Personal View site logo
Best gear deals, direct from factories - CatchIt deals and Special deals. Also check Cameras, lenses, software, gear deals.
You support is vital for us. To keep this place ad free and independent, select one of the options below.
Donations are going to project support costs and work (hosting, etc).
I am spending good amount of time on it and your support allows to improve and expand this site.
contribution size
Official Nikon Hacks, D7000, D7100, D3100, D3200, D5100, V1, V2, J1, D4, D800 and Nikon Tool
  • 330 Replies sorted by
  • @Georgester - nothing yet for the D5100, the tool is at this point only for experimentation.

  • @micah

    you are wrong again.

    the D800 is mechanically a complete different camera. they built it with a dedicated aperture drive motor.

    on the D7000, the aperture wheel in live view mode does NOT control the aperture in real time, it is just changing the aperture value on the screen which has to be enabled by turning the live view off so the mirror comes down, and turning live view back on, so the mirror mechanism will CHANGE and hold the aperture in position you have set in live view. as soon the mirror is up, the aperture can not be changed anymore.

    only the value on the live view screen is changing.

    not the actual aperture.

    you have to disable and enable the live view to use the set aperture

    also , aperture preview does only work when live view is not enabled. means the mirror has to be down for it to work. the aperture is set by the mirror mechanism as first step before the mirror even moves. the aperture preview stops right there, before it even actuates the mirror.
    the d7000 has 3 motors, 2 motors in the shutter mechanism, one for the mirror mechanism and aperture, one for the shutter curtain only. and a slow, quite noisy AF motor that is used to drive the focus on on older lenses without AF motor.

    i took a broken d7000 apart, and be assured, there is mechanically no way that the aperture could be changed dynamically in live view. you would need a complete different mechanism or in this case the new D800 which was made with video in mind, and being able to set aperture in live view

  • Dear Nikonian friends. I have tried in vain to find the D200_IMAGE_ADJ_01_25_06 (or newer) software and needs it really bad to refrech my old D200 from tuck pixels. Is there anyone here that actually got hold of the file and care to share it with me? I would be very grateful and happy if someone could help me with this! Please respond to marc.de.legion(at)gmail.com Best regards from a fellow Nikonian in Norway. /// Marc

  • Vitaly, I have a question regarding your ntool.exe: How exactly do you find all those JPEG files? Simply by searching for JPEG signature, like "FF D8 FF E0 00 10 4A 46 49 46 00" ? Or you happened to find some kind of a "master directory" inside firmware? I've found some, but it does not contains all the JPEGs that are inside..

  • @scev0la

    It uses special algorithm for extracting JPEG files. No directory inside exist.

  • @Vitaliy_Kiselev, Directory inside do exist (in fact, there's a lot of them), and btw you're storing into JPEG 1 extra byte at the very end of the file that does not belong there.

  • @scev0la

    How about sharing your info here?

    you're storing into JPEG 1 extra byte at the very end of the file that does not belong there.

    And? Right now tool is suitable for viewing only, so this small bug does not cause any problems.

  • @Vitaliy_Kiselev

    I'm just started digging into nikon's firmware, so it's 'a little bit of this, a little bit of that' - though I do have previous experience with embedded RE, so I know some tricks, but right now I'm just working out some very basic "vectors of development", so to say.

  • There are tables the refer to the jpg's, not all are table driven. For the D5100:

    JpgTableTypeA(0x054258, 0x054260);
    JpgTableTypeA(0x055de4, 0x055EEC);
    JpgTableTypeA(0x2A5898, 0x2A59F8);
    JpgTableTypeA(0x2a66D8, 0x2A6770);
    JpgTableTypeA(0x7c5a34, 0x7c6254);
    JpgTableTypeB(0x38e7b0, 0x38e8d0);
    JpgTableTypeC(0x38e8d0, 0x38E998);
    JpgTableTypeD(0x392F90, 0x393320);
    

    were:

    JpgTableTypeA is 8 byte block, {pointer, length}
    JpgTableTypeB is 12 byte block, {dummy, pointer, length}
    JpgTableTypeC is 20 byte block, {dummy, pointer, length, dummy, dummy}
    JpgTableTypeD is 16 byte block, {pointer, length, dummy, dummy}
    

    And then there are some left over jpegs:

    MakeJpeg(0x8A6B4B, 0x22FE);
    MakeJpeg(0x8A8E49, 0x2661);
    MakeJpeg(0x8AB4AA, 0x2C66);
    MakeJpeg(0x8B0FD7, 0xE6C);
    MakeJpeg(0x8B1E43, 0x1680);
    MakeJpeg(0x8B34C3, 0x181C);
    MakeJpeg(0x8B4CDF, 0xDB2);  
    MakeJpeg(0x8B5A91, 4280);
    MakeJpeg(0x8BEAAD, 0xECB);
    MakeJpeg(0x8BF978, 0x155F);
    MakeJpeg(0x8C0ED7, 0xFEC);
    MakeJpeg(0x8C1EC3, 0x1103);
    MakeJpeg(0x8C2FC6, 0x10dE);
    MakeJpeg(0x8C53FF, 5049);
    MakeJpeg(0x8C8235, 0xCF4);
    MakeJpeg(0x8E7930, 0xE44);
    MakeJpeg(0x8E8774, 0x162E);
    MakeJpeg(0x8E9DA2, 5801);
    MakeJpeg(0x8EB44B, 3224);
    MakeJpeg(0x8EC0E3, 0x122E);
    MakeJpeg(0x8ED311, 4820);
    MakeJpeg(0x8EE5E5, 0x12E7);
    MakeJpeg(0x8EF8CC, 4451);
    MakeJpeg(0x8F0A2F, 6335);
    MakeJpeg(0x8F22EE, 4733);
    MakeJpeg(0x8F356B, 0xE7D);
    MakeJpeg(0x8F43E8, 6595 );
    MakeJpeg(0x8F5DAB, 0x1E7C);
    MakeJpeg(0x8F7C27, 0xFBC);
    MakeJpeg(0x8F8BE3, 5284 );
    MakeJpeg(0x8FFDD9, 0xF07);
    MakeJpeg(0x900CE0, 0x16E0);
    MakeJpeg(0x9023C0, 0x100C);
    MakeJpeg(0x9033CC, 5772 );
    MakeJpeg(0x904A58, 0x117F);
    MakeJpeg(0x905BD7, 0xB8B);
    MakeJpeg(0x906762, 0xC03);
    MakeJpeg(0x907365, 0x1994);
    

    The addresses are all memory space, not file space references

  • @swfree

    I hate to burst your bubble, but: www.youtube.com/watch?v=iwDYKENnUis

    In the video, I'm using the aperture ring on an AF35/2 lens. When custom setting F6/aperture ring is set to "off", the aperture can be adjusted with the aperture ring on a lens that has cpu. This works even during live view and video. On a lens with an aperture ring and no cpu, this is the default regardless of the setting.

    The actuator (the 4.1 arm in Nikon tech parlance) may be software locked, but it is not hardware locked. This is an important distinction to make, since we are talking about software hacks here. So yes, it is very likely that aperture control during live view or video can be enabled with a hack.

    In closing, thanks for all the hard work of the people who are attempting this hack, and please disregard the nay-sayers like swfree, who think it can't be done.

    -Micah

  • @Micah

    dont worry, there is no bubble to burst.

    you are using a manual aperture lens in that video, the actuator lever on the D7000 is spring loaded, alowing it to get pushed back when the aperture lever on the lens is pushing against it so the camera gearbox would not be damaged. it is locked in place, but connected to a spring alowing it to get out of the way when pushed by outside force. it cant move on its own once the mirror is locked up.

    of course it is true that the cpu in the lens is transferring the information to the camera so it shows up on the screen or in the viewfinder, but that is just outgoing info from the lens,

    this aperture data readout even works on manual aperture lenses without cpu. the D7000 has this little movable notch on the bayonet mount, just a little bit above the white dot you use to line up the bayonet when attaching a lens, which is pushed by the aperture ring on non cpu lenses when you twist it, telling the camera what aperture is set right now.

    thats why you set your lens aperture to the smallest setting when attaching your lens or that notch would not be operated correctly when turning the aperture ring. the cpu in the lens, or the notch for non cpu lenses are PASSIVE read out instruments. it has nothing to do with the camera actually operating the aperture.

    i am talking about G lenses without aperture ring, which have to be set by the front dial below the shutter. these lenses are using a slap aperture lever,which is operated by the camera, it has to be set and slapped by the mirror mechanism. take your D7000 apart and see for yourself, its connected to the same motor drive as the mirror. im not naysaying here, im just pointing out the facts.

    grab yourself a G Lens, go to aperture priority mode in live view, because in manual it will do nothing at all with the aperture , and try to set the aperture in live view using the front dial, you will notice it does not change the aperture when you look into your lens , until you turn off and turn on live view again.

    the reason for that ive stated in my previous post, you will see the exact same behavior, which is connected to the same reasons ive already posted, but let me explain it again, just for you.

    nikon is using a mechanical lever for controlling the lens aperture diaphragm on G lenses, and manual aperture lenses with CPU which have a aperture lever. Canon and Olympus DSLRs and all mirrorless cameras use electrical contacts and in-lens motors for this.

    the most simple and cheap implementation of the mechanical aperture lever is by a mechanical coupling with the mirror mechanism. live view is obtained in these cameras using the same sequence as when taking a picture. OK, the D3100, D7000 and D5100 have the means of keeping the mirror locked up during live view shooting, but the rest of the mechanics are working like during regular shooting.

    you can see the aperture lever slap on the left side of the mount going up and down, operating the aperture with each gear cycle of the mirror

    the sequence when entering live view is:

    1. aperture is stopped down to the shooting value, mirror is up, (like when taking a picture)
    2. first curtain of the shutter travels down

    suppose now that you want to set a different aperture value to the one set before entering live view. you cannot vary the aperture during the taking of a picture with these cameras. the mechanical lever does not have a separate motor, it must wait for a new mirror & shutter gearing cycle. that means completing the cycle, i.e. closing the second shutter curtain and taking a shot, which is in fact almost the same thing as exiting and re-entering live view. you can see the aperture control lever moving only during these steps.

    so, even if the mirror is kept up in LV, the aperture is behaving like during normal shooting, showing that the rest of the mechanical connections are well in place.

    when taking a picture in LV the sequence is: 0. (mirror is already up, the aperture is already stopped down.) 1. shutter closes (second curtain travels down)

    1. aperture opens all the way (like you have taken a shot and you need to look in the OVF between shots) - now the shutter is re-cocked

    2. aperture closes back down. (now it will close at the value set previously when in LV)

    3. shutter opens and closes.
    4. aperture opens all the way back up (again)
    5. aperture closes back down.
    6. shutter opens, live view resumes.

    the only Nikons that can vary the aperture in live view are the Nikon D3 family; the brand new D4 and D800. These more expensive cameras have a separate electromagnetic actuator for the mechanical lever.

    on the D7000 this is not a software lock, it is a mechanical limitation.

  • Ok, leaving the technicals of can it be done or not, but...

    why would you want to change aperture while filming? Or is all the debate over changing aperture between takes, and not wanting to have to flip in/out of live view?

  • @Simeon

    i guess its all about not having to turn off and turn back on live view. like having a real time preview of the changes. i haven't seen the necessity yet to be able to change the aperture electronically on the fly while filming, it just looks bad, cant imagine what it would be good for. i still say if you want to be serious about filming you buy non G , fully manual lenses.

    you wont use auto focus while filming anyways.

    changing aperture is easier.

    and the build/image quality is mostly better.

  • ...my final word on this, and the case that proves my point: aperture preview. ; D

    Ever see the mirror more during aperture preview? No, because they aren't mechanically coupled. I understand why you think they are, because of their behaviour, they do generally act together. But that's like saying you can't have your left and right turn signals on, because the stalk only goes one way at a time. In fact, it's electronic and the hazard blinker will put them all on. But if you don't know about the hazard button, you probably imagine it can't be done. You just need to know how. That's what Simeon and company are doing right now. They're making good progress, and I (and I'm sure others) would appreciate keeping the confused speculation to a minimum.

    (And for the record, I've taken apart plenty SLRs and DSLRs, and I know how the mechanism in Nikon's works, thank you very much.)

    Yes, the new Nikons allow "smooth" aperture changes. By "smooth" them don't mean a continuous spectrum, they mean that they transition slowly and smoothly from one aperture to the next. In situation where lighting can't be controlled 100% (moving between indoor and outdoor light in the same cut) it can be very useful.

    Cine lenses are purely mechanical aperture adjustment at the lens, but they have no click stops.

  • you dont read my posts do you? or is it just hard to comprehend what you read? not sure if trollan....

    aperture preview with the live view turned off works because the mirror drive isnt fully cycling, it only does one step forward, and back again. its more of a hack done by nikon engineers to add this feature and save money. as soon the mirror is locked up this wont work anymore because the motor has to hold actively the mirror in place. this is why you have to fully charge your cameras battery when you do a sensor cleaning, so the motor has enough juice to hold the springloaded mirror in place for the whole time

    aperture preview does not work in live view because the mirror is locked up, and you need a full gear cycle of the mirror gear box to cock the aperture actuator again.

    i even made you that video to demonstrate the aperture preview behavior without and with live view.

    you just like to believe in wizardry, and that some hack would materialize a 300$ electromagnetic linear stepper motor in front of the mirror box, when theres even no room for one.

    the d7000 is so densely packed , they just managed to cram the shutter curtain release drive, image

    and a mirror box motor into the body, other cameras mostly dont even have a dedicated shutter release motor, doing all of the operation with the mirror box drive. image

    the rest of the free space is occupied by the relatively big dedicated screwdriver motor and its gearbox to focus AF lenses, image

    and there is one more electromagnetic solenoid on top of the body, visible when you take off the top ,which is used to actuate the black hook to release the pop up flash. image image


    here is a pic of the mirror/aperture actuation mechanism located on the right side of the mirror box. the side facing right is the front. image

    ;the blue arrow points at the central pivot mount, the whole mechanism rocks around that.

    ;the red circle marks the spot where the gearbox of the mirror drive motor hooks into, moving that lever forward and back again.

    ;the yellow arrow points at the mirror hinge spring, the hinge itself is surrounded by that chrome spring above, forming the brake assembly.

    ;the pink dot marks the contact point of the mirror to the yellow mirror pusher connected to the center pivot. the mirror pusher will only move if the gearbox coupling will move all the way. a quarter cycle will only actuate the aperture

    ;the green transparent bar is covering the aperture actuator lever pusher, not the lever itself, it is covered by the lens mount frame. the whole assembly is vertically covered by the mirror drive motor, with its gearbox at the bottom

    there is nothing more to that. its a simple, reliable, compact and cheap mechanism, used by nikon since decades, even before digital cameras.

    only d3´s , d4´s and the d800 got gifted by nikon with a relatively expensive electromagnetic high speed precision actuator and a redesigned mirrorbox which r&d costs are partly reflecting in the prices of these units

    but since im throwing facts against your believes wall here, i see no point discussing this with you anymore.

    mirrorlinkage1.jpg
    628 x 555 - 110K
    mirror motor.jpg
    736 x 447 - 117K
    AF motorgearbox.jpg
    480 x 353 - 74K
    solenoid flash hook.jpg
    634 x 428 - 80K
    shutter motor.jpg
    458 x 217 - 57K
    solenoid.jpg
    668 x 363 - 158K
  • @SWFree: I'm sorry, I lied--that wasn't my final word. ; )

    To quote you "as soon the mirror is up, the aperture can not be changed anymore."

    In the first part of the video, the aperture is changed while the mirror remains up. By taking a couple shots, live view is stopped and restarted, but the mirror is remaining in place while the aperture arm is starting at one setting and stopping at another. This is a software determined process and limitation.

    The second part shows that the aperture arm is indeed moving around while the mirror is static, locked in the up position. Proof the mirror is up and the aperture is changed, contrary to your statement(s) above.

    And to disprove that the motor is what's holding the mirror in place, try this: 1) Remove the lens/body cap of your camera to observe. 2) Enter live view. 3) Remove the battery. 4) Be astonished when the mirror doesn't drop. 5) Pop the battery back in and press the shutter button to get the mirror and aperture arm back in place so you don't break anything. 6) Remove foot from mouth.

    Sure, you are probably right that they are moved by the same motor, but once up, a different solenoid or other mechanical component is holding the mirror, and the aperture arm is free to move however software tells it to, until live view is ended. The mirror is indeed raised by a motor, and returned by a spring, but for battery savings, there is a separate mechanical lock.

    I don't doubt that such a change in behaviour would take a significant coding effort. But I stand by my assertion that it is at least mechanically possible.

    Cheers. -Micah

  • image


    I made tool aimed at end users.

    http://www.gh1-hack.info/ntool2.zip

    Unlike previous tool, it uses full fledged PTool engine and easy to run on Mac also (using Wine or WineBottler).

    Based on some work by Simeon.

    Version history

    v2.0a

    • Added support for D7000 v1.03 (video limit and text patch).
    • Added support for D3100 v1.01 (video limit and text patch).
    • Added support for D5100 v1.01 (video limit and text patch).
    • Added support for J1 v1.11 (only text patch).
    • Added support for V1 v1.11 (only text patch).
  • i found this video limit patch for the d7000 what does "added support" mean? what is this video limit? recording time, or quality setting? is it already a working release, or just a preparation of the hack to support these patches as soon they are working? how likely is it to brick my cameras with it? and what are text patches? so many questions..

  • @Moose

    How about download firmware, NTool and look at the hints?

    Otherwise most questions are quite strange.

  • i do not dare to.. i might be tempted to try something reckless with it :D

  • This is starting to become an exciting thread.

  • @Vitaliy_Kiselev Thanks for updating NTool to v2.0! When saving patched firmware, what are the rules for altering the file name?

  • When saving patched firmware, what are the rules for altering the file name?

    Build in rules allow to change version part of the file name only.
    You can try and play with it.

  • how about a step by step guide for how to use this hack? :)