[RayeR]

Maybe there are environment settings that activate a filter in the firmware for selectable languages.

They may use some unique serial number e.g. in CPU that FW use to determine which s/n range for what variant. Or there is some extra configuration eeprom that is programmed differently during manufacturing. I guess there's separate memory for storing user settings so it maybe inside.

[jedie]

There looks to be a region code set when the camera rolls of the production line. You can change it via debug commands

Hm! I see on your last screen shot ( https://www.pentaxforums.com/forums/6-pentax-dslr-discussion/250555-resurrect...ml#post2736356 ) the point REGION CODE
Maybe that's the needed settings.

[retroflex]

Tried to donate but got "The card you entered cannot be used for this payment. Please enter a different debit or credit card number." Strange... it's a standard VISA. Anyone knows why?

[Shodan]

Tried to donate but got "The card you entered cannot be used for this payment. Please enter a different debit or credit card number." Strange... it's a standard VISA. Anyone knows why?

Don't know but don't think it's at my end

[RayeR]

BTW did someone investigate how does O-GPS1 module communicate with pentax body? How about to make own GPS module?
I can see it use 4 pins of flash hot shoe connector decribed here (trigger is not used)
https://www.pentaxforums.com/forums/125-flashes-lighting-studio/246697-manual-flash-puzzle.html
I'm not familiar with this connector, what exactly is the digital pin? Is is just output or bidirectional? What protocol? I measured there is soft 3,23V after power on, other pins on 0 level. Then I found that GPS presence is indicated though Mode input pin. If pulled high (I just use resistor from Digital to Mode pin), then display react immediatelly and GPS menu is enabled (press INFO button twice and see compas icon on right side is active now). The question is how GPS module sends data. I guess that the module has 3,3V UART feeding classic NMEA data but where? Maybe to Digital pin if it is bidirectional or maybe to Ready pin or maybe to Mode pin. But there also may be different mode than UART and some security elements that deny to use non-original GPS module. I can try something, it's safe. I don't know nobody with original O-GPS1 otherwise it would be easy to hook it to DSO...

[awaldram]

Hi,

I am new here so forgive me if my questions are stupid.

Am I the only one who has the impression that even though the Debug mode is open now, we still can not save LensROMs on a K-30 or K-3?

If I press "ok" on these menu items ("lens rom dat camera =>sd") nothing happens, even though it happily saves camera log files to the card.

Has anyone managed to save a lensROM to SD card using specifically a K-30 or K-3?

@Shodan:
As you are searching for the bitmaps for the icons I wonder if you couldnt search for the "Test Mode" functions in the disassembled code. The test mode does have this function "Icon test". I am no great programmer, but wouldnt it sound worthwile to search the firmware for the text string "Icon test" and then check the code around it, since this obviously calls all the icons?

On previius cameras you had to first 'activate' the extended function via PKtether before the SD card 'Debug_enable' would work for extended functions so I suspect something similar is required to unleash full functioinality for the K3 and K30.

[Negative Creep]

Thanks for starting on this endeavour, i hope you and others can open up possibility of something similar to magic lantern for Pentax.
I cant offer much in the way of firmware hacking or the like, but i sent you £50 towards your goal.

[lister6520]

BTW did someone investigate how does O-GPS1 module communicate with pentax body? How about to make own GPS module?
I can see it use 4 pins of flash hot shoe connector decribed here (trigger is not used)
https://www.pentaxforums.com/forums/125-flashes-lighting-studio/246697-manual-flash-puzzle.html
I'm not familiar with this connector, what exactly is the digital pin? Is is just output or bidirectional? What protocol? I measured there is soft 3,23V after power on, other pins on 0 level. Then I found that GPS presence is indicated though Mode input pin. If pulled high (I just use resistor from Digital to Mode pin), then display react immediatelly and GPS menu is enabled (press INFO button twice and see compas icon on right side is active now). The question is how GPS module sends data. I guess that the module has 3,3V UART feeding classic NMEA data but where? Maybe to Digital pin if it is bidirectional or maybe to Ready pin or maybe to Mode pin. But there also may be different mode than UART and some security elements that deny to use non-original GPS module. I can try something, it's safe. I don't know nobody with original O-GPS1 otherwise it would be easy to hook it to DSO...

I have a DSO and an O-GPS1. I had decoded quite a lot of the P-TTL protocol a year or so ago. Never had a look at the GPS yet but maybe it's about time I do. The flash protocol isn;t too difficult to reverse engineer. My guess is that the GPS will be easier - I might give it a try the coming weekend.

[RayeR]

I have a DSO and an O-GPS1. I had decoded quite a lot of the P-TTL protocol a year or so ago. Never had a look at the GPS yet but maybe it's about time I do. The flash protocol isn;t too difficult to reverse engineer. My guess is that the GPS will be easier - I might give it a try the coming weekend.

Yeah, this sounds a promissing combination. I guess a very few peopele have O-GPS1 and DSO
I found that I was wrong with my first look. When Digital pin is pulled low with reistor it starts to transmit but also Mode and Ready transmits too! On digital there are some slower data, Mode and Ready are faster, looks like 115200. I'm confused that I see 3 different signals going from hotshoe but what pin is receiver? According to older flash pinout this pins must behave as input so they are bidirectional...
How much memory do you have on your DSO? And have it serial decoding capability? If it is UART, then hook some 3v3 FTDI232 adapter on it. It would be helpfull to record communication from camera turn on how GPS and body negotiate and how GPS sends data. I hope we will see classic NMEA data there. Magneto data could be added as another NMEA sentence.
Do you have published your notes about P-TTL protocol? Can I read them somewhere? I googled a lot but really nothing...

[Shodan]

I have a DSO and an O-GPS1. I had decoded quite a lot of the P-TTL protocol a year or so ago. Never had a look at the GPS yet but maybe it's about time I do. The flash protocol isn;t too difficult to reverse engineer. My guess is that the GPS will be easier - I might give it a try the coming weekend.

I would be really interested in this. If you can publish the spec I can also find the routines in the firmware. My gut feel is that Pentax can connect upto the hotshoe and get debugging out while the camera is booting - would be nice to know.

I hope we will see classic NMEA data there

I had a quick look and couldn't see NMEA strings in the firmware - not to say it's not being received by a special chip.

Thanks for starting on this endeavour, i hope you and others can open up possibility of something similar to magic lantern for Pentax.
I cant offer much in the way of firmware hacking or the like, but i sent you £50 towards your goal.

Thanks, it helps a lot!

I've just checked the firmware CPU_ROM_STORE is not supported on the K-30. The functionality just doesn't exist.

Can you see if the Lens ROM download functions are in there or if this is also just a dead menu entry?

[lister6520]

Yeah, this sounds a promissing combination. I guess a very few peopele have O-GPS1 and DSO
I found that I was wrong with my first look. When Digital pin is pulled low with reistor it starts to transmit but also Mode and Ready transmits too! On digital there are some slower data, Mode and Ready are faster, looks like 115200. I'm confused that I see 3 different signals going from hotshoe but what pin is receiver? According to older flash pinout this pins must behave as input so they are bidirectional...
How much memory do you have on your DSO? And have it serial decoding capability? If it is UART, then hook some 3v3 FTDI232 adapter on it. It would be helpfull to record communication from camera turn on how GPS and body negotiate and how GPS sends data. I hope we will see classic NMEA data there. Magneto data could be added as another NMEA sentence.
Do you have published your notes about P-TTL protocol? Can I read them somewhere? I googled a lot but really nothing...

I had posted my notes on this forum but cannot find that post so here is the info again:
P-TTL flash protocol reverse engineering.rar

Unfortunately it is all just my personal notes and somewhat muddled, not really intended for publication and might be a bit difficult to follow. However feel free to ask and I'll help you through it where it is too unclear.

The word document describes the function of the contacts and some basics of how the communication is formatted.

The excel sheets show the actual waveforms in detail, the bit by bit composition of the messages, translation of the values into real terms such as aperture, ISO, flash power and so on as well as a good number of actual sequences correlated to the actual flash settings and stuff.

This was all done with a K-r and a Metz 58-AF2. I initially used a DSO to figure out what the pins did, the various data rates and so on and once that was figured out I used a PIC microprocessor to pick up the signals from the hot shoe and convert them into ASCII strings which are then sent to the PC over a TTL to USB converter which appears to the PC as a serial port. The contents of the 'Sample sequences' sheet is that output pasted directly onto the worksheet and formatted a bit to make it tidy.

The data pin is indeed bidirectional but the data is sent/received synchronously being clocked by another of the pins. The third pin is somne sort of ready/attention indicator and I think also controls the direction of the transfer. One thing I have not yet understood is who controls the ready and clock pins. It seems that the clock is always stepped by the camera but I haven't yet confirmed that.

I am curious to find out whether the GPS uses the same principle or else a more conventional asynchronous mode with separate transmit and receive.

And here is something also about the optical signals used for remote flash:
https://www.dropbox.com/s/5u4oiqbop6vbkq0/Remote%20flash%20protocol%20reverse%20engineering.txt

---------- Post added 03-17-14 at 07:16 PM ----------

Ah just realised - so as not to create confusion please note that the first page on the excel sheet 'General info' is nothing to do with the Pentax protocol but rather some notes about the decoding program running on the PIC. The first table can however be used as the key to understanding the meaning of the sequences shown on the page 'sample sequences'. This is a sort of semi decoded formatting of the bits to make it visually easier to understand.

[Nass]

This is superb, great work!

[Shodan]

Can you see if the Lens ROM download functions are in there or if this is also just a dead menu entry?

There looks to be some code but I haven't RE any of it yet. From a quick look flashing the lens rom should work.

[RayeR]

Thanks lister6520, I'l have a look. I'm in a hurry...
Here's my yesterday measurement on empty hot-shoe. The communication is invooked only by pulling Digital pin low (I use 1k resistor). Any other pin is at log. 0 state and are not sensitive. I watch all pins at camera power on and there's no any communication like bootloader debug messages. Neither with open SD doors and Dev. Menu enabled. But maybe it can be enabled in FW...

After pulling Digital low it starts to transmit. You can see bursts every 125ms until 10s timeout is reached when no reply, then it's back to default state. Now I can see the communication looks like SPI with one data instead of UART. The Ready pin is surely the clock signal. It always have 4 ticks per symbol - data nibbles. It starts on 125kHz for first data and then switch to 250kHz. Probably older devices used slower clocks so it have backward compatability try and if no response it tries higher speed. The Mode pin transmits data. It looks like nibbles. I used MSb first for decoding, data sample on fall edge. There's sequence 006381700h on 125kHz and 4C50h on 250kHz. It repeats the same in every burst per 125ms.