D7500 et al - DHCP address change

[konrad]

Hi,
first thanks for all the work. I own a D7500 and now with latest firmware update v1.10 I'm able to access it by WiFi only bypassing the Snapbridge Bluetooth interworking.
As my network is running on 192.168.1.00/24 it is hard to have a two face access from my laptop to the camera by Wifi and to my intranet as both will use the same subnet. So I was looking for an option inside the camera to change, there is nothing. Also with available tools WMU/WTU/Snapbridge this looks not feasible. So I came to Nikonhacker.
Following the instructions for the FirmwareDecoder (via Emulator) first it failed fore the D7500 frmware, then I saw the offset change for the Z6/Z7, manually stripping these 0x20 bytes from the firmware bin made the decoder working. I got three files
1) a1450_010101.bin - well known
2) b1450_110d.bin - also well know, this is the UI part
3) _wma_ver01.11.00 - Looking to the strings inside it looks to be the WiFi part implementiong a simple WU2 adapter realising a USB to PTPIP bridge.

As you may know the default DHCP server address of the camera is 192.168.1.1 which is C0.A8.1.1 in hex. Knowing this and looking up 3) in a hex editor identifies

Code: Select all

1.  


2. 00042F10  00 01 01 A8 C0 00 FF FF FF 02 01 A8 C0 00 00 00  ...¨À.ÿÿÿ..¨À...


3.              |Server    | Mask      | DHCP clnt |  


4.  

which is eactly the default IP configuration.
So a patch could be set up to modify these 3 address to avoid conflicts in local networks.

Few side notes:
1) I could not identify these settings from settings stored on SD card
2) The WU2 seems to have a lot more capabilities like FTP or Infrastructure mode (connecting to an AP), which I would like to have
3) In UI binary I could not find any strings pointing to hidden/switched off menus for Infrastructure/FTP etc, so adding this would be a much higher effort, hardly feasible for leisure time to write such a rucksack.

So to conclude, might be an option to provide a patch to all the cams which recently got the update for standalone WiFi connection like the D7500.

Any ideas which further cameras would be feasible?

[Simeon]

So you can build a patch for changing the network to a new fixed value, (ether the 10/24 or 172.16/20) and assume the _wma... is the third file in the package it should look like:
the first parameter in the Patch object is the file thus should be 2, then file offset (thus looks like 0x43f11) and then the stream of old bytes and new bytes

or you could split the 192.168.x.x network and put the camera in a higher sub block, and change your home network to also be a sub block of 192.168

[MountainMike]

Gentlemen,

I find myself in the same predicament as Konrad: My D7500 and home network both share 192.168.1.0/24, and the 7500 networking settings cannot be changed with existing tools. In order to use tools such as qDslrDashboard I have to disconnect from my home network in order to connect to the camera. Tolerable, but not very elegant.

May I humbly ask if any development is planned for the patch Konrad proposed? Simply changing the camera's DHCP server address to 192.168.2.1 and the client address to 192.168.2.2 would do the job.

I ran my *.bin file through the patch tool, just to see if anything popped up, and nothing did. I also spent several hours trying to understand and learn the hacking process (excellent documentation on this, by the way!), but I just don't have the aptitude or coding skills necessary to manipulate the firmware. I'm happy to do it, I just can't quite sort out exactly how to do what needs to be done.

I understand the Nikon Hacker team has a life and families (which I wholeheartedly support!), but if a little time creeps into your schedule, a look at this patch request would be much appreciated. in advance.

[konrad]

Hi Simeon,
thanks for the advice. As I said the D7500 looks to follow the way Z6/Z7 does for there firmware, so there is a 0x20 byte header. The other cameras patched here do not have this offset. So providing a patch cs does not look to be a big issue, but rebuilding the firmware bin is something I do not know how to archive. What are these 0x20 bytes ? Possible to omit? A signature? How to create?
Is there any experience in repackaging Z6/Z7 fw?

Looking at Nikon-Patch makes me think that I would have to build the environment for test first on a local machine or is there a way how I can apply a custom patch file like for my experiments with the Nikon-hacker site?

[MountainMike]

Konrad,

I just discovered that the Nikon WMU mobile App can actually change the IP addressing of the Nikon camera's wireless network--no FW patch needed. (Proven on a Nikon D7500 and the Android version of the WMU app.) The curious thing is that the camera won't report that the IP has changed (in the settings menu), but it indeed will have changed in the camera's OS.

This is what I did...

Change Camera's IP Address:
1. Use the Nikon WMU Android app
2. Connect to the camera over the phone's and camera's WiFi (remember to turn on the WiFi connection in the camera)
3. Tap the settings icon (the gear) in WMU
4. Tap Wireless Mobile Adapter settings
5. Tap Advanced settings
6. Tap DHCP server IP address and change it 192.168.2.1 (tap Save)
7. Click DHCP client IP address and change it to 192.168.2.2 (tap Save)
8. Exit the settings menu back to the main WMU home screen

Close WiFi connection on the camera and power it off. After a minute or two, power on the camera. Check the WiFi Current settings on the camera...note that it still says it is using 192.168.1.1. Now, enable the WiFi connection on the camera and connect your computer to the camera's WiFi. Open your computer-based app of choice, say, qDslrDashboard and connect to the camera: Change qDSLR's connection IP to 192.168.2.1, by click-and-holding the wireless Nikon icon in the qDSLR app. Boom, connecting to the camera on 192.168.2.1!

I'm interested to hear if this same thing works on your camera.

Even though this didn't require a patched FW by NikonHacker, THANKS to you guys for all you do!

[konrad]

MountainMike,
great job, immediately tried ...

iPhone7 IOS 12.4 , version 1.6.2.3000 (german version)
When going to the WMA settings, extended settings, I got a notice like "for settings please use the menues on camera" ... disappointing

Rereading your notes again, you say Android, hmmm... Picked my good old Asus Zenfone2 Android 6.0.1 , I installed the Nikon WMU app, version 1.6.2.3001 and, a big applause to Mountain Mike, here I get offered the setting for DHCP server and for DHCP client address. I tried a first time ... it did not work. Tried a second time and it ... worked. Difference was that I go back from the setting lower menues by pressing back button after save intead of abort from here, then I got a next "save" dialog which looks to do the actual transfer including a restart of the adapter. After next reconnection sill shows the changed addresses. The first try was also with a 192.168.12.x address set, whereas the second test was using 192.168.2.x like in your example.

As I'm a suspicious software guy, the GUI may tell something, I went for the WiFi settings in Android and there the details of the connection showed 192.168.2.2 for the Android phone. OK curious, I tried now to connect the iPhone also to exclude any inner setting of the Android device and, still surprising, now the iPhone got also an address 192.168.2.3 (the dhcp server in the camera seems to be able to handle more addresses).

Now I'm doing a final test for today switch of Android phone and camera, removed the battery from camera, waiting some time ...
Now the thing back, and even more surprise, even after the power cycle the camera is still distributing 192.168.2.x adresses.

A next test, now I applied 192.168.12.x adresses in WMU extended settings, using the "back" Android button, this also got installed and is working now.
So I think we can assume the issue about the DHCP address to be solved at least for D7500, other people should check the procedure for their camera where they cannot change the address from the camera menus. iPhone folks may have to wait for a next version?

A few further notes:
1) My Zenfone2 is rooted, but I would not expect an influence from that on the procedure.

2) About the extra 0x20 bytes in the the firmware file. It looks to me that Nikon has started to use secure boot functionality together with signing the firmware files. In this context the 0x20 bytes could be a SHA256 hash used by the flash loader to checker whether the firmware is signed correctly. In the firmware file I saw some FirmwareChk strings, so could be that the check is only from the running firmware to check the new firmware file. If Nikon did correctly protecting theier cameras then they will have established a chain of trust from a certificate in the rom bootloader which the checks the next step in the load on boot an so on. Then it would be very hard to ceate a patched firmware file as this includes rebuilding the signature and this would involve the private part of the key only Nikon should know. As this is common industry practice I expect this to be likely.

[konrad]

Checked now from my laptop, wired LAN 192.168.1.x and wirelessly connected to AP on camera using 192.168.12.x network, this works with a two face IP access. I still can access internet via the wired LAN and look to my camera the same time. Windows takes care to select the right link to internet.
I checked quickly with qdslrdashboard and digicamcontrol, both look to work fine.

Let's wait what others report who got the free WiFi update this year.

I forgot to confirm in my previous note that the changes do not appear in the menues on the camera, there still 192.168.1.x is shown, even after battery re-insertion. This is not true, look at the IP settings on your phone/tab/PC to confirm the change.

Btw. some months back I had a talk to Nikon Customer service on setting the DHCP addresses and they were not even aware of the WiFi-only connection capability of the camera, they also told that DHCP change would not be possible.

[MountainMike]

Konrad,

Glad to hear this procedure worked for you! Just for the record, my Android phone is not rooted, so root state doesn't appear to be a factor in this procedure working.

It is rather strange that the camera won't report the camera's actual IP address, and that only the Android version of the WMU app can change the DHCP server. But I'm not complaining about the functionality. It works. I'm happy.

Your work on the camera's FW is interesting. You are far better at analyzing and understanding what is (or might be) implemented in the camera's firmware. Keep up the good work, my friend!