Sony NEX/Axx Firmware hacking

N

Nexus7

New member
Hi,

I have started firmware hacking project, current plan is to dump and decrypt complete firmware.
Currently I'm reversing flashing protocol used for FW upgrading, hoping for some undocumented commands.
Also as mentioned on WIKI, XORing firmware files produces short blocks of clear text.
This suggests file isn't really encrypted, just XORed with pseudo-random sequence that is static among ALL compatible cameras.
After some research, I found this is same for all Alpha Axx and NEX series. This indicates common firmware is used in all these models.
Pattern is different for compact cameras like HX5 and VG video cameras.
From parts of firmware, I can see there is debug console with commands to read/write memory and other interesting stuff.


So far, I have found one interesting feature in Firmware updater:
Create empty FirmwareUpdater.log file in updater directory (where SPUFirmwareUpdater.exe is).
When updater finds this file, it will be used for nicely detailed debug logging of all data send and received.
I have already updated my camera firmware, but if anyone here will be doing firmware upgrade (Axx,NEX or LA-EA1),
please enable logging and upload the log. It will greatly help me with understanding the protocol.

EDIT: If you can, run firmware updater on already updated camera (just to the point it says camera version, then close it).
I have only NEX3 log file, logs for other cameras are welcome (even without actual flashing).


More good stuff will come soon...


p.s. I'm well known for other similar projects, but Sony isn't really happy when hackers are having fun and likes to sue and cause problems...
So I will be posting under this new user without any link to my previous work.
 
Last edited:
There is this this nice connector in VG10 with two UARTs and even JTAG port.
In firmware, there is 112500Bd console active on one UART with servicing commands and possible shell access.
Also it may be possible to read full flash image using JTAG or upload dumper code to RAM and execute it.
There are also test points for all these pins, some near CPU, some directly behind connector.
Similar connector is in NEX series, but I don't have LEVEL 2 service manual to confirm it.
 

Attachments

  • vg10_cpc_pinout.jpg
    vg10_cpc_pinout.jpg
    17.3 KB · Views: 0
  • vg10_cpc_location.jpg
    vg10_cpc_location.jpg
    19.1 KB · Views: 0
I'm waiting with baited breath for your offerings!.. the nex 3 and 5 are both very highly specified cameras and it is very clear sony have held back on features via their firmware to create product differentiation, and make their new nex c3 and 5n more appealing. the nex3 would benefit very much from the manual shutter/iso control during video mode.. at the moment it goes stright to auto, and you cannot set a fixed iso or shutter. also, higher bitrates, and a non cropped video mode would be welcomed. I bought the nex3 for the apsc sensor, but they only give me 2/3 of it when i am in video mode! are you any further on the project? im sure many would be willing to make donations to your cause, instead of buying a new 5n, nex 7 or c3, which technically are no better than the originals!
 
Hi I am a NEX3 owner who really wants to have remote trigger via the UART that you mentioned before. This would allow things like triggertrap to control an NEX camera! Any updates on the hack?
 
Confirmation of the nice connector on Nex-3/5 for the Image Processor, contains JTAG, UART0 and UART1 (UART2 is pin 3 & 4 of the lens connector) for the Image Processor - http://i.imgur.com/hv4sz.jpghttp://i.imgur.com/hv4sz.jpg

Main CPU JTAG is on the underside - http://i.imgur.com/8WoJS.jpg

Service Manuals (level 2 and 3) for Nex-3/5 can be found at http://www.2shared.com/file/k4EZ0W0m/Sony_nex-3-5_service_manual.html

Would love to see a FirmwareUpdater.log file, any further progress regarding the firmware decryption?
 
Hello,
Have you got any news for the firmware hacking of the Sony Nex?

I have a Nex-3 with 05 firmware and I wait for HD1080p vidéos.

Thanks.
 
Sony Nex 5n clean signal HDMI out.

Sony Nex 5n clean signal HDMI out.

Have seen a lot of people around the net asking for firmware mod. to get clean 4:2.2 signal out of the Nex 5n HDMI out.

Sony have made some restrictions, not to get the clean signal out. Think to protect their pro line series.

The Nex series uses Avchd 2.0 witch gives us a compressed 4:2:0. Highly useable and nice video pix. But, if U want a signal for green screen work, chromakeying etc. 4:2:2 is far more usable. And that could be nice to get from the little lovely Nex 5n.

Some say it could be done by a small firmware modification? If somebody can figure it out we are ready to pay and donate for the work :)

Pho2graph
 
Last edited:
Hi Nexus7,
I have a NEX-5n and would like to help you out. From you post, does it mean I can save an empty file call Firmwareupdater.log first in my SDCard and then run the firmware update?
I am going to update my NEX-5n to the latest firmware. What I wish is enable 5n can switch between 50p/60p/24p and increase the bitrates.
Please guide me more detail. Thank you!

Paul
 
zaku2 said:
Hi Nexus7,
I have a NEX-5n and would like to help you out. From you post, does it mean I can save an empty file call Firmwareupdater.log first in my SDCard and then run the firmware update?
I am going to update my NEX-5n to the latest firmware. What I wish is enable 5n can switch between 50p/60p/24p and increase the bitrates.
Please guide me more detail. Thank you!

Paul
Click to expand...
I am not Nexus7 but...
No, you should unpack exe file of the update (for example - Update_NEX5nV101.exe), go to folder Resource in unpacked data (where is SPUFirmwareUpdater.exe situated) and create there empty file with name FirmwareUpdater.log then run SPUFirmwareUpdater.exe. After updating FirmwareUpdater.log should contain some debug info.
 
As much as it would be a dream come true to finally see someone sticking it to Sony with an awesome hack...these little cameras warm up way too much as it is. I´m not a tech guy at all but I would think increasing the bit-rate or the way the footage is encoded might kick up the heat even more. I hope not,though. Getting 100Mbit 4:2:2 out of these little cameras would turn them into one mean filming machine.
 
I will obtain the log for you tomorrow (nex 5n). My friend has extracted all the files from the updater packet and has created the .log folder. bear with me nexus.. He will send it to me soon. We want clean HDMI without 'rec 00:00' and other items on screen during recording. during playback it feeds full HDMI 1080p out of the socket, during recording they crop it and add 'rec' 'time' and dials on screen which cannot be removed.
 
You must log in or register to reply here.
Back
Top