Difference between revisions of "Private/ds/app/484E94*/pit.bin"
Jump to navigation
Jump to search
m (→File Header) |
|||
| Line 28: | Line 28: | ||
| 0x0E | | 0x0E | ||
| 2 | | 2 | ||
| − | | | + | | Incremental photo counter (i.e. : next photo's number will be this counter + 1) |
|- | |- | ||
| 0x10 | | 0x10 | ||
Revision as of 15:32, 28 January 2011
File Header
| OFFSET | SIZE | DESCRIPTION (common value) |
|---|---|---|
| 0x00 | 4 | Magic ("0TIP") |
| 0x04 | 4 | UNKNOWN ("_1""00" LE, maybe number of first folder or max number of photos per folder) |
| 0x08 | 2 | Block-Size (0x0BB8 => 3000 Bytes) |
| 0x0A | 2 | # folders' hundreds digit |
| 0x0C | 2 | # folders' tens digit |
| 0x0E | 2 | Incremental photo counter (i.e. : next photo's number will be this counter + 1) |
| 0x10 | 2 | UNKNOWN (0x0000) |
| 0x12 | 2 | # of frames |
| 0x14 | 2 | CRC16 of whole file |
| 0x16 | 2 | Size of header (0x0018) |
It is known that if the offset to entries (size of header) is pushed passed the end of the file, the system freezes, it is not known wether this is exploitable or not. Infact any change which makes it read passed the end of the file makes it crash.
Each entry (16 bytes)
4 : Date 8 : Zeroes 1 : Type (1: Frame, 3: Photo) 1 : UNKNOWN : 8 * n <-- n is may entry number (first = 0 seconds = 1 ...) only the last Byte of the result is used 1 : Sticker (0: None, 4: Star, 8: Clover, 12: Heart, 16: Frame) 1 : UNKNOWN : Always zero
Misc information
Photos are stored in:
- SD:\DCIM\100NIN01
- SD:\DCIM\100NIN02
Frames are stored in:
- SD:\private\ds\app\484E494A\DCIM\100NIN01
- SD:\private\ds\app\484E494A\DCIM\100NIN02