How to inspect APP Segments Matters

Advanced: Python Script to Inspect APP Segments

Below is a Python script that walks the JPEG structure and prints every APP segment with offsets, types, and lengths.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""
jpg_segment_inspector.py

Usage:
  python jpg_segment_inspector.py your_image.jpg

Outputs each APP segment with offset, length, and label.
"""

import sys
import os
import struct

MARKER_NAMES = {
    0xD8: "SOI",
    0xD9: "EOI",
    0xC0: "SOF0 (Baseline DCT)",
    0xC2: "SOF2 (Progressive DCT)",
    0xC4: "DHT (Huffman Table)",
    0xDB: "DQT (Quantization Table)",
    0xDD: "DRI (Restart Interval)",
    0xDA: "SOS (Start of Scan)",
}

def read_byte(f):
    b = f.read(1)
    if not b:
        raise EOFError
    return b[0]

def read_marker(f):
    byte = read_byte(f)
    while byte != 0xFF:
        byte = read_byte(f)
    while True:
        byte = read_byte(f)
        if byte != 0xFF:
            break
    return byte

def get_app_label(data):
    label = data[:16]
    try:
        text = label.decode("ascii", errors="ignore")
    except Exception:
        text = ""
    text = text.strip("\x00")
    if "JFIF" in text:
        return "JFIF"
    if "Exif" in text:
        return "EXIF"
    if "ICC_PROFILE" in text:
        return "ICC_PROFILE"
    if "Adobe" in text:
        return "Adobe"
    return text or "Unknown"

def inspect_jpeg(path):
    with open(path, "rb") as f:
        size = os.path.getsize(path)
        print(f"\n=== Inspecting: {path} ({size} bytes) ===\n")
        start = f.read(2)
        if start != b"\xFF\xD8":
            print("Not a valid JPEG (missing SOI marker FF D8).")
            return
        print("Offset 0x0000: FFD8  --> SOI (Start Of Image)")

        while True:
            try:
                pos = f.tell()
                marker = read_marker(f)
            except EOFError:
                print("\nReached end of file.")
                break

            if marker == 0xD9:
                print(f"Offset 0x{pos:04X}: FFD9  --> EOI (End Of Image)")
                break

            if 0xD0 <= marker <= 0xD7:
                print(f"Offset 0x{pos:04X}: FF{marker:02X}  --> RST{marker - 0xD0} (Restart Marker)")
                continue
            if marker == 0x01:
                print(f"Offset 0x{pos:04X}: FF01  --> TEM (Temporary)")
                continue

            length_bytes = f.read(2)
            if len(length_bytes) != 2:
                print(f"Offset 0x{pos:04X}: FF{marker:02X}  --> Incomplete length field.")
                break

            seg_length = struct.unpack(">H", length_bytes)[0]
            seg_data = f.read(seg_length - 2)

            name = MARKER_NAMES.get(marker, "")
            prefix = f"Offset 0x{pos:04X}: FF{marker:02X}"

            if 0xE0 <= marker <= 0xEF:
                app_no = marker - 0xE0
                label = get_app_label(seg_data)
                print(f"{prefix}  --> APP{app_no}  (len={seg_length})  Label={label}")
            else:
                if name:
                    print(f"{prefix}  --> {name}  (len={seg_length})")
                else:
                    print(f"{prefix}  --> Marker FF{marker:02X}  (len={seg_length})")

def main():
    if len(sys.argv) < 2:
        print("Usage: python jpg_segment_inspector.py your_image.jpg")
        sys.exit(1)

    path = sys.argv[1]
    if not os.path.exists(path):
        print(f"File not found: {path}")
        sys.exit(1)

    inspect_jpeg(path)

if __name__ == "__main__":
    main()

Run the script from a command prompt:

python jpg_segment_inspector.py sample.jpg

You’ll see each APP segment listed with offsets and labels, making it easy to verify JFIF, EXIF, or ICC metadata.