Decrypt Tonies Audiofile on the SD Card CONTENT Folder

TPTim · January 15, 2026, 1:44pm

Hello everyone,

first of all, please move my topic if I selected the false category. I am not 100% sure.

I was able to successfully flash my Tonie Box (CC3200) and integrate it into my own TeddyCloud.

After the initial connection, all Tonies that had ever been on the box were displayed in the TeddyCloud. The Tonie files are stored on the SD card in the CONTENT directory.

The folder and file name consist of the tag’s UID.

The file itself consists of a 4096-byte header, directly followed by an Opus audio file. This assembled file on the SD card has no file type.

As far as I could find out, the 4096-byte header consists of static values, the SHA-1 hash of the Opus audio file, the runtime of the track, and the chapters/jump marks.

I have started writing a small tool that extracts the Opus audio part and checks the SHA-1 hash. This allows you to extract the original Opus audio files from the Tonie files of a used Tonie Box.

These can also be uploaded back to the Teddy Cloud. This allows you to get original Tonie content into the Teddy Cloud without owning the Tonie itself. It is sufficient that the Tonie has been placed on the used box once. The current disadvantage is that the chapters are missing. There is only a single audio file.

But before I look into how the chapters are structured, extract them from the 4096-byte header, and split and rename the Opus file accordingly, I have a question.

Has anyone else dealt with this before? Maybe even written a little tool that does exactly what I’ve been working on. That way, I wouldn’t have to reinvent the wheel.

And/or does anyone have any information about how the chapters/anchor points are structured?

I look forward to hearing from you!

Best regards,
TPTim

0xbadbee · January 15, 2026, 1:54pm

General things about the file format:

Protofile:

github.com/toniebox-reverse-engineering/teddycloud

proto/toniebox.pb.taf-header.proto

master

syntax = "proto2";

message TonieboxAudioFileHeader {
  required bytes sha1_hash = 1;
  required uint64 num_bytes = 2;
  required uint32 audio_id = 3;
  repeated uint32 track_page_nums = 4 [packed=true];
  required bytes _fill = 5;
  //custom_fields_start
  optional uint64 ogg_granule_position = 6;
  optional uint64 ogg_packet_count = 7;
  optional uint64 taf_block_num = 8;
  optional uint64 pageno = 9;
  //custom_fields_end
}

Chapter position in seonds by chapter page

github.com/toniebox-reverse-engineering/teddycloud

src/handler.c

d21f908ca


      
                                  toniebox_audio_file_header__free_unpacked(tafHeader, NULL);
                              }
                          }
                      }
                  }
                  fsCloseFile(file);
              }
              return valid;
          }
          
          void readTrackPositions(tonie_info_t *tonieInfo, FsFile *file)
          {
              bool hasError = false;
              track_positions_t *trackPos = &tonieInfo->additional.track_positions;
              TonieboxAudioFileHeader *tafHeader = tonieInfo->tafHeader;
              trackPos->count = tafHeader->n_track_page_nums;
              if (trackPos->count > 0)
              {
                  trackPos->pos = osAllocMem(trackPos->count * sizeof(uint32_t));
                  uint64_t correction = 0;
                  for (size_t i = 0; i < trackPos->count; i++)

TPTim · January 15, 2026, 2:14pm

Thank you for your fast answer!

I searched a bit and found TeddyBench. This tool does everythink that I need… Unbelivable how good TeddyBench is working No further questions,…

Thank you!