Hi All!
Since this chip is a mitsubishi 32R, How does this relate to the DIGIC DV II chip we know the camcorder uses, and the DryOS we suspect the HF10/HF100 is running? (pardon my ignorance)
I think Digic DV should be a kind of specialized videoprocessor, and m32r is only a controlling unit...
I've found some DryOs symbols in the f/w, so it looks like camera still uses this OS.
Does this firmware give us hints about how to create a dumper firmware for the HV20 camcorder? Files it looks for on the card, for instance? I noticed several intersting strings/paths in the HF10 firmware:
If compare it with still cameras, we should analyze not the main f/w, but the bootloader unit (which is not a part of firmware). And to get this bootloader code we have to manage a way to inject our code into the firmware.
Another way could be analyzing the USB protocol (or even some other hidden internal camera serial ports) - f/w contains many debug commands and a kind of debug console. Normally this is used to debug and diagnose failed units. This protocol could be discovered just analyzing the f/w we have and experimenting with usb connection.
The firmware we now have should be loaded at 0xBFA00000 address (so the encrypted part starts at 0xBFA10010).
There are many problems I see now in using IDA m32r disassembler, they downspeed the analysis heavily.