Win a Pentax Limited Lens: Raffle Now Live!

tr13 · 07-30-2009, 10:45 AM

Originally posted by eurostar

I don't understand how could you have the M lenses to behave like A ones with just software modifications, when the problem is hardware based. Same for configuration of "each lens", when the non-AF ones have no means to tell the camera their identity...

As for how we could make M lense to behave like A lens - it is quite easy. All that we need to change is lever moving distance. As M lenses have different distance to diaphragm relation.
DSLR is able to stop-down A lens during shot, so it is possible to properly stop-down M lens.
And all data we need is open aperture.
I want to make special text configuration file and use button to scroll through all available lenses (so you could instantly set SR distance, exposure compensation, aperture, AF compensation value, etc).

tr13 · 07-30-2009, 10:47 AM

Originally posted by KyPainter

Isn't it available for download from fujitsu or is this a limited functionality version?

Download require registration and require you to be in US, Mexico, rtc
This is the reason that we need freely available version.
If you could register and download it, just share it with us.

KyPainter · 07-30-2009, 11:11 AM

Originally posted by tr13

Download require registration and require you to be in US, Mexico, rtc
This is the reason that we need freely available version.
If you could register and download it, just share it with us.

Ok, I see. Do they block downloads by IP address, or do they just not give the passwords out if you are out of North America?

For what it's worth to anyone that's interested. It appears that the registration process is just their way of getting your contact information for sales calls. I faked all of mine, put "none" in the company field, and somewhere said I was a student. They still gave me a password for installation and told me that I could buy hardware kits at digikey. It's not a product key, no serial number or such, just a generic password.

Unless they specifically block downloads by country you can download the software prior to registration or just after completing and submitting the registration form. I forget which, but you don't have to wait for a password to download it.

Edit: I'd post the download link and password but I don't think that's right for me to do in this forum, even though it's obvious that the registration process and restrictions are there for reasons other than protecting their software (it's for sales, marketing, territory protection, etc.).

deejjjaaaa · 07-30-2009, 11:25 AM

Originally posted by tr13

Download require registration and require you to be in US, Mexico, rtc
This is the reason that we need freely available version.
If you could register and download it, just share it with us.

enjoy - FMEMDVD52 (that is a password - let us know if you still can't download the setup itself).

Last edited by deejjjaaaa; 07-30-2009 at 11:37 AM.

bc_the_path · 07-30-2009, 11:41 AM

Unfortunately, mine is not a contribution but a request!

Could someone please hack the firmware to
- allow the user use either the HSM or the body-based autofocus?

This is especially handy for those with a faulty (and off warranty) HSM.
My 50-135mm has just started to behave badly, that is why!

Good luck!

tr13 · 07-30-2009, 12:02 PM

Originally posted by bc_the_path

Unfortunately, mine is not a contribution but a request!

Could someone please hack the firmware to
- allow the user use either the HSM or the body-based autofocus?

This is especially handy for those with a faulty (and off warranty) HSM.
My 50-135mm has just started to behave badly, that is why!

Good luck!

OK. Added to my wishlist.
I'll add wishlist page to site as soon as we decrypt or dump firmware.

tr13 · 07-30-2009, 12:03 PM

Originally posted by deejjjaaaa

enjoy - FMEMDVD52 (that is a password - let us know if you still can't download the setup itself).

Thanks guys.
Softune is now available on my site, password is also under download link.
Thanks again.

tr13 · 07-30-2009, 09:19 PM

It looks like DSLRs use Fujitsu Milbeaut M-4 MB91680 with REALOS.
Next task is to find libraries of REALOS and try to find same functions inside K10D firmware.
As firmware have only one text string that is similar to terms used in REALOS (beside info I fot that compact Samsung cameras really use REALOS).

UPDATE.
I also managed to archive some progress in decryption of new firmwares. At least I can now decrypt from 1/2 to 3/4 of file (but each 4th byte is wrong :-) )
My assumptions were right as XOR values depend on address or offset.

Das Boot · 07-31-2009, 08:08 PM

I find it interesting that every fourth byte (all the ones you show) are loaded to the right or towards the LSB. I'm not sure if it has a name, but let me illustrate my point:

0x01 - 0 0 0 0 0 0 0 1
0x03 - 0 0 0 0 0 0 1 1
0x07 - 0 0 0 0 0 1 1 1
0x0F - 0 0 0 0 1 1 1 1
0x1F - 0 0 0 1 1 1 1 1 <- Didn't see this one in your example
0x3F - 0 0 1 1 1 1 1 1
0x7F - 0 1 1 1 1 1 1 1
0xFF - 1 1 1 1 1 1 1 1 <- Didn't see this one either

There is obviously a pattern here.... Do all of the discrepancies only use these numbers? This could be some sort of checksum/shift register....

tr13 · 08-02-2009, 10:54 PM

Sorry, didn't read forum last days.
But I have very good news.

I decrypted all firmware files :-) Not all, to be correct, as second small part is encrypted differently.
Information soon will be available on my site.

UPDATE.
I placed information on site.
Small decryption tool is also available.

Here is illustrations:

Become

snogglethorpe · 08-03-2009, 12:00 AM

Originally posted by tr13

I decrypted all firmware files :-)
Information soon will be available on my site.

Excellent!

(that was fast!)

Photix · 08-03-2009, 12:51 AM

Very good job ! and very fast

Do you think it is possible to have access to the decrypted parts. Perhaps we can give you some help by reading it ?

tr13 · 08-03-2009, 01:56 AM

We just have 256kb from 8Mb file still encrypted.
I believe that this part will be decrypted soon also. Or dumped.

We also have enought parts to start reversing.
Search FR assembler reference on google and use either provided FR disassembler
or IDA.

Shantz · 08-03-2009, 04:08 AM

Hi tr13,

This may be a dumb question, but here goes: Is there any way to put the K20D firmware on a GX-20?

I couldn't find anything about this on any forum.

Thanks!

tr13 · 08-03-2009, 04:23 AM

May be it is possible.
You'll need change file headers (for original encrypted firmware).
One header is at start of file.
Second at 0x800000.
Result could be either working or bricked camera.
Most possible it'll work but will be completely unusable, as all settings (read service manual to understand that it is bunch of them) will be wrong.
And why do you need K20D firmware?

07-30-2009, 11:11 AM	#48
KyPainter Forum Member Join Date: Oct 2007 Location: Owensboro, Kentucky Posts: 69	Originally posted by tr13 Download require registration and require you to be in US, Mexico, rtc This is the reason that we need freely available version. If you could register and download it, just share it with us. Ok, I see. Do they block downloads by IP address, or do they just not give the passwords out if you are out of North America? For what it's worth to anyone that's interested. It appears that the registration process is just their way of getting your contact information for sales calls. I faked all of mine, put "none" in the company field, and somewhere said I was a student. They still gave me a password for installation and told me that I could buy hardware kits at digikey. It's not a product key, no serial number or such, just a generic password. Unless they specifically block downloads by country you can download the software prior to registration or just after completing and submitting the registration form. I forget which, but you don't have to wait for a password to download it. Edit: I'd post the download link and password but I don't think that's right for me to do in this forum, even though it's obvious that the registration process and restrictions are there for reasons other than protecting their software (it's for sales, marketing, territory protection, etc.). Last edited by KyPainter; 07-30-2009 at 11:23 AM.

07-30-2009, 09:19 PM	#53
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	It looks like DSLRs use Fujitsu Milbeaut M-4 MB91680 with REALOS. Next task is to find libraries of REALOS and try to find same functions inside K10D firmware. As firmware have only one text string that is similar to terms used in REALOS (beside info I fot that compact Samsung cameras really use REALOS). UPDATE. I also managed to archive some progress in decryption of new firmwares. At least I can now decrypt from 1/2 to 3/4 of file (but each 4th byte is wrong :-) ) My assumptions were right as XOR values depend on address or offset. Last edited by tr13; 08-02-2009 at 10:53 PM.

07-31-2009, 08:08 PM	#54
Das Boot Veteran Member Join Date: Feb 2008 Location: Sparkle City, South Cackalacky Photos: Gallery Posts: 689	I find it interesting that every fourth byte (all the ones you show) are loaded to the right or towards the LSB. I'm not sure if it has a name, but let me illustrate my point: 0x01 - 0 0 0 0 0 0 0 1 0x03 - 0 0 0 0 0 0 1 1 0x07 - 0 0 0 0 0 1 1 1 0x0F - 0 0 0 0 1 1 1 1 0x1F - 0 0 0 1 1 1 1 1 <- Didn't see this one in your example 0x3F - 0 0 1 1 1 1 1 1 0x7F - 0 1 1 1 1 1 1 1 0xFF - 1 1 1 1 1 1 1 1 <- Didn't see this one either There is obviously a pattern here.... Do all of the discrepancies only use these numbers? This could be some sort of checksum/shift register.... Last edited by Das Boot; 07-31-2009 at 08:49 PM.

08-02-2009, 10:54 PM	#55
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Sorry, didn't read forum last days. But I have very good news. I decrypted all firmware files :-) Not all, to be correct, as second small part is encrypted differently. Information soon will be available on my site. UPDATE. I placed information on site. Small decryption tool is also available. Here is illustrations: Become Last edited by tr13; 08-03-2009 at 12:02 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
DFS hack	eccentricphotography	Pentax DSLR Discussion	24	10-12-2010 11:08 AM
Yet another hack job -- OM to PK ??	RioRico	Pentax SLR Lens Discussion	15	10-07-2010 07:49 AM
K20D Firmware Ver - Pentax Web Site Ver?	ChipB	Pentax DSLR Discussion	2	02-23-2010 04:14 PM
Teleconverter hack?	Raptorman	Pentax SLR Lens Discussion	4	01-20-2010 03:51 AM
News Site News and Site Suggestions hidden from guests	Adam	Site Suggestions and Help	0	11-30-2009 12:38 AM

07-30-2009, 10:45 AM	#46
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Originally posted by eurostar I don't understand how could you have the M lenses to behave like A ones with just software modifications, when the problem is hardware based. Same for configuration of "each lens", when the non-AF ones have no means to tell the camera their identity... As for how we could make M lense to behave like A lens - it is quite easy. All that we need to change is lever moving distance. As M lenses have different distance to diaphragm relation. DSLR is able to stop-down A lens during shot, so it is possible to properly stop-down M lens. And all data we need is open aperture. I want to make special text configuration file and use button to scroll through all available lenses (so you could instantly set SR distance, exposure compensation, aperture, AF compensation value, etc).

07-30-2009, 10:47 AM	#47
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Originally posted by KyPainter Isn't it available for download from fujitsu or is this a limited functionality version? Download require registration and require you to be in US, Mexico, rtc This is the reason that we need freely available version. If you could register and download it, just share it with us.

07-30-2009, 11:25 AM	#49
deejjjaaaa Veteran Member Join Date: May 2007 Location: steel city / rust belt Posts: 2,043	Originally posted by tr13 Download require registration and require you to be in US, Mexico, rtc This is the reason that we need freely available version. If you could register and download it, just share it with us. enjoy - FMEMDVD52 (that is a password - let us know if you still can't download the setup itself). Last edited by deejjjaaaa; 07-30-2009 at 11:37 AM.

07-30-2009, 11:41 AM	#50
bc_the_path Veteran Member Join Date: Mar 2007 Location: Ankara, Turkey Photos: Gallery Posts: 401	Unfortunately, mine is not a contribution but a request! Could someone please hack the firmware to - allow the user use either the HSM or the body-based autofocus? This is especially handy for those with a faulty (and off warranty) HSM. My 50-135mm has just started to behave badly, that is why! Good luck!

07-30-2009, 12:02 PM	#51
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Originally posted by bc_the_path Unfortunately, mine is not a contribution but a request! Could someone please hack the firmware to - allow the user use either the HSM or the body-based autofocus? This is especially handy for those with a faulty (and off warranty) HSM. My 50-135mm has just started to behave badly, that is why! Good luck! OK. Added to my wishlist. I'll add wishlist page to site as soon as we decrypt or dump firmware.

07-30-2009, 12:03 PM	#52
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Originally posted by deejjjaaaa enjoy - FMEMDVD52 (that is a password - let us know if you still can't download the setup itself). Thanks guys. Softune is now available on my site, password is also under download link. Thanks again.

08-03-2009, 12:00 AM	#56
snogglethorpe Forum Member Join Date: Jul 2009 Location: Tokyo, Japan Posts: 71	Originally posted by tr13 I decrypted all firmware files :-) Information soon will be available on my site. Excellent! (that was fast!)

08-03-2009, 12:51 AM	#57
Photix New Member Join Date: Aug 2009 Posts: 1	Very good job ! and very fast Do you think it is possible to have access to the decrypted parts. Perhaps we can give you some help by reading it ?

08-03-2009, 01:56 AM	#58
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	We just have 256kb from 8Mb file still encrypted. I believe that this part will be decrypted soon also. Or dumped. We also have enought parts to start reversing. Search FR assembler reference on google and use either provided FR disassembler or IDA.

08-03-2009, 04:08 AM	#59
Shantz Junior Member Join Date: Jul 2009 Location: Bucharest Photos: Gallery Posts: 43	Hi tr13, This may be a dumb question, but here goes: Is there any way to put the K20D firmware on a GX-20? I couldn't find anything about this on any forum. Thanks!

08-03-2009, 04:23 AM	#60
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	May be it is possible. You'll need change file headers (for original encrypted firmware). One header is at start of file. Second at 0x800000. Result could be either working or bricked camera. Most possible it'll work but will be completely unusable, as all settings (read service manual to understand that it is bunch of them) will be wrong. And why do you need K20D firmware?

Pentax Firmware Hack site

Win a Pentax Limited Lens: Raffle Now Live!