Pyramids (3DSWare)

Overview

A valid QR code contains 170 bytes of data and is LZ-10 compressed. The only byte that can cause a crash is at offset 0x01, as stated below.

QR Image

https://s13.postimg.org/f2lqhhaon/img.png

RAW Decompressed Data

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000080  00 00 12 00 00 09 13 00 00 00 00 00 00 00 00 00     ................
00000090  00 00 05 05 05 05 05 05 05 05 05 05 05 05 05 05     ................
000000A0  05 05 1E 00 00 00 C9 73 A8 1A                       ......És¨.

Raw Decompressed Data Explained

Address Length Meaning
0x00 1 byte Must be 0x01 or the game will not accept the level.
0x01 1 byte This byte selects the level background. Valid bytes ranges from 0x00 to 0x04. Anything over 0x04 will cause a null exception and crash.
0x02 160 bytes This section contains specific data bytes that makes up the level (16x10 grid thus 160 bytes).
0xA2 4 bytes This represents the time required to complete the level. Its stored as Little Endian Unsigned Int
0xA6 4 bytes This is a Reversed CRC32 of the combined bytes from address 0x00 to 0xA5

Reason for not being exploitable

The only byte that causes a crash is located at address 0x01 (Level background byte). The crash results in a null ptr exception which is not exploitable.