Return to Digital Photography Articles

JPEGsnoop - Version History

A summary of the updates and features in each release of JPEGsnoop

Return to JPEGsnoop Main Page

Version History

1.8.0 June 26, 2017

- Fixed vulnerability (div0) with invalid DQT
- Fixed vulnerability (DLL hijacking)
- Fixed compression stats for files with RST markers
- Fixed batch file processing
- Fixed Photoshop 8BIM, XMP decode reporting
- Major code cleanup to eliminate warnings (Visual Studio 2017)

1.7.5 November 29, 2015

- Added Photoshop (PSD) decoding
- Added "-offset*" and "-done" command-line flags
- Added batch progress report to window
- Fixed user DB warning message
- Added "Relaxed Parsing" mode and more robust handling of corrupt images

1.7.3 September 28, 2014

- Fixed Win XP launch issue
- Improved error handling with missing User Database
- Fixed command-line filenames with leading '-'

1.7.2 September 19, 2014

- Extended file size support up to 4GB
- Added parsing of DAC, DNL, EXP, SOFn
- Added progress reporting in lengthy search operations

1.7.1 September 14, 2014

- Fixed Search Executable for DQT function
- Disabled warning dialogs in batch and command-line "-nogui" modes
- Fixes in batch command-line mode
- Fixed handling of long marker identifier strings [SF-bug-021]
- Fixed DHT/DQT indexing [SF-bug-022]
- Various fixes in 8BIM / IPTC decoding

1.7.0 August 24, 2014

- Added parsing of Photoshop files (*.PSD)
- Added decoding of Photoshop APP13 (IRB/8BIM)
- Support for Unicode and foreign filenames
- Extended support for IPTC parsing (IIM v4)
- Fixed subsampling decode issues
- Fixed IFD/Makernote dumping issues
- Batch operation enhancements: batch extract all, alternate destination
- Command-line enhancements: extract all JPEG
- Many other bug fixes and enhancements
- Minimum version now: Windows XP SP1
- Source code extensive rewrites

1.6.1 November 4, 2012

- Added support for long filenames (>64 chars) in GUI [ID:3583822]
- Changed SOS component header table display format
- Fixed vulnerability in CSS range checks [ID:3583820]
- Fixed DHT expand labels for EOB [ID:3442132]
- Fixed large file handling issue (eg. 40+ megapixel images).

1.6.0 June 14, 2012

- Added batch extraction of JPEGs from file [ID: 3088849]
- Fixed incorrect DQT used for 2nd chroma channel [ID: 3508359]
- Fixed support for chroma subsampling over 2x2 (eg. 4x2) [ID: 3518288]
- Fixed image decode for some images during Detailed Decode
- Fixed GPS metadata display
- Fixed JFIF comment search for assessment [ID: 3466580]
- Improved handling of oversized files
- Fixed YCC/RGB clipping statistics
- Fixed large file handling issue (eg. 40+ megapixel images).

1.5.2 February 20, 2011

Fixed YCC/RGB clipping statistics. Fixed large file handling issue (eg. 40+ megapixel images).

1.5.1 November 14, 2010

Improved robustness of batch mode. Added average luminance report. Fixed crash on files with APP1 EXIF without IFD. Extra error checking in EXIF decode.

1.5.0 October 30, 2010

Released to Open Source. Batch processing. Added "Force SOI" to Export JPEG.

1.4.2 April 10, 2010

Fixed stuff byte handling in Detailed Scan Decode. Fix problems with 20+ megapixel images. Ignore RST checking when DRI interval=0.

1.4.1 May 29, 2009

Minor update. Clarified license as free for commercial use. New icon. Report extra data following EOI.

1.4.0 April 30, 2009

Rewrote and improved EXIF tag decode, added GPS tags, fixed Canon makernotes. Print Adobe XMP metadata (APP1). Support 12-bit lossy JPEGs. Added feature to hide unknown EXIF tags. Decode ICC header.

1.3.0 February 8, 2009

Enhanced image assessment logic, supports camera phones better. Flashpix contents decode corrected. Better failure abort handling. Support extra marker pad bytes. Detailed scan decode now handles restart markers.

1.2.0 January 22, 2008

Export dialog now adds option to ignore missing EOI (in addition to Force EOI). Report MCU coords for bad markers in scan. MCU overlay grid drawn even in 25% mode (not 12.5%) instead of 100%+. More robust in handling invalid file offsets (encoded within MakerNote IFD entries) as a result of corrupting editors (e.g. Picasa). Limited number of scan data bad marker error messages. Added "MJPG" as decodable FourCC codec for MotionJPEG (not just "mjpg"). Fast Huffman code lookup is only done if enough bits remain in scan buffer. Restart markers are now handled properly and reset decoder state. Expect restart markers and report if missing. Restart markers checked for proper sequence. Limited IFD decode of excessive # components, in case IFD corrupted. Fixed bug in Overlay mode dialog. Fixed vulnerability to Win32/Exploit.MS04-028 Trojan (COM field length underrun). Added marker hex word to headers during decode, adjust OFFSET value to account for 2 bytes in marker word. Added brightest pixel search. Initial reporting of IDCT RGB Dump (in detailed decode mode). Decoding now detects AVI1 APP0 identifier. Added PDF file type. Fixed bug in IFD offset calc for some TIFF Identifier strings. Handle grayscale images with odd sampling factors. Extra error checks in DHT decoding.

1.1.3 November 30, 2007

Automatic display of YCC DC block values (16-bit). Image export now allows for optional overlays and MJPG DHT insertion. Full detailed Huffman VLC decoding output for those interested in writing a decoder or learning JPEG compression, including DCT matrix. Sped up color conversion speed by 25% when Histogram disabled. Histograms now calculate at pixel level. Bad marker in scan data no longer stops decode by default (more robust in handling corrupt photos). Record MCU position and YCC values upon clicking within image (set marker). Corrected extra byte at end of export.

1.1.2 November 8, 2007 Added MCU Grid overlay. Added automatic MCU positioning plus file offset of current mouse position over image. Enhanced test overlay functionality to show binary codes and instant Apply. Mouse scroll wheel support in image window. Corrected incorrect zoom menu levels. Added all IJG grayscale signatures. November 4, 2007 Further increased resiliency in decoding corrupted images. Added configuration option to set limit on number of scan decode error messages to show.
1.1.1 November 3, 2007 Enabled decode of corrupt images to proceed. Capped scan decode error messages to a maximum limit.
1.1.0 November 3, 2007 Added high-resolution scan decode (full IDCT decode of DC+AC scan coefficients), available via [Scan Segment->Full IDCT]. Increased image view zoom range. Marking of partial MCU boundary. Cosmetic improvements. Note that Full IDCT mode is very slow, but performance will be increased in future releases. Added back in [Lookup MCU Offset] and [File Overlay] functions, disabled since 0.8.2.
1.0.2 October 28, 2007 Extract embedded JPEG images from file, also includes ability to extract frames from MJPEG AVI files. Several enhancements to compression signature detection, including rotated signatures and JFIF comment field indicators. Improved error handling.
1.0.1 October 24, 2007 Corrected Scan decode for images with single pair of DHT tables. Added .crw RAW file type. DQT executable search added pre- and post-zigzag searches. Decoded several AVI fields.
1.0.0 October 24, 2007 Major update: Complete rewrite of user interface: clipboard, printing, find, unlimited report log length, etc. Drag & Drop files to main window to open. Full AVI file parsing (to identify MotionJPEG). DQT table searches in Executables (for hackers). Management of user signature database. Added thousands of signatures for both cameras and software. Automatic checking for new updates. Configuration options and user preferences retained. Increased image decode performance by 10x. Enhanced support of DNG files. Many other bug fixes and more robust error handling.
0.8.1a October 6, 2007 Minor update: Added detection of Photoshop IRB to signature compare. Added 50+ cameras to database.
0.8.1 October 4, 2007 Added Extended Sequential DCT decode (SOF1), 16-bit DQT tables. Added signatures for all IJG quality 1-100, and all Photoshop quality levels for Mac & Windows. Report editors that use IJG quality levels. Total 1800 signatures. Rewrote signature submit code to support older OSes (Windows 95/98).
0.8.0 October 1, 2007 Completely rewrote image authentication / signature detection. Signature database increased from 300 entries to over 1600! User submission of compression signatures for digicams and software editors. Decode of embedded JPEG thumbnail. Minor bug fixes.
0.7.3 September 14, 2007 Digital image forensics - determine if a photo is edited or what camera took it. Partial FlashPix decode.
0.7.2 August 16, 2007 Grayscale preview (scan decode) fixed. File overlay test. Horizontal scrollbars in preview.
0.7.1 August 9, 2007 Multiple-channel preview (RGB, YCC and all individual channels). Multiple zoom levels for preview. Direct lookup of pixel position into file offset.
0.7.0 August 3, 2007 AVI (MotionJPEG) display of embedded frames (no RIFF parsing). Arbitrary file offset for start of JPEG decode (specified in hex or decimal). JPEG frame search functions. Fixed handling of tiny images and memory allocation issue.
0.6.8 August 1, 2007 Extract IPTC Metadata fields. Tolerant of CMYK images (but no display/scan decode yet)
0.6.7 May 10, 2007 Fixed scan decode display of images with only one DQT.
0.6.6 Apr 29, 2007 Added ability to display and dump luminance histogram (Y channel).
0.6.5 Apr 09, 2007 Split-screen view of decoding data and image display / histogram. Fixed drag & drop. Fixed grayscale exception bug. Scan Parse enabled by default.
0.6.4 Apr 01, 2007 Command line options, unlimited log file output (from Save), precise erorr reporting of file offsets, YCC clipping errors, fixed display of logs that exceeded 2000 lines.
0.6.3 Mar 22, 2007 Added Dequantization stage which corrects the under-saturation that some images were displaying.
0.6.2 Mar 20, 2007 Individual RGB channel histogram display. Fixed and improved color conversion YCC to RGB statistics. Fixed drag & drop and command line invokation.
0.6.1 Mar 17, 2007 DC scan bitmap display. Improved memory handling. Increased speed of variable length code parsing. Compression ratio calculation. Huffman code histogram / stats.
0.6 Mar 11, 2007 Scan data decode & detection of corrupt images. Progress indication. Better error identification. Support grayscale images. Handle images with > 4 DHT. Various fixes.
0.5 Feb 1, 2007 Added detection of Photoshop Quality settings (Save As, Save For Web) in APP12 & APP13 markers. Handle virtually unlimited JPEG file size with minimal memory consumption.
0.4.4 Jan 30, 2007 Added more robust handling of non-JFIF APP0 segments and truncated files.
0.4.3 Jan 14, 2007 Added Huffman table expansion, Scan data dump.
0.4.1aNov 25, 2006 Actually fixed missing DLL issue.
0.4.1Sep 22, 2006Makernote decode for Sony, Sigma. Fixed DLL issue (no).
0.4Sep 12, 2006Makernote decode for Canon, Nikon.
0.3Sep 08, 2006Log file saving, corrected UI features.
0.2Sep 07, 2006Added EXIF metadata decode.
0.1Sep 06, 2006First initial release. Limited functionality.


This version has some limitations:

  • Doesn't decode all JFIF marker types
  • Doesn't decode all APP# markers
  • Makernote decode supported for Canon, Nikon (Type 3), Sigma, Sony only.
  • Scan Parsing and Image Display does not support Progressive Scan images.
  • Does not decode files > 2GB in length.

Known Bugs

The following bugs are known to exist and should be fixed in the next release or two:

  • Doesn't decode images with subsampled Luminance (Y) properly -- very rare

Source Code

JPEGsnoop was written in Visual C++, with source code currently being considered for release as Open Source!

The JPEGsnoop decoder was written completely from scratch, and as such it does not use any other decoder libraries or parsers. In taking this approach, the development has enabled me to gain a deeper understanding of the file and compression format, and has afforded me the flexibility to enhance this application in interesting ways. The downside of enhanced flexibility is a reduction in decode performance.


I want to thank the following people for their contributions:

  • Rez - Beta-testing Win98, large collection of corrupt JPEG images
  • Dag Ă…gren - DQT entries for a large number of digicams and Mac software
  • And many others who have taken the time to provide valuable feedback and suggestions

Want to be notified of new versions?

If you want to receive an email when a newer version is available, click here:


Reader's Comments:

Please leave your comments or suggestions below!
 I used this to extract the imagaes embedded in .mms files in a Doro phone.
It workes really well except tha you have to press search forward in every file so I didn't get the batch processing to work.
 will this break down how an image was ran through photoshop? For example, would it show the steps the photographer used to edit the image in Photoshop?
 Hi Amber - No, this tool won't give you any indication of what was done within Photoshop itself, only that Photoshop appeared to be used to resave it. In some cases JPEGsnoop can reveal extra information included in the file (such as the thumbnail) that may give a hint as to changes that may have occurred, but this isn't typical.
 Hi, I was trying to implement RTP packetisation prescribed by RFC 2435 for MJPEG Video. The encoder I have gives the huffman tables used in the output image.
The output standard is recognised as MJPEG by JPEGSnoop. Is it required in the RTP payload or can the huffman table be omitted from the payload by mentioning the type of huffman table used, somewhere in the payload?
 Hi Anoop -- From what I recall, I don't think there is any actual indication of the type of Huffman table expected in a file (if it is omitted). JPEGsnoop makes the assumption that if it sees markers indicative of MJPEG AVI files that it automatically loads the MJPEG default DHT.
2010-06-13subhajit chatterjee
 i need the JPEG snoop source code...i want to extract pixel value from a should i proceed??
 There is a "bug" (only visual) in the Huffman detailed decoding when there is an FF00 padding. I have a 64x64 4:4:4 JPEG with standard Huffman tables that starts like:
"FE 42 57 F6 54 FF 00"
and coefficiens decode show (1st Luma block):
DC: [0x FE 42 57 F6 = 0b (11111110 01000010 01------ --------)]
1: [0x 57 F6 54 FF = 0b (--0101-- -------- -------- --------)]
2: [0x 57 F6 54 FF = 0b (------11 11110110 01010100 --------)]
and, here is the error:
3: [0x 00 A8 6F A7 = 0b (00000000 10101000 01101--- --------)]

What should be shown is:
3: [0x FF A8 6F A7 = 0b (11111111 10101000 01101--- --------)]
ignoring the 00h byte and leading to the right Huffman code (Lum 6/5): "11111111 10101000"

Thanks for your great app!
 Hi -- You're right. I believe I have already fixed this issue in an upcoming release. Please check your email for a download link to test out. Thanks!


Leave a comment or suggestion for this page:

(Never Shown - Optional)

NOTE: Image repair requests are not accepted. Thanks for your understanding.