HV20-firmware HACK- 1st topic

[junes.HV20]

hello CHDK forum ,
i was surprised to find out this forum about canon's firmware hack !

as some of you should know, canon release the HV20 and HV30 camcorders , a new HD consumer cam wich is barely revolutionary for its near professional capabilities. whatever, there is a HUGE community of users out there waiting for releasing the real power of that camera , because it could be a preofessionnal camera with some new functions such as gain control for example or a raw hack via firewire.
we already talked about this in "our" HV20 forum here : Theoretically possible firmware only RAW hack - Canon HV20 / HV30 User Forum

a lot of people are waiting for something , and i'm the first of the list ^^.

does anyone could give us advices , clues or anything to begin the work on this ? i'm sure you have a lot more experience in this. (sorry for my bad english ^^)

best regards FRIENDS !! 

[GrAnd]

Unfortunately, nobody works on camcorders within the bounds of CHDK project. Even for PowerShot family, there are problems with two generation of Digics and two completely different OSes, despite more or less similarity in hardware.
In your case we have total different hardware, different processor, etc. Of course there is a chance, that DigicDV is also based on ARM core and uses the same/similar OS and methodology.
Is there an existing firmware (or firmware update, or firmware dump) to start with? It is necessary to have it for analysis.

Regards,
  GrAnd.

[ivan.hv20]

there is actually an updated HV20, the HV30 which has the very same hardware features, with just a 30p mode added. My guess is this should be made possible because of just a firmware update.

How to extract both firmwares, though, i don't really know.

[PhyrePhoX]

what he means is a firmware that can be downloaded from canon (official update, had some of those for CHDK) or some "grey channels" (inofficial updates, leaks). without these it will be really difficult.

[kwf]

Without knowing what i am talking about, i would day porting CHDK to the HV20 will be probably a challenging task.

If Canon would provide a firmware upgrade, it would be probably possible to decipher it and to disassemble to check if an CHDK port is possible. I never heard of an firmware upgrade for the hv20, so without this firmware upgrade things are more complicate.

Second possibility is to find an other Canon camcorder with the same processor. I think the Canon XL-HL1 uses the same DIGIC DV II. Canon did provide a firmware upgrade for this one, some people have a SD card with the firmware upgrade file on it. But the file is not available for download anywhere. It might be possible to analyse this firmware to write a blinker for the HV20 (think, thats how most CHDK ports start...). With available firmware it might then be possible to port CHDK to the HV20, but this still could be difficult.

Third possibility is to hope for some luck, investigate how the HV20 reacts to things which work on Canon digital cameras. Maybe digic II is not so different. E.g. ver.req ... is there a firmware update menu item, e.g. if you place a ".fir" file on the sd card... With a lot of work, it then might be possible to write a blinker. If you are really serious (and more the hardware guy) you might want to read out the firmware
directly from the flash chips

[zero01101]

i'm contributing absolutely nothing to this thread except for a feeble hope that someone smarter than myself can unleash the potential ability of the sweet hv20. 
carry on

[kwf]

@zero01101:
I doubt anything will happen, if not a HV20 owner will do some work. But people here might assist. Trying to find the firmware of at least one Digic DV II camera (e.g. XL-H1) will be the first step.

[jnuts]

Is there an existing firmware (or firmware update, or firmware dump) to start with? It is necessary to have it for analysis.

I believe there is a reset firmware.  Would that be a good start?

[kwf]

Is there an existing firmware (or firmware update, or firmware dump) to start with? It is necessary to have it for analysis.

I believe there is a reset firmware.  Would that be a good start?

I think this would be a good start. Make it available to some interested developers and you will see if hacking is possible

[intrinsic]

In your case we have total different hardware, different processor, etc. Of course there is a chance, that DigicDV is also based on ARM core and uses the same/similar OS and methodology.

Wasn't there some suspicion that the Canon DV Cams were built on DryOS some time back?

Of course without a firmware the discussion is entirely academic.

[cail]

Accidentially I own both Canon's camcorder (HV10 although) and camera (ixus65 - which I've ported chdk to).And surely the camcorder hacking ideas and possibility of this was an asspain for me from the very beginning ;)

Right now of what I've tracked down, there is actually a firmware upgrade for the XL-H1 and some owners have it on SD cards. We may probably ask someone (XL H1 Firmware Upgrade Details - The Digital Video Information Network) to share this SD card's content with us.
Minimally, this may give us a clue on how firmware upgrade works.

So, if someone is somehow related to XL-H1 or to people owning it, you may try to help us.

I believe the possibility exists. There is a hack someone found - you may try to press REC and PHOTO buttons in photo mode, and then Power on the camcorder in playback mode. This'll bring up a kind of system screen with internal f/w version and ids. probably it is somehow related with the f/w upgrade.

Surely, there is another way to extract flash memory content out of there. However its a kind of hardcore and requires a special hardware ;)

BTW, head some rumors that the exactly this community (CHDK) could be a reason for canon not to release and allow any public firmware upgrades or information leaks for their HD camcorders ;)

[GrAnd]

BTW, head some rumors that the exactly this community (CHDK) could be a reason for canon not to release and allow any public firmware upgrades or information leaks for their HD camcorders

Shame on they...  I mean Canon, of course...

[Barney Fife]

Deleted

[RyeBrye]

I posted some stuff on their threads over at HV20 - I'm interested in this because if there is a chance an hv20 / hv30 can be hacked - (i.e. we can get it to run arbitrary code or get a firmware dump) I'll definitely buy one of them and get to work on it.

I'm wondering if using Firewire to grab directly at the internal memory of the camera would be a good approach. If the camera has the ability to be put into a "host" mode, I think that firewire's direct memory access might be a great way to bust on in there and get access to the memory. Of course, it would still take a lot of work even if that were possible - but if you could find the program counter and then insert some code to have it basically dump the firmware to memory - and then have some code to read that memory as it is getting dumped... you could obviously stream the firmware off of the camera very quickly.

( See: Physical Access Attacks with Firewire for an introduction to firewire hacking. )

[kmaage]

There is a firmware downloadable for a closely related camcorder HF100, and a serial number (listed on an ebay page) was 772632060551

Download was here: http://web.canon.jp/imaging/dcp/ivis/hf10/frm/firmdownload-j.html

Edit: Decoding and other work are continuing in this thread
HF10 (Digic DV II) decrypted!

and at the chdk wiki
HF10/100 Firmware Analysis - CHDK Wiki