Nikon Medata discussion

[leegong]

Hi ,all ,
According to firmware analysis , Nikon tag 0xBC seems to indicates NEF thumbnail :
bytes 0-3  :  string for version ,
byte 4-5 : maybe width
byte 6-7 : maybe height
byte 8-11 : unknown
byte 12 - N : data payload

Leegong 

[Phil Harvey]

Hi Leegong,

Can you tell me what model this is for so I can check some images?

- Phil

[Hayo Baan]

Interesting, this looks like a newer tag to me; the older Nikon cameras I tested this with (D3, D200) don't have the tag, but the more recent D4 has.

The tag seems to be 7700 bytes long each time with quite a lot of 0 padding. It would be interesting to know what is in those bytes

[leegong]

Hi , Phil , Hayo Baan ,
Tag 0xBC is found in D5100 firmware ,  size 0xD98 bytes  , including version string .

[leegong]

Tag 0xBA is found in D800 firmware , but not found in D5100 .
byte0 == 0x49
byte1 == 0x31
byte2 == 0x0
byte3 = Vignettecontrol : 0 - off , 1 - on
if byte3 = 0 , then followed by 258 bytes 0x0
if byte3 != 0 , then followed by unknown data

EDIT  : Tag 0xBC is found in D800 also , the size is 0x1E0C ,
different from 0xD98 in D5100 , but seems only the first 0x12DE bytes of data payload
are useful .

[leegong]

1 byte for tag0x8A , it is set by JPG encoding hardware engine after one YUV image
is encoded into JPG , it absolutely indicates sth related to JPG encoding , but i have
no idea about what it means exactly.   

[leegong]

value for Tag0xA3 = enum{0 , 1} , it comes from bit5 of one byte,
each bit in this byte indicates one kind of status :
bit3  indicates GPS Auto Meter ,  : 1 On, 0 Off
bit2  indicates status of sensor cleaning
bit1  indicates status of Info Menu :0 - off , 1 - active 

[Phil Harvey]

Thanks for the hints.  I assume that this byte you are talking about for tag 0xa3 is found somewhere in the firmware, and not in the image metadata?  If so, I guess we are only interested in bit 5.  Any idea what it means?

- Phil

[leegong]

Sorry , Phil , i have no idea about meaning of tag0xA3 .

Did you get thumbnail in tag0xBC ? i think that byte8 of tag0xBC is bitdepth .

[Phil Harvey]

Hi Leegong,

I have looked at tag 0x00bc, but it definitely isn't a JPEG thumbnail.  Also, if bytes 4-7 are width and height, then the image is very small (68x34 for the D5100).  How is the image data formatted?

- Phil

[leegong]

Phil , sorry for my poor english , the "NEF thumbnail" i mentioned above
means RAW data  .
In D800 firmware ,  width = 0x42 , height = 0x2C ( 66x44 3:2 aspect ratio) ,  bitdepth = 12 (0xC)

[Phil Harvey]

Typically, very small images like this in other cameras are used for segmented metering.  Do you think this image could be used for exposure metering?

- Phil

[leegong]

There is other metering data generated by metering CCD , this thumbnail data comes from
main CMOS sensor , maybe it can be used for exposure metering in Liveview mode , but i'm not sure .
EDIT : For more info of Nikon firmware , please visit www.nikonhacker.com .

-Leegong

[Phil Harvey]

Thanks.  And thanks for the link.

- Phil

[leegong]

Hi , Phil ,
Sorry , my fault , the URL above is wrong , here's correct URL : https://nikonhacker.com/

Regarding tag0x8A and tag0xA3 , if you have time and don't mind ,
could you please alter value of them  , then open image with
Nikon capture NX2  or View NX2 , check if specific error info is rendered ,
if so , it'll be helpful for decoding them . 

-Leegog

[leegong]

bit3 of Tag0x89 probably is for exposure delay , bit8 for Dlighting bracketing .

[Phil Harvey]

Thanks!  I've added these to the list.

- Phil

[leegong]

Just decode some data in D800 tag0x91 , however they need to be confirmed :
byte1211 :  bit7 - Flash opened , bit6 - Flash charged
byte1212-13  : might be externalFlashFirmware  number
byte1214 : unknown flags for External Flash
byte1215 : ExternalFlash_controlMode :
0x0 = Off
0x1 = iTTL-BL
0x2 = iTTL
0x3 = Auto Aperture
0x4 = Automatic
0x5 = GN (distance priority)
0x6 = Manual
0x7 = Repeating Flash 

byte1217 :  FlashFocalLength

byte1230 :  FlashColorFilter

[leegong]

One 320 bytes array starts from byte 2122 in D800 tag0x91 ,
i'm struggling reading this array , here's some decoding :
D800 tag0x91 byte2122 :
array_byte 0 - 3 :  'LVAE'
array_byte4 : index for aperture or Fstops
array_byte5 : LV AF mode
array_byte6 : ISO index

array_byte12:15 : UNIT32 FPS value multiplies fixed factor

array_byte19 : FlickerReduction , 0 - 50Hz, 1 - 60Hz , 2 - auto

array_byte52 : Lens ExitPupilPosition
array_byte53 : Lens AFAperture
array_byte54 : Lens FocalLength:

array_byte316:319 : 'LVAE' 

[leegong]

Tag0xBB in D800 firmware version 0110 :
byte0-3 : string version
byte4 : exposure compensation in RAW retouch NEF Processing
if no NEF processing retouch , set 0xFF .
byte5 : always 0x1 , if no  NEF Processing , set 0xFF
byte6 == 0x6
byte7 == 0x0   

[Phil Harvey]

Thanks.  How is the exposure compensation represented?  A signed byte where the EV is calculated as <byte>/6 ?  (just guessing)

- Phil

[leegong]

Sorry , i forgot posting the  table in firmware for retouch NEF processing exposure compensation ,
values in the table represente -2Ev - + 2 Ev or +2 Ev - -2Ev :

.byte 0xC 
.byte 0xA
.byte 8
.byte 6
.byte 4
.byte 2
.byte 0
.byte 0xFE
.byte 0xFC
.byte 0xFA
.byte 0xF8
.byte 0xF6
.byte 0xF4

[Phil Harvey]

Thanks.  So it is <byte>/6.  Now the only question is whether it is +<byte>/6 or -<byte>/6.  One would normally assume +<byte>/6, but all of the flash compensation values are -<byte>/6, so I can't decode this until I know one way or the other.

- Phil

[leegong]

I think it will be easy to identify the value if somebody can adjust NEF processing exposure compensation
with D800 or nikon View NX2 , then take a look at tag0xBB data and compare it with value in the table above .

[leegong]

Nikon ShotInfoD5100 Tags
offset 2210(decimal) : uint32 - value of 32bits timer counter when IMX071 exposure is started
offset 2214(decimal) : uint32 -  value of 32bits timer counter when image data from IMX071 is captured and stored in DDR memory .

offset 2222(decimal) : uint16 -  temperature

offset 2286(decimal) : uint32 -  index of the latest action descripted in ring buffer followed
offset 2290(decimal) - 320 bytes ring buffer : 64 bytes array+ 64 uint32 array ,
each byte in byte array of ring buffer = action code of IMX071 and EI155 ,
each uint32 in uint32 array of ring buffer = IMX071&EI155 action timing ,
for more info of ring buffer , please refer to my decoding on NikonHacker Portal     

[Phil Harvey]

Hi Leegong,

Thanks for the information.  I'll read your reference when I get a chance.

Do you know the clock frequency for the timer counter?  Also, what units is temperature (if Celsius, shouldn't it be a signed integer)?

- Phil

[leegong]

Do you know the clock frequency for the timer counter?  Also, what units is temperature (if Celsius, shouldn't it be a signed integer)?

The frequence is 1Khz .
Sorry , i have no idea  about what temperature unit it is yet .

[leegong]

NikonCustom SettingsD5100 Tag starts from offset 1030 instead of 1031 in Nikon ShotInfoD5100 Tag ,
here's some info (based on 1030 offset) , '?' stands for decoding which is not confirmed 100% , "??" stands for
decoding which is not sure , "" stands for just guessing ,  comments for byte14 were copied from TAG
decoding on this website , the others were decoded by Nikon Hacker Team ,
many of them were decoded on this website before i posted , i'm too busy to distinguish what part decoding are not on this website yet ,
just list all of decoding comments in our IDB database .
byte0 : unknown
byte1 :
0xC0 AFC Priority: 0 - release, 2 - focus
0x20 AFS Mode Priority: 0 - focus, 1 - release , 0x10 AF Point Count ON/OFF
byte2 :
mask 0x60 - Manual setting
mask  0x01 : AF Assist Lamp: 0 - off, 1 on
byte3 :
0xC0 - FocusMeteringMode ?
0x3C - Assign MBD11 Btn
0x03 - Battery Cell Kind
byte4 :
0xC0 - Beep Level: 0 off, 1 low, 2 high
0x20 - Slot Empty Lock : 0 - Release locked, 1 - enable release
0x10 - Not Image Review
0x08 - Iso Display
0x04 - Show Easy ISO
0x02 - View Finder Grid Display
0x01 - View Finder Warning Display
byte5 :
0x18 - File Num Seq
0x03 - Beep Volume
byte6 :
0x80 - Reverse Indicator Mode: 0 normal, 1 revsered
0x10 - Range Finder: 0 off, 1 on
byte7 :
0xC0 - Ev Step: 0 - 1/3, 1 - 1/2, 2 - 1/1 ??
byte8 :
byte9 :
byte10 :
byte11 :
0xC0 - Exposure Delay
0x0F - Burst Rate
byte12 :
0xFF - Max Cont Shoot Count
byte13 :
0x10 - Bracket Order
0xE0 - Auto Bracket Set: 1 AE, 3 WB, 4 ADL
byte14 :
0xF8 - Assign Fn Mode
0x0 = Self-timer
0x8 = Release Mode
0x10 = Image Quality/Size
0x18 = ISO
0x20 = White Balance
0x28 = Active D-Lighting
0x30 = + NEF (RAW)
0x38 = Auto Bracketing
byte15 : 0xF8 - Assign Preview Btn
byte16 :
byte17 :
0xF8 - Assign AEAF Mode: 0 AE AF lock, 1 Lock Only, 2 Lockhold, 3 AF On
byte18 :
0x80 - Rev Dial Rotation Mode
0x60 - Command Rev Dia
0x18 - Menu's and Playback
0x04 - Appeture Setting
0x02 - Shutter Release AEL
0x01 - unknown
byte19 :
0xF0 - index of AutoOffTimer_Meter
0x03 - Remote On Duration: 0 1min, 1 5min, 2 10min, 3 15min   
byte20 :
0xC0 - Self timer: 0 2s, 1 5s, 2 10s, 3 20s
0x30 - unknown
0x0F - Number of shoots for self timer
byte21 :
0xE0 - AutoOffTimer playback menu
0x1C - index of LiveView Auto OFF
byte22 :
0xE0 - index of AutoOffTimer_Playback
byte23 : unknown
byte24:
0x1F - Flash Power Level: 0 Full - 15 1/32
0xC0 - Flash Contrl: 0 TTL, 1 - Manual
...
byte34 :
0xE0 = 0: Face detection system AF, 1: Wide area AF, 2: Normal area AF, 3: Target tracking AF
0x07 = index for TAB , 0: Single AF servo, 2: Constant AF servo, 3: MF (fixed), 4: MF (selection)
used in maunal modes
byte35 :
0xE0 = 0: Face detection system AF, 1: Wide area AF, 2: Normal area AF, 3: Target tracking AF
0x07 = index for TAB , 0: Single AF servo, 2: Constant AF servo, 3: MF (fixed), 4: MF (selection)
used in maunal modes

byte37 :
0x03 - Exposure Metering Mode
0xE0 - index for Monitor auto off of playback
byte38 :
0xF0 - Burst Mode: 0 single, 1 burst
0x0F - Release Mode: 3 self timer, 4 delayed remote, 5 quick response, 6 quiet shutter

[leegong]

Nikon ShotInfoD5100 Tag offset 1370(decimal) is metering data set 576(decimal) bytes size ,
which is divided into 3 same structures (192 bytes size)  ,
however it has not been decoded completely :
byte0-31 : 16 16bits array (no idea about singed or unsigned yet) ,
indicates minimum , maximum ,average metering value of different aera .
byte32 - byte177 : 73 16bits array , guessing maybe 3 x 24 + 1 or 5 x 7 + 3 16bits array
byte178 - byte191 : dummy

Any more analysis is appreciated !

[leegong]

Nikon ShotInfoD5100 Tag offset 773 is a 18bytes array ,
byte0 :
mask 0x80 =  long time expourse Noise Reduction ?
mask 0x20 =  WB bracket ON/OFF
byte1 : ISO
byte2 : TV
byte3 : AV

byte8 : for Tag 0x9290 SubSecTime ==  (byte2char)byte8 + '0' + 0x0

i need more info for decoding more bits in byte0 , any help is appreciated !   

[Phil Harvey]

It takes a camera owner to decode the Nikon custom settings.  To do this, you need to run through all settings, changing one at a time and taking one image at each setting, all the while carefully documenting the settings for each picture.  Then with ExifTool you can see which bits changed for each setting.

- Phil

[leegong]

NikonCustom SettingsD5100 Tag :
byte1 : mask 0x7 - AFLockTime
byte2 : mask 0x6 - AFAreaIllumination
byte7 : mask 0x30 - ISO Step: 0 - 1/3, 1 - 1/2, 2 - 1/1?

byte8 :
0xE0 - CenterWeightArea
0x0F - ExposureTuning for center weighted mode

byte9 :
0xF0 - ExposureTuning for matrix mode
0x0F - ExposureTuning for spot mode

byte16 : 0xF8 - OkButtonShooting
byte17 : 0xF8 : Assign AEAF Mode: 0 AE AF lock, 1 Lock Only, 2 Lockhold, 3 AF On

byte27 : 0x1F : FlashPowerLevel2
byte28 :
0xC0 : FlashCommandSelfMode
0x1F : FlashCommandSelfValue
byte29 :
0xC0 : FlashCommandAMode
0x1F : FlashCommandAValue
byte30 :
0xC0 : FlashCommandBMode
0x1F : FlashCommandBValue

byte34 : for LV AF
bit2:0 = index for TAB , 1: Single AF servo, 3: Constant AF servo, 4: MF (selection)
used in maunal modes ??
byte35 : for LV AF
bit2:0 = index for TAB , 1: Single AF servo, 3: Constant AF servo, 4: MF (selection)
used in auto modes ??
byte36 : for photo AF
0x7 = AFMode for photo only :
0 = AF-A , 1 = AF-S, 2 = AF-C,  4 = MF ??

Sorry there is some mistakes in previous post , if any conflict , here's correct result .   
Note : ExposureTuning means byte0 in Nikon tag 0x1C

[leegong]

Nikon ShotInfoD5100 Tags offset 973 (decimal) :
byte0 : 0xF0  - program mode ??
byte1 : image quality
0x40 - Jpeg Compression: 0 Size, 1 Quality
0x20 - NEF Compression: 0 Loss less, 1 Compressed
0x18 - Image Size : 0 - Large , 1 - Middle , 2 - Small
0x07 - Image Quality , such as NEF , JPG basic , JPG fine and so on .
byte2 :
0x20 - NEF bit level: 0 12bit, 1 14bit
0x08 - Auto Distortion: 0 off, 1 on
0x07 - Active D-Lighting : 0 = Off ,1 = Low , 2 = Normal , 3  = High , 4 -  Extra High , 5 - AUTO
byte3 : 0xFF - ISO
byte4 :
0x80 - Auto Iso Sensitivity: 0 Auto off, 1 Auto on
0x40 - Iso Senitivity
0x3F - Min Shutter Speed
byte5 : 0xFF - max ISO
byte6 :
0x80 - Long Exposure NR
0x60 - High ISO NR Mode :
0 = Minimal , 1 = Low , 2 = Normal , 3 = High
0x03 - Remote Mode
byte7 : unknown
byte8 :
0xF0 - White Balance Mode
0x1 = Incandescent
0x2 = Fluorescent
0x3 = Directsunlight
0x4 = Flash
0x5 = Cloudy
0x6 = Shade
0x8 = Presetmanual
0x0F - White Balance Flouro Mode
0x0 = Sodiumvaporlam
0x1 = Warmwhitefluor
0x2 = Whitefluoresce
0x3 = Coolwhitefluor
0x4 = Daywhitefluore
0x5 = Daylightfluore
0x6 = Hightempmercur
byte9 - byte18 :
divided into two parts : 0xF0 and  0x0F , for WB bias and so on
byte19 : 0xFF - WB Kelvin Color Temp

byte22 :
0xF0 Multi Exposure shot3
0x0F Multi Exposure shot2
byte23 :
0x80 MultiExposureAutoGain ON/OFF
bit6 = 1 - HDR on , 0 - HDR off
bit5:4 = HDR Level :
0 = Auto , 1 = 1 EV , 2 = 2 EV  ,3 = 3 EV  ,255 = n/a
bit3:2 = HDRSmoothing :
0 - off , 1 - high , 2 - normal , 3 - low

[leegong]

Nikon Tag0xB8 FileInfo Tag :

byte4 : unknwon unit16

if (retouch type != NULL )
{ byte10 :  uint16  = enum {0,1} , card driver ?
  byte12 :  unit16  DirectoryNumber
  byte14 :  unit16  FileNumber   
  if (retouch type == ImageOverlay)
   { byte16 :  uint16  == enum {0,1} , card driver ?
     byte18 :  unit16  DirectoryNumber
     byte20 :  unit16  FileNumber
    }   
}

EDIT : Wild guessing ,  byte4 = card driver   , byte10 - byte20 indicate info of source image files for retouching ?

[leegong]

Nikon ShotInfoD5100 Tag
offset 792 : 32bits - exposure time ,for TIFF Tag0x829A also
offset 796 : byte - FNumber , for TIFF Tag0x829D also
offset 797 : byte - ExposureBiasValue for TIFF TAG0x9204
offset 798 : byte - unknown
offset 799 : byte - ExposureBracketValue
offset 800 : byte - FlashExposureBracketValue , equivalent to value in Nikon Tag0x18

[leegong]

Just extract Nikon tag0xBC , i don't think it's NEF preview anymore ,
my gut feeling , it probably is auto WB pattern .

[leegong]

In Nikon LensData0800 Tags , https://exiftool.org/TagNames/Nikon.html#LensData0800
offset80 : uint8 LensAttrib_1st ; // Each bit stands for specific Lens attrib
offset81 : uint8 LensAttrib_2nd ; // Each bit stands for specific Lens attrib
offset82 : uint8 LensAttrib_3th ; // Each bit stands for specific Lens attrib , only lowest 2bits are available currently
offset85 : uint8 maybe_LensPowerStatus ;
offset86 : uint8 LensFocusStatus ; //Each bit stands for specific status

[Phil Harvey]

Thanks, but this isn't much help without knowing about the specific attributes.  Also, are your offsets in decimal?

- Phil