[Shodan]

Very interesting work, now to do the same with something more interesting attached.

I've also considered that if there is a UART that is accessible with the shell off it could well be over USB.

---

Last edited by Shodan; 03-18-2014 at 10:08 AM. Reason: can't write

For P-TTL you should have a look at the patents.

There is a German Pentax patent # DE000010146135B4 you can download here
https://depatisnet.dpma.de/DepatisNet/depatisnet?action=einsteiger
which has 86 pages.

It is quite detailed on the communications.

[RayeR]

For P-TTL you should have a look at the patents.

There is a German Pentax patent # DE000010146135B4 you can download here
https://depatisnet.dpma.de/DepatisNet/depatisnet?action=einsteiger
which has 86 pages.

It is quite detailed on the communications.

Thanks,
better link: https://depatisnet.dpma.de/DepatisNet/depatisnet?window=1&space=menu&content...s=86&pdfpage=1
to save click Volldokument laden

This also looks interesting and in English!
http://www.freepatentsonline.com/6498901.html

>Shodan
I doubt about shell over USB... you may try to search something that looks like an USB CDC descriptor...
I forgot to mention that if pin Digital is connected to Mode (a loopback), then GPS menu become immediatelly available (and communication didn't stop after 10s timeout). Digital pin is bidirectional and behaves like input that understand data clocked by Ready pin. Seems there will be no NMEA but probably some proprietary structure tranfered by packets...

[Shodan]

Does anyone have a copy of Softune Workbench V6? I think this is the toolchain that built the original firmware. If I could get some of the files from it I can make signature and find the same ones in the K-30 firmware.

It's free but comes on CD and my Google-fu is weak.

[jcdoss]

I donated. Keep it going, even though I don't understand a lick of what you guys are talking about.

[Shodan]

I just found the technical manual for the operating system that the camera runs. I'm pretty sure it's still REALOS which has now been ported to ARM. Details of the ARM port can be found here:
http://edevice.fujitsu.com/fj//MANUAL/MANUALp/en-pdf/uITRON-MN706-00012-1v0-E.pdf

It is already coming out with some good stuff. Taking a look at the DSP dump I think i've found the kernel initialization code.
The following is from the manual page 71.

Code:

; --- Initialise stack pointer registers
MSR CPSR_c, #Mode_SVC:OR:I_Bit:OR:F_Bit ; SVC Mode
LDR SP, =_kernel_StackSVC_End ; Stack Set
MSR CPSR_c, #Mode_FIQ:OR:I_Bit:OR:F_Bit ; FIQ Mode
LDR SP, =_kernel_StackFIQ_End ; Stack Set
MSR CPSR_c, #Mode_IRQ:OR:I_Bit:OR:F_Bit ; IRQ Mode
LDR SP, =_kernel_StackIRQ_End ; Stack Set

This is from the cameras DSP dump which I think is actually a dump of the 'user program' as 0xA0000000

Code:

ROM:A00001E8                 MSR             CPSR_c, #0xD3 ; 'Ë' ; Transfer Register to PSR
ROM:A00001EC                 LDR             SP, =0x4200 ; Load from Memory
ROM:A00001F0                 MSR             CPSR_c, #0xD1 ; 'Ð' ; Transfer Register to PSR
ROM:A00001F4                 LDR             SP, =0x4640 ; Load from Memory
ROM:A00001F8                 MSR             CPSR_c, #0xD2 ; 'Ê' ; Transfer Register to PSR
ROM:A00001FC                 LDR             SP, =0x4600 ; Load from Memory

This is almost identical and if true would give the following values.

kernel_StackSVC_End = 0x4200
kernel_StackFIQ_End = 0x4640
kernel_StackIRQ_End = 0x4600


I'll keep on plodding through the document tonight...

[derekkite]

What files are you looking for?

[Shodan]

ARM lib files and associated header. I can then use those to make something called FLIRT signatures.

Ideally i'd like the full installer.

[Frater]

Hi, now I'm curious regarding beneficial uses of the debug mode.

Is there a way to switch of the mandatory RAW denoising in K-5*, which otherwise kicks in at somewhere between ISO=1600 and 3200?
Background:
- I don't want the body to do its lower-quality, superficial RAW denoising, but want to use PC Software (which fully harnesses the PC processor power and is generaly superior for such a task).
- the K-3 would benefit as well. But I don't know the exact ISO value where RAW denoising kicks in there, because the denoising is either of a type not detected by DxOMark's "auto correlation" test, or they simply forgot to tag smoothed ISOs as "smoothed" in their charts.
Also for the K-5* I don't now the exact threshold, because DxOMark only tests full EV ISO steps, not half or third steps. But if this RAW denoising cr*p is switched off alltogether, one simply woudln't need to care any longer.

With older cams, e.g. K20D, one could switch off RAW denoising via setting the parameter [DISABLENR] 1@ in a SYSPARAM.TXT control file, which was evaluated only in debug mode.

Would be great, if similar tweaks/controls would be revealed also for the recent bodies such as my K-5 II ?
Looking forward to that, would be a great bonus for high ISO usefulness

[Shodan]

I can only say about the K-30 but DISABLENR no longer exists. However DISABLE_ALL_NR does.

[RayeR]

Shodan,
Vitaliy though they still use RealOS. Here is some info about it (right bottom)
Downloads
There's REALOS kernel
Libraries and headers, maybe it helps you.

[Shodan]

Yeah I've seen that. The older stuff will only be helpful if it supports ARM.

While I can contribute little, I can just show some pages I stumbled upon:

This here seems to be a bunch of guys working on a very similar topic on the yellow side:
https://nikonhacker.com/viewtopic.php?f=2&t=1623&sid=c5fea046fe54da8ec3357458bdbe649a
https://nikonhacker.com/wiki/Fujitsu_FR

And this is an archived page:
Microcontrollers - Application Notes : FUJITSU United States

I wonder if the update file here Development Tools : SWB (FR) V6 would contain anything of interest to you.

[lister6520]

I was all set up to start figuring out the GPS protocol but I've hit a snag which is going to delay me somewhat. For the flash I have used a P-TTL extension lead which I slightly modified to tap into the connections but for some reason the GPS is not communicating at all with the camera when I connect it via the extension cable, even before I have conencted anything to the tapped connections. I've tried also with a second splitter cable and it doesn;t work either - seems it likes to be connected directly to the hot shoe.

I am thinking it is excessive capacitance. The thing is I don't to ruin the two cables I have beyond the minor intervention I made to tap into the connections. I've just ordered a cheap one from Poland on eBay which I'll then dismantle and rebuild wiring the two ends together with very short lengths of single wires. Hopefully that will work.



Is there anyone who has an O-GPS1 and a P-TTL extension cable who could try see if the GPS can actually work on an extension cable, maybe I am just unlucky and the specific cables I have are the problem?



If I do manage to figure it out my next project will be a device to allow me to dial in a compensation for the magnetic compass error. The idea would be that a PIC processor would sit in between the GPS and the camera passing on most of the data unchanged but then when it recognises a compass reading it would add an offset to it and send on the modified version instead of the original. Well that's the theory at least. Meantime I'm still hoping Pentax would include such functionality in the next firmware update and saving me a lot of effort.

[StigVidar]

Is there anyone who has an O-GPS1 and a P-TTL extension cable who could try see if the GPS can actually work on an extension cable, maybe I am just unlucky and the specific cables I have are the problem?

Does not work with my Meike MK-PT01 cable either.