1. Toolchain not found

After stepping away few days far from my PC for family reason, I resumed my activities on the Tsykuyomi project.
So I started by reading the https://github.com/WHhkwong/SIPI_Bear_playback code and looking for a SNC7001A Toolchain/SDK to build it. But unfortunately the only website that propose it for download is login/password protected.

So I turned to the SDCard dump meanwhile finding a way to get the toolchain.

2. Uninteresting hidden fat12 partition

I started by opening the dump with 'testdisk' utility to look for a hidden partition or disk structure. so I found only one "fat12" partition at address 0xD920 0000 :

D920 0000: EB 3C 90 4D 53 44 4F 53  35 2E 30 00 02 08 08 00  .<.MSDOS 5.0.....  
D920 0010: 02 00 02 00 50 F8 08 00  3F 00 FF 00 00 00 00 00  ....P... ?.......  
D920 0020: 00 00 00 00 80 01 29 22  8E 62 BC 4E 4F 20 4E 41  ......)" .b.NO NA  
D920 0030: 4D 45 20 20 20 20 46 41  54 31 32 20 20 20 33 C9  ME    FA T12   3.  
D920 0040: 8E D1 BC F0 7B 8E D9 B8  00 20 8E C0 FC BD 00 7C  ....{... . .....|  

And more further I found the content of uninteresting files (pdf, link, ...) which appears anyway in the virtual storage media disk when I connect Lunii to the PC.

3. Comparing the dumps

So by analyzing the dumps of the sdcard before and after adding a new "Story" to Lunii -Thanks to vbindiff- , I found out very interesting things:

1. Bitmap Image files with "BM8" or "BM6" magic at specific addresses

 $ hexdump -C disk-dump-0| grep -e BM6 -e BM8
00000600  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
00038c00  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
00071200  42 4d 36 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM6.......6...(.|
000a9800  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
030ee000  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
03126600  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
0315ec00  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
03197200  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
031cf800  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
03207e00  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
03240400  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
03278a00  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
032b1000  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
032e9600  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
03321c00  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
0335a200  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(.|
03392800  42 4d 38 84 03 00 00 00  00 00 36 00 00 00 28 00  |BM8.......6...(. 
...

2. WAV files with "RIFF" magic

$ hexdump -C disk-dump-0 | grep RIFF
03a9e800  52 49 46 46 6e dd 02 00  57 41 56 45 66 6d 74 20  |RIFFn...WAVEfmt |
03acc600  52 49 46 46 6c e5 03 00  57 41 56 45 66 6d 74 20  |RIFFl...WAVEfmt |
03b0ac00  52 49 46 46 7c 0b 03 00  57 41 56 45 66 6d 74 20  |RIFF|...WAVEfmt |
03b3b800  52 49 46 46 46 51 02 00  57 41 56 45 66 6d 74 20  |RIFFFQ..WAVEfmt |
03b60a00  52 49 46 46 a6 19 02 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
03b82400  52 49 46 46 b4 2c 02 00  57 41 56 45 66 6d 74 20  |RIFF.,..WAVEfmt |
03ba5200  52 49 46 46 82 09 02 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
03bc5c00  52 49 46 46 20 10 01 00  57 41 56 45 66 6d 74 20  |RIFF ...WAVEfmt |
03bd6e00  52 49 46 46 26 5e 01 00  57 41 56 45 66 6d 74 20  |RIFF&^..WAVEfmt |
03bece00  52 49 46 46 c2 98 01 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
03c06800  52 49 46 46 26 90 01 00  57 41 56 45 66 6d 74 20  |RIFF&...WAVEfmt |
03c1fa00  52 49 46 46 26 13 01 00  57 41 56 45 66 6d 74 20  |RIFF&...WAVEfmt |
03c30e00  52 49 46 46 ce 28 b0 00  57 41 56 45 66 6d 74 20  |RIFF.(..WAVEfmt |
04733800  52 49 46 46 8c 27 be 00  57 41 56 45 66 6d 74 20  |RIFF.'..WAVEfmt |
05316000  52 49 46 46 a6 1f 01 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
05328000  52 49 46 46 f0 23 f9 00  57 41 56 45 66 6d 74 20  |RIFF.#..WAVEfmt |
062ba400  52 49 46 46 be 09 cc 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
06f7ae00  52 49 46 46 e6 89 01 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
06f93800  52 49 46 46 26 45 01 00  57 41 56 45 66 6d 74 20  |RIFF&E..WAVEfmt |
06fa7e00  52 49 46 46 4a 15 e7 00  57 41 56 45 66 6d 74 20  |RIFFJ...WAVEfmt |
07e19400  52 49 46 46 4e ea d1 00  57 41 56 45 66 6d 74 20  |RIFFN...WAVEfmt |
08b38000  52 49 46 46 7a 7f 01 00  57 41 56 45 66 6d 74 20  |RIFFz...WAVEfmt |
08b50000  52 49 46 46 0e 91 c8 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
097d9200  52 49 46 46 9e e3 9b 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
0a197600  52 49 46 46 26 90 01 00  57 41 56 45 66 6d 74 20  |RIFF&...WAVEfmt |
0a1b0800  52 49 46 46 60 58 01 00  57 41 56 45 66 6d 74 20  |RIFF`X..WAVEfmt |
0a1c6200  52 49 46 46 1c b3 be 00  57 41 56 45 66 6d 74 20  |RIFF....WAVEfmt |
0adb1600  52 49 46 46 5c 1a 12 01  57 41 56 45 66 6d 74 20  |RIFF\...WAVEfmt |
0bed3200  52 49 46 46 2a 6d 01 00  57 41 56 45 66 6d 74 20  |RIFF*m..WAVEfmt |
0beea000  52 49 46 46 ce 4f 93 00  57 41 56 45 66 6d 74 20  |RIFF.O..WAVEfmt |
0c81f000  52 49 46 46 3e 45 28 01  57 41 56 45 66 6d 74 20  |RIFF>E(.WAVEfmt | 
...

3. Global structure about number, start addresses and length of Lunii Stories

030D4000      # Address of info structure
00 02 00      ===> number of album
00 00 01 00   ===> Start sector of the first Story
15 FE E4 00   ===> length in sector of the first Story
00 00 00 00   ===> id of first Story ???
15 FE E5 00   ===> Start sector of the second Story
08 59 F6 00   ===> length in sector of the second Story
A8 00 00 00   ===> id of second Story ???
...

4. Other Information which I believe that belong for navigation:

030D4200  00 A8 01
030D4400  C4 13 9D .. C3 00 00 .. A9 00 01 00 00 FF FF FF FF FF FF 00 01 00 01
030D4600  3D 7C 6F .. C3 00 00 .. A9 00 24 00 00 FF FF FF FF FF FF 00 00 00 01
030D4800  34 94 4D .. FF 00 00 .. AA 00 02 00 00 FF FF FF FF FF FF 00 00 00 01 00 01 00 00 00 01 00 00
030D4A00  8C 2C A1 .. FF 00 00 .. AB 00 04 00 00 00 A9 00 24 00 00 00 00 00 01 00 01 00 00 00 01 00 00
030D4E00  C9 64 6C .. C3 00 00 .. A9 00 24 00 01 FF FF FF FF FF FF 00 01 00 01 00 01 00 00 00 00 00 00
....
030E9200  fd c7 f2 .. c3 00 15 .. cd 00 30 00 2f 00 a9 00 24 00 00 00 01 00 01 00 01 00 00 00 00 00 00 

Next Steps:

1. Write a python script that extract medias (wav + BM + navigation data?? ) from a dump.

2. Understand the navigation data.

3. Construct a new "Story" with simple contents bitmap and sound for : the simplest is digits : 0 1 2 3 4 5 6 7 8 9 and try to pushed write it into the SDCard.