FAQ FAQ  Forum Search   Events   Register Register  Login Login

E-mount electronic protocol reverse engineering

Page  <1 678910 15>
Author
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 23 July 2018 at 20:17
Leegong, maybe better luck with the firmware of the Sigma 30mm F1.4 DC DN C016: http://www.sigma-global.com/common/download/lenses/firmware/data/Update_SigmaC30F14V3.exe ?

Here's other lens firmware from Sigma: https://www.sigma-global.com/en/download/lenses/firmware/
 



Back to Top
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 28
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2018 at 02:18
rokaka ,
i download and decrypt firmware of the Sigma 30mm F1.4 DC DN C016 ,
however i have no idea about MCU model , no way to analyze it with IDA .
Back to Top
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 28
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2018 at 02:43
i also download lots of E-mount Lens firmware from Sony offical site ,
for example Vario-Tessar FE24-70mm F4 ZA OSS , SEL 35F1.4 Zeiss , Sony 24-70mm F2.8 GM ......
Renesas R2J30503 is responsible for OSS , but no way getting datasheet of Renesas R2J30503, meanwhile no idea about main MCU model.

Edited by Leegong - 24 July 2018 at 03:18
Back to Top
sympa View Drop Down
Newbie
Newbie

Joined: 09 August 2015
Country: Netherlands
Status: Offline
Posts: 16
Post Options Post Options   Quote sympa Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2018 at 06:39
Firmware is very often encrypted. If it is not, or once it is decrypted, it should not be that hard to find out the CPU type as they will not use a custom design.

Understanding the E-mount protocol is likely the most interesting bit. I noticed that people were looking for a 'chip' to mount to an all-manual lens. I wonder if that can be made if one only has an AF lens as an example.
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 24 July 2018 at 08:25
Leegong, maybe you can upload your decrypted files to e.g. https://bayfiles.com/ or https://mega.nz/ so we can all take a look and maybe find out more?
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 03 August 2018 at 10:15
Can anyone tell which MCU is being used in the Tamron A036 lens, so we can find the datasheet? Here is the decrypted firmware: https://bayfiles.com/e2k2Dafdb7/TAMRON_A036_2875_Ver02.bin


To load it in IDA:

select CPU as ARM little endian, set manual loading, then set ROM loading address = 0x800 0000, IDA selects size of ROM automatically,
set file offset = 0x0000 ,
set RAM address = 0x2000 0000 , size = 512KB

(all credits go to Leegong).

Edited by rokaka - 03 August 2018 at 13:08
 



Back to Top
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 28
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 11 August 2018 at 16:19
The chip is based on ARM core , probably cortex-M3 or cortex M4 ,
there are several notable features inside it :
the chip uses 0x4000xxxx - 0x4002xxxx , 0x4242xxxx ,
0x48000000 - 0x48001FFF and 0x50000000 - 0x500007FF for Peripherals accessing .
which one known MCU has similar feature ?

Edited by Leegong - 12 August 2018 at 16:00
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 12 August 2018 at 11:38
Can you tell if there are any floating point or DSP instructions present? That would at least differentiate between M3 and M4(F) I think?
Back to Top
Leegong View Drop Down
Newbie
Newbie

Joined: 30 September 2016
Status: Offline
Posts: 28
Post Options Post Options   Quote Leegong Quote  Post ReplyReply Direct Link To This Post Posted: 13 August 2018 at 09:03
It should be cortex-M4 , in sub_8039348 , there are lots of FPU instructions
such as VCVT , VLDR , VDIV......
Back to Top
rokaka View Drop Down
Newbie
Newbie

Joined: 30 June 2018
Status: Offline
Posts: 22
Post Options Post Options   Quote rokaka Quote  Post ReplyReply Direct Link To This Post Posted: 13 August 2018 at 11:27
According to Wikipedia, that would 'narrow it down' to:

The following microcontrollers are based on the Cortex-M4F (M4 + FPU) core:

Cypress PSoC 6200 (one Cortex-M4F + one Cortex-M0+), FM4
Infineon XMC4000
Microchip (Atmel) SAM 4C (one Cortex-M4F + one Cortex-M4), 4E, D5, E5, G5
Microchip CEC1302
Nordic nRF52
NXP LPC4000, LPC4300 (one Cortex-M4F + one Cortex-M0)
NXP (Freescale) Kinetis K, V3, V4
Renesas Synergy S3, S5, S7
Silicon Labs (Energy Micro) EFM32 Wonder
STMicroelectronics STM32 F3, F4, L4, L4+, WB (one Cortex-M4F + one Cortex-M0+)
Texas Instruments LM4F, TM4C, MSP432
Toshiba TX04
Back to Top
bostwickenator View Drop Down
Newbie
Newbie

Joined: 19 June 2009
Status: Offline
Posts: 29
Post Options Post Options   Quote bostwickenator Quote  Post ReplyReply Direct Link To This Post Posted: 14 October 2018 at 04:15
Has anyone managed to get a dev board talking on the bus? I'm going to attempt to try and see if I can get a basic AF drive system figured out which steps a servo.

The baud rate is pretty high at 1.5Mbaud so I'm probably going to use a Teensy 3.6 to give me a bunch of spare compute at first.
Back to Top
bostwickenator View Drop Down
Newbie
Newbie

Joined: 19 June 2009
Status: Offline
Posts: 29
Post Options Post Options   Quote bostwickenator Quote  Post ReplyReply Direct Link To This Post Posted: 20 October 2018 at 02:01
If you guys are looking to reverse engineer existing adapters techart has a bunch of their binaries available here http://www.techart-logic.com/g-nex3/firmware/firmware.txt

These are downloaded OTA via bluetooth LE so I suspect it's either a http://www.ti.com/product/CC2640 or https://www.nordicsemi.com/index.php/eng/Products/Bluetooth-low-energy/nRF51822

Edited by bostwickenator - 20 October 2018 at 04:25
Back to Top
bostwickenator View Drop Down
Newbie
Newbie

Joined: 19 June 2009
Status: Offline
Posts: 29
Post Options Post Options   Quote bostwickenator Quote  Post ReplyReply Direct Link To This Post Posted: 20 October 2018 at 03:53
Ok made a snooping harness, wish me luck
Back to Top
Miranda F View Drop Down
Senior Member
Senior Member

Joined: 11 January 2014
Country: United Kingdom
Location: Bristol
Status: Offline
Posts: 3814
Post Options Post Options   Quote Miranda F Quote  Post ReplyReply Direct Link To This Post Posted: 22 October 2018 at 12:09
Very neat. I made one for A-mount but mine wasn't quite so pretty.
I know that on A mount there was some speed-control negotiation like in the old serial comms days, but don't know whether this happens on E-mount. On A mount the protocol used for lens-camera comms varied accoridng to the lens age you fitted as well as the camera. Guess this is going to be simpler for E-mount.
Miranda F & Sensorex, Sony A7Rii, A58, Nex-6, Dynax 4, 5, 60, 500si/600si/700si/800si, various Sony & Minolta lenses, several Tamrons, lots of MF primes and *far* too many old film cameras ...
Back to Top
Dyxum main page >  Forum Home > Dyxum Community > Knowledge Base Page  <1 678910 15>

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.078 seconds.

Monitor calibration strip

Dyxum.com - Home of the alpha system photographer

In memory of Cameron Hill - brettania

Feel free to contact us if needed.