[zezo]

Which manual are you using?

The Instruction Manual. Chapter 5.1 Pipeline Operation.

[tr13]

Ouch.
Discussion is now on another level :-) Looks like some kind of reversing forums :-)
I am learning IDC and looking at plugins, just because prefer to make tools first.

Guys, could you look at IDA2SIG and check if FLIRT will work for transferring name information from one firmware to another?

I also noticed one thing working with auto-comment problem for our module - we could make much improved auto-comments, as IDA supports passing command parameters to comments.
We can make some pseudo C comments. Contact me if you are insterested in this task.
IF you are interested in second (by zezo) version with working auto-comments you can also contact me.

Another good suggestion for reversers.
Use Softune comiler to make simple programs and look at them in IDA to understand how this compiler works.

[rparmar]

Discussion is now on another level :-) Looks like some kind of reversing forums :-)

You're telling me! And all I wanna know is... which should I get, the DA70 or FA77?

[tr13]

Important addition

I have more reasons to belive that used OS is indeed REALOS.
Due to heavy Int 0x40 usage in many functions and this is common to REALOS
Look at documents:
int 0x40 realos - Google Search

[zezo]

Important addition

I have more reasons to belive that used OS is indeed REALOS.
Due to heavy Int 0x40 usage in many functions and this is common to REALOS
Look at documents:
int 0x40 realos - Google Search

That was stated clearly in the K100D firmware but the string was removed in later models:

strings FWDC156B.BIN | grep -i fuji
6Softune REALOS/FR is Realtime OS for FR Family, based on micro-ITRON COPYRIGHT(C) FUJITSU LIMITED 1994-1999

BTW at first glance it seems that GX 20 v1.03 uses a lot more int 0x40 calls than 1.01 but that may be only subjective impression.

[Zebooka]

Guys, lots of thanks for K10D 1.30 debug enabling with MODSET.TXT

IT WORKS!

[tr13]

Info update

Latest Softune (much newer then that we had previously)
http://www.pentax-hack.info/firmware...u/softune2.zip
CPU definitions file have some info about MB91680 interrupts.

REALOS related stuff :-)
www.pentax-hack.info/firmware/fujitsu/kernel.zip
www.pentax-hack.info/firmware/fujitsu/tools.zip

Last file have tools and good manuals on RealOS functions.
First one have libraries on sources of kernel functions (works with Softune).

If anyone have good Japanese knowledge, contact me, please.
As I hope to get MB91680 manuals :-)

[opiedog]

anyone got this to work on the k2000/km? i tried it and it doesn't work on the k2000

[tr13]

Here is solution just posted by readers on my blog:

By times and times trying, I succeed open debug menu on K-m. The process like follow:

-----------------------------------------------
1. Create a file name MODSET.464 in root directory on SD card, and the content in file are two lines:
[DEBUG_MODE EN]
[OPEN_DEBUG_MENU]

2. Turn off the K-m. Insert the SD card into the camera. Then Press "Delete Key" (the key below to "mneu" key) while turn on the camera.

3.You see! The debug menu is display on the screen of camera. So you can set every entries of the menu.

[DEBUG_MODE EN] is not required, as I understand as you can turn it on/off in debug menu.

[opiedog]

okay. i got my k2000 to display the debug menu.
after creating MODSET.xxx files from .001 to 999, but was only able to copy up to MODSET.509 on the root of the SD card.
i guess this is a limitation for the # of filenames on the root directory

i'm going to slowly remove files and see which one is the correct one for k2000
i wasn't able to get it to work with the MODSET.464

will report back in a little bit...

[opiedog]

.482

at least in my FW 1.1, that's what i used to get it to work.

the content of MODSET.482 is
[OPEN_DEBUG_MENU]

card door - closed
turn power on.
made no difference holding the delete button.

thanks!

edit:
you DO need to hold down the delete button the first time to enable it.

[tr13]

i'm going to slowly remove files and see which one is the correct one for k2000
i wasn't able to get it to work with the MODSET.464

MODSET.464 is only for K-m, not for K2000. So, it is all correct.
Thanks for useful info. I'll update site in next few days and make separate page with all known information.

[zezo]

It seems that the file extension is stored in the firmware update file as 4-byte word at offset 0x10

The same (2-byte) value repeated twice is used as block terminator together with the A5 5A 5A A5 sequence - in the case of k2000 '01 e2 01 e2 a5 5a 5a a5' is found at:

Code:

000001f8 - end of header?
000ffff0
00fffff0 -  end of DSP firmware
01000070 - end of CPU firmware header?
01037ff8
0103fbf0

[tr13]

Yeah, I mailed to you some part of header references, but now look that don't mailed that it is at 0x10 :-)
I also noticed this eZZe stuff.


Anyone tried to change one byte (in debug commands, using HEX editor in first post), change version in header and flash firmware back (if you decrypted it, remember to encrypt back) ?
As I don't see any real code for checksum calculation yet.

[zezo]

Yeah, I mailed to you some part of header references, but now look that don't mailed that it is at 0x10 :-)
I also noticed this eZZe stuff.

That one was pretty obvious - a lot of printf() type calls with things like "MODSET.%d" near the reference. But there are few more interesting header fields.

I still wonder what the best way to compare notes is. Email/forum/blog/wiki?