Nikon Firmware Insights #05

Just to let people know, yes I’ve been working on understanding the D5100 firmware.

I’ve got most the area’s of code identified (where they are, not what they do), but there are some puzzles, with some chunks of code that are used (eg selects a picture to be shown based on shooting mode) but the code it self is not directly linked to, and it’s address in not present in the image. There is defiantly some form of jump/call table compression/encoding done, as there are functions that do some maths, and then call the result. So that needs to be puzzled out.

So to help map the data (and thus remove possible options from above puzzle), I previous mentioned mapping the jpg’s out:

Embedded Jpg's
Embedded Jpg's

As can be seen in this small sample, there’s the icons for the different shooting modes, and three colour schemes.

Last night I was working on using a modified version of BinViz (original found here) and have found how the font’s and overlay text/images are packed, and I am in the process of tracking down how the width/size information is encoded in the associated data tables. Shown below is the same block of data shown, but at two different widths, showing the “Dial” overlays and the “Bulb Time” text:

Overlay Images 2
Overlay Images 2
Overlay Images 1
Overlay Images 1

It’s quite neat looking at the Asian font sets, as the fonts/overlays use subpixel rendering, which can be seen in the green arm of the sports mode dial icon above. Much simpler, the normal overlays are just black/white, and now look better X/Y scaled.

I started a Google Code Project called Nikon Firmware Tools in which I’m placing the tools I’m using and the changes I’m making to them as I go. So interested developers can look there. Sorry only code so far.

Interested in more, come join the us at Nikon Hacker, or use the Online Patch Tool (Help)

Comments:

Marc 2011-12-06 12:53:28

Wow, sounds great!

I have no experience in understanding binary code but I’m like apparently hundreds of people interested in getting the video mode of the camera right.

Generally one would just like the camera to keep the iso, shutter and exposure fixed as it was, when changing to video mode. What one would have to do is thus only to deactivate the automatic calibration routine.

Is that a near term possibility for someone with some experience or do I imagine it too easy?

Best, Marc


Simeon 2011-12-06 13:24:03

Hi Marc,

Yes someone with “some experience” should be able to do what you ask. The only problem is that, currently only the Nikon firmware developers have “some experience”. I’m not yet at a place to make that change, and I don’t know when I will be. Also I have no clue when some other person would be at that stage…

Simeon


Marc 2011-12-06 13:38:22

Ok, nice work already :)


mojo43 2011-12-06 15:39:08

Thanks again for posting, interesting discoveries!


John Caballero 2011-12-06 16:18:36

Great work. Yes, total manual controls in video mode would be awesome on the D5100. I am sure at some point somebody will come along to complete what you have started. Thank you for taking the time and knowledge to work on this.


LPowell 2011-12-06 17:26:53

Enabling manual video controls on the D5100 won’t do much good if there’s no reliable way to judge the exposure you’re setting. Since the camera lacks a Live View histogram, you need to either rely on auto-ISO to set exposure or eyeball the light levels shown on the LCD. Unfortunately, when the D5100 is in Manual exposure mode, the LCD does not accurately display the exposure level in Live View mode. A fully manual video patch would need to patch the Manual mode Live View display as well.


Christian Johansson 2011-12-06 21:08:03

Nice Simeon!
You have made great progress in understanding the code, lets hope more people with some basic understanding in this sort of thing help you. The more the merrier ;)

I dont have the more advanced D5100, only the D3100.
But I guess many people would like some nice changes on that one too so may it too will get the love it deserves.

I will absolutely follow the progress with my fingers crossed.


Milan 2011-12-07 15:58:10

Is it possible to edit extracted JPG images and put them back to .bin firmware? I am not very familiar with this codes… Nice work by the way, i am following “the investigation” :D


Simeon 2011-12-07 16:27:18

Yes and No. If you have smaller pictures after the editing, you could do this pretty safely. The two ways to make them smaller is to compress them more (or have more compressible image), or have smaller dimensions. The former would be ‘safe’ and the latter would be risky.

You could also move data the follows a larger picture, but this again is risky, and you have to be very confidant that you change all references, otherwise you could brick the device.

The image section is one or two locations I’d look towards for inserting altered code, the other is the fonts for Asian languages, given I only speak English…


ΤΚ 2011-12-07 17:59:17

I would like to donate the cracked version of IDA Pro, but i guess thats something you could find yourself Simeon.
Myself trying to understand anything on code with my minimal assembly knowledge i have.


Goran 2011-12-08 05:18:03

The feature I am interested in ( I believe others are too ) is AF FINE TUNE or autofocus offset general value. No need for 20 lenses preset, just one general value. It is probably possible to change that value in firmware. Fixing front/back focusing issue would be excellent breakthrough in this great work of yours. Thanks for giving as a hope!


arm.indy 2011-12-08 16:19:11

Hi,
you can use CryptTool to compute Floating Frequency over the file and see what parts are compressed or encrypted (freq>60 generally). http://www.cryptool.org/index.php/en/features-topmenu-43.html
and about Greg Conti: http://www.rumint.org/gregconti/, http://www.rumint.org/gregconti/publications/dfrws_2010-301.pdf
and http://magiclantern.wikia.com/wiki/ReverseEngineering_tools

Indy


Simeon 2011-12-08 20:59:55

Cheers for the links. Very sure there’s no real compression. Just a little bit of byte packing/ bit shuffling.


william 2011-12-10 10:47:54

Hello from Cali - Colombia !

Man we wait you…Great Job Hope you can make this hack for D7000 that really a great job.

Regards
William From Colombia


Renee Teunissen 2011-12-11 05:36:38

Great work, do you have some kind of getting started howto, to get more pleople involved in decoding, mapping and probably disassambling the code.

I own an D50, D90 and a D700, and if possible the D50 could be a great device to do testing with code, as I hope it utilizes the same cpu core/instruction sets.

Please let me know when it possible to dive into this, to prevent double work to be done.

Kinds regards,
Renee.


Simeon 2011-12-11 08:29:23

Hello Renee,

I don’t have anything more than what on this blog, or a few tools posted to the Google project.


hq 2011-12-11 11:13:54

Great job Simeon.

You’ll finally make NHDK a reality! Perhaps you should pool some of the experienced resources from CHDK.

Excellent excellent job. Keep up the great work!

Cheers,


Maxim 2011-12-12 09:45:56

hello
Thank you for your work! Your success is waiting for the whole world!

It would be nice if you could find a way to increase bitrate video …
Maxim Ukraine


Goran 2011-12-14 08:16:12

I found some guys that hacked into D70 (at least I think they did). May be helpful. It`s from 2006
http://wiki.berndlux.de/doku.php/elektr:nikond70s_hack


Martin 2011-12-21 07:59:01

Anyone interested in collaborating on building and injecting a debugger into the Nikon firmware? It would provide trace and logging functionality, so we could have an easier time at locating procedures of interest.
For example, people interested in adding a feature for full manual control of HD movie mode need to find two things: how to disable the automatic exposure program mode during movie recording, and at the same time how to enable the user interface control of exposure parameters.
By having a debugger with tracing loaded into custom firmware, the camera could be put into HD movie mode, and then shut down. This will result in the debugger logging the call stack to a file on the SD card. Since the camera will have been shut off, the most recent trace provides the addresses of relevant procedures.
The reason for doing this is we cannot emulate the hardware features that the code is dependent on - and I’m sure nobody wants to brick their D5100 in the process of aimless random code changes.
I can bring 10+ hours per week to the table for this project and software industry experience along with a recent bachelors level class on mips.
Thanks,
Martin
mmsjca AT gmail dot com


Paul 2011-12-21 20:46:09

Wow, great job! If this gets enough attention the possibilities will be endless!
If you are seeking people with experience for this kind of thing you should consider contacting:
- Vitaly Kiselev, who hacked the Panasonic GH1 & GH2 (But I believe you already know this one)
- Trammel Hudson, and other people from the Magic Lantern firmware hack for Canon Cameras, (those are the best IMO).
- And, of course, the people at CHDK.

These people know people who know exactly how to completely unravel the mysteries of your hack. You are not alone, get some help.


Christian Johansson 2011-12-22 13:55:35

Vitaly is already involved, or at least know about it.
He has made some posts in the comments and he has a thread about this on his homepage.

What would help most would be an inside leak from Nikon with information about how the firmware is built up. That would kick this project far ahead from where it is now.


Martin 2011-12-22 22:46:07

If you’re wondering how they access the SD card, and it looks like through subroutines that refer to it as the A:\ drive in plain FAT32. You can find these strings all over the B firmware binary.
I’m digging through it in IDA Pro 6.1 using the FR 32 bit mips module, connecting string references to the A:\ drive letter with subprocs.

Others that are similar with references to Format Card and so forth show a pattern of calling the same subset of “file access” subroutines, these must hold the memmap locations. Unfortunately with 40+ megs of disassembled code, it’s like searching for a needle in a haystack. Right now I’m noticing that I can’t find any FLIRT signatures in IDA that refer to the Fuji FR - does anyone know if there is a DLL around that provides some? That would cut down our task quite a bit.

A practical side to the hack - To help with recovery if lost and discourage theft, I’ve tagged my name into the camera menus. To keep it there, the “firmware version” menu option is now another “movie settings” :)

Thanks,
Martin

PS: Some data, check out how many subprocedures - now you know why I wanted to put in a debugger first thing. The FR hardware has support for

INTE instruction so we can set up traps and debug on the fly. Once we have the subprocs for SD card A:\ drive, using INTE during picture and

movie taking to grab the memmap io #’s can reveal how the XPEED2 is accessed. It will narrow down our task quite a bit.

0020cf30
A:\DCIM

0022a4cc
FAT32

0027e500
SoftGyro Ver.1.0

005b8290
Update?

005bba00
end of english strings library

0072f555
NEF (RAW)

00730b85
TTL.M.AA

007312d5
4928x3264; 16.1 M

007315a1
Picture Control

0073247a
16:9

007324e2
1920x1080

00732a99 TCP/IP
FTP
Wireless Transmitter

Exports
Name Address Ordinal
---- ------- -------
IBE 00000012
DMAC2 00000013
AD 00000781
EI6 00000928
MVEC 00000CB0
UARTT1 00001018
INT1 00001210
DMAC3 00001781
TBTO 00001EBC
COPETRAP 00002001
UARTR2 0000200F
EI3 0000201D
INT0 00005F10
RLTIM0 00006D34
EI5 00008B48
OBT 00008B84
STT 00008C86
RESET 00008F86
INTE 0000971C
DMAC4 00009720
DISB 00009B0D
DMAC1 00009F1C
UARTT2 00009F80
UARTR1 00009F8C
UTIMER0 0000A5CD
DMAC0 0000A804
UIE 0000B366
UTIMER2 0000B43A
UTIMER1 0000C000
I2C 0000C006
UARTR0 0000D8C2
UARTT0 0000E309

Functions procedures subroutines
sub_1EB ROM 000001EB 000001D8 R . . . . . .
sub_3C3 ROM 000003C3 0000008E R . . . . . .
sub_451 ROM 00000451 00000002 R . . . . . .
sub_5E5 ROM 000005E5 00000140 R . . . . . .
sub_725 ROM 00000725 0000005C R . . . . . .
AD ROM 00000781 0000007E R . . . . . .
sub_7FF ROM 000007FF 00000022 R . . . . . .
sub_821 ROM 00000821 000000A0 R . . . . . .
sub_8C1 ROM 000008C1 00000008 R . . . . . .
sub_A1B ROM 00000A1B 00000008 R . . . . . .
sub_BD7 ROM 00000BD7 00000024 R . . . . . .
sub_BFB ROM 00000BFB 0000001A R . . . . . .
MVEC ROM 00000CB0 00000006 R . . . . . .
sub_DE9 ROM 00000DE9 0000000A R . . . . . .
sub_DFF ROM 00000DFF 00000016 R . . . . . .
sub_E15 ROM 00000E15 00000008 R . . . . . .
sub_E1D ROM 00000E1D 0000000E R . . . . . .
sub_E2B ROM 00000E2B 00000022 R . . . . . .
sub_E98 ROM 00000E98 00000004 R . . . . . .
sub_EC9 ROM 00000EC9 00000008 R . . . . . .
sub_FEF ROM 00000FEF 00000014 R . . . . . .
sub_10D5 ROM 000010D5 00000004 R . . . . . .
sub_10FB ROM 000010FB 00000014 R . . . . . .
sub_11F7 ROM 000011F7 0000000A R . . . . . .
sub_1201 ROM 00001201 0000000C R . . . . . .
INT1 ROM 00001210 0000001E R . . . . . .
sub_132D ROM 0000132D 0000001E R . . . . . .
sub_134B ROM 0000134B 00000006 R . . . . . .
sub_14F9 ROM 000014F9 000000A8 R . . . . . .
sub_15A1 ROM 000015A1 0000000E R . . . . . .
sub_15AF ROM 000015AF 00000080 R . . . . . .
sub_166B ROM 0000166B 00000014 R . . . . . .
sub_167F ROM 0000167F 00000014 R . . . . . .
sub_1693 ROM 00001693 00000016 R . . . . . .
sub_170D ROM 0000170D 00000074 R . . . . . .
DMAC3 ROM 00001781 0000002E R . . . . . .
sub_17AF ROM 000017AF 0000000E R . . . . . .
sub_1949 ROM 00001949 00000040 R . . . . . .
sub_1989 ROM 00001989 00000028 R . . . . . .
sub_1A4A ROM 00001A4A 0000001C . . . . . . .
sub_1BED ROM 00001BED 0000000C R . . . . . .
sub_1BF9 ROM 00001BF9 00000024 R . . . . . .
sub_1C1D ROM 00001C1D 00000008 R . . . . . .
TBTO ROM 00001EBC 00000083 R . . . . . .
COPETRAP ROM 00002001 0000000E R . . . . . .
UARTR2 ROM 0000200F 0000000E R . . . . . .
sub_2069 ROM 00002069 00000026 R . . . . . .
sub_208F ROM 0000208F 00000022 R . . . . . .
sub_20B1 ROM 000020B1 0000004C R . . . . . .
sub_2109 ROM 00002109 00000004 R . . . . . .
sub_210D ROM 0000210D 0000005A R . . . . . .
sub_2167 ROM 00002167 00000082 R . . . . . .
sub_226D ROM 0000226D 0000001C R . . . . . .
sub_2289 ROM 00002289 000000CA R . . . . . .
sub_2353 ROM 00002353 00000022 R . . . . . .
sub_2375 ROM 00002375 00000028 R . . . . . .
sub_239D ROM 0000239D 00000018 R . . . . . .
sub_23B5 ROM 000023B5 0000008A R . . . . . .
sub_243F ROM 0000243F 00000064 R . . . . . .
sub_25D9 ROM 000025D9 0000003C R . . . . . .
sub_2699 ROM 00002699 0000000C R . . . . . .
sub_26A5 ROM 000026A5 0000002A R . . . . . .
sub_26CF ROM 000026CF 00000016 R . . . . . .
sub_29A7 ROM 000029A7 000000B4 R . . . . . .
sub_2A5B ROM 00002A5B 00000A0A R . . . . . .
INT0 ROM 00005F10 000002CA . . . . . . .
RLTIM0 ROM 00006D34 00000034 R . . . . . .
EI5 ROM 00008B48 0000003C R . . . . . .
OBT ROM 00008B84 00000102 R . . . . . .
STT ROM 00008C86 00000300 R . . . . . .
RESET ROM 00008F86 0000000C . . . . . . .
sub_96F7 ROM 000096F7 0000000C R . . . . . .
INTE ROM 0000971C 00000004 R . . . . . .
DMAC4 ROM 00009720 00000124 R . . . . . .
sub_9A9B ROM 00009A9B 0000000A R . . . . . .
DISB ROM 00009B0D 00000064 R . . . . . .
DMAC1 ROM 00009F1C 00000064 R . . . . . .
UARTT2 ROM 00009F80 0000000C R . . . . . .
UARTR1 ROM 00009F8C 00000310 R . . . . . .
UTIMER0 ROM 0000A5CD 0000000E R . . . . . .
DMAC0 ROM 0000A804 00000B62 R . . . . . .
UIE ROM 0000B366 000000D4 R . . . . . .
UTIMER2 ROM 0000B43A 000000AA R . . . . . .
UTIMER1 ROM 0000C000 00000006 R . . . . . .
I2C ROM 0000C006 000000E0 R . . . . . .
sub_D737 ROM 0000D737 0000000C R . . . . . .
sub_D743 ROM 0000D743 00000052 R . . . . . .
UARTR0 ROM 0000D8C2 00000066 . . . . . . .
sub_DD85 ROM 0000DD85 00000076 R . . . . . .
sub_E0D3 ROM 0000E0D3 00000008 R . . . . . .
UARTT0 ROM 0000E309 000000A0 R . . . . . .
sub_E3A9 ROM 0000E3A9 0000002A R . . . . . .
sub_E3D3 ROM 0000E3D3 00000014 R . . . . . .
sub_E3E7 ROM 0000E3E7 000000A4 R . . . . . .
sub_E593 ROM 0000E593 00000008 R . . . . . .
sub_E5DF ROM 0000E5DF 00000006 R . . . . . .
sub_E651 ROM 0000E651 0000001C R . . . . . .
sub_13E42 ROM 00013E42 00000150 R . . . . . .
sub_140BA ROM 000140BA 00000136 R . . . . . .
sub_141F0 ROM 000141F0 0000002A R . . . . . .
sub_1421A ROM 0001421A 0000002E R . . . . . .
sub_14248 ROM 00014248 00000070 R . . . . . .
sub_142B8 ROM 000142B8 0000003A R . . . . . .
sub_142F2 ROM 000142F2 0000000A R . . . . . .
sub_142FC ROM 000142F


Martin 2011-12-22 22:49:18

Hello Renee,

Can you please volunteer your D50 as our guinea pig?
We want to get some very basic things down - access the SD card, use the INTE intruction to set up traps, and debug the procedure calls as they’re made during camera usage.

Thanks,
Martin
mmsjcs AT gmail DOT com


MartinSK2011 2011-12-23 22:58:11

Hello, we are creating custom firmware for the D5100 and need beta testers, assembly programmers, graphic designers, and others to help volunteer.
Please go to [http://nikonhacker.com\] and sign up if you would like to contribute.
Beta version is being released this weekend, please check my photostream for updates.

Loading custom firmware:

Running custom firmware:


poorpeter 2011-12-27 13:52:46

Keep on your great work, sir!
By the way, do you think there’s hope for a firmware hack of the glorious D90?
It’s a great camera not improved by Nikon with proper updates…
I hope You will give new life to her!


Rodrigo 2011-12-28 12:19:42

Great job!

I was wondering if it´s possible to hack the D90 firmware and to make it record full HD videos… can you help me with that? than-x!


Goran 2011-12-29 04:16:06

It would be great to find out how goes the recovery mode for DSLR. Just in case somebody mess up the firmware so bad that camera doesn`t power up. Recovery mode should help loading correct firmware over the messed up one. That mode is common option in usb devices like mp3 players and stuff. Holding certain button while powering up triggers the mode I think.


sorin 2011-12-29 08:48:24

Hi,
Martin, what modification u manage to make in the custom firmware.
I am interested in beta testing but I want to know if I have a possibility to put original firmware back in case of something wrong or to not loose the warranty.
It is possible to implement the micro focus adjustment in d5100?

Tx!


arianne 2011-12-29 15:44:28

Hi Simeon, please hack the d90 too! Full hd videos… but most of all control over iso and shutter during video capture would be a dream for us!!!


ydaniels 2011-12-31 13:36:14

Happy New Year to Simeon Pilgrim!!!


Simeon 2011-12-31 14:48:14

Thanks, happy New Year to you all too!