Hacking Pushmo/Pullblox QR codes analyzed

celcodioc

celcodioc

Major A$$hole
OP
Member
Level 2
Joined
Nov 13, 2011
Messages
278
Trophies
0
XP
159
Country
LATEST MAJOR EDIT: Added sections "Manhole/pullout switch location data" and "Coordinates"
POST STATUS: Messy

Note that these facts and theories are based on a few hours of research and comparing files. I'm still working on this and some facts may be incorrect.
Also, please remember that I'm not an experienced hacker, I just wanted to analyze these QR codes (and share my findings) because it seems like nobody else has yet.

The facts:
  • The file is always 718 bytes (722 including common QR data)
  • 512 of these contain block data and locations
  • Each block is encoded into a half-byte, 0-9 based on block colour (up to 1024 blocks per level - 32x32)
  • Half-byte [0xA] = No block
  • Each level has specific values for "locked" and "unlocked" states
  • Every byte after the QR header needs to be moved 4 bits to the right (for example, [0x4C, 0x86, 0xB2] --> [0x04, 0xC8, 0x6B, 0x20]), thanks elisherer :)

The theories:
  • The file might contain an obfuscated timestamp (pretty sure these are random values though)
  • The locked/unlocked values are based on those values
  • There is a byte tells the 3DS how long the level name is somewhere

To-do list:
  • Fix the pictures...



Manhole/pullout switch location data
coords.png




Coordinates
xyvalues.png




Downloads
easy_fixed.bin
easythree_fixed.bin
easy.bin - including QR data
easythree.bin - including QR data
 
  • Like
Reactions: FM360, tlyee61 and frogboy
celcodioc

celcodioc

Major A$$hole
OP
Member
Level 2
Joined
Nov 13, 2011
Messages
278
Trophies
0
XP
159
Country
tigris said:
Woah, time for a Mii QR code analysis xD
Good job, bro(dette).
Click to expand...

Thanks :)
Unfortunately, if I recall correcly, Mii data files are encrypted. I could be wrong though ;)

elisherer said:
awesome!!!! we could make pushmos out of pictures!!!!
Click to expand...
If I could find a working encoder we could probably test and see if the game accepts our edited levels.

elisherer said:
both links (easy + easythree) are for the same file easy.bin...adding the "three" to the "easy" gives the real link...
Click to expand...
Fixed, thanks.
 
frogboy

frogboy

lacking both style and grace
Member
Level 9
Joined
Dec 6, 2011
Messages
2,434
Trophies
1
Age
28
XP
1,736
Country
United States
Nice theory. Don't worry, if I ever produce a Pushmo PC level editor, I'll give you credit!

too bad i'm not great at coding...
 
elisherer

elisherer

I ♥ 3DS
Member
Level 4
Joined
Dec 16, 2009
Messages
778
Trophies
0
Location
3dbrew.org
Website
www.sherer.co.il
XP
392
Country
Iceland
correction: every byte is aligned to the nearest 4bits...

I shifted the two files 4 bits to the left.. and see this..

easythree.bin
Code: 
00000000 02 CE 8D 06 00 00 00 00 00 00 B6 25 9D 52 01 07 .. ........% R..
00000010 07 20 77 21 3D 2A 2E 23 51 1C 0F 0F 00 00 FF FF . w!=*.#Q.......
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000030 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000050 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000060 FF FF FF FF FF FF FF FF FF FF FF FF FF FF 45 00 ..............E.
00000070 61 00 73 00 79 00 00 00 14 08 78 41 14 08 5C 69 a.s.y.....xA..\i
00000080 2A 00 00 00 00 00 00 00 00 00 B8 3B 14 08 00 00 *..........;....
00000090 00 00 C4 5B 2A 00 C0 3E 14 08 04 00 00 00 00 00 .. [*..>........
000000A0 14 08 C0 3E 14 08 00 00 A0 C1 00 00 80 3F 00 00 ...>.... ... ?..
000000B0 00 00 04 00 00 00 FF FF FF FF FF FF FF FF FF FF ................
000000C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
000000D0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000000E0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000000F0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000100 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000110 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000120 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000130 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000140 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000150 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000160 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000170 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000180 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA A2				
00000190 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001A0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001B0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001C0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001D0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001E0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001F0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000200 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000210 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000220 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000230 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000240 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000250 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000260 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000270 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000280 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000290 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002A0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002B0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002C0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002D0 0A 0A										   ..

easy.bin
Code: 
00000000 02 CE 8D 06 00 00 00 00 00 00 E2 4C 5D B8 01 07 .. ........L]...
00000010 07 20 7F 21 3D 2A 2E 23 51 1C 0F 0F 00 00 FF FF . !=*.#Q.......
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000030 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000050 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000060 FF FF FF FF FF FF FF FF FF FF FF FF FF FF 45 00 ..............E.
00000070 61 00 73 00 79 00 00 00 6C 00 6F 00 78 00 20 00 a.s.y...l.o.x. .
00000080 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1...............
00000090 04 01 C4 5B 2A 00 C0 3E 14 08 0A 00 00 00 50 00 .. [*..>......P.
000000A0 75 00 6C 00 6C 00 62 00 6C 00 6F 00 78 00 20 00 u.l.l.b.l.o.x. .
000000B0 31 00 04 00 00 00 FF FF FF FF FF FF FF FF FF FF 1...............
000000C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
000000D0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000000E0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000000F0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000100 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000110 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000120 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000130 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000140 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000150 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000160 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000170 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000180 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA A2				
00000190 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001A0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001B0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001C0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001D0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001E0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001F0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000200 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000210 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000220 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000230 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000240 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000250 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000260 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000270 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000280 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000290 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002A0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002B0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002C0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002D0 0A 0A										   ..

plus don't forget to find:


10 pullout switches
10 manholes (should be connected some how)
level = 1-5 (Easy, Pretty Simple, Average, Tricky, Hard)
flag = 16x16 / 32x32
 
celcodioc

celcodioc

Major A$$hole
OP
Member
Level 2
Joined
Nov 13, 2011
Messages
278
Trophies
0
XP
159
Country
elisherer said:
correction: every byte is aligned to the nearest 4bits...

I shifted the two files 4 bits to the left.. and see this..

easythree.bin
Code: 
00000000 02 CE 8D 06 00 00 00 00 00 00 B6 25 9D 52 01 07 .. ........% R..
00000010 07 20 77 21 3D 2A 2E 23 51 1C 0F 0F 00 00 FF FF . w!=*.#Q.......
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000030 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000050 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000060 FF FF FF FF FF FF FF FF FF FF FF FF FF FF 45 00 ..............E.
00000070 61 00 73 00 79 00 00 00 14 08 78 41 14 08 5C 69 a.s.y.....xA..i
00000080 2A 00 00 00 00 00 00 00 00 00 B8 3B 14 08 00 00 *..........;....
00000090 00 00 C4 5B 2A 00 C0 3E 14 08 04 00 00 00 00 00 .. [*..>........
000000A0 14 08 C0 3E 14 08 00 00 A0 C1 00 00 80 3F 00 00 ...>.... ... ?..
000000B0 00 00 04 00 00 00 FF FF FF FF FF FF FF FF FF FF ................
000000C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
000000D0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000000E0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000000F0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000100 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000110 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000120 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000130 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000140 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000150 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000160 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000170 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000180 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA A2				
00000190 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001A0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001B0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001C0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001D0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001E0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001F0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000200 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000210 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000220 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000230 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000240 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000250 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000260 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000270 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000280 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000290 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002A0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002B0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002C0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002D0 0A 0A										   ..

easy.bin
Code: 
00000000 02 CE 8D 06 00 00 00 00 00 00 E2 4C 5D B8 01 07 .. ........L]...
00000010 07 20 7F 21 3D 2A 2E 23 51 1C 0F 0F 00 00 FF FF . !=*.#Q.......
00000020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000030 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000040 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000050 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
00000060 FF FF FF FF FF FF FF FF FF FF FF FF FF FF 45 00 ..............E.
00000070 61 00 73 00 79 00 00 00 6C 00 6F 00 78 00 20 00 a.s.y...l.o.x. .
00000080 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1...............
00000090 04 01 C4 5B 2A 00 C0 3E 14 08 0A 00 00 00 50 00 .. [*..>......P.
000000A0 75 00 6C 00 6C 00 62 00 6C 00 6F 00 78 00 20 00 u.l.l.b.l.o.x. .
000000B0 31 00 04 00 00 00 FF FF FF FF FF FF FF FF FF FF 1...............
000000C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................
000000D0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000000E0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000000F0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000100 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000110 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000120 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000130 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000140 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000150 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000160 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000170 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000180 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA A2				
00000190 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001A0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001B0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001C0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001D0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001E0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000001F0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000200 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000210 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000220 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000230 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000240 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000250 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000260 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000270 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000280 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
00000290 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002A0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002B0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002C0 AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA				
000002D0 0A 0A										   ..

plus don't forget to find:


10 pullout switches
10 manholes (should be connected some how)
level = 1-5 (Easy, Pretty Simple, Average, Tricky, Hard)
flag = 16x16 / 32x32
Click to expand...

Whoa, that's really interesting. Thanks :) (Actually, even ZXing detected that. Common QR code pattern?)

10 pullout switches - already done
10 manholes (should be connected some how) - already done
level = 1-5 (Easy, Pretty Simple, Average, Tricky, Hard) - forgot about that thing :P
flag = 16x16 / 32x32 - I can't create 32x32 levels yet so someone else has to find that.

Just updated the picture with more accurate information.
 
elisherer

elisherer

I ♥ 3DS
Member
Level 4
Joined
Dec 16, 2009
Messages
778
Trophies
0
Location
3dbrew.org
Website
www.sherer.co.il
XP
392
Country
Iceland
celcodioc said:
elisherer said:
I'll be happy to write a simple program to read your findings...
Click to expand...

Feel free to do that anything. I haven't copyrighted them, have I? ;)
Also, if the first four bits aren't needed... it means I have to redo the entire picture D:
Click to expand...
I don't want to steal your thunder...you were the first one to work on this, so you would be the one credited. :)
 
elisherer

elisherer

I ♥ 3DS
Member
Level 4
Joined
Dec 16, 2009
Messages
778
Trophies
0
Location
3dbrew.org
Website
www.sherer.co.il
XP
392
Country
Iceland
see this http://www.thonky.co...-1-encode-data/

To summarize:
The qr data starts with a nibble (half-byte) which sets the mode... 4 is binary.
because it's 4 and the version of the pushmo qr code is 18 then the data length is 16 bits after the mode.
which in this case is 0x2CE meaning that it doesn't include the last 0xA0.
so...
It has a 20-bit header (=0x402ce).
a 0x2CE block of data
and an 8-bit trailer which is 0xA0.

focus your efforts on that 0x2CE blob. :)
 
celcodioc

celcodioc

Major A$$hole
OP
Member
Level 2
Joined
Nov 13, 2011
Messages
278
Trophies
0
XP
159
Country
I've been working a bit slowly, but this is what I found a while ago:
  • What I thought was a checksum might be some kind of an obfuscated timestamp or just random values (pretty sure it's random values) and the specific values for locked/unlocked state are most likely based on those
  • There is no flag that tells whether the level is 16x16 or 32x32

Time to figure out exactly how pullout switch/manhole locations are encoded (should be easy)
I need a working bytes -> QR Code encoder to test my theories though, encoding them manually is such a pain :P

elisherer said:
see this http://www.thonky.co...-1-encode-data/

To summarize:
The qr data starts with a nibble (half-byte) which sets the mode... 4 is binary.
because it's 4 and the version of the pushmo qr code is 18 then the data length is 16 bits after the mode.
which in this case is 0x2CE meaning that it doesn't include the last 0xA0.
so...
It has a 20-bit header (=0x402ce).
a 0x2CE block of data
and an 8-bit trailer which is 0xA0.

focus your efforts on that 0x2CE blob. :)
Click to expand...

Thanks, I'm fairly inexperienced with QR codes.
 
elisherer

elisherer

I ♥ 3DS
Member
Level 4
Joined
Dec 16, 2009
Messages
778
Trophies
0
Location
3dbrew.org
Website
www.sherer.co.il
XP
392
Country
Iceland
celcodioc said:
I've been working a bit slowly, but this is what I found a while ago:
  • What I thought was a checksum might be some kind of an obfuscated timestamp or just random values (pretty sure it's random values) and the specific values for locked/unlocked state are most likely based on those
  • There is no flag that tells whether the level is 16x16 or 32x32
Time to figure out exactly how pullout switch/manhole locations are encoded (should be easy)
I need a working bytes -> QR Code encoder to test my theories though, encoding them manually is such a pain :P

elisherer said:
see this http://www.thonky.co...-1-encode-data/

To summarize:
The qr data starts with a nibble (half-byte) which sets the mode... 4 is binary.
because it's 4 and the version of the pushmo qr code is 18 then the data length is 16 bits after the mode.
which in this case is 0x2CE meaning that it doesn't include the last 0xA0.
so...
It has a 20-bit header (=0x402ce).
a 0x2CE block of data
and an 8-bit trailer which is 0xA0.

focus your efforts on that 0x2CE blob. :)
Click to expand...

Thanks, I'm fairly inexperienced with QR codes.
Click to expand...

I'm working on it...will be ready in no time...
 
V

vashgs

Well-Known Member
Member
Level 3
Joined
Feb 1, 2008
Messages
236
Trophies
0
XP
234
Country
United States
You're close with this analysis, but no cigar ;-)

Your checksum location is incorrect, and the garbage data is, in fact, just garbage data. It's a buffer to hold the name. You can confirm this by changing the name twice, then saving your level. You will see remnants of the old name in the garbage data, after the new name. We already have a QR encoder/decoder and much more research on the actual layout of the files. We'll keep you posted on any developments :-) Glad to see somebody else as interested in this as we are!

EDIT: If you're interested in "fixing" the garbage data for identical garbage across differing levels, do the name change trick. This can be useful in identifying other aspects of the level data :-)

EDIT 2: Removed some information ;-) Can't give away too much!
 
elisherer

elisherer

I ♥ 3DS
Member
Level 4
Joined
Dec 16, 2009
Messages
778
Trophies
0
Location
3dbrew.org
Website
www.sherer.co.il
XP
392
Country
Iceland
vashgs said:
You're close with this analysis, but no cigar ;-)

Your checksum location is incorrect, and the garbage data is, in fact, just garbage data. It's a buffer to hold the name. You can confirm this by changing the name twice, then saving your level. You will see remnants of the old name in the garbage data, after the new name. We already have a QR encoder/decoder and much more research on the actual layout of the files. We'll keep you posted on any developments :-) Glad to see somebody else as interested in this as we are!
Click to expand...
The maximum name is 16 letters meaning 32 bytes (in unicode) so the rest of the 'buffer' is unknown...sometimes it's says 'Pushmo 1' or 2 or 'Pullbox 1'...sometimes just gibberish...
 
celcodioc

celcodioc

Major A$$hole
OP
Member
Level 2
Joined
Nov 13, 2011
Messages
278
Trophies
0
XP
159
Country
elisherer, your encoder works (:D) but the game does apparently not accept edited levels. It detects that it is a Pullblox QR code but says that "there is something wrong with it". Probably because of invalid locked/unlocked values since these are based on almost the entire level.

vashgs said:
You're close with this analysis, but no cigar ;-)

Your checksum location is incorrect, and the garbage data is, in fact, just garbage data. It's a buffer to hold the name. You can confirm this by changing the name twice, then saving your level. You will see remnants of the old name in the garbage data, after the new name. We already have a QR encoder/decoder and much more research on the actual layout of the files. We'll keep you posted on any developments :-) Glad to see somebody else as interested in this as we are!

EDIT: If you're interested in "fixing" the garbage data for identical garbage across differing levels, do the name change trick. This can be useful in identifying other aspects of the level data :-)

EDIT 2: Removed some information ;-) Can't give away too much!
Click to expand...

I've already tried fixing it, but the garbage data in file #1 was very different from the garbage data in file #2 and there were no names in it (and yes, I did remove the QR header). I'll fix the incorrect "checksum" location, though.


Anyway, I guess I should check the file header instead of thinking that "ZXing does all the decoding and gives me the full file" next time ^^
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Is it possible...?

After the 8th of April, will it still be possible to create a new NNID (Nintendo Network ID) and/or transfer a NNID from one console to another?

Need help

Hacking Homebrew  how to link pnid to 3ds/how to use juxtaposition?

Hacking Homebrew  A new way to experience StreetPass

Hacking  New 2ds Refuses to boot

Hacking Misc  VCRUNTIME140.dll UCRTBASED.dll Master Thread

Translation Project  DQM2SP translation

General chit-chat
Help Users
  • AncientBoi @ AncientBoi:
    LEOtck? Who's he? Never 'erd of the las. :)
  • LeoTCK @ LeoTCK:
    I only show the mirror to people and you all can't stand what you're seeing
  • LeoTCK @ LeoTCK:
    bunch of bullies
  • RedColoredStars @ RedColoredStars:
    Narcissistic Personality Disorder 101
  • LeoTCK @ LeoTCK:
    I think that's what you have
  • RedColoredStars @ RedColoredStars:
    Thanks for providing further evidence of my claim in a single comment. lol.
  • LeoTCK @ LeoTCK:
    pff\
  • RedColoredStars @ RedColoredStars:
    You're a gaslighting narcissist. Everyone out to get you. You wont get professional help because you'll just chalk up their diagnosis as another conspiracy out to get you.
  • LeoTCK @ LeoTCK:
    leave me alone, I'm not going to engage with you anymore, bye
  • LeoTCK @ LeoTCK:
    Motherfucker I was checked by a psychiatrist and there's nothing wrong with me
  • RedColoredStars @ RedColoredStars:
    okay. Bye. Thought you were leaving anyway. Why are you still around? You already said goodbye to everyone here.
  • LeoTCK @ LeoTCK:
    so stop spurting your nonsense
  • RedColoredStars @ RedColoredStars:
    lol. liar.
  • DinohScene @ DinohScene:
    knock it off now, both of you
  • LeoTCK @ LeoTCK:
    yea you're just a mean bully
  • LeoTCK @ LeoTCK:
    he SHOULD
  • LeoTCK @ LeoTCK:
    and NOW
  • RedColoredStars @ RedColoredStars:
    liar, loudmouth, cussing and swearing, all angry
  • RedColoredStars @ RedColoredStars:
    ok. sorry. ill stop now. promise
  • RedColoredStars @ RedColoredStars:
    Sooo. How about Dune part 1 & 2? The cinematography is fantastic, but thats some of the most boring ass sci-fi Ive seen in my life.
  • DinohScene @ DinohScene:
    haven't seen both
  • RedColoredStars @ RedColoredStars:
    Im going to see the new Godzilla next week. Sure they aren't some cinematic masterpieces but the last few were all really great and fun popcorn flicks to see on the big screen.
  • DinohScene @ DinohScene:
    can't remember the last time I went to the cinemas
  • RedColoredStars @ RedColoredStars:
    Me neither, not precisely. I think the last one I went to was Top Gun Maverick
  • RedColoredStars @ RedColoredStars:
    Oh. Wait. I took my mom to see Elvis. I think that was the last time I went. I'll most likely see the new Planet of the Apes in a theater too.
    RedColoredStars @ RedColoredStars: Oh. Wait. I took my mom to see Elvis. I think that was the last time I went. I'll most likely...