Pyramids (3DSWare)
Overview
A valid QR code contains 170 bytes of data and it's LZ-10 compressed. The only byte that can cause a crash is at offset 0x01 (As stated bellow)
QR Image
RAW Decompressed Data
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000080 00 00 12 00 00 09 13 00 00 00 00 00 00 00 00 00 ................ 00000090 00 00 05 05 05 05 05 05 05 05 05 05 05 05 05 05 ................ 000000A0 05 05 1E 00 00 00 C9 73 A8 1A ......És¨.
Raw Decompressed Data Explained
| Address | Length | Meaning |
| 0x00 | 1 byte | Must be 0x01 or the game will not accept the level. |
| 0x01 | 1 byte | This byte selects the level background. Valid bytes ranges from 0x00 to 0x04. Anything over 0x04 will cause a null exception and crash. |
| 0x02 | 160 bytes | This section contains specific data bytes that makes up the level (16x10 grid thus 160 bytes). |
| 0xA2 | 4 bytes | This represents the time required to complete the level. Its stored as Little Endian Unsigned Int |
| 0xA6 | 4 bytes | This is a Reversed CRC32 of the combined bytes from address 0x00 to 0xA5 |
Reason for not being exploitable
The only byte that causes a crash is located at address 0x01 (Level background byte). The crash results in a null ptr exception which is not exploitable.