GH1 firmware research volunteers required

[Vitaliy Kiselev]

If you want to donate go to http://www.gh1-hack.info

Your money go to equipment used by firmware patch developer and testers.

What do we need today:

G2 camera body - collection in progress (leave note at PayPal form - "G2 hack project", please)!
SanDisk Extreme III 30MB/S 32GB SDHC card to determinate real limits of camera bitrate - collection in progress, donate, please!
You can donate any fast prime lens including C mount, Pentax, etc, any m4/3 converters to old glass.

I also hope to have special sponsor place in next interface remake.
So, if anyone selling some gear want to provide it as donation, we could place his advertisment. This is very effective way to get info to potential customers.

I want to emphasize that this project can stop without information and tools.
We must build small team with sole purpose to reach necessary people in Panasonic Lumix division development department.
Under this I mean information digging, many calls via cheap international Skype, etc. to get necessary persons and talk to them.
I really mean many calls and collecting all contacts is special database.
Contact me if you want to become member of such team.

If you passively read this thread, it is time to join!
Contact me at info dot pentax-hack dot info.

Partial list of users who already donated (>170 people already): Turbo Two, kaonashi, Car3o, Philip Lipetz, NPrincen, rotrier, kainekainekaine,
surfer030303, sunghui, R-ik, Oleg2d, greige, Bishaway, Barry Green, Bern Caughey, Angular Mo, JackBayer .

Send your request to our money collector - Car3o to be included in this list.

Special thanks: NURBS, jobeless for testing; dracode - WinGraph development.

Thanks Zynamics for provided BinDiff licence (worth $1200).
Thanks www.Hook-Api.com for provided Text Capture SDK.

Panasonic original V1.32 firmware update: http://panasonic.jp/support/global/c...ts/dl/gh1.html

Firmware manipulation tool: http://www.gh1-hack.info/ptool3d.zip



Screenshot shows only patches available for GH1 v1.32

For Mac users - use http://winebottler.kronenberg.org/

Simple instructions:

1) Place ptool3.zip and GH1__V13.zip inside one folder.
2) Extract both archives and delete zip files.
3) Now you must have two files - ptool3.exe and GH1___132.BIN
4) Run ptool3.exe, check help hints or FAQ and manual threads.


Version history (starting from 3.30):

3.40d
Interface redesign, now each patch have proper place.
Settings storage (up to 10) and sharing.
More tight integration with forum.
Many hints are rewritten to be more clear.
720 GOP settings ported to GF1.
MJPEG Compression Cut patches (for testers only).


3.36
Native 24p/25p patch modified to prevent freezing on playback.
Simplified video bitrate patch added.
MJPEG 1280m Size related patches returned by request.
MJPEG 1280m 420->422 Color Sampling patch added.

3.35
Limiting bitrate patch added.
Sensor mode 4 parameters patches officially added (testers only!).

3.34
AVCHD 1080p24/25->720p24/25 patch added.
Sensor mode patches added (officially :-) ).
MJPEG Size 1280m->1920m and MJPEG Encoder 1280m->1920m patches added (for use friendly way to set 1920x1080 MJPEG mode).

3.33
MJPEG Size and Fps patches added (see tester notes!).
MJPEG Sensor mode patch added.


Major issues for today are:

Time limit for PAL cameras (done)
50/60fps PAL/NTSC switchable (done)
Audio Encoding bitrate low (done)
24p/25p native (done)
Third-party battery (done)
1080p mud (done, will be improved later)

720p24 (cropped, so, only partially working)
MJPEG 720p24 (skip frames)
AGC for audio (research stage)
Video monitoring (research stage)

P.S. As always, no one can quarantee that you camera will work after this :-)

[Vitaliy Kiselev]

Notes to testers

1) Check 32.000 and 44.000 audio sampling rate with 448.000 kbps encoder setting (any other patches are ok).

Resoluton chart to shoot : www.pentax-hack.info/firmware/pan/ISO_12233-reschart.pdf

Plans, information, specialists required etc

Important request.

I want to remind you that we need tools to move forward at good pace.

First.
Panasonic service software can be very helpful.
Go and ask your service center is they have it.
Most of the service software leaks are made exactly this simple way.
We are not intended to make it public.
So, if you want to provide it and remain anonymous you can be sure that it'll be used for development only.

Contact me by PM if you think you can help us!
We must build small team with sole purpose to reach necessary people in Panasonic Lumix division development department.
Under this I mean information digging, many calls via cheap international Skype, etc. to get necessary persons and talk to them.
I do not mean any useless petitions, etc
Contact me by email and PM if you want to become member of such team.
I specially invite people from Japan.

No one still want to disassembly his GH1 and look for used CODEC on Audio P.C.B?
As it can be best approach to AGC.


C++ developers

Read other threads in this sub-forum.

So, our targets:
H264 encoder settings allowing to adjust quality estimator, I and P frames size allocation.
MJPEG encoder settings.
Low level sensor setup routines, like scanning speed, fps, etc.
Trying to locate AGC (or limiter :-) ) related stuff.
Video output functions research.

I do not expect HDMI out and any video output to appear soon.
This is crucial parts, and we know only few things about video monitoring.

Plus turning AGC off requires interface, this is also very big work (we can use audio volume setting for this).

Here is small summary of what we can do:

We can change some encoders settings.
This includes AVCHD, Audio, MJPEG.

Currently messing with some sensor related settings.

Any native Japanese here with ability to view binary files and C knowledge ?
We need to extract all Japanese strings from firmware in JIS, Shift JIS and Unicode.

Table:

.byte 9 dup(0xA0) ! 0 !
.byte 0xA1 ! 9
.byte 0xA2 ! 10
.byte 0xA3 ! 11
.byte 0xA4 ! 12
.byte 0xA5 ! 13
.byte 0xA6 ! 14
.byte 0xA7 ! 15
.byte 0xA8 ! 16
.byte 0xA9 ! 17
.byte 0xAA ! 18
.byte 0xAB ! 19
.byte 0xAC ! 20
.byte 0xAD ! 21
.byte 0xAE ! 22
.byte 0xAF ! 23
.byte 0xB0 ! 24
.byte 0xB1 ! 25
.byte 0xB2 ! 26
.byte 0xB3 ! 27
.byte 0xB4 ! 28
.byte 0xB5 ! 29
.byte 0xB6 ! 30
.byte 0xB7 ! 31
.byte 0xB8 ! 32
.byte 0xB9 ! 33
.byte 0xBA ! 34
.byte 0xBB ! 35
.byte 0xBC ! 36
.byte 0xBD ! 37
.byte 0xBE ! 38
.byte 0xBF ! 39
.byte 2 dup(0x90) ! 40 .byte 2 dup(0x91) ! 42 .byte 2 dup(0x92) ! 44 .byte 2 dup(0x93) ! 46 .byte 2 dup(0x94) ! 48
.byte 2 dup(0x95) ! 50 .byte 2 dup(0x96) ! 52 .byte 2 dup(0x97) ! 54 .byte 2 dup(0x98) ! 56 .byte 2 dup(0x99) ! 58
.byte 2 dup(0x9A) ! 60 .byte 2 dup(0x9B) ! 62 .byte 2 dup(0x9C) ! 64 .byte 2 dup(0x9D) ! 66 .byte 2 dup(0x9E) ! 68
.byte 2 dup(0x9F) ! 70
.byte 4 dup(0x70) ! 72
.byte 4 dup(0x71) ! 76
.byte 4 dup(0x72) ! 80
.byte 4 dup(0x73) ! 84
.byte 4 dup(0x74) ! 88
.byte 4 dup(0x75) ! 92
.byte 4 dup(0x76) ! 96
.byte 4 dup(0x77) ! 100
.byte 4 dup(0x78) ! 104
.byte 4 dup(0x79) ! 108
.byte 4 dup(0x7A) ! 112
.byte 4 dup(0x7B) ! 116
.byte 4 dup(0x7C) ! 120
.byte 4 dup(0x7D) ! 124
.byte 4 dup(0x7E) ! 128
.byte 4 dup(0x7F) ! 132
.byte 8 dup(0x50) ! 136
.byte 8 dup(0x51) ! 144
.byte 8 dup(0x52) ! 152
.byte 8 dup(0x53) ! 160
.byte 8 dup(0x54) ! 168
.byte 8 dup(0x55) ! 176
.byte 8 dup(0x56) ! 184
.byte 8 dup(0x57) ! 192
.byte 8 dup(0x58) ! 200
.byte 8 dup(0x59) ! 208
.byte 8 dup(0x5A) ! 216
.byte 8 dup(0x5B) ! 224
.byte 8 dup(0x5C) ! 232
.byte 8 dup(0x5D) ! 240
.byte 8 dup(0x5E) ! 248
.byte 0x10 dup(0x5F) ! 256
.byte 0x10 dup(0x30) ! 272
.byte 0x10 dup(0x31) ! 288
.byte 0x10 dup(0x32) ! 304
.byte 0x10 dup(0x33) ! 320
.byte 0x10 dup(0x34) ! 336
.byte 0x10 dup(0x35) ! 352
.byte 0x10 dup(0x36) ! 368
.byte 0x10 dup(0x37) ! 384
.byte 0x10 dup(0x38) ! 400
.byte 0x10 dup(0x39) ! 416
.byte 0x10 dup(0x3A) ! 432
.byte 0x10 dup(0x3B) ! 448
.byte 0x10 dup(0x3C) ! 464
.byte 0x10 dup(0x3D) ! 480
.byte 0x10 dup(0x3E) ! 496
.byte 0x10 dup(0x3F) ! 512
.byte 0x20 dup(0x10) ! 528
.byte 0x20 dup(0x11) ! 560
.byte 0x20 dup(0x12) ! 592
.byte 0x20 dup(0x13) ! 624
.byte 0x20 dup(0x14) ! 656
.byte 0x20 dup(0x15) ! 688
.byte 0x20 dup(0x16) ! 720
.byte 0x20 dup(0x17) ! 752
.byte 0x20 dup(0x18) ! 784
.byte 0x20 dup(0x19) ! 816
.byte 0x20 dup(0x1A) ! 848
.byte 0x20 dup(0x1B) ! 880
.byte 0x20 dup(0x1C) ! 912
.byte 0x20 dup(0x1D) ! 944
.byte 0x20 dup(0x1E) ! 976
.byte 0x10 dup(0x1F) ! 1008

[chinkster]

Switch OFF the AGC... please...!!!!

[mojo43]

I'd be interested in helping out...

[Vitaliy Kiselev]

Reserved for info.

[Vitaliy Kiselev]

I added some info about NM103 to my blog.
GH1 firmware can be disassembled without major problems.
You could also note that MN103 is CISC processor, so more easy to understand sometimes.
I believe that bitrate, AGC and batteries check can be found .
Note that processor module source is freely available on request.

Unfortunately, I am sure that GH2 firmware will be encrypted very good (as is TZ7, TZ10 firmwares). Without any hope for dumping and similar things.

[Vitaliy Kiselev]

Managed to disassembly TZ5 firmware image.

[hunter richards]

Cool- Thanks for your effort. So do you mean that the bitrate can be made higher? What about mpeg 720 mode, can that be adjusted to a higher bit rate?

[JerryB]

It is really great to hear that the wheels are beginning to roll in regards to reverse engineering the GH1 and getting some very helpful features added. I would see the most important (and feasible) hacks would be attempting to disable AGC and having native 24fps in 1080 & 720.

I unfortunately do not have the knowledge to spearhead anything of this caliber in a technical regard, but...

I do have extensive experience setting up grassroots campaigns for art-house film distribution companies in New York where I live and work. If we could find an engineer with the knowledge or a group of focused people to start working on a small list of hacks, a paypal account could be set up for them (much like the Magic Lantern project) for GH1 owners to donate to the cause. I would be more than willing to set up a small campaign to help spread the word and try to attract people to donate to such a cause. GH1 owners (including myself) are passionate about filmmaking and this camera and I'm certain would be behind a cause like this.

Thanks for getting the wheel rolling tester13!!!

[TrueIndigo]

Very interesting thread; will be following it with interest. Wish I could help in some way but all this stuff is way beyond me.

Sorry for going off topic, but could you briefly say if your work on the Pentax camera(s) uncovered any possible enhancements for their video capability -- such as bitrate changes or 24/25 fps frames rates? Are they easier to work on compared to Panasonic?

Thanks.