c10ud's right. There surely are more appropriate parts of the firmware to intercept file saving, but I chose to hook filewritetask because it was easy to understand what it's doing. Downside is that the camera "remembers" the shots. Those "unidentified" images appear to not take up malloc memory, but shooting thousands of images may cause the shutdown of the camera's USB connectivity.