Views: 578,522 Main | Rules/FAQ | Memberlist | Active users | Last posts | Calendar | Stats | Online users | Search 06-26-17 08:16 PM

0 users reading JPEG Signatures | 1 bot

Main - Reverse-engineering - JPEG Signatures New reply

Posted on 10-25-15 07:44 AM Link | #554
The DSi Camera utility stores some Exif header with AES signature in JPEG files, and refuses to load any JPEGs without such signatures from SD card. The 3DS is probably having same/similar JPEG signatures.

The overall format for DSi JPEGs is described here, http://problemkaputt.de/gbatek.htm#dsisdmmccamerafilesjpegs
A real DSi jpeg can be found here, http://dsibrew.org/w/images/d/d4/DSiCameraSampleImage.jpg

Seeing a 3DS jpeg would be nice too. Can somebody upload such a file somewhere, or did anybody already do so?

Does the 3DS contain the "DSi Camera" utility, too? If so, seeing a JPEG taken on "a 3DS in DSi mode" would be interesting, too.

I haven't yet tried to modify DSi JPEGs (or to import non-DSi images), but from what I can see, the signature stuff seems to be working as so:
DSi Signature (IV+MAC)
The 1Ch-byte Signature is split into a 0Ch-byte IV value (this might be just a
random number?), and a 10h-byte MAC value. The MAC is computed via AES-CCM:
IV[00h..0Bh] = First 0Ch-bytes of signature
KEY[00h..0Fh] = Constant (70,88,52,06,...) ;from BIOS ROM
Zerofill the 1Ch-byte signature area in the JPEG file
Probably zeropad(?) the JPEG file (if filesize isn't a multiple of 16 bytes)
Pass the whole JPEG as "extra associated data" to the AES-CCM hardware
Copy the IV value and computed MAC value back to the JPEG's signature area
Unknown if the IV value is just random, and unknown if there are further
requirements (such like using same Maker/Model strings or same resolution as in
original DSi files).
Locating "ldr rx,=927Ch" opcodes at various locations in Nintendo DSi Camera is
easy; but the stuff is handled via numerous sub-functions, including IPC stuff
with both ARM7 and ARM9 envolved; which isn't too easy to disassemble.
If you want to experiment with it, mind that the DSi uses little-endian AES (unlike most open source AES implementations), and observe that the official AES specs seem to require a 'header' (containing the extra data length with some weird encoding) in the first "extra associated data" block, but the DSi hardware does simply omit that weird header.

Posted on 10-25-15 02:22 PM Link | #562
I don't think there's one, I've tested this myself some time ago to let the DSi read a picture taken from 3DS, must take note it's a DSi XL from mid 2008 (old DSi?)

I'll upload a 3DS picture tomorrow, I can't do that on the 3DS itself (webrender imgur seems to fail?)

3DS with themehax 2.0

Very active player on Pokémon Shuffle, rip NNID (hello .cia)

Posted on 10-25-15 02:26 PM Link | #563
I remember trying to feed a custom-made image into my 3DS and it would read it fine.

Maybe the signature just serves to identify which files were taken from the DSi/3DS? Would be a lot of trouble for nothing though.

blargSNES -- SNES emu for 3DS
More cool stuff

Posted on 10-25-15 02:32 PM Link | #564
Is there a way to "set" a date for the picture that the 3DS recognizes it? Normally it would be 01-01-1900 if unknown.

3DS with themehax 2.0

Very active player on Pokémon Shuffle, rip NNID (hello .cia)

Posted on 10-25-15 02:55 PM (rev. 3 of 10-25-15 03:06 PM) Link | #566
Posted by StapleButter
I remember trying to feed a custom-made image into my 3DS and it would read it fine.

I can confirm this at least for MPO files (3d images, basicly 2jpegs with special exif markers).

EDIT: Just confirmed it, any JPEG file works as long as it follows the naming convention of the camera app.
It might vary from a 3DS to another, but for me it is /DCIM/100NIN03/HNI_XXXX.jpg(or .mpo)


this is the full output of exiftool using your DSi jpeg including unknown markers :

ExifTool Version Number : 9.89
File Name : DSiCameraSampleImage.jpg
Directory : .
File Size : 70 kB
File Modification Date/Time : 2015:10:25 15:00:43-04:00
File Access Date/Time : 2015:10:25 15:00:43-04:00
File Creation Date/Time : 2015:10:25 15:00:43-04:00
File Permissions : rw-rw-rw-
File Type : JPEG
MIME Type : image/jpeg
Exif Byte Order : Big-endian (Motorola, MM)
Make : Nintendo
Camera Model Name : NintendoDS
X Resolution : 72
Y Resolution : 72
Resolution Unit : inches
Software : EINH
Modify Date : 2009:05:23 04:32:38
Y Cb Cr Positioning : Co-sited
Exif Version : 0220
Date/Time Original : 2009:05:23 04:32:38
Create Date : 2009:05:23 04:32:38
Components Configuration : Y, Cb, Cr, -
Nintendo 0x1000 : õ.;..¤¨ë0uö`éÕW¯ÜÎç|š&Ϧü)é
Nintendo 0x1001 :
Flashpix Version : 0100
Color Space : sRGB
Exif Image Width : 640
Exif Image Height : 480
Interoperability Index : R98 - DCF basic file (sRGB)
Interoperability Version : 0100
Related Image File Format : JPEG Exif Ver 2.2
Compression : JPEG (old-style)
Thumbnail Offset : 584
Thumbnail Length : 4674
Image Width : 640
Image Height : 480
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:2 (2 1)
Image Size : 640x480
Megapixels : 0.307
Thumbnail Image : (Binary data 4674 bytes, use -b option to extract)

Posted on 10-25-15 05:41 PM (rev. 2 of 10-25-15 05:58 PM) Link | #567
Hmmmm, no issues importing JPEGs to 3DS? A while ago, I've read this: http://www.hjort.co/2011/09/transferring-photos-to-nintendo-3ds.html and that sounded as if would be difficult to import images.

Maybe Nintendo dropped that restriction in more recent firmware revisions, as it's been only annoying people and could have been bypassed via the browser trick anyways (?)

Or maybe it's been really just a filename issue all the time ;- ) apart from needing to follow the filename notation, the files must be also listed in "pit.bin" on DSi (ie. one could replace existing files with same name, but couldn't add new files with different names).

Now I am wondering if the DSi did really ever have had any issues, too... Just tried... Yes, the DSi does refuse even minor modifications of photos taken on DSi.
I've used the above sample image from dsibrew (and verified that I can view the original image on my DSi). Then I changed the three date strings from "2009:05:23" to "2009:05:24" in a hex editor, and, after that change, the DSi does just display "?, Cannot display image".
My DSi has some portions of the firmware downgraded, but the DSi Camera utility should be from most recent firmware upgrade.
EDIT: Since the time/date is also stored in pit.bin, I've restored the original date (caused the file to work on DSi) and then changed "EINH" to "PINH" (caused the "?, Cannot display image" to occur again)

Posted on 10-25-15 06:06 PM Link | #568
So I just tested again, a JPEG with no EXIF information can be displayed fine as long as its size is not too big (600x450 is fine on 3ds). Some big images will not be listed. (by big, I mean around 1200x800)
This is with an old3ds 9.2

Posted on 10-25-15 06:09 PM Link | #569
I remember having big issues getting any modified JPEG to show up. Perhaps they resolved it in a firmware upgrade..

Posted on 10-25-15 06:13 PM Link | #570
For me it worked since like always. Just had to adjust the file name.

Posted on 10-28-15 11:59 AM (rev. 2 of 11-01-15 11:43 AM) Link | #585
Posted by Yoshi
I don't think there's one, I've tested this myself some time ago to let the DSi read a picture taken from 3DS, must take note it's a DSi XL from mid 2008 (old DSi?)

Okay, so the 3DS appears to store DSi-compatible signatures in the JPEGs.
EDIT: Or did you mean that you've tested it... and the test has FAILED?

Yes, would be great if you could upload a photo taken on 3DS somewhere, just to see if the signature is really there, and if they have changed the "NintedoDS" string to "Nintendo3DS" or the like.

Posted on 10-28-15 12:34 PM Link | #586
I'm almost 100% certain that 3DS Camera checked this signature thingy way back..

Posted on 11-01-15 11:55 AM (rev. 2 of 11-01-15 11:57 AM) Link | #642
Any news? First lots of people posted about JPEGs... and then nobody managed to dump a JPEG from 3DS? Are there tech problems?
I could supply some tutorial on How-to-export-JPGs-on-DSi (if that should be really needed, but don't know if that info would apply on 3DS, too).
Does the 3DS support copying .JPGs to SD card at all? Or does it only allow to export .MPO's?
For uploading a 3DS .jpg, http://dsibrew.org might be a good place (since the forum doesn't seem to support attachments, and http://3dbrew.org seems to be blocked via some obscure captcha).

PS. seeing a .MPO file from 3DS would be also interesting. Are that files compatible with JPG viewers (eg. allowing to see the "left" half as normal 2D image)?

Posted on 11-20-15 03:10 PM (rev. 2 of 11-20-15 03:10 PM) Link | #755
I took a photo and a video on my o3DS which has System Version 9.5.0-22E.
Here is the folder that was saved into the DCIM folder:

Do you want me to copy and paste something from my DSi?

Posted on 11-20-15 03:17 PM Link | #756
Posted by nocash
PS. seeing a .MPO file from 3DS would be also interesting. Are that files compatible with JPG viewers (eg. allowing to see the "left" half as normal 2D image)?

Yes, .mpo files are simply two jpeg files joined together and all jpeg viewers show just the left half as a normal 2D image.
Here's an example of a 3DS mpo file as taken from Steel Divers: Sub Wars: http://puu.sh/lsBrQ/b72c8fe530.zip

Main - Reverse-engineering - JPEG Signatures New reply

Page rendered in 0.038 seconds. (2048KB of memory used)
MySQL - queries: 26, rows: 89/89, time: 0.021 seconds.
[powered by Acmlm] Acmlmboard 2.064 (2015-10-07)
© 2005-2008 Acmlm, Xkeeper, blackhole89 et al.