Pyramids (3DSWare)

Overview

A valid QR code contains 170 bytes of data and it's LZ-10 compressed. The only byte that can cause a crash is at offset 0x01 (As stated bellow)

QR Image

https://s13.postimg.org/f2lqhhaon/img.png

RAW Decompressed Data

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000  01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00     ................
00000080  00 00 12 00 00 09 13 00 00 00 00 00 00 00 00 00     ................
00000090  00 00 05 05 05 05 05 05 05 05 05 05 05 05 05 05     ................
000000A0  05 05 1E 00 00 00 C9 73 A8 1A                       ......És¨.

Raw Decompressed Data Explained

Address	Length	Meaning
0x00	1 byte	Must be 0x01 or the game will not accept the level.
0x01	1 byte	This byte selects the level background. Valid bytes ranges from 0x00 to 0x04. Anything over 0x04 will cause a null exception and crash.
0x02	160 bytes	This section contains specific data bytes that makes up the level (16x10 grid thus 160 bytes).
0xA2	4 bytes	This represents the time required to complete the level. Its stored as Little Endian Unsigned Int
0xA6	4 bytes	This is a Reversed CRC32 of the combined bytes from address 0x00 to 0xA5

Reason for not being exploitable

The only byte that causes a crash is located at address 0x01 (Level background byte). The crash results in a null ptr exception which is not exploitable.