Pentax Firmware Hack site

simico · 08-10-2009, 06:48 AM

Originally posted by tr13

Try to upgrade to publically available v1.10 version.

It is updated to that version (downloaded the upgrade and did it on last week).
Has anybody had success on K-m? I don't really have time to try 999 versions of MODSET.XXX ...

tr13 · 08-10-2009, 07:14 AM

Originally posted by simico

It is updated to that version (downloaded the upgrade and did it on last week).
Has anybody had success on K-m? I don't really have time to try 999 versions of MODSET.XXX ...

Please, look carefully on method proposed by K200D owner. He used bat file to make all files and copy them at once. So, only one check is needed.

Disassembling progress
I also have good news as it looks like we will be able to use legal IDA 4.9 Freeware for research. I managed to make Fujitsu processor module that sucessfully runs with free IDA version. It was considered impossible without touching IDA (and this is illegal, as we know). But I won't distribute it on my site until we will be able to write such module from scratch to be absolutely clear here :-) It is quite poor at the moment. But if anyone want to participate in disassembling you can PM me (I'll ask few questions first).
Try to use IDA Free 4.9 first with Windows executables (like Camera_Control_V2.dll), as it is about 20x time easear :-).
Remember to find modern signatures for IDA. And try to read some books, af far as I know best one - Amazon.com: The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler (9781593271787): Chris Eagle: Books.

As for C/C++ guys - we need two things :
1) Make refactoring of existing DFR disassembler we have on my site. COde is not that bad, but quite a mess.
2) Modify interface and add it to Biew (and, later, possibly Neo Hex Ultimate).
3) Make software to find fonts and bitmaps.

tr13 · 08-10-2009, 08:57 PM

Screenshot from disassembler during work on GX20 DSP firmware.

ytterbium · 08-11-2009, 01:02 AM

Om not yet certain of this, but i feel like i should write it down somewhere.
Looks like enabling debug and scripting, even after i've disabled them, disabled guide display (showing shooting mode when changing them or powering on on main LCD).
I could enable it in menu, but i left it disabled.

tr13 · 08-11-2009, 01:20 AM

Originally posted by ytterbium

Om not yet certain of this, but i feel like i should write it down somewhere.
Looks like enabling debug and scripting, even after i've disabled them, disabled guide display (showing shooting mode when changing them or powering on on main LCD).
I could enable it in menu, but i left it disabled.

I can't follow your though.

Another screen on work in progress:

tr13 · 08-11-2009, 01:26 AM

If you look at last assembler strings on my screenshot you could see:

Quote:

ldi:32 #Get_File_Extension, r12
call @r12

This is typical FR far function call.
Unfortunately current FR module can't move analisis to this address and don't add proper xref.
If anyone here know C quite well and is not afraid to work with command-line BC++ compiler (you can download one free from Embarcadero site, btw), you are welcome.
Of course, it'll require you to learn some IDA functions :-)

darky_mtp · 08-11-2009, 02:34 AM

Autorun present and executed : Guide display self turn off in setup menu.
Removing autorun or disabling it in debug menu allow you to set guide menu back on.

darky_mtp · 08-11-2009, 03:22 AM

You can find here a zip file with all possible file names to enter into debug menu.

Be sure to use FAT32 on your SD card (FAT16 allow only 512 files on root).

Once in debug menu use 'DSP ROM SAVE to FILE' .
On SD card root you now have a KBxxxDSP.BIN with xxx the right number for your firmware.

kytutr · 08-11-2009, 04:48 AM

Originally posted by darky_mtp

You can find here a zip file with all possible file names to enter into debug menu.

Be sure to use FAT32 on your SD card (FAT16 allow only 512 files on root).

Once in debug menu use 'DSP ROM SAVE to FILE' .
On SD card root you now have a KBxxxDSP.BIN with xxx the right number for your firmware.

I've tried it with my K200D (first with Polish language set, then with English), but nothing more than displaying VER: 1.00 happened. I saw no debug menu at all.

Steps I took:
1) format SD card with FAT32 filesystem
2) unzip provided file to the root directory of SD card
3) turn on K200D with MENU button pressed

Does anybody reported similar impossibility to enter debug menu in K200D?

tr13 · 08-11-2009, 04:57 AM

Originally posted by kytutr

I've tried it with my K200D (first with Polish language set, then with English), but nothing more than displaying VER: 1.00 happened. I saw no debug menu at all.

Steps I took:
1) format SD card with FAT32 filesystem
2) unzip provided file to the root directory of SD card
3) turn on K200D with MENU button pressed

Does anybody reported similar impossibility to enter debug menu in K200D?

Look at earlear posts in this thread.
MEMSET works on K200D with v1.00.00.03 firmware, as I have dumps of this firmware done using MODSET.445.
If you have AUTORUN.445 in same card, MODSET won't work.

BTW. We managed to get help from a guy who did similar project in private with
K100D. He also made some improvements to FR module. I'll check it and make new working module soon.

darky_mtp · 08-11-2009, 05:07 AM

With my K20D I have to leave the door open and not having AUTORUN.xxx
No need to use MENU button.

kytutr · 08-11-2009, 05:15 AM

Originally posted by darky_mtp

With my K20D I have to leave the door open and not having AUTORUN.xxx
No need to use MENU button.

Thank you, it worked also with K200D.

tr13 -> Sorry for making mess in this therad. From now I will read & think twice before posting

tr13 · 08-11-2009, 06:08 AM

Progress report

I managed to make new FR module using source provided by one very expirienced guy. :-) Now it can analize such jump as described above.
And also add xrefs. Can also make some local variables.

He also provided some very useful information for dumping additional debug information.

This is how it looks now.

tr13 · 08-11-2009, 06:52 AM

Special request

If you have already enabled DEBUG MODE.
Please make SYSPARAM.TXT file on SD card root.
Put [STOREAE] 1@ inside.
Send me resulting dump file, please.
The more guys will send files, the better.

Edvinas · 08-11-2009, 06:56 AM

Привет всем,

I haven't been following this thread for a few days and now I am simply amazed looking at the progress, you guys have made here!

Tomorrow morning I will need to spend some time thoroughly reading all this thread.

I am C++ developer, no embedded device programming experience though and assembler programming days are over for me many many years ago. Anyway, currently I am not too busy, so I could try to help for this project...

08-10-2009, 07:14 AM	#212
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Originally posted by simico It is updated to that version (downloaded the upgrade and did it on last week). Has anybody had success on K-m? I don't really have time to try 999 versions of MODSET.XXX ... Please, look carefully on method proposed by K200D owner. He used bat file to make all files and copy them at once. So, only one check is needed. Disassembling progress I also have good news as it looks like we will be able to use legal IDA 4.9 Freeware for research. I managed to make Fujitsu processor module that sucessfully runs with free IDA version. It was considered impossible without touching IDA (and this is illegal, as we know). But I won't distribute it on my site until we will be able to write such module from scratch to be absolutely clear here :-) It is quite poor at the moment. But if anyone want to participate in disassembling you can PM me (I'll ask few questions first). Try to use IDA Free 4.9 first with Windows executables (like Camera_Control_V2.dll), as it is about 20x time easear :-). Remember to find modern signatures for IDA. And try to read some books, af far as I know best one - Amazon.com: The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler (9781593271787): Chris Eagle: Books. As for C/C++ guys - we need two things : 1) Make refactoring of existing DFR disassembler we have on my site. COde is not that bad, but quite a mess. 2) Modify interface and add it to Biew (and, later, possibly Neo Hex Ultimate). 3) Make software to find fonts and bitmaps. Last edited by tr13; 08-10-2009 at 07:19 AM.

08-10-2009, 08:57 PM	#213
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Screenshot from disassembler during work on GX20 DSP firmware. Attached Images

08-11-2009, 01:20 AM	#215
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Originally posted by ytterbium Om not yet certain of this, but i feel like i should write it down somewhere. Looks like enabling debug and scripting, even after i've disabled them, disabled guide display (showing shooting mode when changing them or powering on on main LCD). I could enable it in menu, but i left it disabled. I can't follow your though. Another screen on work in progress: Attached Images

08-11-2009, 06:08 AM	#223
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Progress report I managed to make new FR module using source provided by one very expirienced guy. :-) Now it can analize such jump as described above. And also add xrefs. Can also make some local variables. He also provided some very useful information for dumping additional debug information. This is how it looks now. Attached Images

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
DFS hack	eccentricphotography	Pentax DSLR Discussion	24	10-12-2010 11:08 AM
Yet another hack job -- OM to PK ??	RioRico	Pentax SLR Lens Discussion	15	10-07-2010 07:49 AM
K20D Firmware Ver - Pentax Web Site Ver?	ChipB	Pentax DSLR Discussion	2	02-23-2010 04:14 PM
Teleconverter hack?	Raptorman	Pentax SLR Lens Discussion	4	01-20-2010 03:51 AM
News Site News and Site Suggestions hidden from guests	Adam	Site Suggestions and Help	0	11-30-2009 12:38 AM

08-10-2009, 06:48 AM	#211
simico Veteran Member Join Date: Jan 2009 Location: Budapest Posts: 821	Originally posted by tr13 Try to upgrade to publically available v1.10 version. It is updated to that version (downloaded the upgrade and did it on last week). Has anybody had success on K-m? I don't really have time to try 999 versions of MODSET.XXX ...

08-11-2009, 01:02 AM	#214
ytterbium Veteran Member Join Date: Jan 2008 Posts: 1,076	Om not yet certain of this, but i feel like i should write it down somewhere. Looks like enabling debug and scripting, even after i've disabled them, disabled guide display (showing shooting mode when changing them or powering on on main LCD). I could enable it in menu, but i left it disabled.

08-11-2009, 01:26 AM	#216
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	If you look at last assembler strings on my screenshot you could see: Quote: ldi:32 #Get_File_Extension, r12 call @r12 This is typical FR far function call. Unfortunately current FR module can't move analisis to this address and don't add proper xref. If anyone here know C quite well and is not afraid to work with command-line BC++ compiler (you can download one free from Embarcadero site, btw), you are welcome. Of course, it'll require you to learn some IDA functions :-)

08-11-2009, 02:34 AM	#217
darky_mtp New Member Join Date: Mar 2008 Posts: 19	Autorun present and executed : Guide display self turn off in setup menu. Removing autorun or disabling it in debug menu allow you to set guide menu back on.

08-11-2009, 03:22 AM	#218
darky_mtp New Member Join Date: Mar 2008 Posts: 19	You can find here a zip file with all possible file names to enter into debug menu. Be sure to use FAT32 on your SD card (FAT16 allow only 512 files on root). Once in debug menu use 'DSP ROM SAVE to FILE' . On SD card root you now have a KBxxxDSP.BIN with xxx the right number for your firmware.

08-11-2009, 04:48 AM	#219
kytutr New Member Join Date: Aug 2009 Posts: 4	Originally posted by darky_mtp You can find here a zip file with all possible file names to enter into debug menu. Be sure to use FAT32 on your SD card (FAT16 allow only 512 files on root). Once in debug menu use 'DSP ROM SAVE to FILE' . On SD card root you now have a KBxxxDSP.BIN with xxx the right number for your firmware. I've tried it with my K200D (first with Polish language set, then with English), but nothing more than displaying VER: 1.00 happened. I saw no debug menu at all. Steps I took: 1) format SD card with FAT32 filesystem 2) unzip provided file to the root directory of SD card 3) turn on K200D with MENU button pressed Does anybody reported similar impossibility to enter debug menu in K200D?

08-11-2009, 04:57 AM	#220
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Originally posted by kytutr I've tried it with my K200D (first with Polish language set, then with English), but nothing more than displaying VER: 1.00 happened. I saw no debug menu at all. Steps I took: 1) format SD card with FAT32 filesystem 2) unzip provided file to the root directory of SD card 3) turn on K200D with MENU button pressed Does anybody reported similar impossibility to enter debug menu in K200D? Look at earlear posts in this thread. MEMSET works on K200D with v1.00.00.03 firmware, as I have dumps of this firmware done using MODSET.445. If you have AUTORUN.445 in same card, MODSET won't work. BTW. We managed to get help from a guy who did similar project in private with K100D. He also made some improvements to FR module. I'll check it and make new working module soon.

08-11-2009, 05:07 AM	#221
darky_mtp New Member Join Date: Mar 2008 Posts: 19	With my K20D I have to leave the door open and not having AUTORUN.xxx No need to use MENU button.

08-11-2009, 05:15 AM	#222
kytutr New Member Join Date: Aug 2009 Posts: 4	Originally posted by darky_mtp With my K20D I have to leave the door open and not having AUTORUN.xxx No need to use MENU button. Thank you, it worked also with K200D. tr13 -> Sorry for making mess in this therad. From now I will read & think twice before posting

08-11-2009, 06:52 AM	#224
tr13 Veteran Member Join Date: Jul 2009 Location: Russia Posts: 343 Original Poster	Special request If you have already enabled DEBUG MODE. Please make SYSPARAM.TXT file on SD card root. Put [STOREAE] 1@ inside. Send me resulting dump file, please. The more guys will send files, the better.

Thread Tools	Search this Thread
	Search this Thread: Advanced Search

08-11-2009, 06:56 AM	#225
Edvinas Veteran Member Join Date: Sep 2006 Location: Kaunas Posts: 1,458	Привет всем, I haven't been following this thread for a few days and now I am simply amazed looking at the progress, you guys have made here! Tomorrow morning I will need to spend some time thoroughly reading all this thread. I am C++ developer, no embedded device programming experience though and assembler programming days are over for me many many years ago. Anyway, currently I am not too busy, so I could try to help for this project...