A tracker module is a small filesystem pretending to be a song: a header, a pattern order, the pattern data, then the instrument samples, all in one file. The three formats differ in signature and rigidity but share that shape. MOD has no leading magic at all; the only reliable tell is four bytes at offset 1080, and the audio location is computed, not stored. XM opens with the string "Extended Module: " and a self-describing header you must walk block by block. S3M hides its signature entirely — the "SCRM" magic sits 44 bytes in, after the title — and reaches its instruments and patterns through DOS paragraph pointers, a 16-bit value shifted left four. IT opens with "IMPM" and, uniquely, stores explicit on-disk pointer tables: one offset per instrument, sample, and pattern. The record drawn below is a real IT IMPS sample header; its sample pointer is an absolute file offset to the PCM, the pointer acidcat follows and carves. Hover any field to light its bytes; click a field with a + to open its table. Color marks kind (see the key).
Same skeleton -- header, order, patterns, samples -- four ways of laying it out. acidcat maps all four down to the byte offset of every embedded sample, so each is carveable.
The oldest and the trickiest to detect. Everything before offset 1080 is fixed by position: a 20-byte title, 31 sample descriptors of 30 bytes each, a song length and restart byte, then a 128-entry order table. The audio location is stored nowhere; it is computed from the number of patterns (one greater than the highest index in the order table) times the pattern size (64 rows x channels x 4 bytes). That layout, and the offset-1080 tag, belong to the 31-sample format only: the original 15-sample Soundtracker MOD had neither, its patterns starting at offset 600 (0x258) with no magic anywhere -- the genuinely headerless case a detector falls back to heuristics for.
Opens with "Extended Module: ", a module name, a tracker string, a version word, and a header whose size is a u32 field. From there it is a walk, not a fixed map: pattern blocks announce their own header and packed-data lengths, and instrument blocks announce their own size and sample count. To reach the last instrument's samples you traverse every pattern and every preceding instrument.
ScreamTracker 3's format is the odd one out on detection: there is no signature at offset 0. The file opens with a 28-byte title, and the "SCRM" magic sits at offset 0x2C — you confirm an S3M by looking 44 bytes in. The header (below) then gives the counts, a file-format flag that decides signed vs unsigned samples, and the tracker version that wrote it. To reach an instrument or pattern, S3M uses parapointers: a 16-bit value you shift left four (multiply by 16) to get a byte offset — DOS paragraph addressing, so a two-byte pointer spans a one-megabyte file. The sample record's own memseg is a further parapointer to the PCM.
The richest. After the "IMPM" header and the order list come three explicit tables: one 32-bit offset per instrument, sample, and pattern. These are absolute file offsets, a tiny on-disk filesystem. Following a sample-table entry lands on an IMPS sample header (below), whose sample pointer at +72 is a further absolute offset to the PCM. IT is a two-level pointer structure, and acidcat annotates both levels as followable xrefs, flagging one that dangles past EOF.
Header, pattern order, and every embedded sample at its real byte offset -- so a sample is a carveable region, and IT's pointer tables are followable. Decoding XM/IT delta or IT compression to playable audio is out of scope; this maps structure and extracts.