E-mount electronic protocol reverse engineering

So, I keep on forgetting to log in and reply. I often get notifications of new posts when I'm at work, but by the time I get home I get distracted with something else.

Focus hold - it's almost surely in status group 5 or 6. Which subgroup, I don't know. Until recently I did not own any lenses with a focus hold button, and I haven't had an opportunity to bust out the logic analyzer on my A7III + 24-105G yet. Maybe the next time there's a rainy weekend. Retrofitting this to a lens would be extremely difficult - you'd have to interrupt the RX pin, monitor all data, and alter one of the bytes in the data stream on the fly. This would introduce a single byte of latency which probably would not be an issue - but the mechanical challenges of breaking into the RX pin would require delicate and difficult surgery of the lens. No way to add an interposer without losing infinity focus. (I have considered doing something like this to make a "more intelligent" extension tube that tells the body the lens is farther away from the sensor.)

Basic "ID chip" - something like this (a basic minimal lens implementation that makes the body thing something there) is one of the next steps in the effort - I'm reaching the limits of what I can do by just passively monitoring data and have to instead start talking to a lens or body. But this requires a lot more work to put something together, so it keeps on getting put off.

That Russian adapter - you'll notice that it's manually controlling a Canon lens with buttons and doesn't talk to the body unfortunately. It did have some potential ideas as to how I might mechanically build something to experiment with, but my mechanical skills aren't as good as that guy.

Basic AF forwards/backwards - pretty much the next phase after ID chip. I think I know almost enough about the various protocol fields to do a legacy adapter emulation, but again - haven't had the time in a while. A big question mark is the lens initialization sequence - I don't know the meaning of a lot of those fields and when I try to actually emulate a lens I might miss something important.

Just download firmware of TAMRON 28-75mm F/2.8 Di III RXD (A036 for sony E-mount),
i plan to analyze it with IDA Pro,but have no idea about the main MCU of this Lens,

Does anybody get teardown info of TAMRON A036 Lens for sony ?

Edited by Leegong - 19 July 2018 at 07:42

rokaka wrote: Sounds like a plan Leegong. I don't know about the MCU, but apparently there are/were AF issues with the lens ( https://www.dpreview.com/news/0946193973/tamron-28-75mm-f2-8-di-iii-rxd-autofocus-issue ), so make sure you have the firmware without those issues.

Thanks so much.

@Leegong: maybe this link will inspire you. It's been decades since I was into reverse engineering, so I hope you will find something useful! Keep us posted!

http://hexblog.com/files/recon%202010%20Skochinsky.pdf

Hi Leegong,

I don't own this lens myself. I asked the MCU type here https://www.youtube.com/watch?v=uMfe98QvflM and got this answer. If you say it doesn't match, I believe you. I'm sure you are a skilled reverse engineer, so I doubt me looking at the .bin will help. Maybe just upload the file somewhere (e.g. Mega) and post the link, so everyone interested can take a look? IDA should decompile for the uPD78F0534 out of the box I think, so if it doesn't... the MCU is indeed probably different... :(

Edit: could the binary be encrypted?

Edited by rokaka - 23 July 2018 at 09:12

That Youtube video shows a Nikon lens, not the Sony variant.

Leegong wrote: @rokaka , i have decrypted the firnware , i'm 100% sure the decrypted binary file is correct . The following are parts of strings in the binary file : a_lot_of_frames_err ; AA036SF000 ; FCADJ_SV ; I'm not able to open youtube , there are two kinds of TAMRON 28-75 F2.8 1) TAMRON 28-75mm F/2.8 Di III RXD (A036 for sony E-mount) 2) TAMRON SP AF28-75mm F/2.8 XR Di LD Aspherical [IF] MACRO Model A09 for Nikon,Canon Maybe the lens is A09 instaed of A036 ?

Decrypted binary is fine then I guess. The lens in the Youtube vid is the A09. IDA doesn't disassemble your binary?