none
mp4 file corruption

    Question

  • I have windows 7 Home Edition 64 bit with Media Center, etc. Lately I have been converting some videos to h.264 mp4 and noticed something strange. Some of my mp4 files that played fine previously suddenly stopped playing. After checking things out I noticed that the ones that stopped playing have recent modified dates and are all over 4GB. I think some background process is adding metadata of some kind and corrupting the ones over 4GB. The modified dates seems to be like every 20-30 minutes one file to the next. The mp4 files below 4GB are still fine (even though they have more recent modified dates). The ones over 4GB are all trash now. I did recently back these up and move them to a new folder watched by media center. I also may have played them in media player. Anybody know of any process that automatically modifies mp4 files?

    Wednesday, August 14, 2013 3:08 AM

Answers

  • I figured out how to repair the video files. Figured I'd post in case this happens to someone else

    1. using a hex editor Find the "Xtra" atom (search for characters Xtra). Move to 4 bytes before this to get size of this atom and mark the Starting CUT Position. I see 00 00 00 A3 which in decimal is 163. We have to remove the 163 byte Xtra atom which includes the 4 byte size before it's 4 byte Xtra name. So from Starting CUT Postion move out to the byte just before the 4 bytes size before the "mdat" atom. For large files the size before the mdat atom will be 00 00 00 01 becuase it's size is over 4GB. This marks the ending CUT POSTION. If you count all the bytes you are about to cut, this should amount to 163 the size of the Xtra atom.

    Within the Xtra atom we can see the following attributes that where added by windows thus corrupting the file.
    WM/EncodingTime
    WM/MediaClassSecondaryID
    WM/MediaClassPrimaryID

    2. Next we need to correct the size of the parent udta atom. Look at the 4 bytes before the udta atom. I see (00 00 01 03) hex which in decimal is 259. Subtract the size of the Xtra atom we just removed 163 giving 96 (00 00 00 60) hex . Paste the 60 hex in the 4 bytes before the udta atom.

    3. Finally we need to correct the size of the parent moov atom. The 4 bytes before the moov atom are (00 AF E4 1B) hex which is 11527195.
    11527195 - 163 = 11527032 (00 AF E3 78)

    I still don't know what wrote the Xtra atom but I assume what ever wrote it used windows API's to write the WM attributes and corrupt the mp4 file. From now on I will try to set my mp4 files as read only.

    Saturday, August 17, 2013 3:18 AM

All replies

  • http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/smfmf-files-whais-it-and-how-to-open-it/b2b70315-aed0-4c36-891f-c872512d8a5c

    http://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/removal-of-dirtydefragexe-from-pc/c0657710-f1e3-4a74-9464-07fa3d883b59

    this could be due to a kind of ransomeware which encrypts your data ..

     

    Restart and press f8 continuously and login to safe mode with networking.. even within this mode, If u cant download use another pc and download and transfer this....


    Use one scanner at a time

    Download hitman pro 3.7 and have a full system scan..
    http://www.surfright.nl/en
    And/or 


    use malwarebyte and have a full system scan..http://www.malwarebytes.org/

    And/or
    use adwcleanerand have a full system scan.. http://www.bleepingcomputer.com/download/adwcleaner/)

    And/or

    use TDSS Killer have a full system scan..: http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller


    additional info
    If everything fails, you can use offline bootable resccue cd and do a full system scan...
    https://support.kaspersky.com/viruses/rescuedisk

    http://windows.microsoft.com/en-us/windows/windows-defender-offline-faq

    This may be a kind of encryption by a malware.. it will be difficulty to recover existing encrypted data other than a carryout a system restore to a previous date, where infection was not there




    Wednesday, August 14, 2013 6:00 AM
  • Hi,

    What software you are using to edit MP4 files?

    To verify if the issue is related to the MP4 files, play the files with other media players and see if the issue persists.

    Here is another article which discuss the similar issue:

    Can a MP4 AVC H.264 greater than 4GB ?

    http://forum.doom9.org/showthread.php?t=142605

    Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    If any progress, please feel free to let me know.

    Thanks.


    Tracy Cai
    TechNet Community Support

    Thursday, August 15, 2013 2:27 AM
    Moderator
  • I don't this this is malware. I think this might be a bug in windows 7. I can reproduce easily in windows explorer by right clicking on an mp4 video file. Clicking on Details and then giving 5 star rating. This inserts the following tag Xtra atom with WM/SharedUserRating metadata. So far I have detected that none of the co64 atom offsets are adjusted on windows 7 but they are on windows 8. The same operation on the same original file on windows 8 and the file is still fine. On two different windows 7 boxes I have corrupted the mp4 by giving 5 star rating. This also only seems to happen with mp4 files over 4GB. Luckily I have back ups of most of the files. but I did lose 3. Trying to see if I can repair them. Not sure if this helps reproduce but I created the mp4 files with VideoRedo and the ftyp atom is ftypisom....isomiso2avc1mp41.…å.
    Thursday, August 15, 2013 3:23 AM
  • I figured out how to repair the video files. Figured I'd post in case this happens to someone else

    1. using a hex editor Find the "Xtra" atom (search for characters Xtra). Move to 4 bytes before this to get size of this atom and mark the Starting CUT Position. I see 00 00 00 A3 which in decimal is 163. We have to remove the 163 byte Xtra atom which includes the 4 byte size before it's 4 byte Xtra name. So from Starting CUT Postion move out to the byte just before the 4 bytes size before the "mdat" atom. For large files the size before the mdat atom will be 00 00 00 01 becuase it's size is over 4GB. This marks the ending CUT POSTION. If you count all the bytes you are about to cut, this should amount to 163 the size of the Xtra atom.

    Within the Xtra atom we can see the following attributes that where added by windows thus corrupting the file.
    WM/EncodingTime
    WM/MediaClassSecondaryID
    WM/MediaClassPrimaryID

    2. Next we need to correct the size of the parent udta atom. Look at the 4 bytes before the udta atom. I see (00 00 01 03) hex which in decimal is 259. Subtract the size of the Xtra atom we just removed 163 giving 96 (00 00 00 60) hex . Paste the 60 hex in the 4 bytes before the udta atom.

    3. Finally we need to correct the size of the parent moov atom. The 4 bytes before the moov atom are (00 AF E4 1B) hex which is 11527195.
    11527195 - 163 = 11527032 (00 AF E3 78)

    I still don't know what wrote the Xtra atom but I assume what ever wrote it used windows API's to write the WM attributes and corrupt the mp4 file. From now on I will try to set my mp4 files as read only.

    Saturday, August 17, 2013 3:18 AM
  • It is wmpnetwk.exe (Windows Media Player Network Sharing Service) writing and corrupting our files. It adds 2 "tags" to the UDTA box in the file.

    It does it whenever you do something to the MP4 file in explorer, in my case it was renamíng the files that caused WMP to rewrite them. WTF? Who needs malware when you have WMP.

    I wrote a C# script that removes the WMP tags from the MP4 files, making them playable again:

    http://pastebin.com/VJgi20vP

    You can either compile as an exe or run it with cscs.exe.

     



    • Edited by Mnerec Sunday, August 31, 2014 7:37 PM
    Thursday, August 14, 2014 8:11 PM

  • Mnerec,

    Do you know why this is causing the issue? It seems the moov size covers the xtra atom and its componets. 

    I had been doing this manually with AtomicParsley and HxD but I'm glad you have a script for us.  I did try it and its not correcting the moov size for me but I'll see if I can figure it out in the code.

    Thank you

    -  TT

    Wednesday, November 26, 2014 4:04 PM
  • Happy to hear you discovered a reason behind this. I went through a similar process with Microsoft support 2 years ago when I discovered Windows Live Photo Gallery was corrupting mp4s when any tag was added. I could always replicate and send through the different files as evidence but nothing was ever resolved. Funny how they can never replicate these things.

    It was very inconsistent as to when it would happen, and it luckily hasn't been worring me for a while - mostly working around it, and lo-and-behold, i just discovered a large number of recently imported mp4s have become corrupt as soon as an image program (lightroom, picasa, etc) alters their tags. I have tested this again and I can confirm the alteration of the file through the addition of a metatag is causing the corruption.

    I noticed that these are all mp4s from phones (HTC One 7 and Samsung Galaxy tab edge in this case). It is very inconsistent as I have others that were imported by lightroom several months ago and are fine. Same as I discovered a couple of years ago.

    Monday, January 5, 2015 1:32 AM
  • Mnerec, signed up to Technet specially to thank you for this - you just saved a bunch of very important family videos for us and cleared up the mystery as to what the heck was going on. I did all the virus, malware and rootkit scans, I did all the SMART tests, I nearly went out and bought a new hard drive thinking it must be corrupt - not to mention that these really precious family videos (first week of baby's life, that sort of irreplaceable thing) had been backed up, but backed up in an ALREADY CORRUPTED state, since the problem went unnoticed until much later. I had already tried some (hideously expensive) commercial solutions that seemed to see recoverable data in the files, but I was sure there must be a simpler explanation - WHY was it only happening to mp4 videos, for one thing!

    Finally came across this discussion - the phone is also a HTC One - or One S, I think, and the symptoms were identical - moving the files or renaming them in Explorer caused them to stop working and for major panic to ensue.

    I compiled your script and ran it on a copy of the data (a batch of 20-30 mp4 files) and hey presto the files play again - though not in WMP (tragically), but in VLC they work fine. Needless to say I have disabled wmpnetwk.exe.

    I anticipate that this problem will be resolved in Windows 15 or so - we'll look forward to that, in the meantime, thank you once again!

    P.S. Unfortunately damage seems to have been done by wmpnetwk.exe in terms of removing metadata - I am not really clued up on what kinds of metadata are supposed to be in there but information like creation date (important for family videos, right?) has gone, even before running this script. Also a lot of the vids recorded in landscape now play sideways, am pretty sure they didn't before - wonder if that is down to missing metadata too?

    • Edited by markowe Saturday, February 7, 2015 1:05 PM Added note about metadata
    Saturday, February 7, 2015 11:31 AM
  • I did it exactly as described, but no luck for me (maybe because I have another atom 'free' before 'mdat' in my video file). So I fiddled with several variants of removing tags, and the one which eventually worked for me was crudely removing the whole atom 'udta' (with the preceding 4 bytes) all the way to the begining of atom free (4 bytes before occurence of the label). I did not update the size of the atom 'moov' as described above, and yet the file now plays in VPL. Thank you for directing my effort. Otherwise I would be totally lost, or correcting it with expensive software which still does it crudely out of sync and with kind of random length.

    BTW, my mp4 files got corrupted in Windows 7 Professional Edition when I was simply moving them from one directory to another on the same hard disk! Unbelievable.

    • Proposed as answer by TryfTryf Wednesday, March 7, 2018 8:25 AM
    Monday, February 16, 2015 12:00 PM
  • I just had this happen with a 380MB mp4 file, recorded on a ZTE Awe N800 running Android. Right-clicking in Windows Explorer in Windows 7 Home Premium SP1, I edited a few elements of metadata -- name, tags, create date -- and then the file would not play in WMP, Quicktime, or VLC. Going in and deleting the added metadata in Windows Explorer didn't help. Fortunately I still have the original on the phone! So I'm just going to copy that over rather than try the script above. Seems to be a bug in Windows 7, or perhaps something's not structured properly in the file.
    Saturday, May 23, 2015 8:08 PM
  • It is wmpnetwk.exe (Windows Media Player Network Sharing Service) writing and corrupting our files. It adds 2 "tags" to the UDTA box in the file.

    It does it whenever you do something to the MP4 file in explorer, in my case it was renamíng the files that caused WMP to rewrite them. WTF? Who needs malware when you have WMP.

    I wrote a C# script that removes the WMP tags from the MP4 files, making them playable again:

    You can either compile as an exe or run it with cscs.exe.

     

    My childs birthvideo, among others got the tags. How do i run your script. I'm now very little about programming. I tried to compile it trough Viusal CMD but nothing happens when i run the .exe

    Can you perhaps upload a compiled working exe for win7 (64bit) ?

    Monday, November 9, 2015 12:01 PM
  • I have had the same problem and it was also corrupting some important video of my baby. I had 20 video corrupted, some of them with some unique moment of the first weeks of my baby.

    I'm a software developer so I have developped a Windows (7, 8 and 10) application to fix the issue. I was very glad to recover the videos. I have decided to propose it as a Freeware for other users like you. Here it is:

    http://auroraborealissoftware.jimdo.com/english/ 

    I hope that it will fix your issue too!

    Monday, March 7, 2016 12:47 PM
  • I have had the same problem and it was also corrupting some important video of my baby. I had 20 video corrupted, some of them with some unique moment of the first weeks of my baby.

    I'm a software developer so I have developped a Windows (7, 8 and 10) application to fix the issue. I was very glad to recover the videos. I have decided to propose it as a Freeware for other users like you. Here it is:

    http://auroraborealissoftware.jimdo.com/english/ 

    I hope that it will fix your issue too!

    It is now also available on download.cnet.com if you prefer:

    http://download.cnet.com/MP4XtraAtomRemover/3000-2094_4-76476401.html

    Wednesday, March 16, 2016 9:25 AM
  • If you use "MP4XtraAtomRemover" to recover your video, I recomment to use the version 1.0.0.4 or later because it has some important bug fixes:

    http://www.softpedia.com/get/Multimedia/Video/Other-VIDEO-Tools/MP4XtraAtomRemover.shtml

    Tuesday, March 14, 2017 9:47 PM
  • Dude (maaraplus), you just saved my life! Recently this happened to me and I did what flagrantHippo proposed and didn't work for me but I decided to give a try to what you did and videos came back to life! Thank you!


    • Edited by TryfTryf Wednesday, March 7, 2018 8:59 AM
    Wednesday, March 7, 2018 8:25 AM