx, [esp+arg_2A4]
  31.                  mov     esi, [esp+arg_2A8]
  32.                  xor     ecx, ecx
  33.                  xor     eax, eax
  34.                  mov     al, [ebx]
  35.                  xor     edx, edx
  36.                  mov     cl, [ebx+2]
  37.                  nop
  38.                  mov     ebp, [esi+eax]
  39.                  mov     al, [ebx+1]
  40.                  jmp     ebp
  41.  sub_10037110    endp

Yet some details are known:

  • TM2X (or TM2A) stores frame data in a series of chunks each prefixed with 32-bit code, e.g. 0xA0000106 — main data, 0xA0000109 — some initialisation parameters etc;
  • Some block types seem to be alternative versions of the same data (i.e. 0xA0000103 has the same data as 0xA0000010B but with some fields missing and you’re supposed to have either one or another block but not both);
  • Frame seems to be divided into 8×8 blocks that can be one of three types (I guess intra, inter or skip and inter with motion compensation);
  • Motion compensation has halfpel precision and motion vectors coding is surprisingly complicated for such class of codec (it looks like the codec codes motion vectors for large areas and has refinement for those motion vectors per block).

So it’s exactly like TM2 which had fixed structure and delta coding in 4×4 blocks. Either that or this is a missing link between Duck TrueMotion 2 and On2 TrueMotion VP3.

Comments are closed.