I'm working on reverse engineering the firmware for my Fujifilm HS20EXR.
I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera says the firmware is broken. Of course, the same thing happens when I modify the firmware payload. I've tried CRC32, CRC16, MD5sum, but I can't figure out how to reproduce the checksum.
Here's a brief layout of the firmware file:
Size in bytes Description 4 Hardware or OS version 512 Model information (consistent on firmware updates for same model) 8 Firmware version 4 Checksum (different on all firmwares) In this case, `8A 73 D8 D4`, or 0xd4d8738a. 4 Checked several firmwares, generally just "1". variable Payload (bit flipped)
(I've gotten the payload disassembled, but I haven't been able to
get the strings correctly referenced to the code.)
Any advice or recommendations would help greatly.
I've stored my code over at https://github.com/petabyt/fujifilm. If you want to try it out, you should be able to run:
wget https://dl.fujifilm-x.com/support/firmware/hs20WAkw7ifA/FPUPDATE.DAT -O hs20exr.DAT make t=u f=hs20exr.DAT