[Shodan]

For further work we would need to find some safe way (bootstrap) how to load a binary module from SD card. Maybe it could be done via firmware upgrading menu but for easier accessibility then it will need to patch the FW. Also there's still problem with checksum to be able to make some mod. A guy haute found how to bypass checksum on K-7, see here Pentax hack status - Personal View Talks but on K-30 the header looks different and probably it will not be so easy. Also it seems that decripting is not done in full range yet. You should ask Vitaliy personally for help on FRMCRYPT I think he has sources.

Agreed. I've been putting in a lot of work reverse engineering the firmware upgrade process. I'm also desperate to get my hands on the bootloader.

I tried to save various data from debug menu to SD card but not all work for me. Eg. CPU data displayed "error..." and lens rom data didn't displayed error but no file was created. I was able to save this: BOOTBLK.BIN, KB524.ADJ, KB524CAM.LOG

I'd love to know what those files are

[SW_DEBUG_MENU EN] - nothing happen

You need to open the menu and keep pressing right.

[SCRIPT_EN_MODE EN] - works but it cannot be disabled.

[SCRIPT_EN_MODE DIS]

I could help with some testing...

You don't happen to have a copy of IDA Pro?

Attached Images

 

[jup]

[VLENS_CONTROL] - nothing happen

It's [VLENS_CTRL] but I don't think that's very useful. It displays SDM On, PZ On when you hold specific buttons.

Also:
[DSP_ROM_STORE] - will dump (unencrypted) DSP firmware
[NORMALLY_CLOSED_MODE EN] - no idea what this does but it changes the N-DIS flag in debug menu
[LIVE_VIEW_TEST_MODE EN] - same thing for LV_TEST flag

and bunch of others. They're easy to read from dump I got from [DSP_ROM_STORE] and (I guess), from unencrypted firmware (don't need IDA for that, which I don't have). There are also some interesting switches on K-3, but lets keep this to K-30 for now.

[jup]

Agreed. I've been putting in a lot of work reverse engineering the firmware upgrade process. I'm also desperate to get my hands on the bootloader.

BTW, Shodan, K-30 will read unencrypted files from SD card - KB524.BIN, KB524C.BIN, KB524B.BIN and such. These should be DSP firmware, CPU firmware, both together. Unfortunately, I still get error when I try to put firmware dump there, but using these might be easier then breaking the encryption.

Edit: I think they also have some checksum/size check or probably both, since I either get "Card error" or "Firmware data error".

[Shodan]

Reverse engineered the K30's checksum. What's really nice is that if you set the correct magic byte in the firmware then it isn't even checked...

[C#] Pentax K30 firmware checksum - Pastebin.com

[Shodan]

Hmmmmm I've checked my checksum program against the ROM i'm decompiling. The DSP firmware is correct but the CPU firmware isn't. I suspect that the frmcrypt.exe tool isn't correctly dumping it out.

I think i've found the decryption function so I may have to write my own decryptor

[aurele]

it appear that you are making progress, that's cool, that's great !

[RayeR]

>[SW_DEBUG_MENU EN]
You need to open the menu and keep pressing right.

I tried again but I didn't see anything new. Does this option needs to be combined with [OPEN_DEBUG_MENU]?
BTW when I have [OPEN_DEBUG_MENU] and [DEBUG_MODE EN] then dev. menu opens on every turn on even with closed card doors. When CARDDOOR OPEN in enabled in menu, camera then allows operation with doors opened.

[SCRIPT_EN_MODE DIS]

I tried this as I wrote in my previous post but I cannot disable script any other way than deleting script file. You can try it. I'm using latest FW 1.05.
BTW I wonder for what purposes the scripting language is there. If it cannot read from files and memory just only print some constants and variables on screen... It would be used for some automated testing and report generating if it have some more power commands...

[VLENS_CTRL]

Yes, this works but seems nothing usefull. I pressed probably all buttons but all it can display is On for SDM and PZ (I have mounted a SDM lens)

[DSP_ROM_STORE]

Yes, this dumped file KB524DSP.BIN in size 12 582 912 B, almost as a whole firmware (FWDC215B.BIN 1.05 file is 12 845 056 B). It looks like decrypted FW file with different few kB at start of the file. At offset F00h both files seems to be same (some header "HOKKTKIYHTNTMU" string). I also tried [CPU_ROM_STORE] bot got only "ERROR ..." message, no file created. From file size it seems tkat CPU part is only 262 144 B.

Hmmmmm I've checked my checksum program against the ROM i'm decompiling. The DSP firmware is correct but the CPU firmware isn't. I suspect that the frmcrypt.exe tool isn't correctly dumping it out.

Try to contact Vitaliy Kiselev, he knows that frmcrypt.exe is not perfect and there are still some undecrypted parts, he may give access to sources or some advices. He made update to support K-30, K-5 II...

You don't happen to have a copy of IDA Pro?

Yes, I have ver. 5.5 but I use it ocassionally and mostly for x86 MZ or ROM code. I'm not IDA expert, it's very complex and feature rich tool and I still don't know all features - e.g. I don't know that it can make C code from DASM (if my ver. even supports it). I have only few fime at night for playing with it. Maybe it would be good idea that you wrote some quick tutorial into your 1st post how to load decr. FW file to IDA - offsets to important blocks, where is entry point, what is base address of code in CPU address space...
Or maybe better to start some wiki page to store knowledges in well arranged way.

[SlicaR]

Hi everyone!
Have you got any ideas how to get to the debug mode (AF test) i K-50 (fw. 1.01)? I've big problem with front focus.
Please help.

[Shodan]

RE'ing the firmware decryption routine turned out to be harder than I thought. So instead I ripped out the original decryption assembly, recompiled it and ran it on my RaspberryPi. After a little fiddling with the endian-ness I've got the firmware that the actual camera uses in the flash routines.

I've uploading the XOR key i'm using here:
Download xor.key from Sendspace.com - send big files the easy way

If you XOR the K-30 v1.5 firmware with this you'll get the correct firmware.

Now I've got a working decryptor I can properly debug it and write some nice C#. Then I'll probably release some firmware tools that allow you to decrypt and checksum the binary.

[Shodan]

Now I know how to decrypt the firmware and how to compute the checksum I can now make changes to the firmware.

I took a risk and tried changing one of the Debug menu titles. Looks like it worked.

[LeFanch]

Awesome!

[mtux]

Wow! well done.

[seyfer]

Great work! I can donate some money if can help.

[Adam G]

This makes me sad that all I can do is push the shutter button.

[jedie]

Great project!

What's about to collect all Information into a public Wiki?
Move information from pentax-hack.info into Wiki, too. (Because the page seems to be "unmaintained", isn't it?)

Maybe at wikia.com ? There is also Magic Lantern Firmware Wiki