[jokob]

Hi Guys,

I think that this camera is amazing, but I'd welcome some more customisation options.

• custom mapping of all buttons.
• customised folder or naming
• other tweaks which could be done via software update (list yours?)

So, I'm exploring options on altering the firmware and found some resources:

GitHub - crypto512/ricohdec

Ricoh Theta S Updater and Firmware Analysis | Matthew Petroff

Long story short: I am not sure if Ricoh is going to update this camera range or release any great firmware updates. It's a great camera which could be amazing with some little tweaks. Some of the wishlist items could be theoretically achieved by some tweaking of the software. To do that:

• We need to be able to decompile correctly the available firmware
• be able to alter it and connect what changes affect which functionality
• be able to compile our own version

The code I referenced on top is not 100% working (some code is readable, some is still obfuscated, so additional work will be needed). I am regrettably not a crypto analytic, but I can code, so once the above 3 points are sorted modification of the code should be quite straightforward.

I am posting here to see if there is support for such an idea and endeavour.

If yes, and if there is someone with such skill set available in this sub willing to work on this, then great. Otherwise we could post a bounty / ask on other subs or websites for help.


So, let me know guys what you think!

Cheers, Jokob

---

Last edited by jokob; 12-16-2017 at 06:44 PM.

[bootcoder]

You better open file attributes in fopen from "r" to "rb" and from "w" to "wb" or decoder fails built with Mingw on WIndows.

[bootcoder]

For ricoh GR firmware downloaded from official website rg1_v051.zip: you just have to run ricohdec first on rg1_v051.frm, then again on resulting rg1_v001up.bin.
Then you get camera firmware file b01firm8.bin. File b01firm6.bin is firmware updater.

[bootcoder]

Ugh, finally fetched load address of firmware file b01firm8.bin: 0xA0020200. Powered by Fujitsu RealOS. Have a fun analysing!

Attached Images

 

[jokob]

@bootcoder Thanks for the investigative work! This is very much appreciated! Could you please let me know how you've got the nicely formatted output? I've run ricohdec exactly as you've described but part of the file is still not properly readable: https://preview.ibb.co/cbLzbR/ricoh_frm.png. Here is my file after 2 run-throughs: ricohdec/b01firm8.bin at master · jokob/ricohdec · GitHub

Thanks in advance!

[bootcoder]

You should disassemble b01firm8.bin with any tool like IDA/.../objdump that supports ARMv7-A and Thumb 2, taking in account .bin load address 0xA0020200 and big endian byte order.
There is no VFP.

Firmware runs on fujitsu m6 LSI chip (milbeaut 6th-generation). Function names (kernelInit, kernel_err_def_max) were added manually.

[jokob]

You should disassemble b01firm8.bin with any tool like IDA/.../objdump that supports ARMv7-A and Thumb 2, taking in account .bin load address 0xA0020200 and big endian byte order.
There is no VFP.

Firmware runs on fujitsu m6 LSI chip (milbeaut 6th-generation). Function names (kernelInit, kernel_err_def_max) were added manually.

This is supper helpful. Thank you so much!

[bootcoder]

RealOS Manual

In fact I am able to locate all these functions in firmware. It seems there is a powerfull script engine embedded in Ricoh GR firmware with access to all hardware. Investigating this and reversing debug shell could help you locate button code.

[bootcoder]

I do not know if it is already mentioned: Ricoh GR uses Sony IMX071 CMOS sensor that is same as in Nikon D5100/D7000.