Hacking Nikon Z7

All things embedded.
*NO FEATURE REQUESTS*

Re: Nikon Z6/Z7

Postby coderat » Fri Dec 28, 2018 9:22 am

So where is MS7709ASE01 (Hitachi SH-3) ?
coderat
Core Developer
 
Posts: 2283
Joined: Fri Apr 26, 2013 10:21 am
Been thanked: 450 times

Re: Nikon Z6/Z7

Postby leegong » Mon Jan 28, 2019 4:55 am

Find hundreds of device prop codes :
Attachments
DevicePropCode.png
PTP_DevicePropCode.png
leegong
Core Developer
 
Posts: 2139
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 551 times

Re: Nikon Z6/Z7

Postby leegong » Wed Jan 30, 2019 6:41 pm

PTP Debug codes in Z7 are different from that in DSLR ,
0xF036 looks like memory dumping , 0xF037 looks like memory writting .
Attachments
PTP_DebugFunc.PNG
leegong
Core Developer
 
Posts: 2139
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 551 times

Re: Nikon Z6/Z7

Postby Simeon » Thu Jan 31, 2019 5:16 pm

Interesting that they repacked the code space, but I guess "its a different model" so not part of a family so they can reclaim numerical space...
Simeon
Core Developer
 
Posts: 2609
Joined: Wed Nov 30, 2011 6:12 am
Location: Christchurch, New Zealand
Been thanked: 614 times

Re: Nikon Z6/Z7

Postby leegong » Fri Mar 01, 2019 1:01 am

Most parts of RTOS API are decoded.
Code: Select all
  1.  

  2. SVC06_8001_CRE_Task          

  3. SVC06_8009_unknown_core      

  4. SVC06_800A_unknown_core      

  5. SVC06_8016_INF_Task          

  6. SVC06_8017_ref_tsk_core      

  7. SVC06_801C_Task_Wakeup        

  8. SVC06_8022_CRE_SEM            

  9. SVC06_8022_CRE_SEM_core      

  10. SVC06_8023_DELE_SEM_core      

  11. SVC06_8023_DEL_SEM            

  12. SVC06_8024_REL_SEM_core      

  13. SVC06_8024_Rel_SEM            

  14. SVC06_8025_SIG_SEM            

  15. SVC06_8025_SIG_SEM_core      

  16. SVC06_8026_REF_SEM_core      

  17. SVC06_8027_Cre_MTX            

  18. SVC06_8027_Cre_MTX_core      

  19. SVC06_8028_DEL_MTX_core      

  20. SVC06_8029_MTX_Lock          

  21. SVC06_8029_MTX_Lock_API      

  22. SVC06_8029_MTX_Lock_core      

  23. SVC06_802A_MTX_Unlock_core    

  24. SVC06_802B_REF_MTX_core      

  25. SVC06_802C_cre_FLG            

  26. SVC06_802C_cre_FLG_core      

  27. SVC06_802D_DEL_FLG_core      

  28. SVC06_802E_set_FLG            

  29. SVC06_802E_set_FLG_core      

  30. SVC06_802F_clr_FLG            

  31. SVC06_802F_clr_FLG_core      

  32. SVC06_8030_twai_FLG_core      

  33. SVC06_8031_REF_FLG_core      

  34. SVC06_8032_cre_MBX            

  35. SVC06_8032_cre_MBX_core      

  36. SVC06_8033_DEL_MBX_core      

  37. SVC06_8034_MBX_TX_core        

  38. SVC06_8034_Send_MBX          

  39. SVC06_8035_MBX_RCV            

  40. SVC06_8035_MBX_RCV_core      

  41. SVC06_8036_REF_MBX_core      

  42. SVC06_8037_CRE_MBF            

  43. SVC06_8037_CRE_MBF_core      

  44. SVC06_8038_DEL_MBF            

  45. SVC06_8038_DEL_MBF_core      

  46. SVC06_8039_Send_MBF          

  47. SVC06_8039_Send_MBF_core      

  48. SVC06_803A_RCV_MBF            

  49. SVC06_803A_RCV_MBF_core      

  50. SVC06_803B_REF_MBF            

  51. SVC06_803B_REF_MBF_core      

  52. SVC06_8043_cre_INT            

  53. SVC06_8043_cre_INT_core      

  54. SVC06_8045_CRE_MPL_fixed      

  55. SVC06_8045_CRE_MPL_fixed_core

  56. SVC06_8046_DEL_MPL_fixed_core

  57. SVC06_8047_Get_MPL_fix        

  58. SVC06_8047_Get_MPL_fix_core  

  59. SVC06_8048_Rel_MPL_fix        

  60. SVC06_8048_Rel_MPL_fix_core  

  61. SVC06_8049_REF_MPL_fix        

  62. SVC06_8049_REF_MPL_fix_core  

  63. SVC06_804A_CRE_MPF_var        

  64. SVC06_804A_CRE_MPF_var_core  

  65. SVC06_804B_DEL_MPL_var_core  

  66. SVC06_804C_Get_MPL_var        

  67. SVC06_804C_Get_MPL_var_core  

  68. SVC06_804D_REL_MPL_var        

  69. SVC06_804D_REL_MPL_var_core  

  70. SVC06_804E_REF_MPL_var_core  

  71. SVC06_804E_REL_MPL_var        

  72. SVC06_8052_sleep              

  73. SVC06_8052_sleep_core        

  74. SVC06_8053_CRE_CYC            

  75. SVC06_8053_CRE_CYC_core      

  76. SVC06_8054_DEL_CYC            

  77. SVC06_8054_DEL_CYC_core      

  78. SVC06_8055_STA_CYC            

  79. SVC06_8055_STA_CYC_core      

  80. SVC06_8056_STOP_CYC          

  81. SVC06_8056_STOP_CYC_core      

  82. SVC06_8057_REF_CYC_core      

  83. SVC06_8058_CRE_ALM            

  84. SVC06_8058_CRE_ALM_core      

  85. SVC06_8059_DEL_ALM_core      

  86. SVC06_805A_STA_ALM            

  87. SVC06_805A_STA_ALM_API        

  88. SVC06_805A_STA_ALM_core      

  89. SVC06_805B_STOP_ALM          

  90. SVC06_805B_STOP_ALM_core      

  91. SVC06_805C_REF_ALM_core      

  92. SVC06_805E                    

  93. SVC06_8063_REF_unknown_core  

  94. SVC06_8065_REF_unknown_core  

  95. SVC06_8067_inf_Task_core      

  96. SVC06_8069_inf_SEM_core      

  97. SVC06_806B_inf_Event_core    

  98. SVC06_806D_inf_MBX_core      

  99. SVC06_806F_inf_MTX_core      

  100. SVC06_8071_inf_MBF_core      

  101. SVC06_8073_inf_POR_core      

  102. SVC06_8075_inf_MPF_core      

  103. SVC06_8076                    

  104. SVC06_8077_inf_MPL_core      

  105. SVC06_8078                    

  106. SVC06_8079_inf_ALM_core      

  107. SVC06_807A                    

  108. SVC06_807B_inf_CYC_core      

  109. SVC06_807C                    

  110. SVC06_807D                    

  111. SVC06_807E                    

  112.  

leegong
Core Developer
 
Posts: 2139
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 551 times

Re: Nikon Z6/Z7

Postby leegong » Sun Mar 10, 2019 8:12 pm

PTP debug code 0xF13A - 0xF13F request AUDIO debug operation ,
0xF13A will produce file a:TEST??.wav which is 11520044 bytes size ,
44 bytes File header and 11520000 bytes audio data .
0xF13E will produce file A:TEST??.AAC , i guess it records as AAC Audio format .
no idea about others Audio debug operations yet .
Code: Select all
  1.  

  2. WAV File Header

  3. offset 0x00         .ascii "RIFF"

  4. offset 0x08         .ascii "WAVEfmt "

  5. offset 0x10         .long 0x10

  6. offset 0x14         .long 0x20001

  7. offset 0x18         .long 48000

  8. offset 0x1C         .long 192000

  9. offset 0x20         .long 0x100004

  10. offset 0x24         .ascii "data"

  11. offset 0x28         .long 11520000

  12.  

leegong
Core Developer
 
Posts: 2139
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 551 times

Previous

Return to Firmware

Who is online

Users browsing this forum: Google [Bot] and 4 guests

cron