Samsung WB2000/TL350 firmware analysis (also valid for EX1?) - Non-CANON cameras development - CHDK Forum

Samsung WB2000/TL350 firmware analysis (also valid for EX1?)

  • 4 Replies
  • 6279 Views
Samsung WB2000/TL350 firmware analysis (also valid for EX1?)
« on: 09 / September / 2011, 17:11:55 »
Advertisements
The Samsung WB2000 (known as TL350 in the USA) is a compact and well-built camera which has a number of interesting features. However, no matter how much Samsung tries they will never be able to create firmware which fits everybody's wants and (supposed) needs. Inspired by the CHDK project I'll try to open the way for modifying the firmware used in the WB2000. As the firmware (and the hardware) for this camera seems to be closely related to that for the EX1, and probably other members of the WB/TL series.

The progress of this analysis can be followed on the WB2000 project wiki (if you want to help, let me know and I'll create an account).

For such a project to succeed we'll (as in 'anyone else who is willing and able to hack the firmware for this camera') need quite a bit of information as well as some tooling. Let's start with the basic facts. The thing is built around a 'DRIMeIII' ASIC which contains an ARM926E core. It runs VXWorks 6.6. There is plenty of debugging info in the firmware image, as well as a strong indication to the presence of the vxworks command shell. As to how this shell can be accessed I don't know yet - the proprietary Samsung io-connector seems a good candidate though (pin 15: UART RX, pin 16: UART TX, pin 1: D-GND - careful, I have not tried connecting anything yet!). It seems to be able to boot from the SD card so if the firmware in the camera memory (512 MB of Samsung OneNAND according to what I found in the DSP firmware strings) is hosed it should be possible to revive the thing. If not, the schematic diagram (which can be found floating around the 'net) clearly shows JTAG connections so it should be possible to avoid bricking it.

A WB2000 firmware update contains 5 files: an update script, two OneNAND boot loader files, a DSP firmware image and a user interface image file. The latter consists of a simple ROMfs image for which I made an extraction program (inspired by a similar program for an IP camera). As far as I can tell, none of these files are obfuscated. More details can be found on the WB2000 project wiki.

The DSP firmware file is a simple binary dump, prepended with the version number as a null-terminated string. Loading it with an offset of 0x7 makes it possible to disassemble the dump. I have yet to figure out the load address. it probably lies around 0xb?000000 given the references from the secondary boot loader to this area - but I might be completely mistaken.

I'd like to do as much work as possible using the downloaded firmware image file before hooking up the camera to get the vxworks shell up and running. If anyone knows a source for those S20-pin connectors Samsung likes to use, let me know as well. I want one to make a debug cable, so it should have connections on at least pin 1 (gnd), 15 (uart rx) and 16 (uart tx).

I know there are others who have expressed the wish for hackable firmware for these Samsung cameras. If you read this and feel you can help, reply here or send me a PM. With their ARM-based ASICs and VXWorks OS it should be possible to get (something like) CHDK running on these cameras. Given the ease with which the user interface in these cameras seems to be modifiable it might even be possible to integrate a firmware hack in a more streamlined way. Who knows, Samsung might just have created the ideal hackable camera platform - and might see increased sales because of this. Are you reading this, Samsung? If so, please send me some documentation on the firmware file format so I don't have to search for it myself.

If you have any information which can help further this project, please do not hesitate to let me know. Reply to this topic or via PM.
« Last Edit: 12 / September / 2011, 08:41:23 by YAFU »

Re: Samsung WB2000/TL350 firmware analysis (also valid for EX1?)
« Reply #1 on: 16 / May / 2012, 00:22:46 »
I wish I could help   :-[

Had a Canon A610 some years ago, and used CHDK a lot. Now I have a DSLR, but I'm currently traveling abroad and using a Samsung WB690 on the road, and would really appreciate if there was something similar to CHDK for this camera.

I'm not a programmer but have messed around a lot in this area. Can I do something useful?

[ ]'s

Re: Samsung WB2000/TL350 firmware analysis (also valid for EX1?)
« Reply #2 on: 28 / October / 2012, 21:42:08 »
Well i been digging around inside the Firmware update for this cam.

I got me one also for this reason. What i was interested in was 720p with 60fps
The cam is able to shoot 1080 at 30fps and smaller resolutions in 1000 fps, 420fps, 240 fps, 30fps.

What a lot of people complaining about is that they still advertise 60fps at 1280x720 or 640x480
Though in the final model they took that part of the option out. And they are now claiming it to be a miss print. Which is technically false advertisement since they announced the same data on the release day.

So after looking through pages and pages of codes I see there are 120fps and 60 fps options in the firmware update, heck it is even visible on the old Firmware, but it is grayed out, aka locked.

So the camera at one point was able to shoot 60fps and 120fps, why they have taken that function out is a mystery. What i was hoping to do is unlock these options.

Re: Samsung WB2000/TL350 firmware analysis (also valid for EX1?)
« Reply #3 on: 06 / December / 2012, 14:14:19 »
RAW for Samsung WB 150


Re: Samsung WB2000/TL350 firmware analysis (also valid for EX1?)
« Reply #4 on: 12 / December / 2012, 00:52:45 »
So after looking through pages and pages of codes I see there are 120fps and 60 fps options in the firmware update, heck it is even visible on the old Firmware, but it is grayed out, aka locked.

 

Related Topics