Question about unknown Nikon camera and encrypted maker notes

[Xavier_OM]

Hi,
I am currently trying to extract Roll, Pitch and Yaw angles coming from Nikon Z5 and Z50 accelerometers.

From other similar cameras in https://exiftool.org/TagNames/Nikon.html I can see it's a matter of performing an offset in the Nikon Shot Info block to find the "Nikon OrientationInfo Tags"

I think the right offset should be identifiable by diffing data from photos with varying angles.

But my question is about encryption...
On the nikon page with tags :

• next to ShutterCount it is written " This value is used as a key to decrypt other information, and writing this tag causes the other information to be re-encrypted with the new key)"
• next to "Nikon ShotInfoD40 Tags" (and the other ones) it is written "These tags are extracted from encrypted data in D40 and D40X images."

,

I would like to learn more about this encryption, what should be done to decrypt the Nikon Shot Info block ?

Thanks in advance for any tips regarding this !

[Phil Harvey]

You can use the ExifTool -U option to show the unknown contents of the ShotInfo record.

If you discover where the orientation information is stored, post here and I'll add support for extracting this information.

Be sure to use the latest version of ExifTool because some new tags from the Nikon Z cameras have been added recently.

- Phil

[Xavier_OM]

Indeed ! I can see RollAngle, PitchAngle and YawAngle with exiftool 12.57 (which had some updates regarding Nikon tags), that's great !

Still I'm curious about this 'encryption' matter, do you have any piece of information, or any link or doc about this ? I should read exiftool source code maybe

Thanks !

[Phil Harvey]

Hi Xavier,

Yes, read the source code if you want details about the encryption:

https://github.com/exiftool/exiftool/blob/master/lib/Image/ExifTool/Nikon.pm#L11759

Or take a look at the ExifTool -v3 output (or -v4 or -v5) to see the raw encrypted and decrypted data in a file.

- Phil

[Xavier_OM]

At what point did Nikon people say "this is a good idea let's do it" ? ...

So ShotInfo is obfuscated by XORing its content using two pieces of information available in clear text : the camera serial number and the shutter count.

[Phil Harvey]

Yes, basically.  Sony does the same.

- Phil

[blue-j]

@Xavier, might you have a sample with this encrypted data to share?  Thanks!  - J

[Phil Harvey]

Lots of them here.  Basically, any high-end Nikon (and Sony) camera camera will have encrypted metadata.

Also, for whatever reason, Pentax encrypts the ShutterCount of high-end models.

- Phil

[Xavier_OM]

Do you have any additional information about how I can interpret fixed32u type (the type for Roll/Pitch/Yaw) ? Is it a fixed point type ?
exiftool code does a "fixed32u / 65536" division while processing them, as if half of the data was useless here.

Btw it seems that some accelerometer measurements are stored immediately after Roll/Pitch/Yaw values, the next 96 bytes may be read as 3 blocs of sixteen 2-bytes values describing vertical/horizontal/sagittal data, but I'm not still entirely sure of this.

[Phil Harvey]

A fixed32u is a fixed point decimal where the lower 16 bits are the fraction.  So interpret as a 32-bit integer then divide by 65536.  In Perl the division is floating point, so nothing is lost.

- Phil

[Xavier_OM]

Thanks !

[Xavier_OM]

I think NIKON Z 30 orientation angles can be obtained by extending the condition here https://github.com/exiftool/exiftool/blob/master/lib/Image/ExifTool/Nikon.pm#L2304 to version 0807

Code Select Expand

======== photoNikonZ30.jpg
Camera Model Name              : NIKON Z 30
Shot Info Version              : 0807
Roll Angle                      : -2.4
Roll/Pitch/Yaw angles seem correct with this modification when I take 6 photos, 3 normal and 3 ground oriented

[Phil Harvey]

Thanks.  This seems to work well for my samples.  The update will appear in version 12.61 which I plan to release later today.

- Phil