Crossing my fingers and hoping I could ignore those bytes I created a test program that replaced an existing comment and changed the value in 9E to match the comment length. I found that they are in no way time related since I did the same test several times and the 13 bytes were always changed to the same value. However when I manually changed the comment via XP and examined the first 100 or so bytes I found that 13 other bytes besides 9E also changed (6 pairs and a single) and I have no idea what they represent. Also when I hex edited the value in that byte to a lower value the comment displayed truncated as I expected. For example I found that the length of a comment is stored in byte 9E of the file and if I change the comment via XP the value in byte 9E changes accordingly. I started with the Exif files but I guess I need to abandon this approach because I'm having too much difficulty understanding the structure.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |