THIS PATCH WORKS FOR FIRMWARE VERSION 0.31 ONLY

Scripts you can find here: https://github.com/storyboardcreativity/Z-Camera-E1-Reverse-Engineering

Screenshots with old and new bitrate are attached below.

I'd like to upload the hack files for archival purposes.

Links :-

Canon Firmware Decryption Tools

https://github.com/protyposis/CanonCamcorderFirmwareTools

https://protyposis.net/blog/decrypting-canon-camcorder-firmware-updates/#comment-128

From Time Machine :-)

http://web.archive.org/web/20100727174315/http://hv20.com/showthread.php?t=20098

Features:

• PAL/NTSC region change
• Zero gain option
• LCD Flip option

Flip hack firmware tested successfully, available here!

PLEASE NOTE: even if you have region-switched your camera with the other firmware hack, you must use the proper version for your camera. The NTSC version is for original NTSC ('Vixia' & 'iVIS') HV30s, the PAL version is for PAL ('Legria') cams.

LCD Flip Firmware — NTSC Cameras Download link: http://hv20.info/yopu/HV30_Modified_Firmware_v1_1b.zip

LCD Flip Firmware — PAL Cameras Download link: http://hv20.info/yopu/HV30_Modified_..._v1_1b_PAL.zip

Region Change firmware hack is here!

Our fearless leader has agreed to host the 'patched' firmware here at HV20.com. It's here! Follow this link to download:

Region Change Firmware Download link: http://hv20.info/yopu/HV30_Region_Hack_v1_0.zip

WARNINGS: For the moment, these firmware modifications are only known to work on the HV30. Attempting to install either on any other model might well brick your cam. These are non-factory-authorized, use-at-your-own risk, version 1.0 firmware modifications. Installing either may void your warranty. Be sure to carefully read and follow jollyrogerxp's instructions. You will also need to download the "official" HV30 firmware update from Canon.

These hacks may also work with the HV20, however there is a significant risk they may brick the camera. A partially-broken HV20 has been purchased from the hack fund for Jolly to experiment with.

BELOW IS THE OLD STATUS FROM FEB 2010:

Check the main thread, and 5.1) WIKI: http://chdk.wikia.com/wiki/HF10/100_Firmware_Analysis 5.2) WIKI: http://chdk.wikia.com/wiki/HV20 5.3) WIKI: http://chdk.wikia.com/wiki/HV30_Firmware_Analysis

Have you seen those new features that can be unlocked to some lumix cameras like Gx80 and Lx100 with web browser using the imgapp web protocol? This is the conversation: http://www.eoshd.com/comments/topic/24995-would-you-perhaps-be-interested-in-a-different-gx8085-colour-profile/

This is the web file for the browser: https://drive.google.com/file/d/0B10Ows_xNNgHQXNMLWpkZXNkQUE/view?usp=sharing

In my G80, when Option Availble request is send, this is the camera answer: https://drive.google.com/file/d/0B10Ows_xNNgHR3RDOHdCNUFqLXM/view?usp=sharing

You can see parts like this:

item enable="no" id="menu_item_id_ph_sty_vlog_l" option="detail"/

item enable="no" id="menu_item_id_v_quality_mp4ed_c24p_200mbps"/

Can a simple .html file unlock vlog or higher bitrates for free on Lumix G80?

Useful info:

ILCE-6000 Level 2 & 3 Service Manual Level 2 and 3 document is available on elecktrotanya.com

The quesion is: are there other languages somewhere deep inside the GM5 firmware? Is there any tiny chance to enable it, or add it by firmware hack?

Is there any information available about how famous PTool works? As far as I understand source code is not available? May be I can dedicate spare time to hack it myself, I just need something to start with.

Since this patches are all a bit dated, I wanted to know if I they would work well on a 170MBps or faster Sand Disk card, like a SanDisk SDXC 64Gb 170MBps or faster.

Thanks in advance

Have a nice weekend

Anyway, I found the amazing guide on this site (https://www.personal-view.com/faqs/sony-hack/languages) to help replace the camera language files. I was able to extract the firmware files (Funny enough Ive tried many versions of the fw-tool and none of them would extract the file, except the GUI one.) the extractor gave me the 4 files, one of which is the FDAT file the contains the actual firmware and as you can imagine the file is encrypted and thats where I am stuck now!

I realize it might be against the rules to ask for this, but any "tips" or direction on how to extract the fdat file would be highly appreciated? the guide says to google but I am afraid my google skills aren't as good as I thought they were. I apologize in advance if this is breaking any rules.

The .bin firmware you can download from Panasonic (https://av.jpn.support.panasonic.com/support/share2/eww/com/dsc/fts/zip/G9___V22.zip) has the "UPD " magic, followed by 8 bytes I couldn't associate, and then what seems like a product identifier "MC471" (MC = mirrorless camera?)

The interesting stuff starts at 0x2EC, where something which looks like a partition table starts. This section is 4884 bytes long (including some padding I believe) and contains 48 partitions which I managed to reverse engineer:

// 92 bytes - index entry of the partition listing struct partitionIndexEntry { char name[12]; // 12 bytes - name of the partition int offsetFile; // 4 bytes - offset in the firmware file int size; // 4 bytes - size of the partition int offsetMemory; // 4 bytes - offset in the memory on the camera int encryption; // 4 bytes - whether the partition is encrypted (0x3) or not (0x2) char checksum[32]; // 32 bytes - SHA-256 checksum of unencrypted partitions? char key[16]; // 16 bytes - encryption key?, if encryption == 0x3 char padding[16]; // 16 bytes - padding };

Reading that in in my custom C tool I've written for this logs out 48 partitions with their offset (in the firmware file, the real data starts at 0x1600) and size. I added automatic dd'ing so I now got 48 .bin files which are the extracted partitions out of the big firmware file. Adding all the sizes of the partitions together is also exactly the size of the original .bin minus the 0x1600/5120 bytes at the beginning which are the headers and partition table. You can download the extracted partition files here: https://drive.google.com/file/d/1P4681aZkRlCUuaiL10nH_En1g70iRLKS/view

Now, they obviously seem to be encrypted, and I haven't been able to figure out how. As you can see I was thinking whether the 16 byte long key in the partition index might be a key, because it's filled with zeros if encryption is 0x2.

This is my progress, I greatly appreciate any hints!

You can place here any your questions about this.

All detailed technical info during Z-CAM E2 research process will be posted here:

https://github.com/storyboardcreativity/Z-Camera-E2-Reverse-Engineering

Plans section

• Idea is to cover most if not all cameras in E2 lineup

Issues list

• Possible stop of all E2 production soon, see http://www.personal-view.com/talks/discussion/24341/z-cam-e2-cameras-lineup-production-can-suddenly-stop#Item_2

[VK - added structure a little]

GH1

• We want to allow to change some of the matrixes

Cameras without manual video modes

• Introduce manual video. Current idea is to inherit your stills settings upon pressing video record button.

All cameras

• New round of work considering film modes (or picture modes).
• Display of hack name in the version information screen.

P.S. Right now, and some time in August I am at the rest. :-)

Samsung NX500 / NX1 Mods

KS pack page and downloads:

https://www.facebook.com/NXKS2/

Otto team hacks pages:

• initial installer - https://github.com/ottokiksmaler/nx500_nx1_modding/tree/master/nx-on-wake
• hacks themselves - https://github.com/ottokiksmaler/nx500_nx1_modding/tree/master/video-bitrate-mods/nx-patch
• general - https://github.com/ottokiksmaler/nx500_nx1_modding

Firmware format info - https://sites.google.com/site/nxcryptophotography/diy-firmware

Developers menu access information - http://www.personal-view.com/faqs/samsung-hack/developers-menu

Samsung NX300 Open Source Hack

As most of you probably know, Samsung has released the source code for their NX300 camera. This camera produces an amazing picture, as good if not better than the GH2/3.

And here's the link to download the source code:

http://opensource.samsung.com/

Type "NX300" in the search box and you'll go to the download page.

The archive is 2.2 GB and it expands to 4.55 GB with 282,385 files in 16,329 folders. It's massive. I have no idea how to navigate through this thing. I hope somebody more knowledgable will take a look at it. In particular, where is the code for the H264 compression?

I would like to change the sensor coverage of the MJPG mode, but it's hard for me to find a way.

The patch i'm starting with is flowmotion 2. Sensor coverage is great on ex-tele combined with both "cinema 24P mode" and "HBR" mode. On MJPG and 720p the sensor coverage is smaller than the above, and this is what i'd like to fix.

What I'm trying to achieve, at the end, is a final result of film 3:2 aspect ratio 1920x1280 frame, possibly @24p or 25p.

Any suggestion?

thanks in advance

After you XOR everything with FF, you end up with something that is like the firmware of Panasonic cameras (UPD format):

UPD is the magic, CAYMN I assume is the codename of the camera, 0316 is the version of the firmware, 0200 the size of the first header, 0312E200 the size of the file without the first header, B5435A78 the checksum.

The firmware contains 22 sections:

• loader1
• loader2
• loader3
• program
• storage
• postboot1
• postboot2
• postboot3
• postboot4
• postboot5
• dram_sleep
• eep_ow_a
• eep_ow_b
• eep_adjfix
• history
• music
• osdover
• osddata
• koutei_kao
• eep_net_a
• eep_net_b
• welcom_fs

18 of which are encrypted. I haven't been able yet to figure out what encryption they use and how to decrypt them, hence this post.

There's an index section right after the second UPD header: I have figured out that:

• the first 12 bytes are the name of the section
• the next 4 bytes are the offset in the file
• the next 4 bytes are the size (I deduce there is no compression because the size corresponds to the size in this file)
• the next 4 bytes are the offset in memory
• the next 4 bytes are 02 if the section is not encrypted, 03 if encrypted
• the next 32 bytes are the SHA-256 checksum of the unencrypted section (the reason I came to this conclusion is that, since there are some sections that are unencrypted, I can see that their SHA-256 is equal to this)
• the next 16 bytes are some key (or initial vector) to decrypt the section (sections that are not encrypted have 0s)
• the last 16 bytes are 0s

By just applying AES-128 ECB decryption with the 16 bytes that are a key, I don't get to decrypt the sections.

I have also noticed that right before this UPD header there is a section starting with "leica" that contains 64 bytes that I cannot relate to any checksums: so maybe the encryption method combines those with the 16 bytes of each section in the index.

Has any of you encountered anything similar in the firmware of other cameras? Any hints about how to proceed in order to decrypt the 18 encrypted sections?

I am new here. I just bought an used GH2 in good condition. As the firmware on it is 1.0 (body) and I anyway wanted to try a hack, I just followed the instructions, downloaded latest firmware (1.2.) and the flowmotion hack. All in the same folder as PTool as well. Now PTool gives me the following message after selecting the Firmware GH2__V12file: "wrong file or trying to use already patched file".

No clue what is wrong and how to go ahead. Would be great to get some help here, thank you !

Best Lars

• QP step sizes table.
• Scaling tables just like in GH2.
• Min and Max QP.
• All intra turner.
• I-frame or somelike limit constant.
• Min frame size limit(works incorrectly)

Main problem is i can't control min bitrate, for example when shooting deep black scenes. There is steel error out after 3 sec shooting in such scenes. There is min frame size limit, i guess, i have found. But it's just increases last frame in 1-sec sequence. So need more and more testing.

Is it possible PTool could included compatibility for these models in the future?

I hope to start to work on hack soon.

https://www.personal-view.com/faqs/gh2-hack/ptool-software

1. You'll need to download firmware from http://panasonic.jp/support/global/cs/dsc/download/fts/index2.html

2. StreamParser by Chris Brandin as help tool to analyse AVCHD streams - https://www.personal-view.com/faqs/gh2-hack/ptool-software

   Other good idea is also use trial version of Elecard StremEye - http://www.elecard.com/en/download/products.html

3. Remember that Testers section patches are for testers. Use simple bitrate patches.

4. How can I make encoder hold better in low detailed scenes? Use Auto Quantizer patches.

5. How to update firmware:

   • Load your camera firmware, see 1. how to get it.
   • Check all necessary patches, Version increment must be always checked.
   • Save firmware. Just change last digit to any number you want.
   • Copy firmware to root of SD card. Fully charge you battery. Do not even attempt to use AC coupler!
   • Power off your camera if it was on.
   • Power on camera. After this press (not hold) green play button.
   • You'll see hourglass and prompt to update.
   • Press down arrow and after this Menu/set.
   • Wait until upgrade will be completed.

6. How to provide reports in this topic?

   • Post here only problems and questions about new patches. For all else we have special topics.
   • Use systematic approach (one-two changes at a time with careful thinking).
   • Shift-Click on round button in PTool to save your particular settings.
   • Attach here settings with detailed observation + MediaInfo screenshot + StreamParser screenshot in case of troubles.

7. Read FAQs at http://www.personal-view.com/faqs

8-999. Reserved.

Which patches do spanning in 24p , hbr30p and 720p60?

What settings in ini file makes spanning work?

Thanks!

Or do you recommend to change the presets? They told me with flow motion v2 should not then into the PC mounting apply the LUT cinemas because they are already applied flow of motion and then risvhia to ruin the colors, and all this true? thank you