Hacks News and Development

Pentax (Fujitsu FR) hacking

Preyr — Tue, 31 May 2016 15:33:22 +0000

I am trying to start reverse engineering the Pentax firmware. I have already got some clue but i have questions which you probably may help me with.

1) Does there exist any FR-V instruction manual at all? I could find "disassemble" command in Softune manual but I cannot find any programming manual for FR-V at all, even for FR400 board which seems to be FR-V based. Even if I can disassemble code, I will stugle to read it.

2) Can I disassemble FR-V code with IDA Pro (5.0)? It seems to me that I can't.

3) How do I know entry point without any processor user manual? I do not know how an entry point looks like. - My guess is: I probably should convert all data into code and check out all positions which do not accept any jumps.

4) How do I know base address in RAM? - My guess is: I probably should count occurencies of all bytes in every alignes uint32_t (assuming that there might be addresses stored somewhere) and plot them ti see any fluctuations.

5) Does IDA 5.0 Pro Free has scripting support?

6) Which firmware should have bigger size: for DSP or for CPU? Which firmware should contain strings: one for DSP or one for CPU? I have dumped firmware using debug mode but the bigger file has "DSP" in it and also contains strings.

New Sony A7 series source code enabling access to whole OS?

vroem — Mon, 19 Oct 2015 03:45:54 +0000

A few days ago @nabfathi15 published a chunk of source code on his twitter account that can allegedly be used to develop custom software on a whole bunch of recent Sony cameras: the A7S, A7S II, A7R, A7RII, A6000, RX100M3 and others. He says that this code provides low level access to the entire camera.

Is there anyone out here with java skills and a Sony camera to verify this?

The Source Code info.rtf file reads:

App Source Code include

Sony Imaging Source Code

Sony Base Source Code

Sony FW Source Code

Sony TimeLapse Example Source Code

Sony AVI Source Code (Use by TimeLapse App Example)

Sony Util Source Code.

This is not 100% Source Code of the Sony Camera System
This is at least 80%.
I will release other alternative Source Code.

Why this is helpful ?

Anyone who have a experience in Java/Android Coding can build a application based on the actual source code
This give you the possibility to call specific function of the camera.
You can control the entire camera and even build third party control.
AVI source code is a good example of what is possible to do.

The last few weeks I discover how to reverse engine the system.
How to gain access by injecting code and bypass root permission problem.
I’ve been able to dump important information about the system.

To let you know, that source code has nothing to do with the PlayMemories camera remote API SDK.
The Camera remote SDK provide only a way to control your camera remotely not to gain low-level control or build strong app etc…
Sony will never share the source code of their system layer, because they are needed to make important app for your Camera and this will be problematic, anyone could control the camera in a high advanced way.

I’m going to repeat, the source code I share is bigger than you think, far more bigger than what was release recently, because it include all the boot process, layer control, dsp/soc control, etc… that give the capability to the play memories app to gain low-level access and third party control.
Again you can build third party app based on the actual source code and make something really big of it.

Right now I’m finding how to flash the firmware by using a SD Card in a certain service mode (something I share on Olympus camera in the past). But with this big open source code, it is completely useless, you can even install apk directly from the SD Card without the need of PMCA anymore, you only need to build an Android app for that and place your apk on SD card.

Few problem with the Sony System.

Sony can block that by removing in the future play memories access or restrict completely.

Sony can release a firmware and block everything

You mostly need to respect what have on the source code and limit your application to specific priority, also work under GB SDK.

When you reset the camera, you lost the application.

At the moment, you will need to install the APK using the PMCA website. https://sony-pmca.appspot.com (mostly work with IE explorer, main problem with other browser is that they disable the NPAPI function) but you can try. Here’s the source code of PMCA by ma1co https://github.com/ma1co/Sony-PMCA-RE

Basically you have class/string for certain function of the camera
XAVCS4K for example -> public static final int XAVC_S_4K = 2130772533;
This is just a example, I’m not going to explain the entire source code.

Camera compatible ?

Basically almost all the play memories camera, including a6000.
RX100M3, etc…

Do want you want to do with the source code, have more to come, I have confirmation that one sure coder build a android app based on this that will offer extra features.

Enjoy and be creative.
I’m done with Sony Camera.
Nab

Official GF3 hack development topic

Vitaliy_Kiselev — Wed, 18 Jan 2012 04:47:33 +0000

I got GF3 body, so, I am making this topic.

Right now it'll be closed. I'll open it after I get dumping results in about a week.

Official GH2 "Stalin" hack development topic

Vitaliy_Kiselev — Wed, 04 May 2011 08:07:04 +0000

As we moved from dumping to reversing this topic will containg actual info and discussions.

First good news. It looks like all video related setup routines in GH2 work in RAM, instead of ROM for older models.

Official Nikon Hacks, D7000, D7100, D3100, D3200, D5100, V1, V2, J1, D4, D800 and Nikon Tool

Vitaliy_Kiselev — Sat, 19 Nov 2011 00:16:08 +0000

I made tool aimed at end users.

Click here for download.

It uses full fledged PTool engine and easy to run on Mac and Linux also (using Wine or WineBottler).

Version history

v2.55, 14 June 2013

* Added battery patch for D3200 v1.01.
* Added support for Nikon J1 v1.30 (only text patch).
* Added support for Nikon J2 v1.10 (only text patch).
* Added support for Nikon J3 v1.10 (only text patch).
* Added support for Nikon V1 v1.30 (only text patch).
* Added support for Nikon V2 v1.10 (only text patch).
* Added support for Nikon S1 v1.10 (only text patch).

v2.50a, 27 May 2013

* Added support and patches for D7000 v1.04.
* Added support and patches for D3200 v1.01.
* Added patches for D3100 v1.01.
* Added patches for D5100 v1.01.
* Added support for D600 v1.01 (only text patch).
* Added support for D800 v1.02 (only text patch).
* Added support for D800E v1.02 (only text patch).
* Added support for Nikon J1 v1.20 (only text patch).
* Added support for Nikon V1 v1.21 (only text patch).

v2.00a

* Added support for D7000 v1.03 (video limit and text patch).
* Added support for D3100 v1.01 (video limit and text patch).
* Added support for D5100 v1.01 (video limit and text patch).
* Added support for J1 v1.11 (only text patch).
* Added support for V1 v1.11 (only text patch).

P.S. Many patches originally made by S. Pilgrim.

lpowel reliable in camera playback not playing back in camera

disease8 — Thu, 13 Nov 2014 02:55:32 +0000

Hi I recently got the gf1 and have applied the lpowell reliable in camera playback, but I do not get reliable camera playback. It says error and stops playing, it seems this happens when there is a lot of light or a lot going on in the screen. I don't see how this could be the read speed of the card though because the Transcend card I have it way over the 35mbits read speed of the mjpeg bitrate... Am I doing anything wrong? Can I tweak the settings in ptool to give more reliable playback?

Official G3 hack development topic

Vitaliy_Kiselev — Mon, 21 May 2012 01:24:16 +0000

Got the dump. All looks perfect.

I'll start to work on hack soon.

P.S. remember to support our project, as due to your constant support this place is possible.

G2 Hack Development

producer — Tue, 03 May 2011 02:55:05 +0000

Hi,
Is G2 hack development available about 4:2:2 and 1080p?

Collecting for GH3 and FZ200

Vitaliy_Kiselev — Wed, 26 Sep 2012 14:43:01 +0000

As Photokina is over, and all donations collected went to our team already, we are starting collecting money towards two cameras.

Best mirrorless upcoming camera, and best existing ultrazoom.

Disclaimer.
This projects can be quite long shot, as it was in case of GH2.
As it is completely new cameras, new hardware and many other new things.

So, check proper option and click button on top.

Development status topic

Vitaliy_Kiselev — Tue, 16 Apr 2013 22:02:27 +0000

Status as of Aufust, 2013

GH3 - working on making dump
FZ200 - some work done, but needs public firmware for PTool patches development
LX7 - some work done, but needs public firmware for PTool patches development
GF5 - some work done, but needs public firmware for PTool patches development
GH2 - small fixes in video patches, understanding film modes - working on it
GX1 - needs some fixes in MP4 side, manual video modes - working on it
G3 - same as GX1
G5 - in plans, firmware available.
G6 - in plans, firmware available.
GF6 - in plans, firmware available.

P.S. I'll try to keep it in updated state and will add more detail

ST: MJPEG Encoder team

Vitaliy_Kiselev — Fri, 12 Aug 2011 17:05:32 +0000

This one is easy.

Anyone with systematic approach can participate.

I need very stable MJPEG settings (for table) from default bitrate up to highest possible (4-5 steps):
a) 720p mode
b) 720p upscaled to 1080p
c) 720p upscaled anamorphic
d) 480p upscaled
e) 480p upscaled anamorphic

CHDK-Like Motion Detection Possible on GH2?

ragnar — Thu, 07 Mar 2013 23:59:46 +0000

I've been experimenting and using the motion detection scripts from the Canon CHDK hack on my Canon S100 and from what I've done it looks like it's going to come in real handy for set-and-forget bird photography, which is what I mostly do. It made me wonder if such a motion detection parameter might be possible in the GH2 hack? It's been fun going into the various motion.bas scripts and turning on/off masking areas of the screen and changing the sensitivity of the motion detection so it got me thinking of doing the same with my GH2? Possible? No? Yes? Hope so, but I probably would have heard about it by now.

I did do a search of the term 'motion detection' but only found one incidence which was a request for it in the coming GH3 hack.

Thanks, Harold House

Diary Of An x264 Developer

Ralph_B — Sun, 23 Dec 2012 12:10:24 +0000

I stumbled onto this site. Highly technical, but interesting for people working with H264.

http://x264dev.multimedia.cx/archives/472

http://x264dev.multimedia.cx/archives/458

Pro: AVCHD Quantization process

Vitaliy_Kiselev — Sun, 10 Jul 2011 11:03:25 +0000

As we are moving deeper I am making this topic to talk about some AVCHD encoder things.

It is about QStep table (52 elements table each [i+6] item is doubled compared to [i] item).
As I am looking at this table in GH2 video encoder code.
I want to complety understand its role in quanization.

Useful links:
http://www.vcodex.com/files/h264_transform.pdf
http://www.vcodex.com/files/H264_4x4_transform_whitepaper_Apr09.pdf
http://www.addpac.com/addpac_eng2/down.php?file=267_f11.pdf
http://www.amazon.com/MPEG-Handbook-Second-John-Watkinson/dp/024080578X/ref=sr_1_1?ie=UTF8&qid=1310313414&sr=8-1
http://www.amazon.com/H-264-Advanced-Video-Compression-Standard/dp/0470516925/ref=sr_1_1?ie=UTF8&qid=1310313609&sr=8-1
http://www.amazon.com/H-264-MPEG-4-Video-Compression-Generation/dp/0470848375/ref=sr_1_2?ie=UTF8&qid=1310313609&sr=8-2

Do not post there if you do not understand that it is about.
Any stupid questions will be deleted instantly.
Otherwise any info from knowledgeable people are welcome.

PTool v3.65d topic

Vitaliy_Kiselev — Wed, 28 Mar 2012 10:34:44 +0000

PTool v3.65d released

https://www.personal-view.com/faqs/gh2-hack/ptool-software

You'll need to download firmware from http://panasonic.jp/support/global/cs/dsc/download/fts/index2.html
StreamParser by Chris Brandin as help tool to analyse AVCHD streams - https://www.personal-view.com/faqs/gh2-hack/ptool-software

Other good idea is also use trial version of Elecard StremEye - http://www.elecard.com/en/download/products.html
Remember that Testers section patches are for testers. Use simple bitrate patches.
How can I make encoder hold better in low detailed scenes? Use Auto Quantizer patches.
How to update firmware:
- Load your camera firmware, see 1. how to get it.
- Check all necessary patches, Version increment must be always checked.
- Save firmware. Just change last digit to any number you want.
- Copy firmware to root of SD card. Fully charge you battery. Do not even attempt to use AC coupler!
- Power off your camera if it was on.
- Power on camera. After this press (not hold) green play button.
- You'll see hourglass and prompt to update.
- Press down arrow and after this Menu/set.
- Wait until upgrade will be completed.
How to provide reports in this topic?
- Post here only problems and questions about new patches. For all else we have special topics.
- Use systematic approach (one-two changes at a time with careful thinking).
- Shift-Click on round button in PTool to save your particular settings.
- Attach here settings with detailed observation + MediaInfo screenshot + StreamParser screenshot in case of troubles.
Read FAQs at http://www.personal-view.com/faqs

8-999. Reserved.

Collecting for G3 and GX1

Vitaliy_Kiselev — Tue, 13 Mar 2012 16:20:19 +0000

We started collecting donations for G3 and GX1 bodies.

As usual, use donation button above, and remember add "GX1-G3" to payment comment.

Official GH1 "Lenin" Hack Project Discussion

Vitaliy_Kiselev — Tue, 19 Apr 2011 01:37:46 +0000

Current Status:

1. We are collecting money to get two unhackable bodies.
2. As soon as cameras will be available we'll dump firmware image.

Expected results:

1. Ability to flash new firmware with hacks.

PTool v3.64d topic

Vitaliy_Kiselev — Sat, 18 Feb 2012 13:10:15 +0000

PTool v3.64d released

https://www.personal-view.com/faqs/gh2-hack/ptool-software

You'll need to download firmware from http://panasonic.jp/support/global/cs/dsc/download/fts/index2.html
StreamParser by Chris Brandin as help tool to analyse AVCHD streams - https://www.personal-view.com/faqs/gh2-hack/ptool-software

Other good idea is also use trial version of Elecard StremEye - http://www.elecard.com/en/download/products.html
Remember that Testers section patches are for testers. Use simple bitrate patches.
How can I make encoder hold better in low detailed scenes? Use Auto Quantizer patches.
How to update firmware:
- Load your camera firmware, see 1. how to get it.
- Check all necessary patches, Version increment must be always checked.
- Save firmware. Just change last digit to any number you want.
- Copy firmware to root of SD card. Fully charge you battery. Do not even attempt to use AC coupler!
- Power off your camera if it was on.
- Power on camera. After this press (not hold) green play button.
- You'll see hourglass and prompt to update.
- Press down arrow and after this Menu/set.
- Wait until upgrade will be completed.
How to provide reports in this topic?
- Post here only problems and questions about new patches. For all else we have special topics.
- Use systematic approach (one-two changes at a time with careful thinking).
- Shift-Click on round button in PTool to save your particular settings.
- Attach here settings with detailed observation + MediaInfo screenshot + StreamParser screenshot in case of troubles.
Read FAQs at http://www.personal-view.com/faqs

8-999. Reserved.

Possible StreamParser update to help with Macs

cbrandin — Mon, 25 Jul 2011 13:05:05 +0000

I've noticed that there are several people who would like to run StreamParser on a Mac. I don't really have the time to re-write for a Mac, but there is something else I might be able to do.

The main reason .NET 4 is used is for the video player panel. I could do a version of StreamParser that has that feature removed and is compiled with an earlier version of .NET.

I need to know a couple of things, though. First of all, is anybody interested? Second, what is the latest version of .NET that works well with the various Windows virtual machines/emulators available for Macs?

Chris

Pro: GH2 AVCHD encoder settings

dkitsov — Tue, 05 Jul 2011 17:52:38 +0000

This topic is for testing patches residing in testers section.
Carefully and systematically.

Patches for testers>AVCHD movie mode>AVCHD research>Encoder setting 1 1080i/p when value changed from Original 3 to Modified 2 there are no b-frames encoded into the AVCHD stream.

PTool v3.63d topic

Vitaliy_Kiselev — Sun, 06 Nov 2011 18:34:41 +0000

PTool v3.63d released

https://www.personal-view.com/faqs/gh2-hack/ptool-software

1. You'll need this base firmware:
http://www.personal-view.com/talks/discussion/330/new-gh2-firmware-leak

2. StreamParser by Chris Brandin as help tool to analyse AVCHD streams -
https://www.personal-view.com/faqs/gh2-hack/ptool-software

Other good idea is also use trial version of Elecard StremEye - http://www.elecard.com/en/download/products.html

3. Remember that Testers section patches are for testers. Use simple bitrate patches.

4. How can I make encoder hold better in low detailed scenes?
Use Auto Quantizer patches.

5. How to update firmware:
a. Load GH2 1.0E firmware, see 1. how to get it.
b. Check all necessary patches, Version increment must be always checked.
c. Save firmware. Just change last digit to any number you want.
d. Copy firmware to root of SD card. Fully charge you battery. Do not even attempt to use AC coupler!
e. Power off your camera if it was on.
f. Power on camera. After this press (not hold) green play button.
g. You'll see hourglass and prompt to update.
h. Press down arrow and after this Menu/set.
i. Wait until upgrade will be completed.

6. How to privide reports in this topic?
0. Post here only problems and questions about new patches. For all else we have special topics.
a. Use systematic approach (one-two changes at a time with careful thinking).
b. Shift-Click on round button in PTool to save your particular settings.
c. Paste here settings with detailed observation + MediaInfo screenshot + StreamAnalizer screenshot.

7. If anyone wants to share uncompressed video - you can use http://www.pipebytes.com/ or http://www.sendoid.com/ to instantly share very large files.
Of course you need good connection as it uses p2p tech.

8-999. Reserved.

JPEG estimator and quantization

Vitaliy_Kiselev — Thu, 25 Aug 2011 18:29:59 +0000

New interesting article about company

Q: How does the JPEG format works?

A: JPEG is a lossy compression, meaning that any JPEG compression involves some loss of information. The compression consists of several steps:

•Color space transformation from RGB to YCBCR
•Reducing the spatial resolution of the CB and CR components by a factor of 2 in the horizontal axis, or both in the horizontal and the vertical axis (this step is optional).
•Dividing each color components to blocks of 8×8 pixels.
•Transforming each 8×8 block to the frequency domain using a DCT transform.
•Quantization (reduction of precision by representation with a lower number of bits) of each of the frequency components using a quantization matrix. This is the main stage that causes loss of information.
•Entropy coding (a lossless compression, similar to ZIP) on the frequency components which have undergone quantization.

Q: Is saving an image in Photoshop in minimum JPEG compression (i.e. 12) lossless?

A: Even at quality 12, the Photoshop quantization matrix has values which are greater than 1, so the precision of some of the frequency components is reduced, meaning that some information is lost (you can view the quantization matrixes for Photoshop’s quality 12 here).

Actually, even when using a quantization matrix that has all values set to 1, there is a loss of quality due to the DCT transform and the conversion from floating point values to integer values.

Read the rest at: http://www.megapixel.co.il/english/archive/21907

Other interesting read on JPEGSnoop author page:

http://www.impulseadventure.com/photo/jpeg-quantization.html

http://www.impulseadventure.com/photo/jpeg-huffman-coding.html

ST: AVCHD Encoder team

Vitaliy_Kiselev — Wed, 10 Aug 2011 05:19:09 +0000

This topic is made to form AVCHD focused strike team (we'll have also HDMI team and few others).

Who is strike team member:
1) First, it is very systematic tester, doing all tests accordingly to the provided list in time.
2) Second, all team members will have access to prerelease beta versions.
3) Third, prior testing expirience is required.
4) Forth, strike team members are responsible for making recommended settings before release.

You can apply below.

Samsung camcoders source code

humpman — Fri, 07 Oct 2011 17:11:56 +0000

Links:
http://www.samsung.com/global/cam_opensource/
https://opensource.samsung.com/

Source includes:
image (folder with firmware, ready to flash)
busybox-1.2.1.tar.gz
glib-2.12.9.tar.gz
glibc-2.3.3.tgz
gstreamer_plugin.zip
gstreamer-0.10.11.tar.gz
linux-2.6.17.tar.gz
mp4parser.tar.gz
ramdisk_mp4.tar.gz

Most all samsung written stuff is here linux-2.6.17\kernel_source\nike_test\drivers\s5c73xx

All parts could flash separately (from manual):
3.2 Kernel Update
1. Prepare SD or SDHC card for firmware updating. (Available capacity of SD or SDHC card : 1G ~ 32G)
2. Copy arch/arm/boot/Image to root directory of SD-Card. (Be careful the name of kernel should be 'Image')
3. Turn on the set with AC adaptor and insert SD card.
4. If your set includes internal memory, you can see the message Ў°Change Storage to CardЎ±.
Select Ў°YesЎ±
5. You can seed the message "Update Kernel"
6. Select Ў°YesЎ± to proceed updating.
7. Updating is over, the set turns off automatically.

Some code of jpeg photo mode:

const unsigned char QuantizerTable0[3][64] =
{
{ // Lossless
1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1,
1, 1, 1, 1, 1, 1, 1, 1
/*
// super fine
1, 1, 1, 1, 1, 1, 2, 2,
1, 1, 1, 1, 1, 2, 2, 2,
1, 1, 1, 1, 1, 2, 2, 2,
1, 1, 1, 1, 2, 3, 3, 2,
1, 1, 1, 2, 2, 4, 4, 3,
1, 1, 2, 2, 3, 4, 4, 3,
2, 2, 3, 3, 4, 5, 5, 4,
3, 3, 3, 4, 4, 4, 4, 4
*/
},
{ // fine
1, 2, 2, 3, 5, 9, 11, 13,
2, 2, 3, 4, 5, 13, 13, 12,
3, 2, 3, 5, 9, 12, 15, 12,
3, 3, 4, 6, 11, 19, 18, 14,
4, 4, 8, 12, 15, 24, 23, 17,
5, 7, 12, 14, 18, 23, 25, 20,
11, 14, 17, 19, 23, 27, 27, 22,
16, 20, 21, 22, 25, 22, 23, 22
},
{ // normal
1, 8, 7, 12, 18, 31, 40, 48,
9, 9, 11, 14, 20, 45, 47, 43,
11, 10, 12, 18, 31, 44, 54, 44,
11, 13, 17, 22, 40, 68, 63, 48,
14, 17, 29, 44, 53, 85, 81, 60,
18, 27, 43, 50, 63, 81, 89, 72,
38, 50, 61, 68, 81, 95, 94, 79,
56, 72, 74, 77, 88, 78, 81, 78
}
};

I have samsung smx f30, bought in 2009. Honestly, i don't know what can i do with them, I don't understand programming.
I'll try to compille Linux kernel for now.

Pro: Direct testing requests

Vitaliy_Kiselev — Wed, 20 Jul 2011 19:11:19 +0000

This topic is decicated to my direct requests to make specific testing.

As all Pro topics it is intended to testers who want to help and understand that they are doing.
If you do not understand, either ask or just read and wait.

Active points:
* Try to format SD card using exFAT file system
* Check how it works in GH2
* Combine two large MOV files making them >2Gb, and >4Gb. Check if they can be played back in camera.

GH2 Dumping News

Vitaliy_Kiselev — Tue, 03 May 2011 01:00:28 +0000

My GH2 body just went to dumping.
I hope to get some news within next 24h.