Pentax Firmware Hack site

leadbelly · 08-03-2009, 05:14 AM

This is cool! Ever since I got my K100D three years ago (then K10 -> K20) I always wondered why no one has made hacked firmware for our cameras to improve the little things (and maybe add some cool features as well). Good luck! (I have zero knowledge about these stuff, so consider me a cheerleader to your cause! My moral support is with you guys!)

tr13 · 08-03-2009, 05:30 AM

I could easily answer why no one made hacked firmware.

1) It require free time and quite an expertise. Most people who can make such hack could afford to buy better DSLR, like 5D Mk II :-)
2) Most successfull hacks are made by young people in developing countries. So, small salaries and bunch of free time :-)

Today we are in the era of Apple IIe, and soon IBM PC will be available.
Mobile phone market is also near this period. And you could only guess potential just by looking at Apple iPhone Apps Store.
As soon as camera makers could understand that firmware must be developed incrementally and have parts of source available publicly.

gamgee · 08-03-2009, 05:54 AM

tr13, my eternal gratitude goes to you, for your unselfish efforts.
Unfortunatelly I'm designer, not programmer, and can't help you directly.
If there is anything else I can do to help "our cause", let me know.
Thanks again and good luck!

KyPainter · 08-03-2009, 07:27 AM

I would love to see a little more technical detail on your site. More detail on the encryption used, how it was deciphered, the algorithm used, even the source code.

I used to be very good at such things, but I've been away from it for a few years and it's a hard to follow what you are doing, much less understand or duplicate it, from a couple screenshots.

tr13 · 08-03-2009, 08:04 AM

Originally posted by KyPainter

I would love to see a little more technical detail on your site. More detail on the encryption used, how it was deciphered, the algorithm used, even the source code.

I used to be very good at such things, but I've been away from it for a few years and it's a hard to follow what you are doing, much less understand or duplicate it, from a couple screenshots.

I posted some details on this thread and on site.
But removed most of them as I don't see the point and want to be sure that same encryption will be used in new firmware versions (mostly for K-7).

If you want to help, you could check checksum like 0xFC.

emr · 08-03-2009, 08:13 AM

This is VERY interesting! I certainly hope you could one day provide an alternative firmware with additional options, like the CHDK for Canon. I also hope that Hoya doesn't send the legal big guns to prevent this from happening.

tr13 · 08-03-2009, 08:22 AM

Like CHDK for Canon - definitely no.
You must know how many years and how many guys are required to make something like this. This is reason why Hudson is so fast with 5D Mk II development, as he have almost all information and ready tools.
And it took them about a year to just understand few basic things (without any useful firmware releases).

ytterbium · 08-03-2009, 08:38 AM

Interesting.
Yess the main problem is free-time-per-programmer-brand-users

i guess. Pentax has few users so the cumulative time of those who could contribute is much less. Even less of those who could do it at the same time, so the interaction and cooperation is low.

During the last week i had time only to create a project in DevCpp calling one function from CamCtrlV2-dll and mess with it like twice without any real results (except crashing windows - this scares me from connecting the camera).

I believe disable SDM is in the wish-list already (as well as in my must-have list before i purchase any SDM lenses).
So AF calibration from k20d in k200d would be nice as well.

Shantz · 08-03-2009, 09:04 AM

Originally posted by tr13

May be it is possible.
You'll need change file headers (for original encrypted firmware).
One header is at start of file.
Second at 0x800000.
Result could be either working or bricked camera.
Most possible it'll work but will be completely unusable, as all settings (read service manual to understand that it is bunch of them) will be wrong.
And why do you need K20D firmware?

Thanks! So it's pretty complicated, risky and useless. Good to know.

I don't really need the K20D firmware but I know the Pentax has more control over the colors and also a B&W (Monochrome) mode. I do shoot in raw but I have little time for post processing so many times I just convert the DNG with the in-camera color settings.
Your project is very, very, interesting and I'll keep checking this thread. Sorry I can't help

Cheers,
Andrei

tr13 · 08-03-2009, 09:17 AM

My current plans:
1) Find text file reading routine and use it to read configuration from text file on flash.
2) No visual interface is planned at this time.
2) Try to understand build in firmware script engine.

Das Boot · 08-03-2009, 09:21 AM

tr13,
How many are showing interest in reversing the code and should it be broken up to be more efficient? I've also wondered if taking time to build a simulator might be time well spent. Little is known about what ports/pins are connected to what and probably can't physically be seen anyways. A simulator could be helpful in figuring this out. You've got it this far, I'm willing to help, what's the gameplan?

tr13 · 08-03-2009, 09:43 AM

Currently I am working on decrypting last firmware part.
It must not take long.

Next we'll start using info for K10D (from abandoned project) and move it to GX20 firmware.

As for simulator project.
It is possible to do. But is quite hard.
Good point it that we have full FR ASM documentation and it is RISC.
Bad point is that hardware details of M-4 integrated chip are known very bad.
We need to get this documentation from people involved in M-4 based firmware creation.
Best solution is to make debugger (with breakpoint support) with simple simulator.
May be we could use some info from Softune.
As I understand we don't have REALOS in our Softune distribution. And we need copy with REALOS and support for M-4 chips.

Class A · 08-03-2009, 03:19 PM

Originally posted by tr13

Today we are in the era of Apple IIe, and soon IBM PC will be available.

I agree that the current landscape will change.

I've argued before that Pentax should Make Great Hardware Greater by (cheap) Software by adopting at least a partial open source/access policy.

The opportunities are awesome and there for the taking. Who of the big camera manufactures will be the first to understand?

Class A · 08-03-2009, 03:29 PM

Originally posted by tr13

But removed most of them as I don't see the point and want to be sure that same encryption will be used in new firmware versions (mostly for K-7).

Sorry, but I don't understand this. If Pentax doesn't like what you are doing then they will change the encryption no matter whether or not you publish how it works.

The only rationale I can see in your action to remove details about the encryption is that you don't want the details to spread around and reach Pentax. But don't you think they will learn about your success sooner or later?

falconeye · 08-03-2009, 04:00 PM

Originally posted by tr13

want to be sure that same encryption will be used in new firmware versions (mostly for K-7).

From my naive thinking, shouldn't encryption be built into the firmware boot loader or firmware updater which cannot be changed?

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
DFS hack	eccentricphotography	Pentax DSLR Discussion	24	10-12-2010 11:08 AM
Yet another hack job -- OM to PK ??	RioRico	Pentax SLR Lens Discussion	15	10-07-2010 07:49 AM
K20D Firmware Ver - Pentax Web Site Ver?	ChipB	Pentax DSLR Discussion	2	02-23-2010 04:14 PM
Teleconverter hack?	Raptorman	Pentax SLR Lens Discussion	4	01-20-2010 03:51 AM
News Site News and Site Suggestions hidden from guests	Adam	Site Suggestions and Help	0	11-30-2009 12:38 AM

08-03-2009, 05:14 AM	#61
leadbelly Veteran Member Join Date: Jun 2007 Photos: Gallery Posts: 597	This is cool! Ever since I got my K100D three years ago (then K10 -> K20) I always wondered why no one has made hacked firmware for our cameras to improve the little things (and maybe add some cool features as well). Good luck! (I have zero knowledge about these stuff, so consider me a cheerleader to your cause! My moral support is with you guys!)

08-03-2009, 05:30 AM	#62
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	I could easily answer why no one made hacked firmware. 1) It require free time and quite an expertise. Most people who can make such hack could afford to buy better DSLR, like 5D Mk II :-) 2) Most successfull hacks are made by young people in developing countries. So, small salaries and bunch of free time :-) Today we are in the era of Apple IIe, and soon IBM PC will be available. Mobile phone market is also near this period. And you could only guess potential just by looking at Apple iPhone Apps Store. As soon as camera makers could understand that firmware must be developed incrementally and have parts of source available publicly.

08-03-2009, 05:54 AM	#63
gamgee Senior Member Join Date: Jan 2008 Location: Osijek, Croatia Posts: 116	tr13, my eternal gratitude goes to you, for your unselfish efforts. Unfortunatelly I'm designer, not programmer, and can't help you directly. If there is anything else I can do to help "our cause", let me know. Thanks again and good luck!

08-03-2009, 07:27 AM	#64
KyPainter Forum Member Join Date: Oct 2007 Location: Owensboro, Kentucky Posts: 69	I would love to see a little more technical detail on your site. More detail on the encryption used, how it was deciphered, the algorithm used, even the source code. I used to be very good at such things, but I've been away from it for a few years and it's a hard to follow what you are doing, much less understand or duplicate it, from a couple screenshots.

08-03-2009, 08:04 AM	#65
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Originally posted by KyPainter I would love to see a little more technical detail on your site. More detail on the encryption used, how it was deciphered, the algorithm used, even the source code. I used to be very good at such things, but I've been away from it for a few years and it's a hard to follow what you are doing, much less understand or duplicate it, from a couple screenshots. I posted some details on this thread and on site. But removed most of them as I don't see the point and want to be sure that same encryption will be used in new firmware versions (mostly for K-7). If you want to help, you could check checksum like 0xFC.

08-03-2009, 08:13 AM	#66
emr Guest	This is VERY interesting! I certainly hope you could one day provide an alternative firmware with additional options, like the CHDK for Canon. I also hope that Hoya doesn't send the legal big guns to prevent this from happening.

08-03-2009, 08:22 AM	#67
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Like CHDK for Canon - definitely no. You must know how many years and how many guys are required to make something like this. This is reason why Hudson is so fast with 5D Mk II development, as he have almost all information and ready tools. And it took them about a year to just understand few basic things (without any useful firmware releases).

08-03-2009, 08:38 AM	#68
ytterbium Veteran Member Join Date: Jan 2008 Posts: 1,076	Interesting. Yess the main problem is free-time-per-programmer-brand-users i guess. Pentax has few users so the cumulative time of those who could contribute is much less. Even less of those who could do it at the same time, so the interaction and cooperation is low. During the last week i had time only to create a project in DevCpp calling one function from CamCtrlV2-dll and mess with it like twice without any real results (except crashing windows - this scares me from connecting the camera). I believe disable SDM is in the wish-list already (as well as in my must-have list before i purchase any SDM lenses). So AF calibration from k20d in k200d would be nice as well.

08-03-2009, 09:04 AM	#69
Shantz Junior Member Join Date: Jul 2009 Location: Bucharest Photos: Gallery Posts: 43	Originally posted by tr13 May be it is possible. You'll need change file headers (for original encrypted firmware). One header is at start of file. Second at 0x800000. Result could be either working or bricked camera. Most possible it'll work but will be completely unusable, as all settings (read service manual to understand that it is bunch of them) will be wrong. And why do you need K20D firmware? Thanks! So it's pretty complicated, risky and useless. Good to know. I don't really need the K20D firmware but I know the Pentax has more control over the colors and also a B&W (Monochrome) mode. I do shoot in raw but I have little time for post processing so many times I just convert the DNG with the in-camera color settings. Your project is very, very, interesting and I'll keep checking this thread. Sorry I can't help Cheers, Andrei

08-03-2009, 09:17 AM	#70
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	My current plans: 1) Find text file reading routine and use it to read configuration from text file on flash. 2) No visual interface is planned at this time. 2) Try to understand build in firmware script engine.

08-03-2009, 09:21 AM	#71
Das Boot Veteran Member Join Date: Feb 2008 Location: Sparkle City, South Cackalacky Photos: Gallery Posts: 689	tr13, How many are showing interest in reversing the code and should it be broken up to be more efficient? I've also wondered if taking time to build a simulator might be time well spent. Little is known about what ports/pins are connected to what and probably can't physically be seen anyways. A simulator could be helpful in figuring this out. You've got it this far, I'm willing to help, what's the gameplan?

08-03-2009, 09:43 AM	#72
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Currently I am working on decrypting last firmware part. It must not take long. Next we'll start using info for K10D (from abandoned project) and move it to GX20 firmware. As for simulator project. It is possible to do. But is quite hard. Good point it that we have full FR ASM documentation and it is RISC. Bad point is that hardware details of M-4 integrated chip are known very bad. We need to get this documentation from people involved in M-4 based firmware creation. Best solution is to make debugger (with breakpoint support) with simple simulator. May be we could use some info from Softune. As I understand we don't have REALOS in our Softune distribution. And we need copy with REALOS and support for M-4 chips.

08-03-2009, 03:19 PM	#73
Class A Pentaxian Join Date: Aug 2008 Location: Wellington, New Zealand Posts: 11,251	Originally posted by tr13 Today we are in the era of Apple IIe, and soon IBM PC will be available. I agree that the current landscape will change. I've argued before that Pentax should Make Great Hardware Greater by (cheap) Software by adopting at least a partial open source/access policy. The opportunities are awesome and there for the taking. Who of the big camera manufactures will be the first to understand?

08-03-2009, 03:29 PM	#74
Class A Pentaxian Join Date: Aug 2008 Location: Wellington, New Zealand Posts: 11,251	Originally posted by tr13 But removed most of them as I don't see the point and want to be sure that same encryption will be used in new firmware versions (mostly for K-7). Sorry, but I don't understand this. If Pentax doesn't like what you are doing then they will change the encryption no matter whether or not you publish how it works. The only rationale I can see in your action to remove details about the encryption is that you don't want the details to spread around and reach Pentax. But don't you think they will learn about your success sooner or later?

08-03-2009, 04:00 PM	#75
falconeye Veteran Member Join Date: Jan 2008 Location: Munich, Alps, Germany Photos: Gallery Posts: 6,871	Originally posted by tr13 want to be sure that same encryption will be used in new firmware versions (mostly for K-7). From my naive thinking, shouldn't encryption be built into the firmware boot loader or firmware updater which cannot be changed?