ma1co / fwtool.py Goto Github PK

Querying MTP device
Sony Corporation DSC-HX300 is a camera in MTP mode

Model: DSC-HX300
Product code: 0080813110
Serial number: 04520210
Firmware version: 1.00

Using drivers Windows-MSC, Windows-MTP
Looking for Sony devices

Querying MTP device
Sony Corporation DSC-HX300 is a camera in MTP mode

Switching to app install mode
Traceback (most recent call last):
File "C:\projects\sony-pmca-re\pmca-gui.py", line 76, in do
File "C:\projects\sony-pmca-re\pmca\commands\usb.py", line 274, in installCommand
File "C:\projects\sony-pmca-re\pmca\commands\usb.py", line 37, in switchToAppInstaller
File "C:\projects\sony-pmca-re\pmca\usb\sony.py", line 306, in switchToAppInstaller
File "C:\projects\sony-pmca-re\pmca\usb\sony.py", line 244, in sendCommand
File "C:\projects\sony-pmca-re\pmca\usb\sony.py", line 98, in sendSonyExtCommand
File "C:\projects\sony-pmca-re\pmca\usb_init.py", line 81, in _checkResponse
pmca.usb.InvalidCommandException: MTP error 0x2006

It is possible to pull and decode the 'Backup.bin' file from either the firmware installer image, or directly from camera using Sony-PMCE-RE's updaterconsole.
https://github.com/ma1co/Sony-PMCA-RE

Is anyone compiling a list of known 'keys'?

I assume that there is some standardization between different camera models. Looked at AS15, QX10 and AS100 and they seem to have similar 'blocks'.

Once understood, how can the keys be modified to change camera behaviour? Is there a method of writing an individual 'key' to the camera, or does the whole 'Backup.bin' have compiled and to be written back to the camera (and how)?

I unzip the J1 file through fwtool and replace the J1 file with the ALLLANG file, and then recompress it into the tar file. But I won't modify the verification. Or you can record the method as video and send it to me

Hi,

Camera: Sony ZV-1
crypterName: CXD90045

I managed to unpack and changed the version number in the config.yaml

But I can't pack it, it returned this error:

G:\ZV\fwtool>fwtool.py pack -c output/config.yaml -u output/updater.img -f output/firmware.tar -o packed
Creating firmware image
Encrypting firmware image
Traceback (most recent call last):
  File "G:\ZV\fwtool\fwtool.py", line 345, in <module>
    main()
  File "G:\ZV\fwtool\fwtool.py", line 337, in main
    packCommand(args.firmwareFile, args.updaterFile, args.updaterBodyFile, args.configFile, args.device, args.outDir)
  File "G:\ZV\fwtool\fwtool.py", line 291, in packCommand
    encrypted = fdat.encryptFdat(fdatFile, datConf['crypterName'])
  File "G:\ZV\fwtool\fwtool\sony\fdat.py", line 253, in encryptFdat
    return _crypters[crypterName]().encrypt(file)
  File "G:\ZV\fwtool\fwtool\sony\fdat.py", line 212, in encrypt
    raise Exception('Encryption not supported')
Exception: Encryption not supported

could it support a99m2? thanks!

URL to File -> http://support.d-imaging.sony.co.jp/download/NEX/7DdvKguuiL/Update_ILCE9V101.exe?fm=na

Error MSG:

Extracting installer binary
Decrypting firmware image
Traceback (most recent call last):
File "", line 228, in
File "", line 218, in main
File "", line 127, in unpackCommand
File "", line 83, in unpackDat
File "fwtool\sony\fdat.py", line 213, in decryptFdat
Exception: No decrypter found
fwtool returned -1

Hi, I am trying to modify the firmware of my NEX-5R. Unpacking the firmware / updater will "deeply" unpack all files.
How can I repack an unpacked firmware.tar file?

I am trying to modify files in firmware.tar_unpacked/0700_part_image/dev/nflasha8_unpacked_unpacked and I dont see an obvious way to create a firmware.tar file from the various "unpacked" and "unpacked_unpacked" folders that will work. I guess there is a trick somewhere that I do not understand.

My first guess was to simply edit the files in the camera in-place, but the interesting parts of the filesystem are mounted read-only and there seems to be no way to remount using the busybox interface via telnet.

How can one recover the device encryption key or a the whole new crypto scheme for currently unsupported devices?
(e.g. for the ILCE-7SM3 / ILME-FX3)

Using the gen4 algo - AesCbcCrypter - I can see the FDAT header in plaintext (still the old aes-128-ecb), but the following updater image with compressed romfs that would start at offset 512 turns out as garbage.

Hope to update support as soon as possible @ma1co

ok i am trying to unpack the A57 firmware to try to find how to clean the HDMI.

I download the last version (.exe) and run the command line
"...fwtool.py" unpack -f Update_SLTA57V104.exe -o outDir

a screen flashes but nothing happen and i dont know where is the unpack (.bat) file
is not at the folders

Firstly thanks for the tool.

I've been looking at some Gen2 camera firmware and noticed that the expanded images do not just contain a single 'backup,bin', but seem to contain multiples - presumably for different regions of the world.

fw_as30_v3.0_0110_backup/SYSAVIP-CAM/TF/CX26900_NTSC.bin
fw_as30_v3.0_0110_backup/SYSAVIP-CAM/TFW/CX26900B5_J.bin
fw_as30_v3.0_0110_backup/SYSAVIP-CAM/TFW/CX26900B5_CN1.bin
fw_as30_v3.0_0110_backup/SYSAVIP-CAM/TFW/CX26900B5_AU2.bin
fw_as30_v3.0_0110_backup/SYSAVIP-CAM/TFW/CX26900B5_E35.bin
fw_as30_v3.0_0110_backup/SYSAVIP-CAM/TFW/CX26900B5_UC2.bin
fw_as30_v3.0_0110_backup/SYSAVIP-CAM/TFW/CX26900B6_U2.bin
fw_as30_v3.0_0110_backup/SYSAVIP-CAM/TFWO/CX26900B5_CEN.bin

With a bit of script-fu, we can get to find out which keys are different (to NTSC) in each of these. Attached is a zip with just the deltas... maybe this is helpful in identifying what the keys are (ie. NTSC vs PAL output).

find . -name '*.bin' -exec bash -c "python fwtool.py print_backup -f {} > {}.txt" \;
cd SYSAVIP-CAM/TFW
mkdir NTSC_deltas
find . -name '*.txt' -exec bash -c "diff -t --side-by-side ../TF/CX26900_NTSC.bin.txt {} | grep -B 1 '  |  ' > NTSC_deltas/{}.diff " \;

(https://github.com/ma1co/fwtool.py/files/1416337/fw_as30_v3.0_0110_backup_deltas.zip)
[fw_as30_v3.0_0110_backup_deltas.zip]

Can someone confirm that the 'backup.bin' file can be patched, the firmware repacked and uploaded to a (Gen2) camera? Too scared to try myself without a little encouragement... :-)

Hi, thanks for sharing this on github. I successfully unpacked a Sny N€X-7 firmware with your software and made some changes to firmware.tar_unpacked. How do I re-archive this folder properly and obtain a correct *.dat firmware?

I am asking this because if I simply tar an untouched firmware.tar_unpacked with

tar -tf firmware.tar.bak | /usr/bin/tar -H ustar --no-recursion -b 5 -cf firmware.tar -C ./firmware.tar_unpacked/ -T -

i get a firmware.tar with the same size but different md5 checksum. What is the correct approach to archiving and packing a firmware back?

With some support, if I succeed in the goal, I could help you updating and detailing the README.md

At a glance the following cameras are missing from 'devices.yml'.

HDR-AS20
HDR-AS200V
HDR-AS50
HDR-AS300

Nice to meet you, my name is Francesco :-)

Would anyone be so kind to help me (us) with this? ...or do you know anybody owning such camera?

Thank you very much in advance!

Is it supported?
I can get the camera info.
I need to install international menu with English if supported

@ma1co ,

What are the commands for repacking firmware? I think I may have made some progress adding features to the a6000 but need to flash the firmware to the camera to test.

Thank you!

I was very pleasantly surprised to find you have updated support to include gen4 decrypting. I am just curious though at this stage, is it possible to re-encrypt in future versions? is this feasible or did have things changed with the new gen?

Also, in your experience do you suppose that the swapping the language files (and their sums) would work on the new gen? I've read on forums that method didnt work on gen3 but i wasnt sure if the person trying to do it knew what he was doing.

p.s. I tried the unpacking method on the newly released v5.0 for the a9 and it worked without an issue. it seems they havent changed the encryption code

I can successfully unpack the firmware, but is there anywhere I can find the information about settings?

I manage to unpack A7RM3 firmware with this.
And change the language something.

How do I pack them back all together to the format that accepted by the camera?

I see that the pack command require -o, -c and -d.

Can someone show example of complete command?

Hello,

Is there any ETA for the support for a Sony A7x Mark iii?

If I can grant any help in this process please let me know.

The model number is: ILCE-7M3
And current Firmware version is : 3.01

The errors that I got while trying to install the Open Memories app and Tweak were:

Switching to app install mode
Traceback (most recent call last):
File "", line 73, in do
File "pmca\commands\usb.py", line 207, in installCommand
File "pmca\commands\usb.py", line 31, in switchToAppInstaller
File "pmca\usb\sony.py", line 180, in switchToAppInstaller
File "pmca\usb\sony.py", line 147, in sendCommand
File "pmca\usb\sony.py", line 94, in sendSonyExtCommand
File "pmca\usb_init.py", line 58, in _checkResponse
Exception: Response code not OK: 0x2006

Kind Regards,

Iddo

Hi,

The latest release fails with the decryption of latest firmware image for A7RM5. Following is the error:

$ .\fwtool-v1.2-win.exe unpack -f BODYDATA.DAT -o unpacked_sony
Decrypting firmware image
Traceback (most recent call last):
File "", line 297, in
File "", line 285, in main
File "", line 167, in unpackCommand
File "", line 106, in unpackDat
File "fwtool\sony\fdat.py", line 214, in decryptFdat
Exception: No decrypter found
fwtool returned -1

Originally posted by @ma1co in #13 (comment)

I tried repacking the main partition using the older nex-hack tool, and a tool I wrote to repack the lzpt files. Unfortunately I tested both my tool and several changes I made to the OS at the same time. Now my camera boots up, but right as it gets to the main page or firmware loader, the camera reboots.

I was attempting to remove text from the screens by corrupting the fonts. Apparently doing so also causes the camera to not work.

If anyone knows of a way of un-bricking NEX-5N's, I'm all ears! I'm not sure where else to ask. But I can't get it to do the normal boot-to-a-regular-OS.

My changes to re-pack: https://github.com/cnlohr/nex-hack
The story of the failure: erik-smit/nex-hack#2

Hi,

I am a novice, so I apologize if I ask for stupid questions. I was wondering if is there any possibility to overwrite the camera loaded firmware with the same version?

I guess that just changing the version of the current firmware from the data file and saving it into a new file (1.061 f.i.) should be enought to allow the updater to load the firmware into the camera. Unfortunately I am not familiar with pyton.

Thanks for supporting.

Hi, I'm trying to add a custom lens, so I can have AF support trough an adapter.

I'm using. a6300, a commlite adapter, and cannon EF 75-300 lens

I've confirmed that the camera can talk to the lens, it can change it's aperture, but the autofocus is "unsupported"

I have a firmware 2.00 and 2.01 where they supposedly added support for SEL18135 lens so I'm trying to find where in the dump I could find the new lens.

Most changes i've seen are timestamps and some libraries.
There is partition 18 that contains xx_lensfile.bin, but this one hasn't changed a bit.

There also is InhInfo_InhMgr.db which has few fields moved around, it appears to have settings in it but I'm not sure what are they used for yet.

My guess is there's an Android app that checks if the lens can have autofocus and then allows you setting that option.

Maybe anyone working on this longer has seen where they store lens information.

I'm on macOS High Sierra and Sony haven't provided a way to update the OG A7 series on Sierra/High Sierra.
Can I use the firmware.dat extracted with this tool from Update_ILCE7V320.exe and the pica-gui-v0.13-osx app to update my A7?

I'm a little slow to notice, but there's f/w for the RX0 available now (since Oct 2018).
https://www.sony.ca/en/electronics/cyber-shot-compact-cameras/dsc-rx0-dsc-rx0g

Any use to you?
Simon.

FWTool fails and gives an error message when trying to decode the Backup.bin taken from a DSC-WX80 camera.

ftool-v1.2-win.exe print_backup -f "Backup.bin"

Traceback (most recent call last):
  File "<string>", line 297, in <module>
  File "<string>", line 289, in main
  File "<string>", line 249, in printBackupCommand
  File "fwtool\sony\backup.py", line 47, in readBackup
Exception: Wrong magic
fwtool returned -1

I found there is support for a6300 and a6500 but not 6400. Will it be an update on 6400? Thanks a lot.

Hey. Can it be modified to extract Sony action cam firmware? I tried extract HDR AZ1 firmware (.dat), but it gives me error

>fwtool.exe FirmwareData_Update_HDRAZ1V101.dat fwtool2
=== Extract encrypted FDAT record to 'fwtool2/FDAT_enc.bin' ===
Write chunk FDAT to 'fwtool2/FDAT_enc.bin' ... Done
=== Decrypt FDAT record to 'fwtool2/FDAT_dec.bin' ===
Reading FDAT input file: 'fwtool2/FDAT_enc.bin' ... cipher method = 2, block length = 1024
Writing FDAT output to 'fwtool2/FDAT_dec.bin' ... decrypt_fdat_image(blocknum=0): block checksum mismatch (expected: 948d, calculated: f847)!
fdat_decrypt_file() returned error!

Hello, it is possible to modify the firmware or the installer, to allow reflash the same version (in case of a bad flashing) or also to allow downgrading to a previous version?

Please add PJ 680 in the compatible cameras

Hi, is this Tool for unpacking AND decrypting ? Iam trying to change the language on my Sony Alpha 7 iii.
I Need to decrypt the fdat section of the firmware.

FW for A7RM3 found in http://www.sony.com.au/electronics/support/downloads/00014966,

Would be nice to unpack so we can start unlocking some features.