Okay, good. I suppose it occurs in two places: one where the data is written, and another in the code that reads the dynamic data.

I've a cat on my lap, and cannot move to reach for an appropriate player at the moment, but the general strategy here is to just run the player binary under strace, and observe when it reads/writes the fids area of the dynamic data partition. Based on what that tells me, I'll either just go fishing directly, or instrument the kernel to automatically catch it and dump a traceback.

Between those two methods, I'll have a very good approximation of where the read/write dynamic fid code is within the player's memory space, and from there can track it back to the executable. Once in the right area, it hopefully will just be a matter of looking backwards in the binary for the fated 0010 and 0070 values.

This may take a while until I actually get set up and do this, so others are more than welcome to have a go at it on their own. If/when I do it, I'll be targeting v3a8.

Cheers