3

I'm working on reverse engineering the firmware for my Fujifilm HS20EXR.

I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera says the firmware is broken. Of course, the same thing happens when I modify the firmware payload. I've tried CRC32, CRC16, MD5sum, but I can't figure out how to reproduce the checksum.

Here's a brief layout of the firmware file:

Size in bytes  Description
4              Hardware or OS version
512            Model information (consistent on firmware updates for same model)
8              Firmware version
4              Checksum (different on all firmwares) In this case, `8A 73 D8 D4`, or 0xd4d8738a.
4              Checked several firmwares, generally just "1".
variable       Payload (bit flipped)

(I've gotten the payload disassembled, but I haven't been able to
get the strings correctly referenced to the code.)

Any advice or recommendations would help greatly.

I've stored my code over at https://github.com/petabyt/fujifilm. If you want to try it out, you should be able to run:

wget https://dl.fujifilm-x.com/support/firmware/hs20WAkw7ifA/FPUPDATE.DAT -O hs20exr.DAT
make t=u f=hs20exr.DAT
4

I've figured it out. One of my earlier tests had been done wrong, it turns out it is just a simple case of "add up all the firmware bytes and make sure it equals X".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.