Hacking Nikon Z7

All things embedded.
*NO FEATURE REQUESTS*

Re: Nikon Z6/Z7

Postby coderat » Fri Dec 28, 2018 9:22 am

So where is MS7709ASE01 (Hitachi SH-3) ?
coderat
Core Developer
 
Posts: 2283
Joined: Fri Apr 26, 2013 10:21 am
Been thanked: 450 times

Re: Nikon Z6/Z7

Postby leegong » Mon Jan 28, 2019 4:55 am

Find hundreds of device prop codes :
Attachments
DevicePropCode.png
PTP_DevicePropCode.png
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby leegong » Wed Jan 30, 2019 6:41 pm

PTP Debug codes in Z7 are different from that in DSLR ,
0xF036 looks like memory dumping , 0xF037 looks like memory writting .
Attachments
PTP_DebugFunc.PNG
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby Simeon » Thu Jan 31, 2019 5:16 pm

Interesting that they repacked the code space, but I guess "its a different model" so not part of a family so they can reclaim numerical space...
Simeon
Core Developer
 
Posts: 2622
Joined: Wed Nov 30, 2011 6:12 am
Location: Christchurch, New Zealand
Been thanked: 618 times

Re: Nikon Z6/Z7

Postby leegong » Fri Mar 01, 2019 1:01 am

Most parts of RTOS API are decoded.
Code: Select all
  1.  

  2. SVC06_8001_CRE_Task          

  3. SVC06_8009_unknown_core      

  4. SVC06_800A_unknown_core      

  5. SVC06_8016_INF_Task          

  6. SVC06_8017_ref_tsk_core      

  7. SVC06_801C_Task_Wakeup        

  8. SVC06_8022_CRE_SEM            

  9. SVC06_8022_CRE_SEM_core      

  10. SVC06_8023_DELE_SEM_core      

  11. SVC06_8023_DEL_SEM            

  12. SVC06_8024_REL_SEM_core      

  13. SVC06_8024_Rel_SEM            

  14. SVC06_8025_SIG_SEM            

  15. SVC06_8025_SIG_SEM_core      

  16. SVC06_8026_REF_SEM_core      

  17. SVC06_8027_Cre_MTX            

  18. SVC06_8027_Cre_MTX_core      

  19. SVC06_8028_DEL_MTX_core      

  20. SVC06_8029_MTX_Lock          

  21. SVC06_8029_MTX_Lock_API      

  22. SVC06_8029_MTX_Lock_core      

  23. SVC06_802A_MTX_Unlock_core    

  24. SVC06_802B_REF_MTX_core      

  25. SVC06_802C_cre_FLG            

  26. SVC06_802C_cre_FLG_core      

  27. SVC06_802D_DEL_FLG_core      

  28. SVC06_802E_set_FLG            

  29. SVC06_802E_set_FLG_core      

  30. SVC06_802F_clr_FLG            

  31. SVC06_802F_clr_FLG_core      

  32. SVC06_8030_twai_FLG_core      

  33. SVC06_8031_REF_FLG_core      

  34. SVC06_8032_cre_MBX            

  35. SVC06_8032_cre_MBX_core      

  36. SVC06_8033_DEL_MBX_core      

  37. SVC06_8034_MBX_TX_core        

  38. SVC06_8034_Send_MBX          

  39. SVC06_8035_MBX_RCV            

  40. SVC06_8035_MBX_RCV_core      

  41. SVC06_8036_REF_MBX_core      

  42. SVC06_8037_CRE_MBF            

  43. SVC06_8037_CRE_MBF_core      

  44. SVC06_8038_DEL_MBF            

  45. SVC06_8038_DEL_MBF_core      

  46. SVC06_8039_Send_MBF          

  47. SVC06_8039_Send_MBF_core      

  48. SVC06_803A_RCV_MBF            

  49. SVC06_803A_RCV_MBF_core      

  50. SVC06_803B_REF_MBF            

  51. SVC06_803B_REF_MBF_core      

  52. SVC06_8043_cre_INT            

  53. SVC06_8043_cre_INT_core      

  54. SVC06_8045_CRE_MPL_fixed      

  55. SVC06_8045_CRE_MPL_fixed_core

  56. SVC06_8046_DEL_MPL_fixed_core

  57. SVC06_8047_Get_MPL_fix        

  58. SVC06_8047_Get_MPL_fix_core  

  59. SVC06_8048_Rel_MPL_fix        

  60. SVC06_8048_Rel_MPL_fix_core  

  61. SVC06_8049_REF_MPL_fix        

  62. SVC06_8049_REF_MPL_fix_core  

  63. SVC06_804A_CRE_MPF_var        

  64. SVC06_804A_CRE_MPF_var_core  

  65. SVC06_804B_DEL_MPL_var_core  

  66. SVC06_804C_Get_MPL_var        

  67. SVC06_804C_Get_MPL_var_core  

  68. SVC06_804D_REL_MPL_var        

  69. SVC06_804D_REL_MPL_var_core  

  70. SVC06_804E_REF_MPL_var_core  

  71. SVC06_804E_REL_MPL_var        

  72. SVC06_8052_sleep              

  73. SVC06_8052_sleep_core        

  74. SVC06_8053_CRE_CYC            

  75. SVC06_8053_CRE_CYC_core      

  76. SVC06_8054_DEL_CYC            

  77. SVC06_8054_DEL_CYC_core      

  78. SVC06_8055_STA_CYC            

  79. SVC06_8055_STA_CYC_core      

  80. SVC06_8056_STOP_CYC          

  81. SVC06_8056_STOP_CYC_core      

  82. SVC06_8057_REF_CYC_core      

  83. SVC06_8058_CRE_ALM            

  84. SVC06_8058_CRE_ALM_core      

  85. SVC06_8059_DEL_ALM_core      

  86. SVC06_805A_STA_ALM            

  87. SVC06_805A_STA_ALM_API        

  88. SVC06_805A_STA_ALM_core      

  89. SVC06_805B_STOP_ALM          

  90. SVC06_805B_STOP_ALM_core      

  91. SVC06_805C_REF_ALM_core      

  92. SVC06_805E                    

  93. SVC06_8063_REF_unknown_core  

  94. SVC06_8065_REF_unknown_core  

  95. SVC06_8067_inf_Task_core      

  96. SVC06_8069_inf_SEM_core      

  97. SVC06_806B_inf_Event_core    

  98. SVC06_806D_inf_MBX_core      

  99. SVC06_806F_inf_MTX_core      

  100. SVC06_8071_inf_MBF_core      

  101. SVC06_8073_inf_POR_core      

  102. SVC06_8075_inf_MPF_core      

  103. SVC06_8076                    

  104. SVC06_8077_inf_MPL_core      

  105. SVC06_8078                    

  106. SVC06_8079_inf_ALM_core      

  107. SVC06_807A                    

  108. SVC06_807B_inf_CYC_core      

  109. SVC06_807C                    

  110. SVC06_807D                    

  111. SVC06_807E                    

  112.  

leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Nikon Z6/Z7

Postby leegong » Sun Mar 10, 2019 8:12 pm

PTP debug code 0xF13A - 0xF13F request AUDIO debug operation ,
0xF13A will produce file a:TEST??.wav which is 11520044 bytes size ,
44 bytes File header and 11520000 bytes audio data .
0xF13E will produce file A:TEST??.AAC , i guess it records as AAC Audio format .
no idea about others Audio debug operations yet .
Code: Select all
  1.  

  2. WAV File Header

  3. offset 0x00         .ascii "RIFF"

  4. offset 0x08         .ascii "WAVEfmt "

  5. offset 0x10         .long 0x10

  6. offset 0x14         .long 0x20001

  7. offset 0x18         .long 48000

  8. offset 0x1C         .long 192000

  9. offset 0x20         .long 0x100004

  10. offset 0x24         .ascii "data"

  11. offset 0x28         .long 11520000

  12.  

leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Hacking Nikon Z7

Postby leegong » Fri Mar 22, 2019 11:56 pm

Found brief description of interrupt 0x20 - 0xFA , corresponding to line 0x00 - 0xDA in the following table ,
there are some interesting interruptions for HDMI , JPEG , RAW , H264 and so on ,
each interrupt handler is identified with RTOS API cre_INT .
Code: Select all
  1. ROM:1052B196 TAB_INT_Name:   struc_EXT_INT_Name <"CA7_CPU0_COM_RX">@ 0

  2. ROM:1052B196                 struc_EXT_INT_Name <"CA7_CPU0_COM_TX">@ 1

  3. ROM:1052B196                 struc_EXT_INT_Name <"CA7_CPU1_COM_RX">@ 2

  4. ROM:1052B196                 struc_EXT_INT_Name <"CA7_CPU1_COM_TX">@ 3

  5. ROM:1052B196                 struc_EXT_INT_Name <"CA7_CPU0_CROSSTRIGGER">@ 4

  6. ROM:1052B196                 struc_EXT_INT_Name <"CA7_CPU1_CROSSTRIGGER">@ 5

  7. ROM:1052B196                 struc_EXT_INT_Name <"CA7_CPU0_SYSMET">@ 6

  8. ROM:1052B196                 struc_EXT_INT_Name <"CA7_CPU1_SYSMET">@ 7

  9. ROM:1052B196                 struc_EXT_INT_Name <"A926_COM_RX">@ 8

  10. ROM:1052B196                 struc_EXT_INT_Name <"A926_COM_TX">@ 9

  11. ROM:1052B196                 struc_EXT_INT_Name <"A926_DUAL_INPUT_TIMER_0">@ 0xA

  12. ROM:1052B196                 struc_EXT_INT_Name <"A926_DUAL_INPUT_TIMER_1">@ 0xB

  13. ROM:1052B196                 struc_EXT_INT_Name <"WATCH_DOG_TIMER">@ 0xC

  14. ROM:1052B196                 struc_EXT_INT_Name <"FASP_XDMAC_0">@ 0xD

  15. ROM:1052B196                 struc_EXT_INT_Name <"FASP_XDMAC_1">@ 0xE

  16. ROM:1052B196                 struc_EXT_INT_Name <"FASP_XDMAC_2">@ 0xF

  17. ROM:1052B196                 struc_EXT_INT_Name <"FASP_XDMAC_3">@ 0x10

  18. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_0">@ 0x11

  19. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_1">@ 0x12

  20. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_2">@ 0x13

  21. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_3">@ 0x14

  22. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_4">@ 0x15

  23. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_5">@ 0x16

  24. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_6">@ 0x17

  25. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_7">@ 0x18

  26. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_8">@ 0x19

  27. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_9">@ 0x1A

  28. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_10">@ 0x1B

  29. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_11">@ 0x1C

  30. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_12">@ 0x1D

  31. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_13">@ 0x1E

  32. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_14">@ 0x1F

  33. ROM:1052B196                 struc_EXT_INT_Name <"IPCU_15">@ 0x20

  34. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_0">@ 0x21

  35. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_1">@ 0x22

  36. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_2">@ 0x23

  37. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_3">@ 0x24

  38. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_4">@ 0x25

  39. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_5">@ 0x26

  40. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_6">@ 0x27

  41. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_7">@ 0x28

  42. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_8">@ 0x29

  43. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_9">@ 0x2A

  44. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_10">@ 0x2B

  45. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_11">@ 0x2C

  46. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_12">@ 0x2D

  47. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_13">@ 0x2E

  48. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_14">@ 0x2F

  49. ROM:1052B196                 struc_EXT_INT_Name <"EXT_INT_15">@ 0x30

  50. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x31

  51. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x32

  52. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x33

  53. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x34

  54. ROM:1052B196                 struc_EXT_INT_Name <"CA7_AXI_ERROR">@ 0x35

  55. ROM:1052B196                 struc_EXT_INT_Name <"SIF_0">@ 0x36

  56. ROM:1052B196                 struc_EXT_INT_Name <"SIF_1">@ 0x37

  57. ROM:1052B196                 struc_EXT_INT_Name <"SIF_2">@ 0x38

  58. ROM:1052B196                 struc_EXT_INT_Name <"SIF_3">@ 0x39

  59. ROM:1052B196                 struc_EXT_INT_Name <"SIF_4">@ 0x3A

  60. ROM:1052B196                 struc_EXT_INT_Name <"SIF_5">@ 0x3B

  61. ROM:1052B196                 struc_EXT_INT_Name <"SIF_6">@ 0x3C

  62. ROM:1052B196                 struc_EXT_INT_Name <"SIF_7">@ 0x3D

  63. ROM:1052B196                 struc_EXT_INT_Name <"PPC_0">@ 0x3E

  64. ROM:1052B196                 struc_EXT_INT_Name <"PPC_1">@ 0x3F

  65. ROM:1052B196                 struc_EXT_INT_Name <"PPC_2">@ 0x40

  66. ROM:1052B196                 struc_EXT_INT_Name <"PPC_3">@ 0x41

  67. ROM:1052B196                 struc_EXT_INT_Name <"PPC_4">@ 0x42

  68. ROM:1052B196                 struc_EXT_INT_Name <"MIPU_0">@ 0x43

  69. ROM:1052B196                 struc_EXT_INT_Name <"MIPU_1">@ 0x44

  70. ROM:1052B196                 struc_EXT_INT_Name <"IPU">@ 0x45

  71. ROM:1052B196                 struc_EXT_INT_Name <"IIP">@ 0x46

  72. ROM:1052B196                 struc_EXT_INT_Name <"IDMAC_0">@ 0x47

  73. ROM:1052B196                 struc_EXT_INT_Name <"IDMAC_1">@ 0x48

  74. ROM:1052B196                 struc_EXT_INT_Name <"JPEG_CODEC">@ 0x49

  75. ROM:1052B196                 struc_EXT_INT_Name <"JPEG_ENC">@ 0x4A

  76. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x4B

  77. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x4C

  78. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x4D

  79. ROM:1052B196                 struc_EXT_INT_Name <"H264">@ 0x4E

  80. ROM:1052B196                 struc_EXT_INT_Name <"LCD">@ 0x4F

  81. ROM:1052B196                 struc_EXT_INT_Name <"HIF">@ 0x50

  82. ROM:1052B196                 struc_EXT_INT_Name <"MIF">@ 0x51

  83. ROM:1052B196                 struc_EXT_INT_Name <"DSI">@ 0x52

  84. ROM:1052B196                 struc_EXT_INT_Name <"TM">@ 0x53

  85. ROM:1052B196                 struc_EXT_INT_Name <"MVD">@ 0x54

  86. ROM:1052B196                 struc_EXT_INT_Name <"BDEC">@ 0x55

  87. ROM:1052B196                 struc_EXT_INT_Name <"MPO">@ 0x56

  88. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x57

  89. ROM:1052B196                 struc_EXT_INT_Name <"PSPR">@ 0x58

  90. ROM:1052B196                 struc_EXT_INT_Name <"RAW">@ 0x59

  91. ROM:1052B196                 struc_EXT_INT_Name <"RAWRS">@ 0x5A

  92. ROM:1052B196                 struc_EXT_INT_Name <"DAFI">@ 0x5B

  93. ROM:1052B196                 struc_EXT_INT_Name <"SFLT">@ 0x5C

  94. ROM:1052B196                 struc_EXT_INT_Name <"SDI_0">@ 0x5D

  95. ROM:1052B196                 struc_EXT_INT_Name <"SDI_1">@ 0x5E

  96. ROM:1052B196                 struc_EXT_INT_Name <"LLI">@ 0x5F

  97. ROM:1052B196                 struc_EXT_INT_Name <"MXIC">@ 0x60

  98. ROM:1052B196                 struc_EXT_INT_Name <"GEVG_GP">@ 0x61

  99. ROM:1052B196                 struc_EXT_INT_Name <"GEVG_PPF">@ 0x62

  100. ROM:1052B196                 struc_EXT_INT_Name <"GEVG_PSC">@ 0x63

  101. ROM:1052B196                 struc_EXT_INT_Name <"HDMI">@ 0x64

  102. ROM:1052B196                 struc_EXT_INT_Name <"HDMI_WAKEUP">@ 0x65

  103. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x66

  104. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x67

  105. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x68

  106. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x69

  107. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x6A

  108. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x6B

  109. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x6C

  110. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x6D

  111. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC1_0">@ 0x6E

  112. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC1_1">@ 0x6F

  113. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC1_2">@ 0x70

  114. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC1_3">@ 0x71

  115. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC1_4">@ 0x72

  116. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC1_5">@ 0x73

  117. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC1_6">@ 0x74

  118. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC1_7">@ 0x75

  119. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC_0">@ 0x76

  120. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC_1">@ 0x77

  121. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC_2">@ 0x78

  122. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC_3">@ 0x79

  123. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC_4">@ 0x7A

  124. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC_5">@ 0x7B

  125. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC_6">@ 0x7C

  126. ROM:1052B196                 struc_EXT_INT_Name <"HDMAC_7">@ 0x7D

  127. ROM:1052B196                 struc_EXT_INT_Name <"ADC">@ 0x7E

  128. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x7F

  129. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x80

  130. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x81

  131. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x82

  132. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x83

  133. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x84

  134. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x85

  135. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x86

  136. ROM:1052B196                 struc_EXT_INT_Name <"AUDIO_IF_0">@ 0x87

  137. ROM:1052B196                 struc_EXT_INT_Name <"AUDIO_IF_1">@ 0x88

  138. ROM:1052B196                 struc_EXT_INT_Name <"UPDN_COUNTER_0">@ 0x89

  139. ROM:1052B196                 struc_EXT_INT_Name <"UPDN_COUNTER_1">@ 0x8A

  140. ROM:1052B196                 struc_EXT_INT_Name <"UPDN_COUNTER_2">@ 0x8B

  141. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_0">@ 0x8C

  142. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_1">@ 0x8D

  143. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_2">@ 0x8E

  144. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_3">@ 0x8F

  145. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_4">@ 0x90

  146. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_5">@ 0x91

  147. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_6">@ 0x92

  148. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_7">@ 0x93

  149. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_8">@ 0x94

  150. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_9">@ 0x95

  151. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_10">@ 0x96

  152. ROM:1052B196                 struc_EXT_INT_Name <"TIMER_11">@ 0x97

  153. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x98

  154. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0x99

  155. ROM:1052B196                 struc_EXT_INT_Name <"UART_0_RX">@ 0x9A

  156. ROM:1052B196                 struc_EXT_INT_Name <"UART_0_TX">@ 0x9B

  157. ROM:1052B196                 struc_EXT_INT_Name <"UART_1_RX">@ 0x9C

  158. ROM:1052B196                 struc_EXT_INT_Name <"UART_1_TX">@ 0x9D

  159. ROM:1052B196                 struc_EXT_INT_Name <"UART_2_RX">@ 0x9E

  160. ROM:1052B196                 struc_EXT_INT_Name <"UART_2_TX">@ 0x9F

  161. ROM:1052B196                 struc_EXT_INT_Name <"SIO_0_RX">@ 0xA0

  162. ROM:1052B196                 struc_EXT_INT_Name <"SIO_0_TX">@ 0xA1

  163. ROM:1052B196                 struc_EXT_INT_Name <"SIO_1_RX">@ 0xA2

  164. ROM:1052B196                 struc_EXT_INT_Name <"SIO_1_TX">@ 0xA3

  165. ROM:1052B196                 struc_EXT_INT_Name <"SIO_2_RX">@ 0xA4

  166. ROM:1052B196                 struc_EXT_INT_Name <"SIO_2_TX">@ 0xA5

  167. ROM:1052B196                 struc_EXT_INT_Name <"SIO_3_RX">@ 0xA6

  168. ROM:1052B196                 struc_EXT_INT_Name <"SIO_3_TX">@ 0xA7

  169. ROM:1052B196                 struc_EXT_INT_Name <"SIO_4_RX">@ 0xA8

  170. ROM:1052B196                 struc_EXT_INT_Name <"SIO_4_TX">@ 0xA9

  171. ROM:1052B196                 struc_EXT_INT_Name <"SIO_5_RX">@ 0xAA

  172. ROM:1052B196                 struc_EXT_INT_Name <"SIO_5_TX">@ 0xAB

  173. ROM:1052B196                 struc_EXT_INT_Name <"SIO_6_RX">@ 0xAC

  174. ROM:1052B196                 struc_EXT_INT_Name <"SIO_6_TX">@ 0xAD

  175. ROM:1052B196                 struc_EXT_INT_Name <"SIO_7_RX">@ 0xAE

  176. ROM:1052B196                 struc_EXT_INT_Name <"SIO_7_TX">@ 0xAF

  177. ROM:1052B196                 struc_EXT_INT_Name <"SIO_8_RX">@ 0xB0

  178. ROM:1052B196                 struc_EXT_INT_Name <"SIO_8_TX">@ 0xB1

  179. ROM:1052B196                 struc_EXT_INT_Name <"SIO_9_RX">@ 0xB2

  180. ROM:1052B196                 struc_EXT_INT_Name <"SIO_9_TX">@ 0xB3

  181. ROM:1052B196                 struc_EXT_INT_Name <"SIO_10_RX">@ 0xB4

  182. ROM:1052B196                 struc_EXT_INT_Name <"SIO_10_TX">@ 0xB5

  183. ROM:1052B196                 struc_EXT_INT_Name <"I2C_0">@ 0xB6

  184. ROM:1052B196                 struc_EXT_INT_Name <"I2C_1">@ 0xB7

  185. ROM:1052B196                 struc_EXT_INT_Name <"I2C_2">@ 0xB8

  186. ROM:1052B196                 struc_EXT_INT_Name <"I2C_3">@ 0xB9

  187. ROM:1052B196                 struc_EXT_INT_Name <"LPSIO">@ 0xBA

  188. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xBB

  189. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xBC

  190. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xBD

  191. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xBE

  192. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xBF

  193. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xC0

  194. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xC1

  195. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xC2

  196. ROM:1052B196                 struc_EXT_INT_Name <"DSP_0">@ 0xC3

  197. ROM:1052B196                 struc_EXT_INT_Name <"DSP_1">@ 0xC4

  198. ROM:1052B196                 struc_EXT_INT_Name <"DSP_2">@ 0xC5

  199. ROM:1052B196                 struc_EXT_INT_Name <"SD_0">@ 0xC6

  200. ROM:1052B196                 struc_EXT_INT_Name <"SD_0_IOCARD">@ 0xC7

  201. ROM:1052B196                 struc_EXT_INT_Name <"SD_0_WAKEUP">@ 0xC8

  202. ROM:1052B196                 struc_EXT_INT_Name <"SD_11">@ 0xC9

  203. ROM:1052B196                 struc_EXT_INT_Name <"SD_11_IOCARD">@ 0xCA

  204. ROM:1052B196                 struc_EXT_INT_Name <"SD_11_WAKEUP">@ 0xCB

  205. ROM:1052B196                 struc_EXT_INT_Name <"USB">@ 0xCC

  206. ROM:1052B196                 struc_EXT_INT_Name <"CD">@ 0xCD

  207. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xCE

  208. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xCF

  209. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xD0

  210. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xD1

  211. ROM:1052B196                 struc_EXT_INT_Name <"PCIE_OWN">@ 0xD2

  212. ROM:1052B196                 struc_EXT_INT_Name <"PCIE_EP">@ 0xD3

  213. ROM:1052B196                 struc_EXT_INT_Name <"PCIE_SYS_ERR">@ 0xD4

  214. ROM:1052B196                 struc_EXT_INT_Name <"PCIE_DMA">@ 0xD5

  215. ROM:1052B196                 struc_EXT_INT_Name <"PCIE_TRS_ICS_MSI">@ 0xD6

  216. ROM:1052B196                 struc_EXT_INT_Name <"TL4_0">@ 0xD7

  217. ROM:1052B196                 struc_EXT_INT_Name <"TL4_1">@ 0xD8

  218. ROM:1052B196                 struc_EXT_INT_Name <""> @ 0xD9

  219. ROM:1052B196                 struc_EXT_INT_Name <"PMU">@ 0xDA

leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Hacking Nikon Z7

Postby leegong » Sat Mar 30, 2019 6:50 am

I traced VideoFourCCCode( PTP PROP code 0xDE9B) and VideoBitRate (PTP PROP code 0xDE9C) ,
then find setting data for H.264 module .
Meanwhile , based on H.264 interrupt Handler , i'm sure that 0x24070000 is base ADDR for H.264 encoder/decoder .
To do :
Identify VideoBitRate register number in H.264 mudule , then try higher 4K Video bit rate .
but i just wonder whether it's meaningful to increase it , or to say maybe nobody needs higher bit rate for H.264 4K video ,
since 4K Video bitrate is very high now .
Attachments
TAB_VideSetting.png
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Hacking Nikon Z7

Postby leegong » Tue May 07, 2019 5:58 am

Hi , digitcam ,

Sorry i have to send message to you in the post ,
i tried sending PM to you more than 50 times , but always failed ,
if you don't mind , could you please send it to my E-mail ?
13905790039@139.com

Regards
Leegong
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Re: Hacking Nikon Z7

Postby leegong » Sun Jun 02, 2019 4:37 pm

PTP Debug code 0xF253 : sends custom command to Lens .
PTP Debug code 0xF254 : fetch Lens response .
leegong
Core Developer
 
Posts: 2143
Joined: Mon Mar 19, 2012 12:21 am
Location: Hangzhou , China
Been thanked: 553 times

Previous

Return to Firmware

Who is online

Users browsing this forum: Google [Bot] and 4 guests

cron