[pingflood]

This is a very interesting read. I wish I had more time (and a Pentax body) to assist -- been a while but I've done C/C++ and a fair bit of asm in my days.

Good luck and I will be keeping an eye on this!

[tr13]

I am C++ developer, no embedded device programming experience though and assembler programming days are over for me many many years ago. Anyway, currently I am not too busy, so I could try to help for this project...

Current tasks for C/C++ developers

1) Make software to find fonts and bitmaps . This thing is necessary as we don't have so much text in firmware, so, images allow us to find many things.
2) Improve FR module for IDA 4.9 Free. You need to read some info about IDA first and look at existing modules. They are not magic. But we need to have best tools. And writing better module could save hundreds of hours.

[rparmar]

But we need to have best tools. And writing better module could save hundreds of hours.

As a former software developer, I can only repeat this for emphasis.

[zezo]

I tried to determine the correct extension for the MODSET file on my K10D v1.30 using files from 400-500, but with no luck... Don't want to downgrade as I use wireless operation of my flash quite often.

Edit:
Tried with MODSET.1->MODSET.999 - still no luck

Try 'modset.txt' and open card door during startup. That works on K10D v1.30 (and all previous versions). The file names are obfuscated in the firmware, but still decode to modset.txt and sysparam.txt

[tr13]

Try 'modset.txt' and open card door during startup. That works on K10D v1.30 (and all previous versions). The file names are obfuscated in the firmware, but still decode to modset.txt and sysparam.txt

Welcome zezo!
I hope that your information and support will be very useful.
As your FR module is very useful for me :-)

[falconeye]

Welcome zezo!

Welcome zezo to the forums here.

One post only and famous already

[darky_mtp]

Send me resulting dump file, please.

No matter what I tried, no dump.

Edit : 4WR,4WL,GREEN,etc... can come from "SWITCH TEST" from debug menu second page.

---

Last edited by darky_mtp; 08-11-2009 at 12:16 PM.

[zezo]

Welcome zezo to the forums here.

One post only and famous already :cool: :cool:

Thanks ;)

I forgot to introduce myself, so here it goes:

I've spent some time reversing pentax firmware few years ago - starting with optio 33 wr (Pentax Optio 33WR RAW mode and other secrets). Bought K100D later partially out of curiosity if I can make the debug commands work. They did, and I discovered the famous menu-info-menu-menu-info combo within the first day, but did not publish it at the time.

The only real benefit of this work so far has been the decoding of some EXIF tags and contributing to Phil Harvey's exiftool. So remember me when you see the Temperature and Battery Charge Level tags ;)

Now when we have dedicated project I may be able to contribute some more knowledge - the improved fr disassembler and the sysparam syntax from the posts above should be just the start. I contacted tr13 as soon as fellow pentaxian who was aware of my hobby sent me the link to his site and spent part of the day exchanging emails.

Best regards,

Cvetan

[zezo]

No matter what I tried, no dump.

This works on *istDS, K100D and K10D. You either need the proper file extension or the command/syntax are different. I'll take a look tomorrow.

Edit : 4WR,4WL,GREEN,etc... can come from "SWITCH TEST" from debug menu second page.

Definitely from the debug menu. I just finished reading the entire thread and was going to comment on that too.

[simico]

Please, look carefully on method proposed by K200D owner. He used bat file to make all files and copy them at once. So, only one check is needed.

Tried MODSET.000 -> MODSET.999 and MODSET.TXT : nothing happens. Tried the same with AUTORUN.xxx and that also doesn't work. No matter what the filename is and what it contains, the camera just ignores it.

Why do you think it should work on K-m?

[darky_mtp]

Did you leave the card door open?

[jptreen]

I have to say...first post in these forums...I have very little idea what the hell is going on here but if you need anyone to make the tea or coffee or bring biscuits then I'm your man.

Also if it comes to the point where you are calling for donations make it very clear because I would love to offer what support I can.

[WheresWaldo]

I also have a Samsung GX-1S with v1.02 firmware and the ROM dumps are a different size the CPU is still 256KB but the DSP is only 4096KB instead of 8192KB.

You must use MODSET.TXT and the commands must be in []'s

The file dumps are ST410CPU.BIN and ST410DSP.BIN if you are interested I can email them to you.

[Class A]

Welcome to the forums zezo!

The file names are obfuscated in the firmware, but still decode to modset.txt and sysparam.txt

Perhaps the number extensions are not about obfuscation but about allowing the use of generic.txt files for all models and specific number extension files to target special models only. A camera might even take ".txt" and ".XYZ" files into consideration if they are present at the same time?

[Paul MaudDib]

I am trying to bang something out in C# to find bitmaps in the hex. The stuff I have right now is very rough. I can't do more than crude searching for the magic number and file size without a real file to try and decode the bitmap format from.

If you have it, a valid bmp would be great too. Doesn't even have to be from these cameras, if you've got one from a DIGIC processor would help although it's not obviously as useful as being handed a blueprint of what to search for.

edit: nvm, I got a firmware dump

e: there is nothing with normal magic numbers in it. How do you think there are BMPs in there and how should I try to get them out?