[Shodan]

If you enable debug mode, you get debug menu in between normal menus, as always. That way you can at least adjust AF below what is allowed normally. This is from K-3, but you'll get the idea. And BTW, K-3 menu is almost 1:1 same. It's just missing BOOT BLOCK INFO, for whatever reason.

If you enable debug mode, you get debug menu in between normal menus, as always. That way you can at least adjust AF below what is allowed normally. This is from K-3, but you'll get the idea. And BTW, K-3 menu is almost 1:1 same. It's just missing BOOT BLOCK INFO, for whatever reason.

That menu is also enabled via [SW_DEBUG_MENU EN]

[Giklab]

Since [VLENS_CTRL] only displays "Lens Ctrl" on the screen I assume that there is a tool that can do stuff with the camera/lens. This implies one of the ports might let something through if prompted correctly.

[jup]

Since [LENS_CTRL] only displays "Lens Ctrl" on the screen I assume that there is a tool that can do stuff with the camera/lens. This implies one of the ports might let something through if prompted correctly.

[VLENS_CTRL] is some weird mode. It displays "SDM on" if you hold one of the buttons and "PZ On" if you hold other (I think AF and exp. comp but forgot). It cannot display anything else, there's no such think as SDM Off in FW. So is it for switching between powerzoom and SDM? Some debug mode? Maybe Shodan will tell us more when he gets to that routine.

[Deedee]

Hi

I think rather running an individual project; You should fork Welcome to Pentax Hack

They already made substantial progress.

Just a thought. Good luck and good going.

Cheers!

[aurele]

Hi

I think rather running an individual project; You should fork Welcome to Pentax Hack

They already made substantial progress.

Just a thought. Good luck and good going.

Cheers!

it seems that the whole thing is not moving since 2010 ...

[Shodan]

The Pentax hack site was applicable to camera software written in Latin (FP instruction set)
I'm working on a camera whose software was written in English (ARM instruction set)

We built on the shoulders of geniuses - but we are now way beyond that site...

quick uodate. I'm writing some automated scripts to try and break the back of the RE work. Then it might be good for others to have a look at the RAW code dumped fron IDA.

[Deedee]

You build on the shoulders of geniuses but we are now way beyond that site...

I really wish you good luck. I hope that you are successful.

Cheers!

[patarok]

So great to have someone here moving a little bit around on a new Pentax Hack. I am so happy that shodan is doing this.
I hope he will set up a dedicated website to his hacks. Maybe with new or better rehashed information on SYSPARAM parameters and other things that you can do with debug mode that really make sense.


good night!

[Duc-Driver]

Thank you Shodan, thank you very much.
Waiting long for a full debug on K5, now here it is!

[Duc-Driver]

Awesome, I was able to open debug menu on K5 (v1.14 firmware) using

00077430.505 and DEVELOP.MOD

K5 II and II/s model numbers should be 77680, 77681 respectively but I don't have the cameras to figure out the right numbers.

K5IIs don't work, can't get in debug menu with my camera.

Anyone an idea? Wrong numbers?

edit: For K5IIs it is 00077681.541

info: some can't read lensrom on K30!?

[thibs]

Wow this is almost unbeleivable !

Thank you Shodan and keep the good work.
If in nned of some money, I can paypal you some dollars, no problem !

[patarok]

K5IIs don't work, can't get in debug menu with my camera.

Anyone an idea? Wrong numbers?

edit: For K5IIs it is 00077681.541

info: some can't read lensrom on K30!?

here the reply to duc-drivers post:

i have done it on the k-5II so it should not be any problem on the K-5IIs.
First time I tried that on the new firmware 1.06 on the K-5II, I made a mistake that could happen easily to someone else:
I created a file called "00077680.536" with ms-notepad in which i wrote following lines:
[DEBUG_MODE EN]
[SW_DEBUG_MENU EN]
[OPEN_DEBUG_MENU]
[VLENS_CONTROL]

following the guidance of other people who successfully switched in to debug mode on their cameras i also created a second file with the naming:
DEVELOP.MOD

MY failure was not to check for a second suffix. That sounds weird but ms-notepad seems to tend to append a .txt suffix behind the suffix you gave the file when you save it as pure text file.
So i saw the "00077680.536" i created was actually named "00077680.536.txt" when i reviewed the contents of the directory that contained all the debug stuff with the "dir" command in cmd.exe. (You get to the old commandline when pressing WIN+R and then type in "cmd.exe" and then hit enter)

Then i reviewed the other file.
So essentially important is that you check those files for a "post-suffix".

Second: Many Operating Systems handle their files CASE-sensitive. So it really matters if you name the files with CAPITAL-letters or not.

Third: It may be a problem with the text-encoding if you are on strangeOS. Some operating-systems, file systems, applications and who the heck knows what else colludes here, tend to save text files with other encodings. Onlywin-Users may believe that a pure text file could only be saved with ANSI encoding. That is definitely not true. There are a lot of encodings, though ANSI was the most common in winworld for a long time and UTF-8 is also very common now on many Operating-Systems.
For our "endeavour" only ANSI-encoding will work. (At least it worked for me)

Fourth:
According to all I heard the files main name(in my case: "00077680") is given by the model number of the camera. Then there is a special suffix that could depend very much on the firmware version you have on your camera.
How to get to know that number:
Go download the latest frmcrypt.exe with the link on Welcome to Pentax Hack, download the firmware corresponding to the one that is installed on your camera from ricoh-imaging.
extract that firmware on to your hdd.
put the *.bin file (the firmware binary) into the same folder where your frmcrypt.exe sits.
Then go and run "cmd.exe" by hitting "WIN+R" and then type in "cmd.exe"
dir to the folder and then run:
frmcrypt.exe *.bin *.out
where "*.bin" has to be replaced by the filename of your firmware binary and "*.out" should be named to your liking.
Then you go and open that "*.out" file with notepad or some other text-editor.
hit ctrl+f.
then you type in "%03d". Hit ENTER.
the editor should highlight the string we have searched for. one or two words right to "%03d" you should find something like "C:\KB536.BIN" that is what we are searching for.
The 3 digits 536(in my case, with firmware 1.06) is what the suffix should be named with.

Fifth:
When you are done with that, the files "modelnr.%03d" and "DEVELOP.MOD"(which should or at least can be an empty file) should be copied to the root of the SD-Card in your Camera.

Sixth:
If you followed those steps, you should:
Turn off the Camera and turn it back on whilst pressing the MENU button(on the DSLR) AND leaving the card door open.
Do not hesitate. The screen may stay black for a short time, do not worry.
Given that you did all entries like i did(I wrote every entry to my modset in this post), you should see Development Menu1 on your screen.
there are many options. If you want to know what all that should be good for, you should read a pentax service manual. (at least for the older models you can download a file from "www.pentax-hack.info")
WARNING WARNING and another WARNING! Never do panic. Also do not do anything when you do not know what you are doing.
I also will have to read a service manual first before i can change or modify anything. there is no such thing as a neo. Everything that a human being can now, it has to learn before.
So actually there are only a few useful things that you can do with this, if you do not know how to program for microcontrollers and how to use the fujitsu IDE to develope software for cameras like this.
ONE thing that can be done is switch off SDM on lenses and force them to use the motor drive shaft instead for Autofocusing.
there are tutorials on the internet on how to do so.

one of them should be located at:
https://www.pentaxforums.com/forums/10-pentax-slr-lens-discussion/208353-how-...m-f-2-8-a.html
another one:
How to deactivate SDM and allow for screw drive autofocus with DA* 16-50mm f/2.8 - Le site des amateurs de PENTAX

and in german:
Deaktiverung des SDM an DA* Linsen -> HOW TO - DSLR-Forum

Please mind that every different lens may(or for sure will) need a different hexadecimal modification in its rom.!!!!!!!!!!!!!!!!!!!!!!!!

Another thing, that most people think is useful to them, is turning off "Dark Frame Substraction" this shortens the time the camera needs for postprocessing after taking long expoosure shots.

Maybe if we tinker a little bit, we could get better noise reduction on our cameras. But that would need much more experience and knowledge than i have at the moment.

Everything else you might like to change or tinker around leave that to the real Hackers and people with very much programming experience.

BACK TO THE MAIN PURPOSE OF ALL THIS -> down and upload lensroms.

maybe you panic and think "oh my good i am missing that menu on my camera. Oh no! All for the birds." Stay calm. i also almost lost hope. Because it may seem to you that there is only one page of options
when you switch on your camera into debug mode with the given flags in that modset file named with the number.
just go down the menu and e voila the next page of the debug menu appears. When you are on page 4 that is called "Development Menu4"
You then should see options:
LENS ROM DAT SD=>CAMERA
LENS ROM DAT CAMERA=>SD


Some more nerve saving tipps:
When you try to leave that Development Menu by pressing the MENU button, the screen stays black in first place.
Then you have to press the shutter release button halfway down.
After you have done that the camera shows a string on screen that says "DEBUG MODE".
When you see this string just press the INFO button and the normal display appears on the lcd.
It is almost as in normal mode, except when you press info a lot of times so you go and see the water level display, you can not go further. You are maybe stuck with that "DEBUG MODE" info on your screen.

in case of emergency, you always can go into the cameras normal menu where inbetween custom properties tab and the tab left to it, a test mode menu appears where you can switch off debug menu.
Very seldom, but it happens in some cases when you play with the real debug functions of the camera. The camera can get stuck awefully bad.
No turning back on, some info is steadily showing up on the monochrome lcd on top of the body.
Solution:
Do not panic. Switch off. Open the door pull out the battery. With no battery inside the camera turn the lever like you would do when switching it back on and push the shutter release button for at least 5 seconds.
Then turn the lever back into the OFF position, put back the battery in to the camera close all doors, pray to god and turn it back on.
REMBER YOU ARE DOING ALL THIS ON YOUR OWN RISK!
DO NOT BLAME ME, OTHER HACKERS OR PEOPLE WHO
PUT TUTORIALS LIKE THIS ONLINE, FOR ANY HARM THIS OR ALIKE PROCESSES DO TO YOUR PENTAX DSLR!!!!
And at DO NEVER!!! NEVER blame Pentax or Ricoh for it if you brick your Camera.

If you really bricked it, it is on your own decision to kindly ask a service partner if he could do anything for you or your camera.
he may offer you to buy it for spare parts.
Or you could send it to shodan, and be one of the first with a Custom Hack Pentax if you talk with him about it first and he agrees to sending you the camera back on your own cost.

From here on you should be cool with doing lensrom modding according to those tuts i gave you the link for in this post.

If you do not see those options in Development Menu 4 or do not know how to go on further, then please do yourself a favor and stop. just give up.
if everything goes fine, help is already on the way.
There is one person trying to deliver a complete solution for all your needs that is a kind of CHDK or Magic Lantern for Canon Cameras.
Maybe you already read his first post in this thread.
If you want to help him, try to send private messages to him. AFAIK he is in need of testers, when he is done with coding, and he would be happy if some peeps would donor him actual pentax DSLR models that maybe have some malfunctions like a destroyed display(i guess he could hook up an hdmi display for his work on the cameras) or a shutter that jams sometimes.(So that those malfunctions would not affect his work on extending firmware functions of the camera).
As i read it, he will work everything out for the K-30 in first place, and then (maybe according to what models he gets donored first) for the other Pentax DSLR's.

So i wish you much luck with whatever you trying to do with it. Go and support Shodan!
I hope i helped some people with this.

[RayeR]

Hi Shodan,
nice to see that things was started moving on new Pentax cams and you started this brave way
Yesterday I found this interesting thread and read it all. I saw that you have experiences with Canon CHDK porting. If you remember the ancient age of old Digic1 Powershot running ROM-DOS, I was the one who wrote utilities running on it (like adding a histogram for powershot A70, tetris game, etc.). I started when many of hacking was already done so I could work on top of it. I'm electroengineer and programming and reversing is rather my personal hobby. Later I use mini-CHDK for DSLR on EOS 350D. Now, last year I decided to move on Pentax and bought K-30 - It's quite feature rich cam compared to my old EOS and I'm satisfied with it. I looked for some hacks just for fun but found only one old site of Vitaliy Kiselev that covers pre-ARM models. He did interesting work but things was changed and it's obsolete and unusable on new cams. Unfortunatelly I'm no longer a student with plenty of free time to spend on disasm, I could help with some testing...

I tried to enable debug menu according to your info and try to run simple script that it seems to work but there's a problem with disabling script.
First I'd like to sumarize available options for 00077650.524 file, I tried this:
[OPEN_DEBUG_MENU] - works
[DEBUG_MODE EN] - works
[SW_DEBUG_MENU EN] - nothing happen
[SCRIPT_EN_MODE EN] - works but it cannot be disabled.
[VLENS_CONTROL] - nothing happen
This options in file seems to be mirrored in camera NV memory.

DEVELOP.MOD - is there any options for it? I just created empty file, seems to be only needed for debug unclock...

I tried to run a simple script AUTORUN.524
PRINT "Hello World";
FILEOUT "TEST";
EXIT

When I enabled scripting in debug menu or by [SCRIPT_EN_MODE EN] it was started executing on camera power on. But it disabled debug menu so I cannot simply disable it from the camera. I connect to PC and edit 00077650.524 to set [SCRIPT_EN_MODE DIS] but nothing changed. I tried both with card door open and close, pressing menu on start, removing a battery for short time - still same. Even if I deleted 00077650.524 and DEVELOP.MOD still starting the script. So you can see that this config options are stored somewhere else and may not be easyly restored to default. So I have to delete script itself and when upload 00077650.524 and DEVELOP.MOD I can disable scripting in menu and then it didn't execute uploaded script.

I tried to save various data from debug menu to SD card but not all work for me. Eg. CPU data displayed "error..." and lens rom data didn't displayed error but no file was created. I was able to save this: BOOTBLK.BIN, KB524.ADJ, KB524CAM.LOG

For further work we would need to find some safe way (bootstrap) how to load a binary module from SD card. Maybe it could be done via firmware upgrading menu but for easier accessibility then it will need to patch the FW. Also there's still problem with checksum to be able to make some mod. A guy haute found how to bypass checksum on K-7, see here Pentax hack status - Personal View Talks but on K-30 the header looks different and probably it will not be so easy. Also it seems that decripting is not done in full range yet. You should ask Vitaliy personally for help on FRMCRYPT I think he has sources.

[Giklab]

[SCRIPT_EN(able)_MODE_EN(glish)]?

[KevinE]

Sure wish I understood all of this...