Hacker's Guide to QuickTime

Michael A. Lowry



QuickTime is one of the most commonly encountered digital video formats on the Internet.  Most movie trailers released online are in QuickTime format.  QuickTime has been chosen as the file format for MPEG-4 by the Motion Picture Experts Group.  QuickTime is used by iTunes to handle encoding and decoding of digital audio.  Many digital cameras save movies in QuickTime format.  In short, QuickTime is ubiquitous.

QuickTime gives filmmakers many ways of protecting their movies from casual copying.  Apple's developer documentation discusses methods of copy protetcing movies.  These methods are in common use for the QuickTime movies available online.

Some movies can be viewed online, but not saved to disk for later viewing.  The inevitable result of this is that if you view a movie online and wish to view it again later, you must download it again, wasting network bandwidth and your time.  For people with slow connections, download caps, or usage charges, this is an even greater problem.  QuickTime also allows content authors to make their movies unplayable on some computers based on, for example, network bandwidth, operating system, or geographical location.  This means that it may not be possible for you to download some movies.  And even if you succeed in downloading them, QuickTime Player may refuse to play them. Finally, some movies contain so many extraneous "eye candy" tracks that these movies may not play smoothly on older computers.  Below, I will describe these obstacles and how to overcome them.  Using these instructions, you should be able to download and view almost any QuickTime movie.

Lest it be thought that I am encouraging anything improper, let me take a moment to make my intentions perfectly clear. 
Authors should have control over distribution of their work.  Copyright law has respected and even expanded these rights over the past two centuries.  However, the Fair Use rights of the public must also be upheld.  QuickTime's copy protection mechanisms function to discourage and prevent people from exercising their Fair Use rights.  For example, anyone may use excerpts of a copyrighted work for criticism or parody; and QuickTime attempts to prevent just this sort of thing.  Furthermore, it is unlikely in the extreme that copy protection mechanisms actually discourage real thieves; the people most inconvenienced are ordinary users.

This guide is intended for honest hackers, not thieves.  With the iPod and the iTunes Music Store, Apple has shown that respecting customers rather than treating them like criminals is a winning strategy.   This guide is offered in the same spirit. Please do not infringe other people's copyrights.


  1. How to save a QuickTime movie from your web browser without QuickTime Pro
  2. How to save a QuickTime movie (in some cases) even if the movie does not allow saving
  3. How to save a local copy of QTPluginTemp
  4. How to determine the URL of a movie file by reading the contents of a reference movie
  5. How to determine the URL of a movie file by capturing the HTTP GET request
  6. How to play stubborn QuickTime movies that will not play in QuickTime Player


If you load a QuickTime movie in your web browser but have not upgraded to QuickTime Pro, the "Save as QuickTime movie…" and "Save as source…" commands will not be available in the QuickTime plug-in.  

Starting with version 3.0, Apple has offered an enhanced version of QuickTime called QuickTime Pro for USD 30.  QuickTime Pro adds several important features to QuickTime.  The one most people will notice is the ability to save movies from the QuickTime web browser plug-in.  QuickTime Pro also adds editing features to QuickTime Player.

QuickTime Pro is worth USD 30 for many people.  However, there are occasions when it may be desirable to download a movie to disk without QuickTime Pro:
These instructions will show you how to save movies to your hard disk without QuickTime Pro installed.  

When your web browser loads a QuickTime movie, most of the time it will do so using the QuickTime plug-in.  This is a browser plug-in that allows the display of QuickTime content directly inside the web browser.  In the address bar in your web browser, you can see the URL of the currently displayed file, be it a web page or another kind of file.

If the URL in the address bar ends in .mov, then the file displayed is a QuickTime movie.  This is the simplest case, and saving the movie to your hard disk in this case is a one-step process.  All you really have to do is choose "Save as…" from the File menu of your web browser and then specify where you want to save the .mov file.

If the URL in the address bar ends in .html or another extension, but you still see a QuickTime movie in the browser window, this means that the QuickTime movie is embedded in a web page.  This complicates things a little bit because it means that you'll have to do a little work to find out the URL of the movie file itself.  The simplest way to do this is often to view the HTML source of the web page.  Web pages are often divided into multiple frames, and each frame has its own source.  So viewing the source of the frameset page will not always show you the URL of the movie.  In such cases, you must display the source of the frame in which the movie is embedded.  The best way to do this is to right-click (or control-click) just to the side of the movie and choose "View source…" from the pop-up contextual menu that appears.  When the source window appears, simply search through it for ".mov" until you find the URL of the movie.  Copy and paste this URL into a new web browser window (or tab).  When the movie has loaded completely, just choose "Save as…" from the File menu to save it to disk.


There are a couple of ways in which a movie can be protected from copying.  First, if the movie is embeded in a web page, the author can set KIOSKMODE=True in the EMBED tag.  If QuickTime plug-in sees this setting, it will disable the save options, even if QuickTime Pro is installed.  However, in such cases one can view the source of the web page (as described above) and use the browser's "Save as…" function to save the movie.

However, some movies are saved in such a way that even if you manage to save the movie to you hard drive, if you then make any changes to the movie, QuickTime Player will not allow you to save the edited movie.  An error message will appear that reads: "This movie does not allow saving."

Video editing programs like Cleaner allow authors to save movies in such a way that further changes to the movie are disallowed.  When the author saves the movie, he simply enables the "disallow saving" check box.  Some filmmakers chose to do this to prevent others from altering their work.  Others chose this option to discourage users from making local copies of movies viewed online. 

There are many reasons why an author might wish to control the use of his work in this way, but there are also valid Fair Use rights that must be weighed against such controls.  There are practical reasons that it may be necessary to alter a movie.  For example, some QuickTime movies that contain multiple tracks in addition to the video and audio track do not play smoothly on older computers because of the added computing power required to process the additional tracks.  With the extra tracks removed, such movies play more smoothly.  As an added benefit, they also occupy less space on disk.

A good example of this is the movie trailer for The Two Towers.  The full screen version of this movie trailer, entitled (TheTwoTowers_fs.l.mov) contains eight different tracks.  If you download the movie to you hard disk and open it in the QuickTime Player, you can see the list of tracks by choosing "Show movie properties" from the Movie menu.  This particular file includes a border on the top and bottom, splash screens for the beginning and end of the movie, and other tracks ("sprite" and "tween" tracks for a fade-in/out effect, a customized progress bar and customized start and exit controls).

QuickTime requires extra CPU cycles to display these tracks.  On slower machines, this can often make the difference between a good viewing experience and a bad one.  The only two tracks that are essential for this particular movie are the video and audio tracks.  Deleting the other six tracks makes the movie play much more smoothly ("Delete Tracks…" in the Edit menu).

The slimmed-down version of the movie still contains the full 640x272 resolution video, and plays much more smoothly on older machines.  Unfortunately, because the creator of this movie turned on the "disallow saving" option, it is not possible to save the movie after deleting these six tracks. 

The "disallow saving" option is stored as a flag in the QuickTime movie file itself.  The QuickTime player honors this flag and disables options like saving and copying when a movie file with this option enabled is open.  It should be obvoious that for such movies, it makes no difference whether QuickTime Pro is installed - it will not be possible to use QuickTime Player to save them.

The best way to circumvent this problem would be to determine the structure of the disallow saving flag.  Once the flag's structure is known, it would be possible to write a program to change the value of the flag in a QuickTime movie.  I am not aware of any program that will perform this function.  Until such a program is available, it will not be possible to save a movie with the disallow saving flag enabled.

If you're only interested in viewing the video an audio content of a QuickTime movie, see the topic on VideoLAN Client, below.

3. How to save a local copy of QTPluginTemp

When you load a QuickTime movie in your web browser, the QuickTime plug-in downloads a copy of movie to disk.  This a copy is stored in a location that depends on the operating system and the user.

Mac OS X:


The temporary files are always called QTPluginTempXXXX where XXXX is a pseudo-random number.  The files are deleted as soon as they are not needed by the QuickTime Plugin anymore.  So as soon as you close the web browser window where the movie is displayed, the file will be removed automatically.

On Mac OS X, it's easy to make a copy of the temporary file when it is done loading.  Here's an example of how to do this:

$ cd /tmp/501/TemporaryItems
$ ls -l
-rwxr-xr-x  2 mlowry  wheel  1048576 28 Jan 01:41 QTPluginTemp12345
$ cp QTPluginTemp12345 /mymovie.mov

Note: I'm not sure how to copy a QTPluginTemp file on Windows.  Every time I have tried to do this, Windows returns the error "file already open".

On Mac OS X, there's an even better way to save the file: create a hard link2 to the file.  Here's an example of how to do this:

$ ln /tmp/501/TemporaryItems/QTPluginTemp12345 /mymovie.mov

There are several advantages to creating a hard link instead of a copy:
Once you close the browser window in which the movie was displayed, the QuickTime plug-in will remove the temporary file.  However, if you have created a hard link to the file, the file will still be present on disk, and will still be accessible via the link that you created.


Sometimes when you save a movie locally, the file saved to disk is very small - too small to contain the actual movie.  Usually this means that the file saved to disk is not the real movie, but a small reference movie  that points to (refers to) the actual movie file.  These reference movies are often used to provide a different actual movie file to the user based on his network or CPU speed. Reference movies are also commonly used to hide the location of the actual movie file from the user and thereby prevent him from saving a local copy to disk.  Many of the movie trailers available online are hidden behind reference movies in this way.

If you want to save the actual movie to disk and not just the reference movie, you must discover the URL of the actual movie file.  The URL is usually visible in the ref movie.  Save the ref movie to disk and open it in your favorite text editor.  The URL of the movie file will usually be visible.  Just copy and paste this URL into your web browser and save the movie to disk.

If you are downloading movie trailers from Apple's web site, you'll probably notice a pattern emerging in the way the ref files and movie files are named.  Once you learn this pattern (there are actually several patterns), you'll be able to skip the step of saving and examining the ref file.

Apple's developer documentation has more information about reference movies.


Some movie authors are very clever in hiding the location of actual movie file from view.  I recall that the full-screen version of the movie trailer for Star Trek Nemesis implemented this method of obfuscation.  If one loaded the small, medium, or large versions of the trailer, the movie files were hidden by an ordinary reference movie.  However, if one selected the "full screen" version of the trailer, a more clever type of reference movie would be downloaded.  This movie was more than just a reference movie.  It was larger, for one thing.  It  contained several tracks, including a splash screen, and customized controls.  It also contained instructions to launch QuickTime Player and switch to full-screen view.

Then, the movie instructed QuickTime Player to fetch the actual movie file over the network.  Unfortunately, unlike a traditional reference movie, the small movie that had been saved to disk and launched in QuickTime Player did not contain a readable URL.  So it was not apparent what URL QuickTime Player was fetching.  Complicating matters further, no QTPluginTemp file was present.

Note: I'm not sure where QuickTime Player stores its temporary files.

Luckily, there's another way to download the movie file to disk, and that is to find out the URL of the movie that is being loaded behind the scenes by QuickTime.  QuickTime Player and the QuickTime Plugin of course hide all of this from the user, but in the background, QuickTime sends an HTTP GET request to a web server to retrieve the movie file.  If you could find out what URL is being requested, you could paste this URL into your web browser to download the movie file to disk.

Discovering this URL is actually not too difficult. The instructions below pertain to Mac OS X, but similar commands also exist on Windows.

  1. First, you must identify the HTTP server that is being contacted by QuickTime.  While the movie is loading in QuickTime Player or the QuickTime plug-in, open a Terminal window and run this command to look for established HTTP connections to port 80:
    netstat -an | grep ESTABLISHED | grep .80
  2. One of these connections should be the connection downloading the movie.  If you have downloads going in your web browser, those will show up too, so you'll have to use the process of elimination to find the IP address of the server.  Let's say that the server is (One of Akamai's servers).  The next step is to capture the HTTP GET request to this server.  Because many movies available online are served by a cluster of load-balancing servers, it's best to capture HTTP requests to the entire network to which the web server belongs.  Use tcpflow to capture the request:
    tcpflow '(dst net and (dst port 80)' &
  3. Once the tcpflow command is running in the background, reload the movie or load another movie from the same server so that a new HTTP GET request will be sent over the network.  If all goes well, tcpflow will capture the packet to a text file in the current working directory.  The URL of the movie file will be contained in the HTTP GET request.  Simply copy and paste this URL into your web browser to download the movie file to disk.

6. How to view stubborn QuickTime movies that cannot be viewed in QuickTime Player

QuickTime gives the filmmaker great flexibility in how content is delivered.  As the Two Towers and Star Trek Nemesis trailers show, movie makers can add extra content and a customized appearance to their movies so that what's presented to the viewer contains more than just video and audio.

QuickTime also allows the content creator to exercise control over whether the movie is viewable at all.  The QuickTime version of NOVA program Mars Dead or Alive illustrates one way in which this sort of control can be exercised by filmmakers.  The program files are available from Nova's web site.3

Once you have download one of the movie files to disk, if you attempt to open it in QuickTime Player on a computer located outside of the United States, the movie will not be displayed.  Instead, an image will be displayed that reads:
"Due to rights restrictions, we do not have permissions to make this program available for downloading."

The means that the movie file itself contains instructions that tell QuickTime Player to check the viewer's geographical location4.  In this way, QuickTime will refuse to play if the viewer is not located in the U.S.  Movie creators could also design their QuickTime movies to refuse to play based on other criteria.  A movie might refuse to play, for example, on Windows, or on a computer that does not have QuickTime Pro installed.

But don't despair!  It's not necessary to fool QuickTime Player.  There is another player program called VideoLAN Client that will play most QuickTime movies.  VLC plays only the video and audio content of the movie; it does not attemt to perform any other instructions that might be present in the movie file.  Instructions that might otherwise prevent the movie from playing on certain computers would therefore be ignored.

VLC is an open-source video player that can play media files from hard disk, DVD or Video CD.  VLC can also play streaming media over a network.  VLC can play most types of media, including MOV, AVI, WMF, and DIVX.  It's available for Mac OS X, Linux, and Windows.  Because it is open-source, it can also be compiled for just about any other platform.  VLC is a great example of what can happen when a dedicated group of programmers contributes to an open-source project.

VLC plays the Mars Dead or Alive movies just fine regardless of where the viewer happens to be sitting.  Because VLC plays only video and audio tracks, it can also be used to play movies like The Two Towers trailer without wasting CPU cycles on the unnecessary extra tracks.  VLC has a playlist that can be used to play several movies in sequence (e.g., the seven chapters of the Mars Dead or Alive program).  These playlists can be saved to disk for later use.  Another benefit of VLC is that it plays movies very smoothly in full screen mode.

Document Revision History

1.0.0    2004-01-26    First draft
1.1.0    2004-01-28    Second draft
1.2.0    2004-02-04    Published briefly on Apple's QuickTime discussion forum
1.3.0    2004-02-06    Expanded introduction, converted to HTML, minor improvements and corrections.


  1. With each new release of QuickTime, the user must pay the thirty-dollar Pro fee again or risk loosing the "Pro" features he paid for in the previous release.  For example, if you paid for QuickTime 5.0 Pro and then upgraded to QuickTime 6.5, you would loose the "Pro" features that you had already paid for.  You would then have to pay another thirty dollars to get the "Pro" features back.
    The odd thing is that most of the new features in each new release of QuickTime are available to all users of QuickTime, even those who do not pay for QuickTime Pro.  The "Pro" features one gets by paying for the QuickTime Pro 6.5 are the same features one may have already paid for in QuickTime Pro 5.0.  In other words, users who don't pay for the Pro version still get many of the features of each new release; while users who do pay for the Pro version are forced to pay again and again to keep the same functions.
    Still, Apple does need to recoup its investment in QuickTime.  Apple also must pay licensing fees for the codecs included with QuickTime.  Charging for popular features is an easy way to cover these expenses.  If you want to be able to easily save downloaded movies from your web browser, upgrading to QuickTime Pro is probably the best way to do this.
  2. Here's a little background information about i-nodes and hard links:
    Each file in the file system has an inode.  The inode is what contains all the information necessary to find all the bits of the file scattered across the platters of the hard disk.  Each inode has a unique inode number -- a serial number that is unique for each file within a file system.  inode 2 is usually reserved for the root directory of the file system, and each subdirectory and file has its own number greater than 2.  Each file name in the file system is a hard link to an inode.  Most of the time, there is only one link per inode, but it's possible to create more than one hard link to a single inode.  That's what the ln command above does.  You might be familiar with using the ln command with the -s flag to create a symbolic link.  That's something different, more akin to an alias.  A symbolic link is a special kind of file that points to another file.  So a symlink has its own separate inode.  A hard link is an entry in the file system directory file that points to a particular inode.  You can list a file's inode number with the 'ls -il' command.  When the QuickTime Plugin is done with a particular file, it removes the hard link to that file.  But of course the inode remains, and it's the inode that contains all the information necessary to find all the bits of the file on disk!  So until the file system reuses that inode (i.e., to create another new file), the file data are still accessible.  Having a second hard link to the inode means that even when the first hard link is removed, there is still one hard link left.  As long as there is at least one hard link to an inode, the file system will not remove or re-use that inode.  Creating a second hard link forces the file system to keep the file.  Another benefit of creating a second hard link is that you can name it whatever you like as long as it is located in the same file system (volume) as the original.
  3. If you connect to the the PBS web server from outside the United States, you will be redirected to a page that reads:
    "We're sorry, due to rights restrictions this program is only available for online viewing in the United States, its territories, possessions, and commonwealths. You appear to be connected to the Internet from outside these areas."
    The web server appears to detect the location of the user by the IP address of the connecting HTTP client. With a little effort, it is possible to download the movie files to disk even if one is located outside the US.  Anonymizing proxies can help with this.
  4. I'm not sure how QuickTime Player determines the user's location.  It does not seem to use the computer's time zone or keyboard layout settings.  QuickTime Player refuses to play the movie even if the network is diconnected.  It would be very interesting to find out exactly how QuickTime determines the user's location.