A little under 24 hours ago, and roos posted he and Kungsholmens Kameraklubb found the checksum for the D7000 A & B firmware , but it didn’t work on the d5100 firmware.
The code they used was the big endian form of the CRC16, but running on little endian CPUs.
Turning the Wikipedia CRC code into C# follows:
For the D7000 A & B, D300S A&B, D3S A & B, D3100 A, D5100 A firmware files use start: 0x0000, mask=0x1021
For all models (D3S, D300S, D7000, D5100 & D3100) the CRC is a normal Xmodem CRC16, the originally reported difference for D5100 & D3100 was due to a XOR error (by me), that is now found & fixed.
static int crcBig(byte[] data, int len)
{
int rem = 0x0;
for (int i = 0; i < len; i++)
{
rem = rem ^ (data[i] << 8);
for (int j = 0; j < 8; j++)
{
if ((rem & 0x8000) != 0)
{
rem = (rem << 1) ^ 0x1021;
}
else
{
rem = rem << 1;
}
rem = rem & 0xFFFF; // Trim remainder to 16 bits
}
}
// A popular variant complements rem here
return rem;
}
For the D5100 B firmware use start= 0x4ed4, mask= 0x1021
The D3100 B firmware also matches the same start value, so I’d assume it’s common to both. And the only thing I modified here was the firmware help message, and I’ve not tested if you can load the 1.01 firmware over top it’s self. That is the next step. Also to make a tool (Vitaliy?) the patches and encrypts for you to avoid typo’s.
[Update]
Very import and good news, firmware lets you flash same version over top it’s self. Thus my camera is now back running normal Nikon 1.01 firmware. Warranty unbroken!
[Update 2: 27 Nov] Fixed CRC code in light of XOR code change.
Interested in more, come join the us at Nikon Hacker, or use the Online Patch Tool (Help)