Here's a tool to manipulate Olympus firmwares.
It is mainly based on analysis of the file format by people over at the CHDK forum.
-- removed - updated version below --
Included in the zip are:
- HTML with links to FWs (obtained by sniffing HTTP traffic of Olympus software).
- Binary executable of tool (Windows).
- Source code (+ MSVC9 project).
Here's an example of how to use the tool:
1. Open "oly_fw_linklist-04_07_2010.html", download e.g. "OLY_E_068_1402_0000_0000.BIN" into the tool's "bin" folder.
2. Decrypt and unpack the FW by typing "OlympusFwTool.exe --unpack --in OLY_E_068_1402_0000_0000.BIN --out OLY_E_068_1402_0000_0000.xml".
3. You may estimate the loading address by typing "OlympusFwTool.exe --analyze --in OLY_E_068_1402_0000_0000.dissected\00.main-code-01.bin --out .\OLY_E_068_1402_0000_0000.analysis".
4. Optionally you may extract some resources (jpgs, wavs, etc.) from the FW by typing "OlympusFwTool.exe --extract-resources --in OLY_E_068_1402_0000_0000.xml --out ./OLY_E_068_1402_0000_0000.resources".
5. Open IDA (with MN103 module from tester13's site installed), drag and drop "00.main-code-01.bin".
6. Select "Panasonic/Matshi*a MN103 Family: mn103", ROM start address: 0x6F191420, Loading address: 0x6F191420.
7. Do your stuff, modify "00.main-code-01.bin".
8. Re-pack and encrypt by typing "OlympusFwTool.exe --pack --in OLY_E_068_1402_0000_0000.xml --out OLY_E_068_1402_0000_0000_HACKED.BIN".
Besides the actual reverse engineering and making meaningful modifications, one remaining issue with Olympus FWs is that the cameras can't be updated from SD/CF card.
Instead Olympus provides special software (Viewer, Master, Studio, etc.) which downloads FW binary from Olympus' servers and updates the camera over USB.
To solve this issue, there are three options:
1. Run a local HTTP server which acts like the Olympus server, but serves the modified FW instead.
2. Sniff USB traffic from Olympus s/w while doing an update and create software which does the same thing.
3. Possibly there's a hidden method to do FW updates from card. See below.
It seems Olympus cameras can be updated from SD/CF card at service centers.
In fact for the E-3 camera such service card firmware was leaked.
It consists of a set of files, e.g.:
E0421203.BIN = main body code (regional variant 1)
G0421203.BIN = main body code (regional variant 2)
M0421105.BIN = SWD/IBIS microprocessor code (?)
S0421001.BIN = boot loader (?)
In this example, the E, G and M files can be obtained from the web FW file. However, the S file is not included in the web FW.
Unfortunately, without this S file the camera will not update from card.
For the E-P1 FW for instance, the code that does the update seems in the main code, not in the boot loader.
A better understanding of how this code works by reverse engineering would be useful.
Tester13 told me the E-Px FWs look relatively easy (lots of strings, etc.). However so far I've only reversed a couple of functions and think without the help of more people it won't come to anything meaningful. So I'm hoping some more people are willing to have a go at it...
It is mainly based on analysis of the file format by people over at the CHDK forum.
-- removed - updated version below --
Included in the zip are:
- HTML with links to FWs (obtained by sniffing HTTP traffic of Olympus software).
- Binary executable of tool (Windows).
- Source code (+ MSVC9 project).
Here's an example of how to use the tool:
1. Open "oly_fw_linklist-04_07_2010.html", download e.g. "OLY_E_068_1402_0000_0000.BIN" into the tool's "bin" folder.
2. Decrypt and unpack the FW by typing "OlympusFwTool.exe --unpack --in OLY_E_068_1402_0000_0000.BIN --out OLY_E_068_1402_0000_0000.xml".
3. You may estimate the loading address by typing "OlympusFwTool.exe --analyze --in OLY_E_068_1402_0000_0000.dissected\00.main-code-01.bin --out .\OLY_E_068_1402_0000_0000.analysis".
4. Optionally you may extract some resources (jpgs, wavs, etc.) from the FW by typing "OlympusFwTool.exe --extract-resources --in OLY_E_068_1402_0000_0000.xml --out ./OLY_E_068_1402_0000_0000.resources".
5. Open IDA (with MN103 module from tester13's site installed), drag and drop "00.main-code-01.bin".
6. Select "Panasonic/Matshi*a MN103 Family: mn103", ROM start address: 0x6F191420, Loading address: 0x6F191420.
7. Do your stuff, modify "00.main-code-01.bin".
8. Re-pack and encrypt by typing "OlympusFwTool.exe --pack --in OLY_E_068_1402_0000_0000.xml --out OLY_E_068_1402_0000_0000_HACKED.BIN".
Besides the actual reverse engineering and making meaningful modifications, one remaining issue with Olympus FWs is that the cameras can't be updated from SD/CF card.
Instead Olympus provides special software (Viewer, Master, Studio, etc.) which downloads FW binary from Olympus' servers and updates the camera over USB.
To solve this issue, there are three options:
1. Run a local HTTP server which acts like the Olympus server, but serves the modified FW instead.
2. Sniff USB traffic from Olympus s/w while doing an update and create software which does the same thing.
3. Possibly there's a hidden method to do FW updates from card. See below.
It seems Olympus cameras can be updated from SD/CF card at service centers.
In fact for the E-3 camera such service card firmware was leaked.
It consists of a set of files, e.g.:
E0421203.BIN = main body code (regional variant 1)
G0421203.BIN = main body code (regional variant 2)
M0421105.BIN = SWD/IBIS microprocessor code (?)
S0421001.BIN = boot loader (?)
In this example, the E, G and M files can be obtained from the web FW file. However, the S file is not included in the web FW.
Unfortunately, without this S file the camera will not update from card.
For the E-P1 FW for instance, the code that does the update seems in the main code, not in the boot loader.
A better understanding of how this code works by reverse engineering would be useful.
Tester13 told me the E-Px FWs look relatively easy (lots of strings, etc.). However so far I've only reversed a couple of functions and think without the help of more people it won't come to anything meaningful. So I'm hoping some more people are willing to have a go at it...
Last edited:


