Native Instruments presets are three containers wearing one badge. The NISound "hsin" tree carries Massive .nmsv, Absynth .nabs, FM8, Reaktor, and modern Kontakt .nki; the older .ksd document shell (old Absynth, KORE, FM8) wraps zlib chunks around plain XML; and .nksf is a RIFF form full of MessagePack. The formats are community-documented; everything below was re-derived from byte-level facts against real presets, nothing else. The metadata a producer wants is plain in all three: no decompression is needed to read an hsin preset name. Hover any field to light its exact bytes and read the decode; click a field with a + to open its table. Color marks kind (see the key).
An EBML-like tree of size-prefixed frames, everything little-endian. Each frame opens with a 0x30-byte header (its own size, the "hsin" magic, a UUID), then a stack of DSIN-domain item records, then child frames. The item chain in every preset examined:
The root frame of nicecombo.nmsv, byte for byte. The magic sits at 0x0C, not 0x00: sniff there. NI writes its four-char codes byte-reversed ("hsin" reads NIsh backwards), a habit that repeats through all three families.
At 0x30 the item stack begins: each record is a 4cc domain, a u32 item ID, a u32 version, and a u64 inner size. Records nest by size until the innermost item's own data begins. Drawn below: the RepositoryRoot record that opens nicecombo.nmsv.
The metadata is stored as pascal strings: a u32 character count, then that many UTF-16LE code units. Item 101 holds the app ID (7 = Massive, 6 = Absynth) and the writing version string; item 108 holds the preset name, author, vendor, description, and finally the app name. Drawn below: the name field of nicecombo.nmsv.
The SubtreeItem holds the actual patch. Its payload header is drawn below (nicecombo.nmsv); after it comes a FastLZ level-1 stream that decompresses to a complete nested hsin container of raw synth parameter state. acidcat inspect --verbose runs the decompression and reports the inner container; by default it stays opaque, because the metadata never needed it.
Old Absynth, KORE, and FM8 saved through the "SoundShell" document layer: an ASCII "-in-" magic, a class path string, then a run of chunked zlib streams. The 4ccs are byte-reversed again: atad is data, ofni is info, bilz is zlib. Richest metadata of the three families.
After the magic and a u32 version comes the ASCII class path "#NI#CS#Document##NI#SoundShell#Sound#", then the atad chunks. Each names a stream and wraps it in a bilz envelope with both sizes up front. Drawn below: the info chunk of Trance Sequenz.ksd.
The ofni stream inflates to a small blob tagged " LMX" (XML, reversed once more) holding a plain NI_DOC_HEADER document. Trance Sequenz.ksd, decoded:
The modern cross-vendor preset wrapper is just RIFF with form type NIKS. The metadata chunk NISI is a u32 version followed by one MessagePack map; the plugin state rides along raw in PCHK.
The opening bytes of New_Init_2.nksf: standard RIFF header, then NISI lands first with the whole browser card in one msgpack map.
MessagePack packs its type and length into the lead byte, so short strings cost one byte of framing. The name entry from New_Init_2.nksf: