I'm trying to understand how a certain closed platform stores screenshots. I've led to the conclusion that files are somehow checksumed; Any modification and the built-in picture viewer won't load it, saying it isn't valid. Even a little change into the EXIF metadata will make it unviewable. Here's what I've worked out at the moment:Files must have a special filename to be detected by the viewer, but this is just not important.The format is JPEG, with embebed EXIF metadata. It looks like this: And this is what I know:Red: JPEG Magic NumberBlue: EXIF Magic NumberGreen: (Exif?) header sizeYellow: Exif Magic NumberBlack: Actual exif metadata. Purple: Chunck of data that changes on every picture (That I suspect to be a checksum)The possible checksum:Have you ever seen something like this? Or do you know any kind of tests/modifications I could try? Am I missing something and this isn't new?PS: I've tried loading pictures from other machine and it loads them, so they aren't signed/protected per unit.Thanks!EDIT: The main caveat is that these are screenshots; This means I can take much of them quickly, trying to reduce the variations between each picture, but there's always going to be a little variation.EDIT2: Since the app had a built-in picture editor, I made a minor change and saved a new image. I've noticed another possible checksum (2 bytes large)
Reversing custom JPEG file with POSSIBLE checksum
file format