Fujifilm Firmware Checksum

Question

I'm working on reverse engineering the firmware for my Fujifilm HS20EXR.

I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera says the firmware is broken. Of course, the same thing happens when I modify the firmware payload. I've tried CRC32, CRC16, MD5sum, but I can't figure out how to reproduce the checksum.

Here's a brief layout of the firmware file:

Size in bytes  Description
4              Hardware or OS version
512            Model information (consistent on firmware updates for same model)
8              Firmware version
4              Checksum (different on all firmwares) In this case, `8A 73 D8 D4`, or 0xd4d8738a.
4              Checked several firmwares, generally just "1".
variable       Payload (bit flipped)

(I've gotten the payload disassembled, but I haven't been able to
get the strings correctly referenced to the code.)

Any advice or recommendations would help greatly.

I've stored my code over at https://github.com/petabyt/fujifilm. If you want to try it out, you should be able to run:

wget https://dl.fujifilm-x.com/support/firmware/hs20WAkw7ifA/FPUPDATE.DAT -O hs20exr.DAT
make t=u f=hs20exr.DAT

Answer 1

I've figured it out. One of my earlier tests had been done wrong, it turns out it is just a simple case of "add up all the firmware bytes and make sure it equals X".