Hacking Nikon Z7

All things embedded.
*NO FEATURE REQUESTS*

Hacking Nikon Z7

Postby leegong » Thu Aug 23, 2018 1:56 am

How about hacking Nikon Z6/Z7 ?
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby Simeon » Fri Oct 05, 2018 3:49 pm

they seem pretty nice devices..
Simeon
Core Developer
 
Posts: 2623
Joined: Wed Nov 30, 2011 6:12 am
Location: Christchurch, New Zealand
Been thanked: 618 times

Re: Nikon Z6/Z7

Postby leegong » Sun Oct 07, 2018 9:10 pm

Just find Nikon Z7 teardown ,
STM32F412 and R5F56519AD are found on Z7 mother board .
Wild guessing :
The firmware is probably divided into 3 parts , for Expeed , for STM32F412 and R5F56519AD respectively.
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby leegong » Wed Oct 17, 2018 3:24 am

Just take a look at D750 Firmware A (running on Toshiba TMPM440 ARM cortex-M4 MCU),
there is one useful backdoor added , it reads Firmware A directly and sends back to PC over USB connection .
I hope this backdoor is supported in Nikon Z7 , then we don't have to wait for Nikon Z7 Firmware updating package .
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby leegong » Mon Nov 19, 2018 10:02 pm

Download Nikon Z7 firmware package v1.01 and v1.02 .
Thanks to Simeon's tool , just decrypt and extract 3 files from FW package ,
i believe they are FirmWare A , FirmWare B and FirmWare C respectively.
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby leegong » Sun Nov 25, 2018 6:54 pm

Find codes that communicate with battery
Attachments
Z7_FirmwareA.png
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby leegong » Fri Dec 21, 2018 4:11 am

Lots of SVCs :
Attachments
Z7_FirmwareA.jpg
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby coderat » Wed Dec 26, 2018 8:21 am

I've got 4 files out of package:
  1. ex1610_010000.bi - Firmware A
  2. eg1610_0102b0.bi - Firmware B (ARM)
  3. vr1610_010000.bi - Firmware for Vibration Reduction MCU
  4. _tpj01_v140.bin ?

Unfortunately they dropped RTTI out of Firmware B.
coderat
Core Developer
 
Posts: 2283
Joined: Fri Apr 26, 2013 10:21 am
Been thanked: 450 times

Re: Nikon Z6/Z7

Postby coderat » Wed Dec 26, 2018 9:07 am

License/Dongle software integrated:
Hardware:MS7709ASE01 - Software:matrixNET

?
coderat
Core Developer
 
Posts: 2283
Joined: Fri Apr 26, 2013 10:21 am
Been thanked: 450 times

Re: Nikon Z6/Z7

Postby leegong » Wed Dec 26, 2018 9:24 pm

coderat wrote:I've got 4 files out of package:
  1. ex1610_010000.bi - Firmware A
  2. eg1610_0102b0.bi - Firmware B (ARM)
  3. vr1610_010000.bi - Firmware for Vibration Reduction MCU
  4. _tpj01_v140.bin ?
Unfortunately they dropped RTTI out of Firmware B.


ex1610_010000.bi - Firmware A runs on ARM Cortex-M4-based STM32F412 ,
i'm not sure if it uses ARM-CMSIS and STM offical HAL library .
Firmware A communicates with Remote control/UART debug/GPS module , shoulder LED , SB , battery ......
it also communicates with unknown module over I2C , maybe Power Manage IC , just wild guessing.
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Next

Return to Firmware

Who is online

Users browsing this forum: konrad and 3 guests