I'm trying to extract the DateTime from a JPEG file's Exif header. I did a quick hex dump to try and locate the Tiff entry. Here's a snippet of the hex dump:
00000000  ff d8 ff e1 27 19 45 78  69 66 00 00 4d 4d 00 2a  |....'.Exif..MM.*|
00000010  00 00 00 08 00 0b 01 0f  00 02 00 00 00 06 00 00  |................|
.
.
00000060  00 02 00 00 00 05 00 00  00 b6 01 32 00 02 00 00  |...........2....|
00000070  00 14 00 00 00 bc 02 13  00 03 00 00 00 01 00 01  |................|
.
.
000000b0  78 00 00 00 00 48 00 00  00 01 00 00 00 48 00 00  |x....H.......H..|
000000c0  00 01 31 32 2e 32 00 00  32 30 31 39 3a 30 35 3a  |..12.2..2019:05:|
000000d0  31 32 20 31 32 3a 30 32  3a 35 38 00 00 20 82 9a  |12 12:02:58.. ..|
So from the hex dump, I know that:
Now, if I look at the 20 bytes of value starting from address 0x00bc, it starts off with 0x00, 0x48, 0x00, 0x00, which doesn't represent anything. And it gets cut off at address 0xcf which doesn't include the entire date string. And as you can probably see, the actual date value starts at address 0x00c8 with bytes 0x32 0x30 0x31 0x39 0x3a, which is "2019:" and should continue until address 0xdb.
Can anyone explain why this is happening??
the address of any pointer calculate with base+offset and the base in this case is 0x0C because TIFF header start at 0x0C so 0xBC+0x0C=0xC8 that point to Date, also consider that the end of Date has 0x00 so total length is 20.
you can read more about it at this site.
User contributions licensed under CC BY-SA 3.0