Capture services

caps:a

This is "nn::capsrv::sf::IAlbumAccessorService".

Cmd	Name
0	GetAlbumFileCount
1	GetAlbumFileList
2	LoadAlbumFile
3	DeleteAlbumFile
4	StorageCopyAlbumFile
5	IsAlbumMounted
6	GetAlbumUsage
7	GetAlbumFileSize
8	LoadAlbumFileThumbnail
9	[2.0.0+] LoadAlbumScreenShotImage
10	[2.0.0+] LoadAlbumScreenShotThumbnailImage
11	[2.0.0+] GetAlbumEntryFromApplicationAlbumEntry
12	[3.0.0+] LoadAlbumScreenShotImageEx
13	[3.0.0+] LoadAlbumScreenShotThumbnailImageEx
14	[3.0.0+] LoadAlbumScreenShotImageEx0
15	[4.0.0+] GetAlbumUsage3
16	[4.0.0+] GetAlbumMountResult
17	[4.0.0+] GetAlbumUsage16
18	[6.0.0+] #GetAppletProgramIdTable
19	[11.0.0+] #GetAlbumFileName
100	[5.0.0+] GetAlbumFileCountEx0
101	[5.0.0+] GetAlbumFileListEx0
110	[15.0.0+] GetAlbumFileListEx1
120	[17.0.0+] GetAlbumFileListEx2
130	[17.0.0+] LoadAlbumFileRawData
140	[17.0.0+] GetAlbumFileCreatedEvent
141	[18.0.0+]
150	[17.0.0+] LoadAlbumSystemReservedInfo
151	[18.0.0+]
160	[18.0.0+]
202	[1.0.0-2.3.0] SaveEditedScreenShot
301	GetLastOverlayScreenShotThumbnail
302	[4.0.0+] GetLastOverlayMovieThumbnail
401	GetAutoSavingStorage
501	GetRequiredStorageSpaceSizeToCopyAll
1001	[3.0.0+] LoadAlbumScreenShotThumbnailImageEx0
1002	[3.0.0+] #LoadAlbumScreenShotImageEx1
1003	[4.0.0+] LoadAlbumScreenShotThumbnailImageEx1
8001	ForceAlbumUnmounted
8002	ResetAlbumMountStatus
8011	RefreshAlbumCache
8012	GetAlbumCache
8013	[4.0.0+] GetAlbumCacheEx
8021	[2.0.0+] GetAlbumEntryFromApplicationAlbumEntryAruid
8022	[19.0.0+]
10011	SetInternalErrorConversionEnabled
50000	[6.0.0+] LoadMakerNoteInfoForDebug
50001	[19.0.0+]
50011	[19.0.0+] GetAlbumAccessResultForDebug
50012	[19.0.0+] #SetAlbumAccessResultForDebug
60002	[4.0.0+] #OpenAccessorSession

GetAppletProgramIdTable

Takes a type-70 buffer and returns a bool. If the buffer is sufficient it writes two application ID's to the buffer (0x100000000001000 and 0x100000000001fff) and returns true. This is used by photoViewer to group all screenshots of applets.

GetAlbumFileName

Takes an input #AlbumFileId and a type-0x6 output buffer. Writes the filename of the corresponding file to the buffer.

LoadAlbumScreenShotImageEx1

Takes a total of 0x38-bytes of input, two type-0x5 input buffers, and returns 0x20-bytes of output. [4.0.0+] No longer returns output, and now takes the following buffers instead: type-0x16, type-0x46, and type-0x6.

SetAlbumAccessResultForDebug

Allows setting a result code that will make following access functions fail with: GetAlbumFileCount, GetAlbumFileCountEx0, GetAlbumFileList, GetAlbumFileListEx0, GetAlbumFileListEx1, GetAlbumFileListEx2, LoadAlbumFile, DeleteAlbumFile, StorageCopyAlbumFile, LoadAlbumFileThumbnail, LoadAlbumScreenShotImage, LoadAlbumScreenShotImageEx, LoadAlbumScreenShotImageEx0, LoadAlbumScreenShotImageEx1, LoadAlbumScreenShotThumbnailImage, LoadAlbumScreenShotThumbnailImageEx, LoadAlbumScreenShotThumbnailImageEx0, LoadAlbumScreenShotThumbnailImageEx1, OpenAlbumMovieReadStream The raw code can be read by caps:c 2501 and caps:a 50011, which themselves return the result code 0.

OpenAccessorSession

Takes a total of 8-bytes of input, a PID, and returns an #IAlbumAccessorSession.

IAlbumAccessorSession

This is "nn::capsrv::sf::IAlbumAccessorSession".

This was added with [4.0.0+].

Cmd	Name
2001	OpenAlbumMovieReadStream
2002	CloseAlbumMovieReadStream
2003	GetAlbumMovieReadStreamMovieDataSize
2004	ReadMovieDataFromAlbumMovieReadStream
2005	GetAlbumMovieReadStreamBrokenReason
2006	GetAlbumMovieReadStreamImageDataSize
2007	ReadImageDataFromAlbumMovieReadStream
2008	ReadFileAttributeFromAlbumMovieReadStream
2009	[19.0.0+]
5000	[18.0.0+]

caps:c

This is "nn::capsrv::sf::ICaptureControllerService".

[2.0.0+] This is "nn::capsrv::sf::IAlbumControlService".

Cmd	Name
1	[1.0.0] CaptureRawImage
2	[1.0.0] CaptureRawImageWithTimeout
33	[7.0.0+] #SetApplicationShimLibraryVersion
1001	[1.0.0] RequestTakingScreenShot
1002	[1.0.0] RequestTakingScreenShotWithTimeout
1011	[1.0.0] NotifyTakingScreenShotRefused
2001	NotifyAlbumStorageIsAvailable
2002	NotifyAlbumStorageIsUnavailable
2011	[2.0.0+] #RegisterAppletResourceUserId
2012	[2.0.0+] #UnregisterAppletResourceUserId
2013	[2.0.0+] #GetApplicationIdFromAruid
2014	[2.0.0+] CheckApplicationIdRegistered
2101	[2.0.0+] #GenerateCurrentAlbumFileId
2102	[2.0.0+] GenerateApplicationAlbumEnrty
2103	[19.0.0+]
2104	[19.0.0+]
2201	[2.0.0-3.0.2] SaveAlbumScreenShotFile
2202	[4.0.0+] SaveAlbumScreenShotFileEx
2301	[2.0.0+] SetOverlayScreenShotThumbnailData
2302	[4.0.0+] SetOverlayMovieThumbnailData
2401	[19.0.0+]
2501	[19.0.0+] GetAlbumAccessResultForDebug
60001	[4.0.0+] #OpenControlSession

SetApplicationShimLibraryVersion

Takes an input u64 #ShimLibraryVersion, an u64 AppletResourceUserId, and a PID, no output.

This is used by caps:su SetShimLibraryVersion.

RegisterAppletResourceUserId

Takes an input u64 and an u64. No output.

[19.0.0+] The second u64 is now a 0x10-byte struct.

UnregisterAppletResourceUserId

Takes an input u64 and an u64. No output.

[19.0.0+] The second u64 is now a 0x10-byte struct.

The struct is ignored.

GetApplicationIdFromAruid

Takes a total of 8-bytes of input. Returns an u64.

[19.0.0+] The output u64 is now a 0x10-byte struct.

GenerateCurrentAlbumFileId

Takes an input u8 and an u64, returns a 0x18-byte struct.

[19.0.0+] The input u64 is now a 0x10-byte struct.

OpenControlSession

Takes a total of 8-bytes of input and a PID, returns an #IAlbumControlSession.

IAlbumControlSession

This is "nn::capsrv::sf::IAlbumControlSession".

This was added with [4.0.0+].

Cmd	Name
2001	OpenAlbumMovieReadStream
2002	CloseAlbumMovieReadStream
2003	GetAlbumMovieReadStreamMovieDataSize
2004	ReadMovieDataFromAlbumMovieReadStream
2005	GetAlbumMovieReadStreamBrokenReason
2006	GetAlbumMovieReadStreamImageDataSize
2007	ReadImageDataFromAlbumMovieReadStream
2008	ReadFileAttributeFromAlbumMovieReadStream
2009	[19.0.0+]
2345	[18.0.0+]
2401	OpenAlbumMovieWriteStream
2402	FinishAlbumMovieWriteStream
2403	CommitAlbumMovieWriteStream
2404	DiscardAlbumMovieWriteStream
2405	DiscardAlbumMovieWriteStreamNoDelete
2406	[7.0.0+] CommitAlbumMovieWriteStreamEx
2411	StartAlbumMovieWriteStreamDataSection
2412	EndAlbumMovieWriteStreamDataSection
2413	StartAlbumMovieWriteStreamMetaSection
2414	EndAlbumMovieWriteStreamMetaSection
2421	ReadDataFromAlbumMovieWriteStream
2422	WriteDataToAlbumMovieWriteStream
2424	WriteMetaToAlbumMovieWriteStream
2431	GetAlbumMovieWriteStreamBrokenReason
2433	GetAlbumMovieWriteStreamDataSize
2434	SetAlbumMovieWriteStreamDataSize
5000	[18.0.0+]

caps:u

This is "nn::capsrv::sf::IAlbumApplicationService".

This was added with [5.0.0+].

Official sw via the nn::album wrappers uses start_DateTime = YYYY-MM-DD 1970-01-01 with the rest set to all-zero, end_DateTime is the same except year = 3000. With #GetAlbumFileList0AafeAruidDeprecated, start_PosixTime = UTC 1999-12-31 00:00 (0x386BF200), and end_PosixTime = UTC 2100-01-01 00:00 (0xF4865700).

Cmd	Name
32	[7.0.0+] #SetShimLibraryVersion
102	#GetAlbumFileList0AafeAruidDeprecated
103	#DeleteAlbumFileByAruid
104	#GetAlbumFileSizeByAruid
105	#DeleteAlbumFileByAruidForDebug
110	#LoadAlbumScreenShotImageByAruid
120	#LoadAlbumScreenShotThumbnailImageByAruid
130	#PrecheckToCreateContentsByAruid
140	[6.0.0+] #GetAlbumFileList1AafeAruidDeprecated
141	[6.0.0+] #GetAlbumFileList2AafeUidAruidDeprecated
142	[17.0.0+] GetAlbumFileList3AaeAruidDeprecated ([7.0.0-16.1.0] #GetAlbumFileList3AaeAruid)
143	[17.0.0+] GetAlbumFileList4AaeUidAruidDeprecated ([7.0.0-16.1.0] #GetAlbumFileList4AaeUidAruid)
144	[17.0.0+] GetAllAlbumFileList3AaeAruidDeprecated ([11.0.0-16.1.0] GetAllAlbumFileList3AaeAruid)
145	[17.0.0+] GetAlbumFileList5AaeAruid
146	[17.0.0+] GetAlbumFileList6AaeUidAruid
147	[17.0.0+] GetAllAlbumFileList5AaeAruid
148	[18.0.0+]
60002	#OpenAccessorSessionForApplication

SetShimLibraryVersion

Takes an input u64 #ShimLibraryVersion, an u64 AppletResourceUserId, and a PID, no output.

GetAlbumFileList0AafeAruidDeprecated

Takes a type-0x6 output buffer containing an array of #ApplicationAlbumFileEntry, a PID, an u8 #AlbumFileContents, two s64s, and an u64 AppletResourceUserId. Returns an output u64 for total output entries (which is copied to a s32 by official sw).

The two s64s are the start/end PosixTime.

DeleteAlbumFileByAruid

Takes a PID, an input u8 #AlbumFileContents, an #ApplicationAlbumFileEntry, an AppletResourceUserId, and no output.

The #AlbumFileContents must match 3.

GetAlbumFileSizeByAruid

Takes a PID, an input #ApplicationAlbumFileEntry, an AppletResourceUserId, and returns an output u64.

This gets the filesize for the entire specified Album file.

DeleteAlbumFileByAruidForDebug

Takes a PID, an #ApplicationAlbumFileEntry, an AppletResourceUserId, and no output.

The cached value loaded from Settings_services#GetDebugModeFlag must be 1, otherwise an error is returned.

LoadAlbumScreenShotImageByAruid

Takes a PID, a type-0x16 output buffer containing a #LoadAlbumScreenShotImageOutputForApplication, a type-0x46 output buffer, a type-0x6 output buffer, an #ApplicationAlbumFileEntry, a #ScreenShotDecodeOption, and no output.

The type-0x46 buffer contains the RGBA8 image data. The type-0x6 buffer is a work buffer used for reading the entire AlbumFile, the buffer size must be at least the AlbumFile filesize (cleared before the cmd returns).

LoadAlbumScreenShotThumbnailImageByAruid

Takes a PID, a type-0x16 output buffer containing a #LoadAlbumScreenShotImageOutputForApplication, a type-0x46 output buffer, a type-0x6 output buffer, an #ApplicationAlbumFileEntry, a #ScreenShotDecodeOption, and no output.

The type-0x46 buffer contains the RGBA8 image data. The type-0x6 buffer is a work buffer used for reading the entire AlbumFile, the buffer size must be at least the AlbumFile filesize (cleared before the cmd returns).

PrecheckToCreateContentsByAruid

Takes a PID, an input u8 #AlbumFileContents, an u64, an AppletResourceUserId, and no output.

GetAlbumFileList1AafeAruidDeprecated

Takes a type-0x6 output buffer containing an array of #ApplicationAlbumFileEntry, a PID, an u8 #AlbumFileContents, two #AlbumFileDateTime, and an u64 AppletResourceUserId. Returns an output u64 for total output entries (which is copied to a s32 by official sw).

The first #AlbumFileDateTime is the start_DateTime, the second #AlbumFileDateTime is the end_DateTime. In the IPC rawdata, these use 2-byte alignment.

GetAlbumFileList2AafeUidAruidDeprecated

Takes a type-0x6 output buffer containing an array of #ApplicationAlbumFileEntry, a PID, an u8 #AlbumFileContents, two #AlbumFileDateTime, an u128 userID, and an u64 AppletResourceUserId. Returns an output u64 for total output entries (which is copied to a s32 by official sw).

The first #AlbumFileDateTime is the start_DateTime, the second #AlbumFileDateTime is the end_DateTime. In the IPC rawdata, these use 2-byte alignment.

GetAlbumFileList3AaeAruid

Takes a type-0x6 output buffer containing an array of #ApplicationAlbumEntry, a PID, an u8 #AlbumFileContents, two #AlbumFileDateTime, and an u64 AppletResourceUserId. Returns an output u64 for total output entries (which is copied to a s32 by official sw).

The first #AlbumFileDateTime is the start_DateTime, the second #AlbumFileDateTime is the end_DateTime. In the IPC rawdata, these use 2-byte alignment.

GetAlbumFileList4AaeUidAruid

Takes a type-0x6 output buffer containing an array of #ApplicationAlbumEntry, a PID, an u8 #AlbumFileContents, two #AlbumFileDateTime, an u128 userID, and an u64 AppletResourceUserId. Returns an output u64 for total output entries (which is copied to a s32 by official sw).

The first #AlbumFileDateTime is the start_DateTime, the second #AlbumFileDateTime is the end_DateTime. In the IPC rawdata, these use 2-byte alignment.

OpenAccessorSessionForApplication

Takes a PID, an input #ApplicationAlbumFileEntry, an u64 AppletResourceUserId, and returns an output #IAlbumAccessorApplicationSession.

IAlbumAccessorApplicationSession

This is "nn::capsrv::sf::IAlbumAccessorApplicationSession".

This was added with [5.0.0+].

This is opened prior to using #OpenAlbumMovieReadStream, when it previously wasn't opened. Official sw only closes this session when closing caps:u, not when using #CloseAlbumMovieReadStream.

Cmd	Name
2001	#OpenAlbumMovieReadStream
2002	#CloseAlbumMovieReadStream
2003	#GetAlbumMovieReadStreamMovieDataSize
2004	#ReadMovieDataFromAlbumMovieReadStream
2005	#GetAlbumMovieReadStreamBrokenReason

OpenAlbumMovieReadStream

Takes a PID, an input #ApplicationAlbumFileEntry, an u64 AppletResourceUserId, and returns an output u64 #AlbumMovieReadStreamHandle.

Up to 4 streams can be open at the same time. Multiple streams can be open at the same time for the same #ApplicationAlbumFileEntry.

CloseAlbumMovieReadStream

Takes an input u64 #AlbumMovieReadStreamHandle, no output.

GetAlbumMovieReadStreamMovieDataSize

Takes an input u64 #AlbumMovieReadStreamHandle, returns an output u64.

This gets the size of the actual MP4, without the JPEG at the end.

ReadMovieDataFromAlbumMovieReadStream

Takes a type-0x6 output buffer, an input u64 #AlbumMovieReadStreamHandle, an input s64 offset, and returns an output u64 actual_size.

offset(+size) must not be negative. offset and size must be aligned to 0x40000-bytes. When offset(+size) goes beyond the size from #GetAlbumMovieReadStreamMovieDataSize, the regions of the buffer which goes beyond that are cleared to 0, and actual_size is still set to the input size.

GetAlbumMovieReadStreamBrokenReason

Takes an input u64 #AlbumMovieReadStreamHandle, no output.

Unused by official sw.

ShimLibraryVersion

This is a version field. Official sw uses func nn::capsrv::GetShimLibraryVersion() to load this from a global var, which is then used with various commands (the input for those cmds must match value 1).

[7.0.0-9.0.0] This is value 1.

Controls which struct version to use for #ApplicationAlbumEntry / #AlbumFileEntry. However, the struct size for the newer version is used regardless on [7.0.0+] for the actual cmds.

AlbumImageOrientation

This is "nn::album::ImageOrientation".

Value	Description
0
1
2
3

AlbumReportOption

This is "nn::album::AlbumReportOption".

Value	Description
0	Don't display the screenshot-taken Overlay-applet notification.
1	Display the screenshot-taken Overlay notification.

AlbumFileContents

This is "nn::capsrv::AlbumFileContents".

Value	Description
0	Screenshot (album screenshots)
1	Movie (album videos)
3	ExtraMovie (videos recorded by the current Application title via GRC MovieMaker)

AlbumStorage

This is "nn::capsrv::AlbumStorage".

Value	Description
0	Nand (ImageDirectory on the USER partition)
1	Sd (ImageDirectory on the Sd card)

AlbumFileDateTime

This is "nn::capsrv::AlbumFileDateTime". This is a 0x8-byte struct.

Offset	Size	Description
0x0	0x2	Year
0x2	0x1	Month
0x3	0x1	Day
0x4	0x1	Hour
0x5	0x1	Minute
0x6	0x1	Second
0x7	0x1	Id (unique ID for when there's multiple Album files with the same timestamp)

This corresponds to each field in the Album entry filename, prior to the "-": YYYYMMDDHHMMSSII.

AlbumEntry

This is "nn::capsrv::AlbumEntry". This is a 0x20-byte struct.

Offset	Size	Description
0x0	0x8	Size
0x8	0x18	FileId

AlbumFileId

This is "nn::capsrv::AlbumFileId". This is a 0x18-byte struct.

Offset	Size	Description
0x0	0x8	ApplicationId
0x8	0x8	Time
0x10	0x1	Storage
0x11	0x1	Contents
0x12	0x1	[19.0.0+]
0x13	0x1	[19.0.0+]
0x14	0x4	Reserved

[19.0.0+] GenerateCurrentAlbumFileId copies the two u8s from instruct+0x8 to AlbumFileId+0x12.

AlbumFileEntry

This is "nn::album::AlbumFileEntry". This is identical to #ApplicationAlbumEntry. On older versions where official sw used to use cmds which use #ApplicationAlbumFileEntry, this struct matches #ApplicationAlbumFileEntry.

ApplicationAlbumEntry

This is "nn::capsrv::ApplicationAlbumEntry". This is a 0x20-byte struct.

Offset	Size	Description
0x0	0x8	Size
0x8	0x8	AES256 with hardcoded key over AlbumEntry
0x10	0x8	Time
0x18	0x1	Storage
0x19	0x1	Contents
0x1A	0x5	Reserved
0x1F	0x1	Unknown (set to 1 by official software)

On older versions where #ShimLibraryVersion is 0, this was a plain AES256 with a random key generated at application launch.

With the output from caps:su sdk-nso only uses this for the Share-applet (when the output is used at all), with everything else it's used as an #AlbumFileEntry. In those cases with the nn::album wrapper funcs, it's "converted" by just copying the struct (arrays are "converted" by just returning a ptr to the input array).

ApplicationAlbumFileEntry

This is "nn::capsrv::ApplicationAlbumFileEntry". This is a 0x30-byte struct.

Offset	Size	Description
0x0	0x20	#ApplicationAlbumEntry
0x20	0x8	#AlbumFileDateTime
0x28	0x8	Unknown

On newer versions where official sw uses #ApplicationAlbumEntry, #ApplicationAlbumEntry is converted to ApplicationAlbumFileEntry when using cmds which need it with:

• First 0x20-bytes are the same.
• u64 ApplicationAlbumFileEntry+0x20 = #ApplicationAlbumEntry+0x10.
• Last 8-bytes = 0.

ScreenShotAttribute

This is "nn::capsrv::detail::ScreenShotAttributeEx0" / "nn::capsrv::ScreenShotAttribute". This is a 0x40-byte struct.

Offset	Size	Description
0x0	0x4	Always set to 0 by official sw.
0x4	0x4	#AlbumImageOrientation
0x8	0x4	Always set to 0 by official sw.
0xC	0x4	Always set to 1 by official sw.
0x10	0x30	Always set to 0 by official sw.

ApplicationData

This is "nn::capsrv::ApplicationData". This is a 0x404-byte struct.

Offset	Size	Description
0x0	0x400	UserData
0x400	0x4	UserData size.

UserIdList

This is "nn::capsrv::UserIdList". This is a 0x88-byte struct.

Offset	Size	Description
0x0	0x80	u128 userIDs
0x80	0x1	Total userIDs.
0x81	0x7	Padding.

LoadAlbumScreenShotImageOutputForApplication

This is "nn::capsrv::sf::LoadAlbumScreenShotImageOutputForApplication". This is a 0x500-byte struct.

Offset	Size	Description
0x0	0x8	s64 Width. Official sw copies this to a s32 output field.
0x8	0x8	s64 Height. Official sw copies this to a s32 output field.
0x10	0x40	#ScreenShotAttributeForApplication
0x50	0x404	#ApplicationData
0x454	0xAC	Unused

ScreenShotDecodeOption

This is "nn::capsrv::ScreenShotDecodeOption". This is a 0x20-byte struct.

Official sw sets this to all-zero with the input for #LoadAlbumScreenShotImageByAruid/#LoadAlbumScreenShotThumbnailImageByAruid.

ScreenShotAttributeForApplication

This is "nn::capsrv::ScreenShotAttributeForApplication". This is a 0x40-byte struct.

Offset	Size	Description
0x0	0x4
0x4	0x1
0x5	0x1
0x6	0x1
0x7	0x1
0x8	0x4
0xC	0x4
0x10	0x4
0x14	0x4
0x18	0x4
0x1C	0x4
0x20	0x2
0x22	0x2
0x24	0x2
0x26	0x2
0x28	0x18	Reserved

Official sw only uses this in nn::album funcs which convert this to #AlbumFileAttribute, with the output from #LoadAlbumScreenShotImageByAruid/#LoadAlbumScreenShotThumbnailImageByAruid (only the first u32 is used).

AlbumFileAttribute

This is "nn::album::AlbumFileAttribute". This is a 0x10-byte struct.

Offset	Size	Description
0x0	0x8	The nn::album funcs referenced by #ScreenShotAttributeForApplication set this to: ScreenShotAttributeForApplication.first_u32 == 2.
0x8	0x8	Set to zero by official sw.

See also #ScreenShotAttributeForApplication.

AlbumMovieReadStreamHandle

This is "nn::capsrv::AlbumMovieReadStreamHandle" / "nn::album::MovieStreamHandle".

This is an u64 stream handle.

Notes

capsrv is responsible for validating the MACs for screenshots stored on the SD card, if the setting capsrv!enable_album_screenshot_filedata_verification is non-zero.

Screenshots are validated as follows: The JPEG's MAC is extracted from the EXIF maker note, and stored. A timestamp string is generated by calling snprintf(&str, 20, "%04d:%02d:%02d %02d:%02d:%02d", ...); with stored timestamp values. If this doesn't match the timestamp string stored in EXIF, then an error 0xA34CE is returned. Otherwise, the entire JPEG is loaded into memory, and the stored EXIF maker note is cleared to zeroes. Then, an HMAC-SHA256 is computed over the entire JPEG using a hardcoded secret key. if (memcmp(calculated_hmac, stored_hmac, 0x10) == 0), the screenshot is valid, else 0xA3ACE is returned.

In 3.0.0, MAC calculation was changed: now, instead of calculating an HMAC, a plain SHA256 hash is calculated. capsrv basically does screenshot_kek = spl::GenerateAesKek(<hardcoded screenshot_kek_source>); spl::LoadAesKey(screenshot_kek, <hardcoded screenshot_key_source>); MAC = spl::ComputeCmac(hash);

Videos

4.0.0 includes video playback etc support in Album via mp4. These include a JPEG thumbnail, which is used for video "validation". The EXIF is also much larger: the MakerNote is 0x498-bytes, with encrypted data starting at offset +0x8. This encryption uses AES-CTR with hardcoded key/ctr. MAC calculation works the same way as the 3.0.0+ JPEG MAC calculation, except with a different movie_kek_source/movie_key_source.

Each 0x40000-byte chunk in the Movie data stream is validated with a SHA256 hash table, where hash_index=offset>>18. Whether an error is thrown on mismatch is controlled by system-setting "capsrv!enable_album_movie_filehash_verification".

Note: the Album process itself uses libstagefright for video playback.