Surfing the SX100 firmware strings

Anaglyphic

129
Anaglyphic lives!

Surfing the SX100 firmware strings

« on: 17 / February / 2008, 21:12:58 »

Advertisements

Since my disassembly skills are limited (as well as my toolset; yagarto / eclipse / WinARM, etc.). I spent about an hour reading through the extracted strings in the rebuilt firmware, just looking around. Besides your endless list of .c references, SSAPI names, directories, filenames, and other CHDK relevant stuff... there is some trivia that's probably not obvious.

-- oss development?? --

Code: [Select]

0x0011bf1c yacc stack overflow
0x0011c400 out of dynamic memory in yy_create_buffer()
0x0011c42c fatal flex scanner internal error--end of buffer missed
0x0011c464 fatal error - scanner input buffer overflow
0x0011c490 input in flex scanner getc not support
0x0011c4b8 input in flex scanner failed

Nice! Using the yacc parser and the flex scanner generator. Both open licensed apps. Should I verify if they use any infectious licensing code and force them to release source? (ya right!)

-- pictbridge url? --

Code: [Select]

0x002b916e http://www.cipa.jp/dps/schema/
Hmm. A Camera & Imaging Products Association web page (formerly Japan Camera Industry Association, the PictBridge consortium guys), and to a member-only password protected area no less. Why is this here? Is there a username and pw stored as well? (no I didn't investigate further.)

-- neutral density --

Code: [Select]

0x00018f18 SSAPI::NotifyNDFilterChanged
0x0023b374 DeltaND                 
0x00025b24 DoNDFilterCtrl
0x002b7d2f NDFILTERADJDATA

Hello ND filter! There is a ND filter patent (USP# 5715103) containing "Delta" and it is owned by Kabushiki Kaisha, at Canon. The adjust data / delta value I assume deals with the light attenuation. I haven't read the patent details, but it is online.

-- some creds --

Code: [Select]

0x00272850 jp56_firmware build#0100 2007/02/19 Saku Hiwatashi, Satoshi Naito, Yukio Chiba 
0x0027294c diagnosis() rev0.03 2004/11/08 Satoshi Naito
0x00272a98 launcher() rev-0.04 2004/09/13 author Satoshi Naito 
0x00272b2a bypass() rev-0.01 author S.Naito 2004/01/19  
0x00272bb4 jp56_common() rev-0.11 2005/01/31 author  naito.satoshi@canon.co.jp / hiwatashi.saku@canon.co.jp
0x00273a4a jp56_jpeg rev3.31 2007/02/19 Yukio Chiba & Satoshi Naito

-- canon font table? --

Code: [Select]

0x003993b0 HCanonGothic
0x0039cee0 DTCanonGothic
0x0039d334 HCanonGothic26
0x0039d9dc HCanonGothic26M
0x0039e084 HCanonGothic20
0x0039e3f0 HCanonGothic20M
0x0039e75c HCanonGothic34
0x0039f1bc HCanonGothic34M

-- Engrish --

Code: [Select]

0x00055070 Filename is fail
0x00057978 Not Plane Text

:-) OK so?

-- ChangeImager strange namings --

Code: [Select]

0x002bbfd2 ChangeImagerToWholeParallelBP
0x002bbff0 ChangeImagerToUltraGhostQ
0x002bc00a ChangeImagerToOITA_XAVIER
0x002bc024 ChangeImagerToXXX
0x002bc036 ChangeImagerToDigiconMode
0x002bc050 ChangeImagerToMontblancMillefe
0x002bc06f ChangeImagerToMontblancWhole
0x002bc0ab ChangeImagerToWholeSerialLineDef
0x002bc0d8 ChangeImagerToMangoPudding
0x002bc0f3 ChangeImagerToHoneyFlash
0x002bc10c ChangeImagerToWholeSerial
0x002bc126 ChangeImagerToWholeParallel
0x002bc186 ChangeImagerToFocusJet
0x002bc19d ChangeImagerToWideDraft
0x002bc1b5 ChangeImagerToSuperWideDraft
0x002bc1d2 ChangeImagerToAlternateDraft
0x002bc1ef ChangeImagerToJumboDraft
0x002bc208 ChangeImagerToJetDraft
0x002bc21f SetStartLineForNarrowDraft
0x002bc24b ChangeImagerToMillefeAdjust

OK, these look like profile (scene) internal names? XXX? That must be the porn movie setting.

HONEY_FLASH is an Japanese anime and RL movie series, MANGO_PUDDING is definitely an asian only thing... ULTRA_GHOST_Q is a mech type in the free web-based game MechQuest. MONTBLANC is both a FF7 character (the leader of Clan Centurio) and a very popular dessert in Japan. (I think it's actually Swiss but that's not relevant.) Of course it could just be Mont Blanc, as in the mountain, eg. related to "Landscape" mode. I don't know about the others. Millefe might be short for millefleur, thousand flowers, perhaps "Foliage" mode?

And finally, the most interesting thing I found:

OITA_XAVIER confuses me. The only way those two words go together appears to be historical... It goes like this: The Otomo family ruled the Oita Prefecture. In the 16th century, the ruler at the time was Lord Sorin. He openly embraced Western ways, and went so far as to be baptized by a Christian missionary, Francisco Xavier, the first Christian missionary to Japan. Sorin even called himself Don Francisco. I'm not Japanese, so it's hard to come up with a non-pejorative meaning. But who knows? Not me. Watashi wa Nihonjin ja arimasen.

Anyway, hope you found this somewhat entertaining.

Logged

Since we cannot know all that there is to be known about anything,
we ought to know a little about everything. -- Blaise Pascal

Barney Fife

1157

Re: Surfing the SX100 firmware strings

« Reply #1 on: 17 / February / 2008, 21:42:23 »

Deleted

« Last Edit: 22 / April / 2008, 12:31:30 by Barney Fife »

Logged

[acseven/admin commented out: please refrain from more direct offensive language to any user. FW complaints to me] I felt it imperative to withdraw my TOTAL participation. Nobody has my permission, nor the right, to reinstate MY posts. Make-do with my quoted text in others' replies only. Bye

mx3

372

Re: Surfing the SX100 firmware strings

« Reply #2 on: 17 / February / 2008, 22:22:43 »

want some more funny strings?

KonikaMinolta A2V113E

0028E15D,38,"Marking : Who the hell are you? [%x]\n"
00294B82,17,"USB IS NOT BORN\n"
00294B93,22,"INTERNET IS NOT BORN\n"
00294BC1,34,"Who the hell are you by connect?\n"
00294C3F,14,"A:\inetSet.txt"
00294CD3,28,"Initialized INTERNET TASKS\n"
00294CEF,23,"Modem is not inserted\n"
00294D07,17,"Init Modem card\n"
00294D1B,20,"Fail dialup 0x%08x\n"
00294D2F,15,"Finish dialup\n"
00294D3F,18,"ftp cmd received\n"
00294D63,17,"ftplogin 0x%08x\n"
00294D77,26,"FTP bin ERROR --- 0x%08x\n"
00294D93,9,"FTP bin\n"
00294D9F,25,"FTP cd ERROR --- 0x%08x\n"
00294DBB,18,"inetPutFTP--->%d\n"
00294DCF,23,"inetSendMail = 0x%08x\n"
00294DE7,35,"Who the hell are you by internet?\n"
00294E0B,10,"I'M DEAD\n"
00294E17,18,"GoodBye Internet\n"
00294E2B,15,"See you again\n"
002952A0,7,"MINOLTA"
0029535B,30,"Who the hell are you by usb?\n"
003AB170,47,"send ICMP ECHO_REQUEST packets to network hosts"

Logged

skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler

Anaglyphic

129
Anaglyphic lives!

Re: Surfing the SX100 firmware strings

« Reply #3 on: 17 / February / 2008, 22:50:15 »

That's not funny, that's downright embarrassing! Was the camera supposed to have a modem and some automated ftp client?? heh. OK yea it is funny. But not cleaning up the code, I know our eeproms got millions and millions of bits these days for pennies, but that's sloppy. Hmm. Then again, this was a DiMAGE A2 firmware? That had to be one of the last cameras made. Maybe they already knew they were closing shop and didn't care?