Exif TIFF field offset doesn't point to correct value

2

I'm trying to extract the DateTime from a JPEG file's Exif header. I did a quick hex dump to try and locate the Tiff entry. Here's a snippet of the hex dump:

00000000  ff d8 ff e1 27 19 45 78  69 66 00 00 4d 4d 00 2a  |....'.Exif..MM.*|
00000010  00 00 00 08 00 0b 01 0f  00 02 00 00 00 06 00 00  |................|
.
.

00000060  00 02 00 00 00 05 00 00  00 b6 01 32 00 02 00 00  |...........2....|
00000070  00 14 00 00 00 bc 02 13  00 03 00 00 00 01 00 01  |................|
.
.
000000b0  78 00 00 00 00 48 00 00  00 01 00 00 00 48 00 00  |x....H.......H..|
000000c0  00 01 31 32 2e 32 00 00  32 30 31 39 3a 30 35 3a  |..12.2..2019:05:|
000000d0  31 32 20 31 32 3a 30 32  3a 35 38 00 00 20 82 9a  |12 12:02:58.. ..|

So from the hex dump, I know that:

  1. The image is "Motorola" type byte aligned because of (0x4d4d)
  2. The tag is DateTime 0x0132 (address 0x006a to 0x006b)
  3. The tag type is 0x0002 which represents ascii string type (address 0x006c to 0x006d)
  4. The number of components is 0x00000014 which is 20 in decimal(address 0x006e to 0x0071)
  5. The value field, which is the offset to the actual value in this case, is 0x000000bc (address 0x0072 to 0x0075).

Now, if I look at the 20 bytes of value starting from address 0x00bc, it starts off with 0x00, 0x48, 0x00, 0x00, which doesn't represent anything. And it gets cut off at address 0xcf which doesn't include the entire date string. And as you can probably see, the actual date value starts at address 0x00c8 with bytes 0x32 0x30 0x31 0x39 0x3a, which is "2019:" and should continue until address 0xdb.

Can anyone explain why this is happening??

jpeg
tiff
exif
asked on Stack Overflow Jul 30, 2020 by rku1999

1 Answer

1

the address of any pointer calculate with base+offset and the base in this case is 0x0C because TIFF header start at 0x0C so 0xBC+0x0C=0xC8 that point to Date, also consider that the end of Date has 0x00 so total length is 20.

you can read more about it at this site.

answered on Stack Overflow Jul 30, 2020 by Ali Fallah • edited Jul 30, 2020 by Ali Fallah

User contributions licensed under CC BY-SA 3.0