GME Header

Length: 512 bytes

The header begins with these 8 32-bit numbers, listed with their offset:

• 0x0000: 32bit offset to the play script table
• 0x0004: 32bit offset to the media file table
• 0x0008: 32bit. If you change this value in a working game file it will no longer be accepted. Its value is 0x0000238b for all tiptoi products seen so far. Maybe this is the Ravensburger customer number at Chomptech.
• 0x000C: 32bit. The offset to an additional script table. Purpose unknown.
• 0x0010: 32bit. The offset to the game table
• 0x0014: 32bit. Product id code (== OID code of the power on symbol on page 1)
• 0x0018: 32bit. Pointer to register init values (16bit counter followed by n×16bit values. First value is register $0, followed by $1 and so on.)
• 0x001C: raw XOR value (8bit), see media file table explanation.
• 0x001D: three bytes with unknown meaning, 0 for all products seen so far.
• 0x0020: a variable length string, consisting of its length (8bit), and that many characters. Newer findings suggest the string must consist of 48 or 49 bytes (at least for non-german pens). Commonly CHOMPTECH DATA FORMAT CopyRight 2009 Ver2.xx.yyyy (varies between products, xx can also be one digit only).
• Next is a 8 digit date string (20111024). The date string seems optional with one condition: if a language string follows the date must consist of at least one ASCII number.
• Next is an optional language string. Currently known: GERMAN, DUTCH, FRENCH, ITALIA, RUSSIA, ENGLISH. If the language string is provided it must match the language of the firmware that is running on the pen (it is unclear where is is checked; the file .tiptoi.log is NOT taken into account here!) or the pen will ignore it. If the language is missing any TipToi pen will accept the file. The pen reads no more than 6 characters of the language string.
• Next there is sequence of zeros up to and including to position 0x5f.
• 0x0060: 32bit offset to an additional media file table
• 0x0071: 32bit offset to the playlistlist for the the power-on sound (played, when the product is recognized. If 0, no sound is played.)

The following entries might exist only from Version 2.10.0901 on:

• 0x008C: 32bit offset to a table of 32bit values, looks like a special media flag table?. Some products have 0 here.
• 0x0090: 32bit offset to the game binaries table (probably the games for the ZC3201)
• 0x0094: 32bit offset to special symbols
• 0x0098: 32bit offset to an another game binaries table (probably the games for the ZC3202N)
• 0x009C: 32bit. purpose unknown, always 0.
• 0x00A0: 32bit offset to an another game binaries table with a single binary (probably the main binary for the ZC3201)
• 0x00A4: 32bit flag. Can be 0 or 1.
  value 0: The rest of the header is filled with 0.
  value 1: The header contains one or more of the following offsets.
• 0x00A8: 32bit offset to another game binaries table with a single binary (probably the main binary for the ZC3202N)
• 0x00C8: 32bit offset to another game binaries table with a single binary (probably the main binary for the ZC3203L)
• 0x00CC: 32bit offset to another game binaries table (probably the games for the ZC3203L)
• Next there is sequence of zeros up to and including to position 0x01FF.