Picture data
The data of a BPicture is composed of instructions.
These instructions have a small header, which looks as follows:

int16 | id | The instruction id
int32 | size | The size of the data

After this header the data follows. There are two exceptions: EnterStateChange and EnterFontState. These are used to enclose state and font changes. For ExitStateChange and ExitFontState there are no instructions, this is not needed as we know the size of the instruction block in the header of the Enter* functions.
These are the known instructions at the moment:

Id | Name | Size | Data
--- | --- | --- | ---
0x0010 | MovePenBy | 4 | BPoint where
0x0100 | StrokeLine | 16 | BPoint start BPoint end
0x0101 | StrokeRect | 16 | BRect rect
0x0102 | FillRect | 16 | BRect rect
0x0103 | StrokeRoundRect | 24 | BRect rect BPoint radii
0x0104 | FillRoundRect | 24 | BRect rect BPoint radii
0x0105 | StrokeBezier | 32 | BPoint[4] control
0x0106 | FillBezier | 32 | BPoint[4] control
0x010B | StrokePolygon | 4 + point data size + 1 | int32 numPoints BPoint *points bool isClosed
0x010C | FillPolygon | 4 + point data size | int32 numPoints BPoint *points
0x010D | StrokeShape | shape data size | shape data, see below
0x010E | FillShape | shape data size | shape data, see below
0x010F | DrawString | 4 + string data size + 8 | strlen char *string float deltax float deltay
0x0110 | DrawPixels | 52 + pixel data size | BRect src BRect dest int32 width int32 height int32 bytesPerRow int32 pixelFormat int32 flags pixel data
0x0113 | StrokeArc | 24 | BPoint center BPoint radii float startTheta float arcTheta
0x0114 | FillArc | 24 | BPoint center BPoint radii float startTheta float arcTheta
0x0115 | StrokeEllipse | 16 | BRect rect
0x0116 | FillEllipse | 16 | BRect rect
0x0200 | EnterStateChange | size of state instructions | state instructions
0x0201 | SetClippingRects | TODO | TODO
0x0203 | PushState | 0 |
0x0204 | PopState | 0 |
0x0205 | SetClippingRects | TODO | TODO
0x0300 | SetOrigin | 8 | BPoint pt
0x0301 | SetPenLocation | 8 | BPoint pt
0x0302 | SetDrawingMode | 2 | drawing_mode mode
0x0303 | SetLineMode | 2 + 2 + 4 | cap_mode capMode join_mode joinMode float miterLimit
0x0304 | SetPenSize | 4 | float size
0x0305 | SetScale | 4 | float scale
0x0306 | SetForeColor | 4 | rgb_color color
0x0307 | SetBackColor | 4 | rgb_color color
0x0308 | SetStipplePattern | 8 | pattern p
0x0309 | EnterFontState | size of font instructions | font instructions
0x0380 | SetFontFamily | 4 + string data size | strlen char *family
0x0381 | SetFontStyle | 4 + string data size | strlen char style
0x0382 | SetFontSpacing | 4 | int32 spacing
0x0383 | SetFontEncoding | 4 | int32 encoding
0x0384 | SetFontFlags | 4 | int32 flags
0x0385 | SetFontSize | 4 | float size
0x0386 | SetFontRotate | 4 | float rotation
0x0387 | SetFontShear | 4 | float shear(is 0 instead of 90?)
0x0389 | SetFontFace | 4 | int32 flags

There are a few undocumented instructions:

30A | ???? | 4 | some state change
388 | ???? | 4 | some font change

Also, not all instructions where checked yet. The SetClippingRects and DrawPixels data has still to be documented.
Shape data
The shape data contained in a BPicture is stored as follows:

int32 | instruction count
int32 *instructions | Each instruction looks like: First byte is the instruction id, MoveTo is not coded as a seperate instruction, but as a bitflag of the next instruction 0x80 see the table below. The next three bytes is the amount of points used*
int32 | point count
points |

Id | Name | Points* | Notes
--- | --- | --- | ---
0x0B | MoveTo | 1 |
0x10 | LineTo | point count in instruction |
0x90 | MoveTo LineTo | point count in instruction + 1 |
0x20 | BezierTo | point count in instruction | point count is always multiple of 3
0xA0 | MoveTo BezierTo | point count in instruction + 1 | point count is always multiple of 3
0x70 | Close | 0 |