Resurrecting Pentax firmware hacking

altopiet · 03-03-2014, 04:49 AM

Originally posted by Adam G

This makes me sad that all I can do is push the shutter button.

I completely agree, I admire whats happening here, and hope it will lead to some substantial changes/settings that might be beneficial to a klutz like me...

Shodan · 03-03-2014, 06:00 AM

Originally posted by seyfer

Great work! I can donate some money if can help.

I think I'll be getting to the point soon where in order to make more progress I'm going to really risk bricking my camera. I'm not going to do that.
I've got some ideas from what I've analysed that might make it possible to load up a second firmware in-place (CHDK and Magic Lantern style) but to test it I need to do some 'dodgy' things to the camera.

So.....I need a spare K-30. I've looked on Ebay for a faulty one but no luck. Anyway I'm open to donations so I can try and get one, alternatively if anyone has one they don't want anymore.

If you're interested please understand that any donations are given 'without return consideration'.

Hopefully there is a bitcoin millionaire here who can sort all this stuff out!

seyfer · 03-03-2014, 06:42 AM

Originally posted by Shodan

I think I'll be getting to the point soon where in order to make more progress I'm going to really risk bricking my camera. I'm not going to do that.
I've got some ideas from what I've analysed that might make it possible to load up a second firmware in-place (CHDK and Magic Lantern style) but to test it I need to do some 'dodgy' things to the camera.

So.....I need a spare K-30. I've looked on Ebay for a faulty one but no luck. Anyway I'm open to donations so I can try and get one, alternatively if anyone has one they don't want anymore.

If you're interested please understand that any donations are given 'without return consideration'.

Hopefully there is a bitcoin millionaire here who can sort all this stuff out!

Do you have a paypal account?

RayeR · 03-03-2014, 08:31 AM

Could you provide memory layout of the firmware file? There is some unencrypted header, then what offset & length is DSP FW and MCU FW?
Hooking the code may be dangerous but maybe you can minimize risk by starting to modify dev. menu code because it can be easily disabled. I hope there's some gap in FW to inject code and redirect a function from dev. menu to this user code...

Shodan · 03-03-2014, 08:51 AM

Quote:

Could you provide memory layout of the firmware file? There is some unencrypted header, then what offset & length is DSP FW and MCU FW?

I'm hoping to get a better picture when I start dumping fw from the device

Memory layout is a bit odd. Looks like the FW is loaded into RAM at 0xA0000000. There looks to be a bootloader at 0xA0000000 which is based on the DSP fw dump from the device. The firmware file is garbage at 0xA0000000 which isn't even decrypted by firmware loader.

Loading the firmware up in IDA you can quickly see three code segments, the rest is either data or filler.

Quote:

Hooking the code may be dangerous but maybe you can minimize risk by starting to modify dev. menu code because it can be easily disabled. I hope there's some gap in FW to inject code and redirect a function from dev. menu to this user code...

Yep that's the plan but still risky. There is also the SW Debug menu which can be accessed during normal operation.

Quote:

Do you have a paypal account?

Working on it

Shodan · 03-03-2014, 12:03 PM

signature updated.

LeFanch · 03-03-2014, 02:05 PM

Originally posted by Shodan

signature updated.

Cool!

patarok · 03-04-2014, 06:30 AM

I donored 10 Pounds to shodan via paypal, a few minutes ago. If all the people who already said "cool, where is your paypal account" would also donor a few bucks, we would get to see results much sooner...

seyfer · 03-04-2014, 06:58 AM

Originally posted by patarok

I donored 10 Pounds to shodan via paypal, a few minutes ago. If all the people who already said "cool, where is your paypal account" would also donor a few bucks, we would get to see results much sooner...

Donated 15,00 pound to shodan

mtux · 03-04-2014, 07:17 AM

Originally posted by patarok

I donored 10 Pounds to shodan via paypal, a few minutes ago. If all the people who already said "cool, where is your paypal account" would also donor a few bucks, we would get to see results much sooner...

I echo this

Duc-Driver · 03-04-2014, 09:47 AM

donated too!
Would be great if there will be some custom firmwares for pentax.
For example it would be nice if i can adjust "fine tuning" from lenses in menu more like "-10" and "+10" for each single lens.
That would be very nice!

Giklab · 03-04-2014, 01:40 PM

Shodan, if you get enough $$, will you buy a K-5 II as well?

Shodan · 03-04-2014, 02:17 PM

Thank you to everyone who has donated so far. I appreciate that we are all strangers with a love of Pentax and that you're all joining me on my quest!
If you have donated, post here so that it is transparent and so that everyone can see the generosity and the direction we are going.

Quote:

Shodan, if you get enough $$, will you buy a K-5 II as well?

Plan is to get the K-30 to a stage where many more people can take over development - perhaps an official port of Magic Lantern maybe. Then take on the other models.
Once one is done the rest should be much much easier. The first one is always the hardest.

At the moment I'm trying to bundle up the work i've done into correctly decrypting, check-summing and check-sum fixing the binary. This will make the process of making custom modification a little easier when the time comes...

**forest_bear59** · 03-04-2014, 10:28 PM

Donated 15,00 pounds. Your work has to be supported!!!

LeFanch · 03-05-2014, 12:04 AM

Donated as well...
20£

03-03-2014, 06:00 AM	#77
Shodan Forum Member Join Date: Feb 2014 Posts: 92 Original Poster	Originally posted by seyfer Great work! I can donate some money if can help. I think I'll be getting to the point soon where in order to make more progress I'm going to really risk bricking my camera. I'm not going to do that. I've got some ideas from what I've analysed that might make it possible to load up a second firmware in-place (CHDK and Magic Lantern style) but to test it I need to do some 'dodgy' things to the camera. So.....I need a spare K-30. I've looked on Ebay for a faulty one but no luck. Anyway I'm open to donations so I can try and get one, alternatively if anyone has one they don't want anymore. If you're interested please understand that any donations are given 'without return consideration'. Hopefully there is a bitcoin millionaire here who can sort all this stuff out! Last edited by Shodan; 03-03-2014 at 06:07 AM.

03-04-2014, 02:17 PM	#88
Shodan Forum Member Join Date: Feb 2014 Posts: 92 Original Poster	Thank you to everyone who has donated so far. I appreciate that we are all strangers with a love of Pentax and that you're all joining me on my quest! If you have donated, post here so that it is transparent and so that everyone can see the generosity and the direction we are going. Quote: Shodan, if you get enough $$, will you buy a K-5 II as well? Plan is to get the K-30 to a stage where many more people can take over development - perhaps an official port of Magic Lantern maybe. Then take on the other models. Once one is done the rest should be much much easier. The first one is always the hardest. At the moment I'm trying to bundle up the work i've done into correctly decrypting, check-summing and check-sum fixing the binary. This will make the process of making custom modification a little easier when the time comes... Last edited by Shodan; 03-04-2014 at 04:26 PM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
NY area SDM Hacking	dappercorpmonkey	Troubleshooting and Beginner Help	11	07-26-2013 04:15 PM
Nature Resurrecting some old images - Angry Birds!	Julie	Post Your Photos!	4	03-07-2013 10:41 AM
k-5 firmware hacking anyone?	secateurs	Pentax K-5 & K-5 II	33	10-05-2012 03:05 PM
Hacking lens' memory	plis	Visitors' Center	6	11-28-2011 10:58 PM
Resurrecting a MX and Super ME	LiMPiNg	Film SLRs and Compact Film Cameras	4	09-27-2011 02:55 PM

03-03-2014, 04:49 AM	#76
altopiet Veteran Member Join Date: Sep 2010 Location: The Gem of the Karoo, South Africa Photos: Gallery \| Albums Posts: 2,307	Originally posted by Adam G This makes me sad that all I can do is push the shutter button. I completely agree, I admire whats happening here, and hope it will lead to some substantial changes/settings that might be beneficial to a klutz like me...

03-03-2014, 06:42 AM	#78
seyfer Junior Member Join Date: Oct 2011 Posts: 31	Originally posted by Shodan I think I'll be getting to the point soon where in order to make more progress I'm going to really risk bricking my camera. I'm not going to do that. I've got some ideas from what I've analysed that might make it possible to load up a second firmware in-place (CHDK and Magic Lantern style) but to test it I need to do some 'dodgy' things to the camera. So.....I need a spare K-30. I've looked on Ebay for a faulty one but no luck. Anyway I'm open to donations so I can try and get one, alternatively if anyone has one they don't want anymore. If you're interested please understand that any donations are given 'without return consideration'. Hopefully there is a bitcoin millionaire here who can sort all this stuff out! Do you have a paypal account?

03-03-2014, 08:31 AM	#79
RayeR Forum Member Join Date: Feb 2014 Posts: 86	Could you provide memory layout of the firmware file? There is some unencrypted header, then what offset & length is DSP FW and MCU FW? Hooking the code may be dangerous but maybe you can minimize risk by starting to modify dev. menu code because it can be easily disabled. I hope there's some gap in FW to inject code and redirect a function from dev. menu to this user code...

03-03-2014, 08:51 AM	#80
Shodan Forum Member Join Date: Feb 2014 Posts: 92 Original Poster	Quote: Could you provide memory layout of the firmware file? There is some unencrypted header, then what offset & length is DSP FW and MCU FW? I'm hoping to get a better picture when I start dumping fw from the device Memory layout is a bit odd. Looks like the FW is loaded into RAM at 0xA0000000. There looks to be a bootloader at 0xA0000000 which is based on the DSP fw dump from the device. The firmware file is garbage at 0xA0000000 which isn't even decrypted by firmware loader. Loading the firmware up in IDA you can quickly see three code segments, the rest is either data or filler. Quote: Hooking the code may be dangerous but maybe you can minimize risk by starting to modify dev. menu code because it can be easily disabled. I hope there's some gap in FW to inject code and redirect a function from dev. menu to this user code... Yep that's the plan but still risky. There is also the SW Debug menu which can be accessed during normal operation. Quote: Do you have a paypal account? Working on it

03-03-2014, 12:03 PM	#81
Shodan Forum Member Join Date: Feb 2014 Posts: 92 Original Poster	signature updated.

03-03-2014, 02:05 PM	#82
LeFanch Senior Member Join Date: Dec 2007 Location: Working in Norway, Bordeaux area when on time-off Posts: 123	Originally posted by Shodan signature updated. Cool!

03-04-2014, 06:30 AM	#83
patarok Veteran Member Join Date: Jul 2013 Photos: Gallery Posts: 389	I donored 10 Pounds to shodan via paypal, a few minutes ago. If all the people who already said "cool, where is your paypal account" would also donor a few bucks, we would get to see results much sooner...

03-04-2014, 06:58 AM	#84
seyfer Junior Member Join Date: Oct 2011 Posts: 31	Originally posted by patarok I donored 10 Pounds to shodan via paypal, a few minutes ago. If all the people who already said "cool, where is your paypal account" would also donor a few bucks, we would get to see results much sooner... Donated 15,00 pound to shodan

03-04-2014, 07:17 AM	#85
mtux Veteran Member Join Date: Apr 2013 Location: the Netherlands Photos: Gallery \| Albums Posts: 2,444	Originally posted by patarok I donored 10 Pounds to shodan via paypal, a few minutes ago. If all the people who already said "cool, where is your paypal account" would also donor a few bucks, we would get to see results much sooner... I echo this

03-04-2014, 09:47 AM	#86
Duc-Driver Forum Member Join Date: Feb 2014 Photos: Gallery Posts: 87	donated too! Would be great if there will be some custom firmwares for pentax. For example it would be nice if i can adjust "fine tuning" from lenses in menu more like "-10" and "+10" for each single lens. That would be very nice!

Thread Tools	Search this Thread
	Search this Thread: Advanced Search

03-04-2014, 01:40 PM	#87
Giklab Veteran Member Join Date: Jan 2012 Location: Slovenia Photos: Gallery Posts: 2,182	Shodan, if you get enough $$, will you buy a K-5 II as well?

03-04-2014, 10:28 PM	#89
forest_bear59 Site Supporter Join Date: Oct 2013 Location: Idstein (near Frankfurt - Germany) Photos: Gallery Posts: 147	Donated 15,00 pounds. Your work has to be supported!!!

03-05-2014, 12:04 AM	#90
LeFanch Senior Member Join Date: Dec 2007 Location: Working in Norway, Bordeaux area when on time-off Posts: 123	Donated as well... 20£