I've been working on a custom firmware for Fujifilm based cameras for a few months now.
Writeup:
https://danielc.dev/blog/hacking-the-fujifilm-digital-camerasSource code:
https://github.com/petabyt/fujifilmOriginal post:
I've got my hands on a Fujifilm Finepix HS20EXR. I'm currently working on manipulating firmware files.
I haven't done anything too crazy yet, but here's a "Leet" hack:
https://petabyt.dev/filedump/fujil.pngAll I had to do was change the 1000 4000 at 0x204 in the firmware file.
I've written a basic firmware unpacker (
https://github.com/petabyt/fujifilm-firmware) and
have been working on figuring out how to insert custom code. Here are some observations:
- Code seems to be 32 bit ARM (not thumb)
- The firmware includes SQLite and some sql code. Not sure why.
- Unlike the cameras described in
https://chdk.setepontos.com/index.php?topic=6484.0, the camera I have
does not appear to have any batch scripting or hidden menu.
- The code includes "A:\DCAA\auto_act.scr". Is this some kind of script? Making the file on the SD
card doesn't seem to do anything.
- There is a "Happy Birthday!" string in the firmware.
- These strings suggest there may be a secret menu:
"OSD DEBUG MODE SCREEN SELECT"
"SCREEN <UP/DOWN> : "
"WARNING <RIGHT/LEFT> : "
I've tried repacking the firmware with small modifications, but it says it's invalid, probably because
it uses a checksum to scan the file first.
