Resurrecting Pentax firmware hacking

frankl · 08-18-2017, 04:49 AM

If that'd allow me to use it on my K-x to fix the battery issue I offer my help. Never done a camera firmware before, but lots of experience in many languages.

bootcoder · 08-19-2017, 08:33 AM - **1 Like**

Originally posted by PiDicus Rex

I'm beginning to think, it'd be easier to have a team start from scratch, with the SDK's for the chipsets

Ok, so give me a call when you get SDK for Milbeaut Image Processor Part.

Jeff Lopez · 08-19-2017, 09:25 AM

If there where any back engineering something, I suggest put effort on useful issues, like reenabling tethering and hacking a faster flash speed..

Class A · 08-19-2017, 08:28 PM - **1 Like**

Originally posted by Jeff Lopez

I suggest put effort on useful issues, like reenabling tethering and hacking a faster flash speed.

Most Pentax DSLRs support tethering and you can exploit that with one of the available free third-party software solutions.

Faster flash speeds cannot be achieved through firmware changes as the maximum speed is determined by the shutter hardware. The only tweak that could be made is to still provide a trigger signal, even if the shutter speed exceeds the sync-speed in order to support the "Hyper Sync" technique where you use a speedlight at full power to achieve a sufficiently long pulse duration.

**photogem** · 09-20-2017, 11:42 PM

Originally posted by bootcoder

K-500 needs file 00077770.550 and DEVELOP.MOD (like others) on the sdcard to enter debug mode.

I have a Pentax K500 with damaged firmware.
I tried those files but can't get into the debug mode.

Is there any other chance?

bootcoder · 09-21-2017, 03:03 PM

Just files with these names is not enough. You should follow similar instructions for K-S1:
Resurrecting Pentax firmware hacking - Page 32 - PentaxForums.com
Resurrecting Pentax firmware hacking - Page 32 - PentaxForums.com

But it depends how bad firmware is.

PiDicus Rex · 10-03-2017, 04:36 AM

Originally posted by bootcoder

Ok, so give me a call when you get SDK for Milbeaut Image Processor Part.

I so wish I knew where to find it too.

ABel · 10-05-2017, 09:09 AM - **1 Like**

photogem's camera became non-working because of my K-50 firmware adapted for K-500.
The camera could start, but didn't allow for changing any parameters, and the downgrading to the original firmware hanged in "NOW LOADING" phase.

Luckily we were able to revert the camera to the original firmware 1.02 by using a "magic" KB545B.BIN filename.

So, K-50 firmware can only be installed in K-50 and K-30. No K-01, no K-500.

**photogem** · 10-05-2017, 10:14 AM

Originally posted by ABel

photogem's camera became non-working because of my K-50 firmware adapted for K-500.
The camera could start, but didn't allow for changing any parameters, and the downgrading to the original firmware hanged in "NOW LOADING" phase.

Luckily we were able to revert the camera to the original firmware 1.02 by using a "magic" filename.

So, K-50 firmware can only be installed in K-50 and K-30. No K-01, no K-500.

Indeed magic, my brothers K500 is fully working again.

Would be interesting if on can use this "forced firmware recovery" for the K30 and K50 as well?

ABel · 10-08-2017, 09:48 PM - **1 Like**

Originally posted by photogem

Would be interesting if on can use this "forced firmware recovery" for the K30 and K50 as well?

As far as understand, this technique can be used with almost any of K-family cameras.

It's already known, that K-30 firmware contains the following filenames: KB524.BIN, KB524C.BIN, KB524C0.BIN, KB524C1.BIN, KB524B.BIN.
These files can be used for a installation of non-encrypted blocks of firmware, and this might even work if a regular firmware installation hangs.
I haven't seen any reports of their successful usage here on PF, that's why I've decided to share what I've discovered during my firmware research.

KB524.BIN contains DSP code, which starts from offset 0 in fwdc215b and occupies C00000 bytes (all offsets and lengths are hexadecimal).
KB524C0.BIN - Core0, start = 0, length = C00000 (these values look really strange to me, and I'm not sure if they are correct).
KB524C1.BIN - Core1, start = 20000, length = 80000.
KB524C.BIN - CPU code, start = C00000, length = 40000.
KB524B.BIN - both DSP and CPU, start = 0, length = C40000.

We've only used "Both" firmware, others were not tested.

KB524B.BIN is just an unencrypted firmware fwdc215b (I use pfwtool for the firmware decryption).
To install, the file should be saved to an SD card using a card-reader. As soon as the card is inserted in the camera, the file's size, hardware IDs and checksums are checked, and if the file is considered valid, the camera requests to eject the card, and the installation starts.

bootcoder · 10-23-2017, 06:02 AM

In terms of pentax Core0=CPU, Core1=DSP. Both ARM, actually no difference, because it is multicore CPU. Core0 code is small 0x1FFFF, serving AF, light, Buttons, peripherials. Core1 serving shooting process, playback, menus, etc.

The code at 0xC00000 seems to do firmware update.

Red_beard · 10-29-2017, 12:29 PM

Originally posted by ABel

As far as understand, this technique can be used with almost any of K-family cameras.

It's already known, that K-30 firmware contains the following filenames: KB524.BIN, KB524C.BIN, KB524C0.BIN, KB524C1.BIN, KB524B.BIN.
These files can be used for a installation of non-encrypted blocks of firmware, and this might even work if a regular firmware installation hangs.
I haven't seen any reports of their successful usage here on PF, that's why I've decided to share what I've discovered during my firmware research.

KB524.BIN contains DSP code, which starts from offset 0 in fwdc215b and occupies C00000 bytes (all offsets and lengths are hexadecimal).
KB524C0.BIN - Core0, start = 0, length = C00000 (these values look really strange to me, and I'm not sure if they are correct).
KB524C1.BIN - Core1, start = 20000, length = 80000.
KB524C.BIN - CPU code, start = C00000, length = 40000.
KB524B.BIN - both DSP and CPU, start = 0, length = C40000.

We've only used "Both" firmware, others were not tested.

KB524B.BIN is just an unencrypted firmware fwdc215b (I use pfwtool for the firmware decryption).
To install, the file should be saved to an SD card using a card-reader. As soon as the card is inserted in the camera, the file's size, hardware IDs and checksums are checked, and if the file is considered valid, the camera requests to eject the card, and the installation starts.

Hi ABel, I have the same problem of photogem with my K-500 and I don't where to find the file KB524B.BIN to recovery.
Please can you help me?
Thank you.

ABel · 10-29-2017, 08:06 PM

Originally posted by Red_beard

Hi ABel, I have the same problem of photogem with my K-500 and I don't where to find the file KB524B.BIN to recovery.
Please can you help me?
Thank you.

Originally posted by Red_beard

d I don't where to find the file KB524B.BIN to recovery. Please can you help m

Have you installed my "K-50 for K-500" firmware?

Red_beard · 10-29-2017, 10:48 PM

Originally posted by ABel

Have you installed my "K-50 for K-500" firmware?

I did. When I try to return to the v1.02 for K-500 the camera remains in "Now loading" phase.

ABel · 10-29-2017, 11:11 PM

Originally posted by Red_beard

I did. When I try to return to the v1.02 for K-500 the camera remains in "Now loading" phase.

I see.

In this case, please save KB545B.BIN from this archive to a preferably empty SD-card using an SD-reader (saving it using the camera's USB-connection was not tested).
Insert the card into your camera, right after insertion the camera will check the firmware for correctness, and if everything is Ok it will ask you to remove the card, and then install the firmware.
Please let me know if this helps.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
NY area SDM Hacking	dappercorpmonkey	Troubleshooting and Beginner Help	11	07-26-2013 04:15 PM
Nature Resurrecting some old images - Angry Birds!	Julie	Post Your Photos!	4	03-07-2013 10:41 AM
k-5 firmware hacking anyone?	secateurs	Pentax K-5 & K-5 II	33	10-05-2012 03:05 PM
Hacking lens' memory	plis	Visitors' Center	6	11-28-2011 10:58 PM
Resurrecting a MX and Super ME	LiMPiNg	Film SLRs and Compact Film Cameras	4	09-27-2011 02:55 PM

08-18-2017, 04:49 AM	#691
frankl New Member Join Date: May 2017 Photos: Albums Posts: 6	If that'd allow me to use it on my K-x to fix the battery issue I offer my help. Never done a camera firmware before, but lots of experience in many languages.

08-19-2017, 08:33 AM - 1 Like	#692
bootcoder Banned Join Date: Oct 2014 Posts: 93	Originally posted by PiDicus Rex I'm beginning to think, it'd be easier to have a team start from scratch, with the SDK's for the chipsets Ok, so give me a call when you get SDK for Milbeaut Image Processor Part.

08-19-2017, 09:25 AM	#693
Jeff Lopez Veteran Member Join Date: Dec 2016 Posts: 531	If there where any back engineering something, I suggest put effort on useful issues, like reenabling tethering and hacking a faster flash speed..

08-19-2017, 08:28 PM - 1 Like	#694
Class A Pentaxian Join Date: Aug 2008 Location: Wellington, New Zealand Posts: 11,251	Originally posted by Jeff Lopez I suggest put effort on useful issues, like reenabling tethering and hacking a faster flash speed. Most Pentax DSLRs support tethering and you can exploit that with one of the available free third-party software solutions. Faster flash speeds cannot be achieved through firmware changes as the maximum speed is determined by the shutter hardware. The only tweak that could be made is to still provide a trigger signal, even if the shutter speed exceeds the sync-speed in order to support the "Hyper Sync" technique where you use a speedlight at full power to achieve a sufficiently long pulse duration.

09-20-2017, 11:42 PM	#695
photogem Site Supporter Join Date: Apr 2015 Posts: 3,520	Originally posted by bootcoder K-500 needs file 00077770.550 and DEVELOP.MOD (like others) on the sdcard to enter debug mode. I have a Pentax K500 with damaged firmware. I tried those files but can't get into the debug mode. Is there any other chance?

09-21-2017, 03:03 PM	#696
bootcoder Banned Join Date: Oct 2014 Posts: 93	Just files with these names is not enough. You should follow similar instructions for K-S1: Resurrecting Pentax firmware hacking - Page 32 - PentaxForums.com Resurrecting Pentax firmware hacking - Page 32 - PentaxForums.com But it depends how bad firmware is.

10-03-2017, 04:36 AM	#697
PiDicus Rex Veteran Member Join Date: May 2013 Location: Melbourne, Australia Posts: 1,381	Originally posted by bootcoder Ok, so give me a call when you get SDK for Milbeaut Image Processor Part. I so wish I knew where to find it too.

10-05-2017, 09:09 AM - 1 Like	#698
ABel Senior Member Join Date: Mar 2013 Location: Middle of Siberia Photos: Gallery Posts: 212	photogem's camera became non-working because of my K-50 firmware adapted for K-500. The camera could start, but didn't allow for changing any parameters, and the downgrading to the original firmware hanged in "NOW LOADING" phase. Luckily we were able to revert the camera to the original firmware 1.02 by using a "magic" KB545B.BIN filename. So, K-50 firmware can only be installed in K-50 and K-30. No K-01, no K-500.

10-05-2017, 10:14 AM	#699
photogem Site Supporter Join Date: Apr 2015 Posts: 3,520	Originally posted by ABel photogem's camera became non-working because of my K-50 firmware adapted for K-500. The camera could start, but didn't allow for changing any parameters, and the downgrading to the original firmware hanged in "NOW LOADING" phase. Luckily we were able to revert the camera to the original firmware 1.02 by using a "magic" filename. So, K-50 firmware can only be installed in K-50 and K-30. No K-01, no K-500. Indeed magic, my brothers K500 is fully working again. Would be interesting if on can use this "forced firmware recovery" for the K30 and K50 as well?

10-08-2017, 09:48 PM - 1 Like	#700
ABel Senior Member Join Date: Mar 2013 Location: Middle of Siberia Photos: Gallery Posts: 212	Originally posted by photogem Would be interesting if on can use this "forced firmware recovery" for the K30 and K50 as well? As far as understand, this technique can be used with almost any of K-family cameras. It's already known, that K-30 firmware contains the following filenames: KB524.BIN, KB524C.BIN, KB524C0.BIN, KB524C1.BIN, KB524B.BIN. These files can be used for a installation of non-encrypted blocks of firmware, and this might even work if a regular firmware installation hangs. I haven't seen any reports of their successful usage here on PF, that's why I've decided to share what I've discovered during my firmware research. KB524.BIN contains DSP code, which starts from offset 0 in fwdc215b and occupies C00000 bytes (all offsets and lengths are hexadecimal). KB524C0.BIN - Core0, start = 0, length = C00000 (these values look really strange to me, and I'm not sure if they are correct). KB524C1.BIN - Core1, start = 20000, length = 80000. KB524C.BIN - CPU code, start = C00000, length = 40000. KB524B.BIN - both DSP and CPU, start = 0, length = C40000. We've only used "Both" firmware, others were not tested. KB524B.BIN is just an unencrypted firmware fwdc215b (I use pfwtool for the firmware decryption). To install, the file should be saved to an SD card using a card-reader. As soon as the card is inserted in the camera, the file's size, hardware IDs and checksums are checked, and if the file is considered valid, the camera requests to eject the card, and the installation starts.

10-23-2017, 06:02 AM	#701
bootcoder Banned Join Date: Oct 2014 Posts: 93	In terms of pentax Core0=CPU, Core1=DSP. Both ARM, actually no difference, because it is multicore CPU. Core0 code is small 0x1FFFF, serving AF, light, Buttons, peripherials. Core1 serving shooting process, playback, menus, etc. The code at 0xC00000 seems to do firmware update.

10-29-2017, 12:29 PM	#702
Red_beard New Member Join Date: Oct 2017 Posts: 5	Originally posted by ABel As far as understand, this technique can be used with almost any of K-family cameras. It's already known, that K-30 firmware contains the following filenames: KB524.BIN, KB524C.BIN, KB524C0.BIN, KB524C1.BIN, KB524B.BIN. These files can be used for a installation of non-encrypted blocks of firmware, and this might even work if a regular firmware installation hangs. I haven't seen any reports of their successful usage here on PF, that's why I've decided to share what I've discovered during my firmware research. KB524.BIN contains DSP code, which starts from offset 0 in fwdc215b and occupies C00000 bytes (all offsets and lengths are hexadecimal). KB524C0.BIN - Core0, start = 0, length = C00000 (these values look really strange to me, and I'm not sure if they are correct). KB524C1.BIN - Core1, start = 20000, length = 80000. KB524C.BIN - CPU code, start = C00000, length = 40000. KB524B.BIN - both DSP and CPU, start = 0, length = C40000. We've only used "Both" firmware, others were not tested. KB524B.BIN is just an unencrypted firmware fwdc215b (I use pfwtool for the firmware decryption). To install, the file should be saved to an SD card using a card-reader. As soon as the card is inserted in the camera, the file's size, hardware IDs and checksums are checked, and if the file is considered valid, the camera requests to eject the card, and the installation starts. Hi ABel, I have the same problem of photogem with my K-500 and I don't where to find the file KB524B.BIN to recovery. Please can you help me? Thank you.

10-29-2017, 08:06 PM	#703
ABel Senior Member Join Date: Mar 2013 Location: Middle of Siberia Photos: Gallery Posts: 212	Originally posted by Red_beard Hi ABel, I have the same problem of photogem with my K-500 and I don't where to find the file KB524B.BIN to recovery. Please can you help me? Thank you. Originally posted by Red_beard d I don't where to find the file KB524B.BIN to recovery. Please can you help m Have you installed my "K-50 for K-500" firmware?

10-29-2017, 10:48 PM	#704
Red_beard New Member Join Date: Oct 2017 Posts: 5	Originally posted by ABel Have you installed my "K-50 for K-500" firmware? I did. When I try to return to the v1.02 for K-500 the camera remains in "Now loading" phase.

10-29-2017, 11:11 PM	#705
ABel Senior Member Join Date: Mar 2013 Location: Middle of Siberia Photos: Gallery Posts: 212	Originally posted by Red_beard I did. When I try to return to the v1.02 for K-500 the camera remains in "Now loading" phase. I see. In this case, please save KB545B.BIN from this archive to a preferably empty SD-card using an SD-reader (saving it using the camera's USB-connection was not tested). Insert the card into your camera, right after insertion the camera will check the firmware for correctness, and if everything is Ok it will ask you to remove the card, and then install the firmware. Please let me know if this helps.