FAQ FAQ  Forum Search   Events   Register Register  Login Login

E-mount electronic protocol reverse engineering

Page  <1 56789 14>
Author
Tofer23 View Drop Down
Newbie
Newbie

Joined: 04 July 2018
Country: Russia
Location: Moscow
Status: Offline
Posts: 2
Post Options Post Options   Quote Tofer23 Quote  Post ReplyReply Direct Link To This Post Posted: 04 July 2018 at 13:06
Hello!

Seem you all know a lot about the topic. I have a simple project - an electronic double focus system for a taken lens and anamorphic adapter. Now I'd like to make it possible to calibrate the focus system automatically, using Sony's AF system. I have two motors rotating two lens and adapter connected to Arduino Nano. I wonder if I can get commands from the e-mount pins to move lens forward or backward till it gets in focus. That's all I need.
 



Back to Top
Entropy512 View Drop Down
Groupie
Groupie

Joined: 22 July 2015
Country: United States
Status: Offline
Posts: 55
Post Options Post Options   Quote Entropy512 Quote  Post ReplyReply Direct Link To This Post Posted: 04 July 2018 at 15:56
So, I keep on forgetting to log in and reply. I often get notifications of new posts when I'm at work, but by the time I get home I get distracted with something else.

Focus hold - it's almost surely in status group 5 or 6. Which subgroup, I don't know. Until recently I did not own any lenses with a focus hold button, and I haven't had an opportunity to bust out the logic analyzer on my A7III + 24-105G yet. Maybe the next time there's a rainy weekend. Retrofitting this to a lens would be extremely difficult - you'd have to interrupt the RX pin, monitor all data, and alter one of the bytes in the data stream on the fly. This would introduce a single byte of latency which probably would not be an issue - but the mechanical challenges of breaking into the RX pin would require delicate and difficult surgery of the lens. No way to add an interposer without losing infinity focus. (I have considered doing something like this to make a "more intelligent" extension tube that tells the body the lens is farther away from the sensor.)

Basic "ID chip" - something like this (a basic minimal lens implementation that makes the body thing something there) is one of the next steps in the effort - I'm reaching the limits of what I can do by just passively monitoring data and have to instead start talking to a lens or body. But this requires a lot more work to put something together, so it keeps on getting put off.

That Russian adapter - you'll notice that it's manually controlling a Canon lens with buttons and doesn't talk to the body unfortunately. It did have some potential ideas as to how I might mechanically build something to experiment with, but my mechanical skills aren't as good as that guy.

Basic AF forwards/backwards - pretty much the next phase after ID chip. I think I know almost enough about the various protocol fields to do a legacy adapter emulation, but again - haven't had the time in a while. A big question mark is the lens initialization sequence - I don't know the meaning of a lot of those fields and when I try to actually emulate a lens I might miss something important.
Back to Top
Tofer23 View Drop Down
Newbie
Newbie

Joined: 04 July 2018
Country: Russia
Location: Moscow
Status: Offline
Posts: 2
Post Options Post Options   Quote Tofer23 Quote  Post ReplyReply Direct Link To This Post Posted: 04 July 2018 at 22:07
Perhaps I need to buy a very cheap lens and disassemble it and use the PWM signals for its servo to move my ones. Could it work?
Back to Top
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 26
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 19 July 2018 at 07:36
Just download firmware of TAMRON 28-75mm F/2.8 Di III RXD (A036 for sony E-mount),
i plan to analyze it with IDA Pro,but have no idea about the main MCU of this Lens,

Does anybody get teardown info of TAMRON A036 Lens for sony ?

Edited by Leegong - 19 July 2018 at 07:42
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 19 July 2018 at 08:08
Sounds like a plan Leegong. I don't know about the MCU, but apparently there are/were AF issues with the lens ( https://www.dpreview.com/news/0946193973/tamron-28-75mm-f2-8-di-iii-rxd-autofocus-issue ), so make sure you have the firmware without those issues.
Back to Top
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 26
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 19 July 2018 at 08:31
Originally posted by rokaka rokaka wrote:

Sounds like a plan Leegong. I don't know about the MCU, but apparently there are/were AF issues with the lens ( https://www.dpreview.com/news/0946193973/tamron-28-75mm-f2-8-di-iii-rxd-autofocus-issue ), so make sure you have the firmware without those issues.

Thanks so much.
 



Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 20 July 2018 at 08:31
MCU seems to be UPD78F0534. Datasheet: https://datasheetspdf.com/pdf-file/837896/NEC/UPD78F0534/1

Maybe this helps.
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 20 July 2018 at 12:52
@Leegong: maybe this link will inspire you. It's been decades since I was into reverse engineering, so I hope you will find something useful! Keep us posted!

http://hexblog.com/files/recon%202010%20Skochinsky.pdf
Back to Top
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 26
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 22 July 2018 at 10:09
Originally posted by rokaka rokaka wrote:

@Leegong: maybe this link will inspire you. It's been decades since I was into reverse engineering, so I hope you will find something useful! Keep us posted!

http://hexblog.com/files/recon%202010%20Skochinsky.pdf


Hi, rokaka ,
I read uPD78F0534 Hardware manual 2 days , but can not be sure that it matches

with Lens firmware .

If you want , i can send the Lens Firmware bin file to you .

Edited by Leegong - 22 July 2018 at 10:14
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 22 July 2018 at 21:10
Hi Leegong,

I don't own this lens myself. I asked the MCU type here https://www.youtube.com/watch?v=uMfe98QvflM and got this answer. If you say it doesn't match, I believe you. I'm sure you are a skilled reverse engineer, so I doubt me looking at the .bin will help. Maybe just upload the file somewhere (e.g. Mega) and post the link, so everyone interested can take a look? IDA should decompile for the uPD78F0534 out of the box I think, so if it doesn't... the MCU is indeed probably different... :(

Edit: could the binary be encrypted?

Edited by rokaka - 23 July 2018 at 09:12
Back to Top
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 26
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 23 July 2018 at 09:56
@rokaka , i have decrypted the firnware ,
i'm 100% sure the decrypted binary file is correct .
The following are parts of strings in the binary file :
a_lot_of_frames_err ;
AA036SF000 ;
FCADJ_SV ;
I'm not able to open youtube , there are two kinds of TAMRON 28-75 F2.8
1) TAMRON 28-75mm F/2.8 Di III RXD (A036 for sony E-mount)
2) TAMRON SP AF28-75mm F/2.8 XR Di LD Aspherical [IF] MACRO Model A09 for Nikon,Canon
Maybe the lens is A09 instead of A036 ?



Edited by Leegong - 26 July 2018 at 07:54
Back to Top
sympa View Drop Down
Newbie
Newbie

Joined: 09 August 2015
Country: Netherlands
Status: Offline
Posts: 16
Post Options Post Options   Quote sympa Quote  Post ReplyReply Direct Link To This Post Posted: 23 July 2018 at 10:12
That Youtube video shows a Nikon lens, not the Sony variant.
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 23 July 2018 at 10:49
Originally posted by sympa sympa wrote:

That Youtube video shows a Nikon lens, not the Sony variant.

You're right. I guess the Sony version uses a different MCU then.
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 23 July 2018 at 12:13
Originally posted by Leegong Leegong wrote:

@rokaka , i have decrypted the firnware ,
i'm 100% sure the decrypted binary file is correct .
The following are parts of strings in the binary file :
a_lot_of_frames_err ;
AA036SF000 ;
FCADJ_SV ;
I'm not able to open youtube , there are two kinds of TAMRON 28-75 F2.8
1) TAMRON 28-75mm F/2.8 Di III RXD (A036 for sony E-mount)
2) TAMRON SP AF28-75mm F/2.8 XR Di LD Aspherical [IF] MACRO Model A09 for Nikon,Canon
Maybe the lens is A09 instaed of A036 ?


Decrypted binary is fine then I guess. The lens in the Youtube vid is the A09. IDA doesn't disassemble your binary?
Back to Top
Dyxum main page >  Forum Home > Dyxum Community > Knowledge Base Page  <1 56789 14>

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.109 seconds.

Monitor calibration strip

Dyxum.com - Home of the alpha system photographer

In memory of Cameron Hill - brettania

Feel free to contact us if needed.