Reversing Nikon service software

Wifi, USB, GPS, Grips, Mics, Ext Power, Lens, Flash

Reversing Nikon service software

Postby leegong » Tue Jul 14, 2015 7:03 am

Based on D5100IMG.EXE reversing , just found D5100 EEPROM offset 8 = int16 shutter adjustment value ,
which add/decrease fixed timing delay between front curtain and rear curtain for shutter release .
Attachments
D5100IMG.png
D5100IMG.png (4.06 KiB) Viewed 7169 times
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Reversing Nikon service software

Postby leegong » Thu Jul 16, 2015 1:07 am

Image sensor Serial Number can be cleared with D5100img.EXE , simple tracing indicates
struc_159 field0x2B0-0x2B9 in firmware B = Image sensor Serial No , no idea about if it's SN of main CMOS and
how it's set and used in camera yet .
Attachments
D5100IMG.png
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Reversing Nikon service software

Postby leegong » Fri Jul 17, 2015 10:03 pm

Just remove Firmware version number checking in the current D800.exe , which supports
the earliest firmware only .
Attachments
D800EXE_RemoveVersionChecking.png
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Reversing Nikon service software

Postby leegong » Sat Jul 18, 2015 8:19 pm

D800.exe shows that D800 eeprom offset 0x2E is AF shift value .
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Reversing Nikon service software

Postby Cereus » Sat Aug 15, 2015 6:41 am

leegong wrote:Image sensor Serial Number can be cleared with D5100img.EXE , simple tracing indicates
struc_159 field0x2B0-0x2B9 in firmware B = Image sensor Serial No , no idea about if it's SN of main CMOS and
how it's set and used in camera yet .

Hi, AFAIK the sensor Serial Numbers are used by the service to retrieve sensor specific calibration data from a Nikon database (e.g. in case of a sensor replacement).

Thanks for your work!
Cereus
 
Posts: 5
Joined: Tue Dec 16, 2014 4:44 pm
Been thanked: 1 time

Re: Reversing Nikon service software

Postby leegong » Sun Aug 16, 2015 8:04 pm

All of Nikon new service software are programmed with license authentication .
Reversing D7200img.exe is in progress , it's much more difficult than i thought before ,
lots of codes call MD5_update , MD5_transfer , MD5_final routines for calculating and decryption .
i have removed license authentication and 6 Virtual machine Protectings which calls one by one ,
have not reached OEP yet .
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Reversing Nikon service software

Postby leegong » Fri Aug 21, 2015 1:17 am

There are more than 13 layers of VM protectings in D7200img.exe , after removing all of them ,
raw binary code of service software seems to be decrypted into memory , lots of codes and japanese unicode string
related to camera adjustment are found in mem now .
But the unpacked D7200img.exe doesn't work yet , have to fix IAT manually , maybe more things needed .
Attachments
D7200img_OEP_dumping.png
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Reversing Nikon service software

Postby leegong » Fri Aug 21, 2015 9:43 pm

I'm pretty sure that OEP of D7200img.exe is located , 0x597E44 .
Just compare code at 0x597E44 with codes at starting entry of D810img.exe which has no license AUC ,
they are almost 100% same .
Attachments
D810IMG_StartingCode.png
D7200IMG_StartingCode.png
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Reversing Nikon service software

Postby leegong » Mon Aug 24, 2015 8:40 am

D7200img.exe application code just got running with ollydbg offical 2.01 ,
it requires extra UserKey , similar as D810img.exe now , i don't know why no UserKey required
in D810img.exe when i run it just several days ago , but it's required now in D810img.exe.
It's very easy to hack UserKey in D7200img.exe and D810img.exe , the code checking Userkey of D7200img.exe
is exactly same as that of D810img.exe , after 10 minutes removing Userkey checking , D810img.exe runs normally ,
but D7200img doesn't work yet .
Damn it , so many trickery and trap inside D7200img !
i would say , lots of kind of current software technology related to encryption/decryption , anti-debugging and
anti tracing could be found in D7200img shell .
Attachments
D7200img_Logon.png
leegong
Core Developer
 
Posts: 2119
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 544 times

Re: Reversing Nikon service software

Postby aliensporebomb » Mon Aug 24, 2015 5:34 pm

D7200 is ARM CPU equipped, correct?

I take it none of the previous cameras (well the Fujitsu ones anyway) had such protections in place?
aliensporebomb
 
Posts: 38
Joined: Fri Oct 10, 2014 7:32 am
Been thanked: 4 times

Next

Return to External Hacks

Who is online

Users browsing this forum: No registered users and 2 guests