http://www.personal-view.com/faqs/ 2026-04-27T21:42:00+00:00 http://www.personal-view.com/faqs/ http://www.personal-view.com/faqs/lib/tpl/dokuwiki/images/favicon.ico text/html 2015-08-10T19:20:03+00:00 http://www.personal-view.com/faqs/sony-hack/axfs?rev=1439234403&do=diff AXFS (Advanced XIP File System) is a compressed read only file system for linux, Currently developed by Numonyx. It is used for the initrd in the 2nd Generation Cameras. It appears to be a bit out of date in terms of support these days and only supports 2.6 kernels. text/html 2015-08-10T16:46:18+00:00 http://www.personal-view.com/faqs/sony-hack/beginners-place?rev=1439225178&do=diff Beginners place Executable location Usage instructions, revision history and compiled Executable are located at: * fwtool Useful tools you need Download and install this C IDE first: * C IDE - Code::Blocks <http://www.codeblocks.org/downloads/26> (get codeblocks-xx.yymingw-setup.exe) * Source Control - Fossil VCS <http://fossil-scm.org/index.html/doc/trunk/www/index.wiki> * Source Control - GUI for Fossil <http://code.google.com/p/fuel-scm/> text/html 2015-08-10T17:13:28+00:00 http://www.personal-view.com/faqs/sony-hack/boot?rev=1439226808&do=diff Folder structure: bin backup_data_list bishop_flagctrl.sh chknandcapa edisx end_keep_backupdata.sh endufp.sh endupdate.sh filecheck.sh keep_backupdata_common.src keep_backupdata_execute.sh keep_backupdata_flag_ctrl.sh keep_backupdata_mount_ctrl.sh keep_backupdata_onenand.sh keep_backupdata_onenand_common.src keep_backupdata_ram_recovery.sh keep_backupdata_write_flag.sh loader_update loader_writer.sh p2clean.sh pfo… text/html 2015-08-10T19:21:15+00:00 http://www.personal-view.com/faqs/sony-hack/current-tasks?rev=1439234475&do=diff Note!! Information is not actual and old. Decryptor Kenan is working on this: Decryption and Encryption works, unpacking down to fsimg level, repacking up from level3. Form of extraction must allow later to put it all back in firmware in identical form, preserving all elements (users, rights, etc) text/html 2015-08-10T17:24:53+00:00 http://www.personal-view.com/faqs/sony-hack/device_info?rev=1439227493&do=diff This file described features of the camera. Here is a deviceInfo.xml from A33 <?xml version="1.0" encoding="utf-8"?> <plist version="1.0"> <dict> <key>XMLFileType</key> <string>DeviceInfoXML</string> <key>Version</key> <string>1.0.00.16230</string> <key>DeviceInfo</key> <dict> <key>Category</key> <integer>6</integer> <key>Feature</key> <integer>3712</integer> <key>Format</key> <integer>66</integer> <key>db</key> <dict> <key>name</key> <string>AVIndex</string> <… text/html 2015-08-10T16:31:27+00:00 http://www.personal-view.com/faqs/sony-hack/firmware-unpack-tool?rev=1439224287&do=diff First and second generation unpacker - can decrypt the package from any firmware ”.dat” file - OR firmware update ”.exe” file. This tools works with all available SLT and NEX firmware images. And also for NEX FS100 firmware. text/html 2015-08-10T19:09:04+00:00 http://www.personal-view.com/faqs/sony-hack/fwencryption?rev=1439233744&do=diff Complete source - see VCS Executable only - It is ready to compile in <http://www.smorgasbordet.com/pellesc/> , so anyone can join quickly. text/html 2015-08-10T17:10:40+00:00 http://www.personal-view.com/faqs/sony-hack/fwpackage?rev=1439226640&do=diff The transport package of the first wave is hashed using the SHA-1 hashing algorithm. The next portion of the key produced by appending the produced data of the previous round to the next one. This [tool] can extract the package from any firmware .dat file. text/html 2015-08-10T16:52:57+00:00 http://www.personal-view.com/faqs/sony-hack/fwtool?rev=1439225577&do=diff fwtool is a package written by oz_paulb in november 2012 which integrated the findings known to that date. This tool is expanded to integrate repacking and encryption of a modified firmware by kenan, as Paul has planned then. actual state of fwtool last released executable - (actual v07b12) text/html 2015-08-10T18:40:01+00:00 http://www.personal-view.com/faqs/sony-hack/fwupdateprocess?rev=1439232001&do=diff This is an early work in progress, as far as i can tell this is correct however needs a lot more information and testing before it can be considered safe After spending a fair amount of time reversing the update utility i have found the following information about the firmware update process. text/html 2015-08-10T18:26:40+00:00 http://www.personal-view.com/faqs/sony-hack/fwupdates?rev=1439231200&do=diff The most recent firmware update file may be downloaded from Sony support sites all around the world. Superseeded versions are not listed in the standard download dialog. Every firmware file matches only it's device, but there are no region, language or submodel specific versions. text/html 2015-08-10T19:17:46+00:00 http://www.personal-view.com/faqs/sony-hack/gui_languages?rev=1439234266&do=diff GUI Languages Devices from the 1. and 2. generation support at least 25 languages. At the language menu every language name is displayed in its own language and lettering regardless of the selected gui language. The following list shows this names and the english translation thereof. The Unicode codepoints are given for languages not using latin letters, and transliterations or hints for the pronouncation. text/html 2015-08-10T19:14:42+00:00 http://www.personal-view.com/faqs/sony-hack/hack-development?rev=1439234082&do=diff Status Beginners place Current tasks Responsibility Source control ---------- Resources Firmware unpacker and repacker fwtool: Firmware decryption, unpacking, repacking, encryption GUI development for fwtool Firmware package Firmware package text/html 2015-08-10T17:22:33+00:00 http://www.personal-view.com/faqs/sony-hack/image-structure?rev=1439227353&do=diff Firmware files package It is a simple TAR in UStar format. Can be unpacked with any utility. The only problem i can imagine here is to repack it on windows since the package mentioned root as a user. This tar contains all the files of the firmware. The folder structure locks pretty the same for NEX and SLT firmware. text/html 2015-08-10T18:32:59+00:00 http://www.personal-view.com/faqs/sony-hack/languages?rev=1439231579&do=diff Part 1 As you may (not) know, many cameras from Sony sold in Japan have this strange feature of allowing only menus in Japanese language. I received such a camera (Sony alpha 65) and nor I or my friend in Japan were aware of this limitation. He bought for me a J1 type camera. Since the transport was not cheap (had to use UPS as being the only post service accepting at that time lithium-ion batteries in the parcel) I decided to not send back the camera after discovering that the only menus avai… text/html 2015-08-10T19:06:50+00:00 http://www.personal-view.com/faqs/sony-hack/lzpt?rev=1439233610&do=diff Complete source for LZPT unpacker - It is ready to compile in <http://www.smorgasbordet.com/pellesc/> , so anyone can join quickly. ---------- NOTE: Latest “fwtool” project can also decrypt “LZPT” images: fwencryption LZPT files (aka TPZL - endian reversed) are images found in the 'second wave' firmware files. text/html 2015-08-10T17:24:14+00:00 http://www.personal-view.com/faqs/sony-hack/main?rev=1439227454&do=diff MAIN The largest file in firmware. File contains resources as well as a code. text/html 2015-08-10T19:15:54+00:00 http://www.personal-view.com/faqs/sony-hack/menus?rev=1439234154&do=diff ESF menu file type 0..3 ESFf 4..5 Version major 6..7 Version minor 8..25 Unknown 26 Compression flag (1-uncompressed 2-compressed) 27..35 Unknown The rest of the file is compressed by the same compression as a cramfs image and use the same method from kernel. text/html 2015-08-10T19:10:25+00:00 http://www.personal-view.com/faqs/sony-hack/nex5r-6-android-reversing?rev=1439233825&do=diff The Nex 5R & Nex 6 firmware contains a custom android build that is responsible for the “apps” that can be downloaded from Sony. It's a fairly standard Android 2.3.7 build with only a handful of system apps but a very extensive list of wrapper classes for hardware functionality. My initial impression is that it is very well possible to control the entire camera hardware via an android app. text/html 2015-08-10T18:34:21+00:00 http://www.personal-view.com/faqs/sony-hack/nex6-av-cam.bin-reversing?rev=1439231661&do=diff Each NEX firmware package contains an av-cam.bin, it's ARM code, and powered with t-kernel RTOS ( open sourced in www.t-engine.org ), but is hard to identify whether it is t-kernel v1 or v2. The init IDC dump of my disassembling to this module can be found here in <https://github.com/steelcnn/nex-hack> . This IDC is incomplete, if you find sth weired, switching the instruction mode bewteen ARM32/Thumb16 may helps. text/html 2015-08-10T16:49:25+00:00 http://www.personal-view.com/faqs/sony-hack/responsibility?rev=1439225365&do=diff Note! Old information! kenan - fwtool: decryption, encryption, unpacking, repacking, console interface Madwyn - GUI for fwtool アンドレアス - USB,wlan communication stuff Diamondback - Android subsystem, custom apps simon - Android certficates, store hijacking text/html 2015-08-10T19:19:13+00:00 http://www.personal-view.com/faqs/sony-hack/rootfs?rev=1439234353&do=diff CRAMFS File system used for this RootFS Compression flags: CRAMFS_FLAG_COMP_ALGO_LZO 0x10000000 CRAMFS_FLAG_COMP_ALGO_LZ77 0x20000000 inode flags Please note that flags are octal! S_IFMT 00170000// Flag mask S_IFDIR 0040000 S_IFLNK 0120000 S_IFREG 0100000 or in HEX text/html 2015-08-10T19:15:13+00:00 http://www.personal-view.com/faqs/sony-hack/scenarios?rev=1439234113&do=diff Cameras uses modification of SWF v3 for user interface. Modification is not small. All the headers and structures looks different. There are two scenario types ESF and RSF. Initially app_eps_rsf.rsf loaded. It appears to be a resource storage. Initial scenario is app_top_snr.esf text/html 2015-08-10T19:12:41+00:00 http://www.personal-view.com/faqs/sony-hack/server?rev=1439233961&do=diff Note: This research was done on a HDR-AS15 but due to the similarities in features and other parts of firmware i believe it will be relevant for the NEX-5R and NEX-6 The camera provides Web servers in 2 modes. * Viewfinder Mode * Send Mode Viewfinder Mode The Web server in the Viewfinder mode runs on port 10000 text/html 2015-08-10T16:55:59+00:00 http://www.personal-view.com/faqs/sony-hack/simple-gui?rev=1439225759&do=diff Introduction The GUI for fwtool is built using standard WIN32 API. Updates Preview 3: Planned Redirect the console output to the UI. Preview 2: Planned Add decryption. Implement the progress bar. Multi-threaded GUI. The decryption or encryption will work in a separate thread so that the UI won't freeze. text/html 2015-08-10T16:50:39+00:00 http://www.personal-view.com/faqs/sony-hack/source-control?rev=1439225439&do=diff Fossil We are using Fossil VCS. <http://fossil-scm.org/index.html/doc/trunk/www/index.wiki> Book - <http://www.fossil-scm.org/schimpf-book/doc/tip/fossilbook.pdf> GUI for it <http://code.google.com/p/fuel-scm/> It is simple, easy to use, one file without dependency, easy to move repository. text/html 2015-08-10T18:25:36+00:00 http://www.personal-view.com/faqs/sony-hack/sources?rev=1439231136&do=diff Overview * Consumer Products : <http://www.sony.net/Products/Linux/DI/category01.html> * Professional Products : <http://www.sony.net/Products/Linux/B2B/category01.html> 1. Generation a. first release * SLT-A55 / SLT-A33 / DSLR-A580 / DSLR-A560 : <http://www.sony.net/Products/Linux/DI/SLT-A55.html> * NEX-5 / NEX-3 : <http://www.sony.net/Products/Linux/DI/NEX-5.html> * NEX-VG10 : <http://www.sony.net/Products/Linux/DI/NEX-VG10.html> text/html 2015-08-10T19:13:49+00:00 http://www.personal-view.com/faqs/sony-hack/usbinfo?rev=1439234029&do=diff The Nex contains a number of USB Descriptors, these are all contained in the libusb.so file These are: * PTP * MSC (Mass storage) * SEN (could be some sort of console access but uses the 0xFF class codes at the interface level. This implies that it is not a simple usb-serial bridge, but a proprietary protocol created by Sony which could make it harder to use as a vector for testing/hacking)