Unlocking AMR: Parsing AOSP and Vendor Audio Formats with 010 Editor

Introduction

The Android Open Source Project (AOSP) uses a container format that, while open, contains many undocumented details; vendor‑specific variants are even less public. To deeply analyze these formats, the author chose 010 Editor for its binary visualization and templating capabilities.

Background

AMR (Adaptive Multi‑Rate) is a voice‑coding audio format used in telephony and voice messages. Although less known than MP3 or AAC, it remains important in specific scenarios.

File Header

AMR files start with a magic string that identifies the type. For AMR‑NB (narrow‑band) the magic is #!AMR\n represented in hex as 23 21 41 4D 52 0A. For AMR‑WB (wide‑band) the magic is #!AMR‑WB\n with hex 23 21 41 4D 52 2D 57 42 0A. Detecting these bytes allows quick format identification.

Data Frames

Each AMR file consists of a sequence of data frames, each representing 20 ms of audio. AMR‑NB defines eight frame types (bitrates 4.75–12.2 kbps) and AMR‑WB defines nine types (6.60–23.85 kbps). The first byte of a frame is the header, where the high‑order bits indicate the frame type (e.g., 0x3C corresponds to a 32‑byte frame for 12.2 kbps NB).

The size calculation is illustrated: 12.2 kbps → 12 200 bits per second → 244 bits per frame → 30.5 bytes ≈ 31 bytes, plus one byte header gives 32 bytes per frame.

Implementation

The 010 Editor template defines several structs such as FRAME_HEADER, AMR_FRAME, AMR_NB_HEADER, and AMR_WB_HEADER. It sets big‑endian byte order, reads the magic bytes to determine NB or WB, and then loops with while (!FEof()) to read each frame.

Helper functions GetNbFrameSize and GetWbFrameSize use a switch statement to return the correct frame size based on the frame type. The template also uses SetBackColor to highlight sections in the UI and issues Warning messages if the file is not a valid AMR.

Value

Writing 010 Editor templates provides deep insight into binary media formats, facilitates debugging of malformed files, and creates a solid foundation for building fuzzers that target these containers, ultimately improving security analysis.

References

https://docs.fileformat.com/zh/audio/amr/

http://www.3gpp.org/ftp/Specs/html-info/26104-CRs.htm

https://www.sweetscape.com/010editor/manual/IntroTemplates.htm

https://github.com/jinchenwu1986/MediaContainerTemplates