Tagged with reverse - Personal View Talks https://personal-view.com/talks/discussions/tagged/reverse/feed.rss Sat, 04 May 24 03:57:24 +0000 Tagged with reverse - Personal View Talks en-CA Lumix G9 firmware reverse engineering https://personal-view.com/talks/discussion/24266/lumix-g9-firmware-reverse-engineering Fri, 14 Aug 2020 08:31:54 +0000 jverbeek 24266@/talks/discussions Hey there, I recently got myself a Lumix G9 and was keen to look into the firmware. I'm hitting a roadblock, but maybe somebody can help me :)

The .bin firmware you can download from Panasonic (https://av.jpn.support.panasonic.com/support/share2/eww/com/dsc/fts/zip/G9___V22.zip) has the "UPD " magic, followed by 8 bytes I couldn't associate, and then what seems like a product identifier "MC471" (MC = mirrorless camera?)

The interesting stuff starts at 0x2EC, where something which looks like a partition table starts. This section is 4884 bytes long (including some padding I believe) and contains 48 partitions which I managed to reverse engineer:

// 92 bytes - index entry of the partition listing struct partitionIndexEntry { char name[12]; // 12 bytes - name of the partition int offsetFile; // 4 bytes - offset in the firmware file int size; // 4 bytes - size of the partition int offsetMemory; // 4 bytes - offset in the memory on the camera int encryption; // 4 bytes - whether the partition is encrypted (0x3) or not (0x2) char checksum[32]; // 32 bytes - SHA-256 checksum of unencrypted partitions? char key[16]; // 16 bytes - encryption key?, if encryption == 0x3 char padding[16]; // 16 bytes - padding };

Reading that in in my custom C tool I've written for this logs out 48 partitions with their offset (in the firmware file, the real data starts at 0x1600) and size. I added automatic dd'ing so I now got 48 .bin files which are the extracted partitions out of the big firmware file. Adding all the sizes of the partitions together is also exactly the size of the original .bin minus the 0x1600/5120 bytes at the beginning which are the headers and partition table. You can download the extracted partition files here: https://drive.google.com/file/d/1P4681aZkRlCUuaiL10nH_En1g70iRLKS/view

Now, they obviously seem to be encrypted, and I haven't been able to figure out how. As you can see I was thinking whether the 16 byte long key in the partition index might be a key, because it's filled with zeros if encryption is 0x2.

This is my progress, I greatly appreciate any hints!

]]>
Nikon Coolpix https://personal-view.com/talks/discussion/15205/nikon-coolpix Fri, 10 Jun 2016 10:49:35 +0000 crt0 15205@/talks/discussions I am working on the subj. The problem is that part of firmware is compressed with variable length coding and I have no clue how to unpack. This is not ZIP or any obvious formats. Encoded data is a stream of blocks. Here is one of them:

00287218h: 02 00 00 00 70 01 00 00 00 01 00 00 30 01 50 00 ; ....p.......0.P.
00287228h: 04 98 01 00 0F 08 00 00 13 08 00 00 21 08 01 00 ; .˜..........!...
00287238h: 30 18 01 00 50 98 01 00 70 A0 01 00 B0 20 02 00 ; 0...P˜..p ..° ..
00287248h: F0 20 02 00 03 00 00 00 4B 00 00 00 CB 03 00 00 ; ð ......K...Ë...
00287258h: 17 08 00 00 17 08 00 00 1F 08 00 00 1F 08 00 00 ; ................
00287268h: 07 80 00 00 0B 80 00 00 23 80 00 00 37 80 00 00 ; .€...€..#€..7€..
00287278h: 6B 00 00 00 97 00 00 00 F3 00 00 00 4F 01 00 00 ; k...—...ó...O...
00287288h: DF 01 00 00 03 02 00 00 43 02 00 00 C7 02 00 00 ; ß.......C...Ç...
00287298h: 1B 08 00 00 1B 08 00 00 23 08 00 00 23 08 00 00 ; ........#...#...
002872a8h: 2F 98 00 00 2F 98 00 00 13 80 00 00 27 80 00 00 ; /˜../˜...€..'€..
002872b8h: 33 80 00 00 3B 80 00 00 47 80 00 00 53 80 00 00 ; 3€..;€..G€..S€..
002872c8h: 57 80 00 00 5F 80 00 00 73 80 00 00 83 80 00 00 ; W€.._€..s€..ƒ€..
002872d8h: 87 00 00 00 8F 00 00 00 93 00 00 00 9B 00 00 00 ; ‡......“...›...
002872e8h: CF 00 00 00 DB 00 00 00 03 01 00 00 13 01 00 00 ; Ï...Û...........
002872f8h: 1F 01 00 00 43 01 00 00 63 01 00 00 F3 01 00 00 ; ....C...c...ó...
00287308h: 13 02 00 00 3F 02 00 00 4B 02 00 00 8B 02 00 00 ; ....?...K...‹...
00287318h: 93 02 00 00 B7 02 00 00 CB 02 00 00 CF 02 00 00 ; “...·...Ë...Ï...
00287328h: D3 02 00 00 D7 02 00 00 DB 02 00 00 F3 02 00 00 ; Ó...×...Û...ó...
00287338h: 13 03 00 00 17 03 00 00 83 03 00 00 D3 03 00 00 ; ........ƒ...Ó...
00287348h: F7 03 00 00 03 04 00 00 47 98 00 00 8F B8 01 00 ; ÷.......G˜..¸..
00287358h: 01 10 03 00 AB 00 00 00 8F 00 00 00 41 08 01 00 ; ....«......A...
00287368h: 35 08 01 00 29 08 01 00 21 88 00 00 6B 00 00 00 ; 5...)...!ˆ..k...
00287378h: 8B 00 00 00 4F 00 00 00 5F 00 00 00 6F 00 00 00 ; ‹...O..._...o...
00287388h: 03 00 00 00 3F 00 00 00 9F 00 00 00 4B 00 00 00 ; ....?...Ÿ...K...
00287398h: 5B 00 00 00 9B 00 00 00 7B 00 00 00 7F 00 00 00 ; [...›...{......
002873a8h: C0 3F 0F 7D A1 18 8F B8 0E 0F E3 6E 08 CF 23 79 ; À?.}¡.¸..ãn.Ï#y
002873b8h: 32 0B E7 94 0B E7 47 26 E0 AE E2 91 D9 8A AE 0D ; 2.ç”.çG&à®â‘ÙŠ®.
002873c8h: FE 25 FD E6 9B B8 96 86 BE 75 67 5E C8 6B B1 82 ; þ%ý書–†¾ug^Èk±‚
002873d8h: FD 07 A3 7C 61 5F 8A AC 2F C4 31 CB 72 2D 6B E1 ; ý.£|a_Š¬/Ä1Ër-ká
002873e8h: 8C D5 F6 3A F8 EF 80 EF 68 11 C4 59 F6 11 67 D4 ; ŒÕö:øï€ïh.ÄYö.gÔ
002873f8h: 45 9F 41 16 7C C4 59 F2 11 67 38 8B 3A 07 3D 40 ; EŸA.|ÄYò.g8‹:.=@
00287408h: 73 2F 77 4B 11 DE 6B DD D5 17 EE B0 5F 56 22 8C ; s/wK.ÞkÝÕ.î°_V"Œ
00287418h: E7 7F B6 D3 7C 8A EF 0A 16 6C 79 0D F0 CD E5 29 ; ç¶Ó|Šï..ly.ðÍå)
00287428h: 45 B1 91 7A C6 ED E8 EF 47 86 74 64 03 21 7C 08 ; E±‘zÆíèïG†td.!|.
00287438h: EB BE DC CC 8A 94 7D 5C DA 5D 3B 58 F6 FF 8A 36 ; ë¾ÜÌŠ”}\Ú];XöÿŠ6
00287448h: 5F ED 3F CE BE 80 00 00 00 00 00 00 00 00 00 00 ; _í?ξ€..........
00287458h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00287468h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00287478h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00287488h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................
00287498h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ; ................

Any idea what it is and how to unpack ? Thanks in advance

]]>
Feature trailer for YES NO YES YES GO https://personal-view.com/talks/discussion/6369/feature-trailer-for-yes-no-yes-yes-go Sun, 10 Mar 2013 12:05:20 +0000 prorevolution 6369@/talks/discussions Hi,

So we're doing what we've coined "reverse-crowdfunding"...we put up the money for the film first and are now using the legitimacy of IndieGoGo to clear debt/deferred payments and distribute by offering a pay-what-you-want download for backers.

Our feature was really low budget, but feels and looks very relevant...especially to someone in their 20s....but you be the judge. I'm interested to hear what people think of this strategy. Surely we'll make lots of mistakes & learn a lot, let me be the guinea pig.

Here's our links:

Thanks for feedback & opinions...we've never quite seen anyone go about distribution this way before...

]]>