Olympus e/mju/stylus series FW analysis - page 2 - Non-CANON cameras development - CHDK Forum
« previous next »
Pages: 1 [2] 3 4 5   Go Down

Olympus e/mju/stylus series FW analysis

  • 46 Replies
  • 42848 Views
*

Offline mx3

  • ****
  • 372
Re: Olympus e/mju/stylus series FW analysis
« Reply #10 on: 22 / October / 2008, 06:25:52 »
Advertisements
see attached file.
extracts sounds and jpgs :-)
Logged
skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler
*

Offline Altsoph

  • *
  • 17
Re: Olympus e/mju/stylus series FW analysis
« Reply #11 on: 22 / October / 2008, 06:44:01 »
Done with checksum  :xmas
Details later.
Logged
*

Offline Altsoph

  • *
  • 17
Re: Olympus e/mju/stylus series FW analysis
« Reply #12 on: 22 / October / 2008, 07:37:18 »
Checksum calculation is simple.

It's just starts from dword 0x00000000 and sub every dword of data from current checksum.
Checksum calculated from  <head>+<decrypted_data>+<tail> always equals zero.
So, checksum calculated from  <head>+<decrypted_data>+<tail without last 4 bytes> always equals dword, stored in last 4 bytes of tail.

Now, I think, we are ready to make our packer, and, if manual update thru /firmware/firmware.bin file works on e-series, we can make our correct updates from scratch and load it to camera.

Checksum calculator source is attached.

So, next step is to disasm some binary (code) block and find the way to make memory dumper -- thru memory card, USB or LEDs.
Logged
*

Offline PhyrePhoX

  • *****
  • 2254
  • make RAW not WAR
    • PhyreWorX
Re: Olympus e/mju/stylus series FW analysis
« Reply #13 on: 22 / October / 2008, 07:42:24 »
you guys are geniuses. really.
Logged
*

Offline Altsoph

  • *
  • 17
Re: Olympus e/mju/stylus series FW analysis
« Reply #14 on: 22 / October / 2008, 10:58:05 »
Has anybody make some progress on decompiling something?
It looks not like normal ARM code for me  :-[
Logged
*

Offline wictor

  • *
  • 6
Re: Olympus e/mju/stylus series FW analysis
« Reply #15 on: 23 / February / 2009, 09:08:37 »
I have been looking E-1, E-500 and E-3 FW binaries and there is
Code: [Select]
F???????BIN next to the body firmware download functions and
Code: [Select]
L???????BIN next to the lens FW download functions. Maybe these names are used when upgrading from CF card if that's even possible...
// Wictor
Logged
*

Offline wictor

  • *
  • 6
Re: Olympus e/mju/stylus series FW analysis
« Reply #16 on: 23 / February / 2009, 09:25:12 »
Quote from: Altsoph on 21 / October / 2008, 11:58:17

Some more info about block types and block numbering:
There are only two different block types known from existing FWs:
1. 4Fh 45h -- almost all blocks have this block type. Inside FW blocks of such type always go first. Numbers of such blocks are incremental (start from 01h 00h, continue by 01h 01h, 01h 02h, ...). Blocks of this type are loaded at memory always with big offset like 0x40XXXXXX or 0x60XXXXXX (depends on camera model).
2. 4Fh 4Dh -- strange rare blocks. In existing FWs there are maximum 1 such block per FW and this block always last in FW. Blocks of this type always contain 00h 00h in <block_number> field and offsets of such blocks are small (0x000E0000 or 0x0000B000).
At least in E-system camera and lens FW binary files these are following
4Fh 45h = "OE" for E-system body. I think this is main FW section
4Fh 4Dh = "OM" this is usually included in E-system body FW binary and could be bootloader section
4Fh 41h = "OA" language binaries have this code.
4Fh 4Ch = "OL" lens FW
// Wictor
Logged
*

Offline Virus

  • *
  • 8
Re: Olympus e/mju/stylus series FW analysis
« Reply #17 on: 25 / March / 2009, 06:38:35 »
Hi!

Quote from: Altsoph on 22 / October / 2008, 10:58:05
Has anybody make some progress on decompiling something?
It looks not like normal ARM code for me  :-[

Because it's not ARM ;-) It's Panasonic AM33 family processor. You can find mn103 processor module for IDA here.
To disassemble decrypted firmware in IDA load it at address 0x40040020 (loading address from fw header + 0x20 for header size alignment).

Thanks guys for your work on fw decrypting and checksums!

--
Regards
Logged
*

Offline Virus

  • *
  • 8
Re: Olympus e/mju/stylus series FW analysis
« Reply #18 on: 30 / March / 2009, 04:11:52 »
Ok! First step has been made. I've managed to update E-520 body with modified firmware :-) I've made minor modifications to show key hex values while button is pressed.
Logged
*

Offline mx3

  • ****
  • 372
Re: Olympus e/mju/stylus series FW analysis
« Reply #19 on: 30 / March / 2009, 04:16:10 »
Quote from: Virus on 30 / March / 2009, 04:11:52
Ok! First step has been made. I've managed to update E-520 body with modified firmware :-) I've made minor modifications to show key hex values while button is pressed.

great !!! keep going  :-)
I don't have any olympus camera.
I'm just happy with your progress
Logged
skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler
Pages: 1 [2] 3 4 5   Go Up
« previous next »
 

Related Topics
SimplePortal 2.3.6 © 2008-2014, SimplePortal