Thanks, ewavr !
This thread + your comments gives me some ideas to chew on for implementing this stuff in CardTricks.
Shouldn't that be 'FAT32' in step 1 ? After all, we can assume it's a card > 4G, right ?
edit2: ... and of course, this whole procedure is impossible on DryOS cams,
which reminds me of a Q i have for ewavr:
if chr succeeded in using his QEMU cam emulation to find and overcome the "New DryOS" encryption,
shouldn't the same be possible for the *.fi2 on DryOS ?