GME Header

Length: 512 bytes

The header begins with these 8 32-bit numbers, listed with their offset:

• 0x0000: 32bit offset to the play script table
• 0x0004: 32bit offset to the media file table
• 0x0008: 32bit. If you change this value in a working game file it will no longer be accepted. Its value is 0x0000238b for all tiptoi products seen so far. Maybe this is the Ravensburger customer number at Chomptech.
• 0x000C: 32bit. The offset to an additional script table. Purpose unknown.
• 0x0010: 32bit. The offset to the game table
• 0x0014: 32bit. Product id code (== OID code of the power on symbol on page 1)
• 0x0018: 32bit. Pointer to register init values (16bit counter followed by n×16bit values. First value is register $0, followed by $1 and so on.)
• 0x001C: raw XOR value (8bit), see media file table explanation.
• 0x001D: three bytes with unknown meaning, 0 for all products seen so far.
• 0x0020: a variable length string, consisting of its length (8bit), and that many characters. Newer findings suggest the string must consist of 48 or 49 bytes (at lest for non-german pens). Commonly CHOMPTECH DATA FORMAT CopyRight 2009 Ver2.xx.yyyy (varies between products, xx can also be one digit only).
• Next is a 8 digit date string (20111024). The date string seems optional with one condition: if a language string follows the date must consist of at least one ASCII number.
• Next is an optional language string (currently known: GERMAN, DUTCH, FRENCH, ITALIAN, RUSSIA. If the language string is provided it must match the language of the firmware that is running on the pen (it is unclear where is is checked; the file .tiptoi.log is NOT taken into account here!) or the pen will ignore it. If the language is missing any TipToi pen will accept the file. The pen reads no more than 6 characters of the language string.
• Next there is sequence of zeros up to and including to position 0x5f.
• 0x0060: 32bit offset to an additional media file table
• 0x0071: 32bit offset to the playlistlist for the the power-on sound (played, when the product is recognized. If 0, no sound is played.)

The following entries might exist only from Version 2.10.0901 on:

• 0x008C: 32bit offset to a table of 32bit values, maybe a special register table for binaries?. Some products have 0 here.
• 0x0090: 32bit offset to the game binaries table
• 0x0094: 32bit offset to special symbols
• 0x0098: 32bit offset to an additional game binaries table
• 0x009C: 32bit. purpose unknown, always 0.
• 0x00A0: 32bit offset to an additional game binaries table, which consists of a single binary
• 0x00A4: 16bit flag. Can be 0 or 1.
  value 0: The rest of the header is filled with 0.
  value 1: The header contains one or more of the following offsets.
• 0x00A8: 32bit offset to another additional game binaries table, which also consists of a single binary
• 0x00C8: 32bit offset to another additional game binaries table, which also consists of a single binary
• 0x00CC: 32bit offset to another additional game binaries table
• Next there is sequence of zeros up to and including to position 0x01FF.