[gamma77]

Seriously, did he try the FW update key combo?

Yes, he tried. The camera is dead, no leds, no screen on, nothing. This due to the firmware update failure.

[bootcoder]

Sometimes there is an "emergency update rom", because problems with users doing firmware update are quite offen.

You can activate this mode by pushing special combinations of buttons and pluging main battery. Or on some cameras by putting a jumper on a main board. Unfortunately, manufacturer will never release this information to public. One need to disassemble main boot rom code for understanding this procedure.

[Giklab]

Yes, he tried. The camera is dead, no leds, no screen on, nothing. This due to the firmware update failure.

Damn. I guess I'm too used to Android where you can boot something even if the rom is borked.

[bootcoder]

GUI resources found and decoded.

HTML Code:

ID:02100D0C, type:StringBox params=0 2
    StringArray: 407CC348
    62      StrTable Entry: 40A4EEC0 len:21 lines:1 40A44A3E='Data being processed'
    63      StrTable Entry: 40AC23FC len:9 lines:1 40A54D4B='Deleting'
    64      StrTable Entry: 40AC4D3C len:17 lines:1 40A55642='Data being saved'
    65      StrTable Entry: 40AC505C len:20 lines:1 40A556D1='Data being recorded'
    66      StrTable Entry: 40ABB87C len:11 lines:1 40A53697='Formatting'
    67      StrTable Entry: 40AA74BC len:5 lines:1 40A514E9='Exit'
  ID:02100D0D, type:ProgressBar
  ID:02100D0E, type:Icon params=0 2 id=0x0152
  ID:02100D0F, type:AnimatedIcon params=0 2
    AnimatedIcon data: 407A93B0
    array:407a939c 00A0 01 01
    icons: 0x000E 0x0001 0x0002 0x0003 0x0004 0x0005 0x0006 0x0007 0x0008
...
  ID:02100100, type:AlignCanvas
  ID:02100101, type:Icon params=0 2 id=0x0022
  ID:02100102, type:String params=0 2
    StrTable Entry: 40A4CE40 len:3 lines:1 40A443AA='OK'
  ID:02100103, type:String params=0 2
    StrTable Entry: 40AA737C len:3 lines:1 40A514DE='OK'
  ID:02100104, type:String params=0 2
    StrTable Entry: 40AA769C len:6 lines:1 40A514FC='Start'
  ID:02100105, type:String params=0 2
    StrTable Entry: 40AB9C5C len:6 lines:1 40A531C0='Enter'

---

Last edited by bootcoder; 12-13-2015 at 10:31 AM.

[anu l]

The reason I am searching for hacking of Pentax firmware is that I just found out that Pentax K-S2 doesn't have Composition adjustment and optical wireless flash control through it's on board flash. Even the K-50 has these and it's available much cheaper than K-S2,

These things dont seem to require extra hardware, but are rather features which have been disabled to force users to buy more expensive K-3, K-3 II etc,- the way Nikon and Canon force.



I havent gone through the whole thread, & this is the first time I am going through such a thread & I appreciate the effort.

but I have some suggestions:

- is there a dedicated website for contributing hacked firmware code for newer Pentax cameras?? it will be autonomous and may attract larger audience.
- till this date has some credible firmware been contributed which has a minimum level of reliability??

[taowang]

Hi, I'm working on porting 'pktriggercord' to K-3, but stucked on some SCSI commands, can anyone locate the USB communication logic in the firmware? Thanks.

[taowang]

Hi, everyone,

Just an update, recently, bootcoder and I are working on the SCSI communication part of 'K-S1' firmware, which has many debug information helped a lot in the analysis, we made great progress. Although the firmware is very different for different camera, I believe the SCSI protocol is relative stable across Pentax DSLRs. So, even some of the discoveries are found in K-S1 firmware, it may apply to other cameras as well.

I wrote a document for it,

Pentax USB SCSI Communication Protocol
(https://github.com/asalamon74/pktriggercord/blob/master/pentax_scsi_protocol.md).

It consist of the discoveries in the firmware found by bootcoder, and my understanding of current 'pktriggercord' implementation. It's working in progress, more updates will be made as more discoveries comes.

Anyone interested in this, please come and help, even a typo/grammar fix helps, as I'm not native English speaker.

Another update is about the firmware decode(decrypt/decompress) tools, written by @svenpeter, @MooseV2 and @bootcoder.

I ported to Node.js, pure Javascript implementation, so it's can be run cross-platform(Linux,OSX,Win,etc.) without compiling.

If you have Node.js installed, just

PHP Code:

			
npm i pfwtool -g 




		

The tool will be installed, and use it also easy :

PHP Code:

			
pfwtool -i xxxx.bin -o xxxx.rom 




		

The 'xxxx.bin' is the firmware file from Pentax site, and 'xxxx.rom' is the output filename, replace them with the real ones.

For more information, come have a look: https://github.com/twang2218/pentax-firmware-tool

[logomancer]

Awesome!

[taowang]

Update, I ported bootcoder's another Perl program, which extract resources from K-S1/K-S2 firmware, to my node.js implementation.

2 more arguments have been added to the command:

PHP Code:

			
    -l, --list-resources           List resource files in the firmware.

    -e, --extract-resources <dir>  Extract the resource to the given directory. 




		

So, to extract resources from K-S1/K-S2 firmware, just give the command a location to save them:

PHP Code:

			
pfwtool -i ks1.bin -e res 




		

And the resource files will be stored in the 'res' directory, and for K-S1 firmware, the content will be something like this:

Code:

res
├── [ 340]  A
│ ├── [ 102]  Icon
│ │ └── [803K]  Icon.bin
│ ├── [ 612]  Jpeg
│ │ ├── [159K]  Direct.jpg
│ │ ├── [ 29K]  Effect01.jpg
│ │ ├── [ 20K]  Effect02.jpg
│ │ ├── [ 20K]  Effect03.jpg
│ │ ├── [ 26K]  Effect04.jpg
│ │ ├── [ 19K]  Effect05.jpg
│ │ ├── [ 26K]  Effect06.jpg
│ │ ├── [ 22K]  Effect07.jpg
│ │ ├── [ 16K]  Effect08.jpg
│ │ ├── [ 22K]  Effect09.jpg
│ │ ├── [ 18K]  Effect10.jpg
│ │ ├── [ 20K]  Effect11.jpg
│ │ ├── [ 15K]  Effect12.jpg
│ │ ├── [ 13K]  LcdAdj.jpg
│ │ ├── [ 52K]  Menu.jpg
│ │ └── [2.5K]  StartUp.jpg
│ ├── [ 238]  LE
│ │ ├── [ 12K]  LE_CN_S.bin
│ │ ├── [ 12K]  LE_CN_T.bin
│ │ ├── [ 12K]  LE_JP.bin
│ │ ├── [ 12K]  LE_KR.bin
│ │ └── [ 20K]  LE_Latin.bin
│ ├── [ 238]  RT
│ │ ├── [1.6M]  RT_CN_S.bin
│ │ ├── [996K]  RT_CN_T.bin
│ │ ├── [632K]  RT_JP.bin
│ │ ├── [235K]  RT_KR.bin
│ │ └── [ 53K]  RT_Latin.bin
│ ├── [ 170]  Sound
│ │ ├── [8.4K]  AF_Tone.bin
│ │ ├── [ 94K]  STF_Tone.bin
│ │ └── [ 94K]  STS_Tone.bin
│ ├── [2.3K]  cmd_cc.txt
│ ├── [ 10K]  cmd_dc.txt
│ └── [ 48K]  kb558s.bin
├── [ 136]  B
│ ├── [ 256]  LogData.bin
│ └── [   4]  Mode.bin
└── [1.7K]  E
    ├── [   4]  ActOb.bin
    ├── [   4]  Adjust.bin
    ├── [   4]  AwbGain.bin
    ├── [   4]  Barcode.bin
    ├── [   4]  BlockCtl.bin
    ├── [   4]  CcdGain.bin
    ├── [   4]  CcdPhase.bin
    ├── [   4]  CcdPulse.bin
    ├── [   4]  Color.bin
    ├── [   4]  CpuAdj.bin
    ├── [   4]  Hw1Pixl.bin
    ├── [   4]  Hw2Pixl.bin
    ├── [   4]  Hw3Pixl.bin
    ├── [   4]  Hw4Pixl.bin
    ├── [   4]  HwVer.bin
    ├── [   4]  LcdAdj.bin
    ├── [   4]  ManuProc.bin
    ├── [   4]  Manufact.bin
    ├── [   4]  OpeChk.bin
    ├── [   4]  Rtn0.bin
    ├── [   4]  Rtn1.bin
    ├── [   4]  Rtn2.bin
    ├── [   4]  Rtn3.bin
    ├── [   4]  Rtn4.bin
    ├── [   4]  Rtn5.bin
    ├── [   4]  Rtn6.bin
    ├── [   4]  Rtn7.bin
    ├── [   4]  Rtn8.bin
    ├── [   4]  Rtn9.bin
    ├── [   4]  SenInfo.bin
    ├── [   4]  SerialNo.bin
    ├── [   4]  Sw10Pixl.bin
    ├── [   4]  Sw11Pixl.bin
    ├── [   4]  Sw12Pixl.bin
    ├── [   4]  Sw1Pixl.bin
    ├── [   4]  Sw2Pixl.bin
    ├── [   4]  Sw3Pixl.bin
    ├── [   4]  Sw4Pixl.bin
    ├── [   4]  Sw5Pixl.bin
    ├── [   4]  Sw6Pixl.bin
    ├── [   4]  Sw7Pixl.bin
    ├── [   4]  Sw8Pixl.bin
    ├── [   4]  Sw9Pixl.bin
    ├── [   4]  SwSerial.bin
    ├── [   4]  TestAdj.bin
    ├── [   4]  VShading.bin
    ├── [   4]  VSubAdj.bin
    └── [   4]  VideoAmp.bin

8 directories, 83 files

Update/install my program is very simple, assume Node.js has been installed, just run:

PHP Code:

			
npm i pfwtool -g 




		

[dme]

Does anyone have any idea whether such commands exist? It would be handy to be able to do this via a tether.

[anemone]

If all commands are read from firmware and given to people see what can be done, then some program could implement them. I doubt there isn't any array in firmware which represents all SCSI commands so this would need some serious reverse engineering.

My educated guess is that there are no such commands and controlling zoom with tether isn't possible.

[DaveK10]

Anybody at work on pentax firmware has discovered something like "focus shift compensation"?

I discovered a strange behaviour in two k5 and a k10d camera. When focusing (half press shutter button) at full aperture the camera focusing in a precise (correct) point, but if you close the lens at e.g. 8 or 11, the camera focusing a wrong point. Is the camera firmware and not the lens, because if i focus in a point at 2.8 and without refocusing I shoot the pic at f11, the pic is perfect. The camera refocusing only if you close the lens.
It is'nt the lens fosing shift issue, is something like a firmware compensation of focusing shift, because the camera refocusing every time you move de aperture setting.

Anyone has found something like this in the firmware code?

[Fire Angel]

Has anyone found out how to put a K-r into debug mode without using the PKTether software? I have a Mac and currently no PC access so I can't run PKTether or the similar programs unless there's a Mac version.

[ofer4]

Has anyone found out how to put a K-r into debug mode without using the PKTether software? I have a Mac and currently no PC access so I can't run PKTether or the similar programs unless there's a Mac version.

Try Parallels or Virtualbox. It would at least allow you access to Windows-based software.

[bootcoder]

Has anyone found out how to put a K-r into debug mode without using the PKTether software?

Did you try usual way, but create 00077420.504 file instead of MODSET.xxx ?