Attempt at explaining Memory Pit. Some details may not be correct but the basic gist is right I think.

Intro: This is all about the DSi Camera's pit.bin file and its inability to parse it safely. The file is a database of pictures on your system's NAND or SD (pit.bin is in both places).

1) Extending the header size at 0x16 far past the usual size of 0x18 (around 0x4000-0x5000) will overwrite a pointer in the heap with custom "picture entry" data (aka, our redirect address).
2) This pointer is redirected to inside the header, where it lands around 0x4C lower than a link register -- this 0x50 area is a data structure of some unknown type, but we don't care what it is.
3) This data structure with a custum crafted LR then jumps to our code after some helpful function uses it!
- See notes_Fig1.png for visualization of these steps (warning: programmer art).

Notes:
a. Each picture entry is sorted by the first int in the 16 byte total size when loaded in RAM. Care must be taken that this does not put data where you did not intend to.
b. There is a  seperation of the pit.bin that occures between the header section and entry section. The gap size has been observed to be: header size (offset 0x16) - 0x50.
c. Payload.dat data cannot be placed in the entries section. The data causes a corruption error and the pit.bin is erased. It is unknown what aspect of the payload data causes this.