NX300 firmware hack to remove video recording limitations

Started Nov 9, 2015 | Discussions
lamer01 Junior Member • Posts: 48
Re: NX300 firmware hack to remove video recording limitations

Interesting stuff.I wonder if making changes to the NX1 would be beneficial. I remember when a lot of people bought the HP Touchpad back when HP discontinued it. People bought it for $99 (it was a $500 tablet at the time). Cyanogenmod then created a modded firmware and the tablet ended up having a very loyal following for a while. Same could happen to the NX1. I can think of a couple of changes that I would like, primarily for video. I would like to make the rolling shutter less bad in 4K. I would also like to increase the bitrate. Obviously we need to understand if the H265 recording is parameterized enough where it could be controlled by modifying those parameters. Also, maybe we can add more custom shooting modes like Gamma DR. I am a developer so I could chip in time and effort as needed.

otto k Senior Member • Posts: 2,110
Re: NX300 firmware hack to remove video recording limitations
1

First thing would be to extract the root filesystem from firmware file (binwalk is your friend) and go from there with extracting startup files and scripts, etc. I did some poking around in NX500 FW and there's a set of interesting utilities that enable one to adjust zoom, focus, etc (basically anything you can do with remote sdk for nx1) from command line but I have no way to access the command line (and I don't have nx500... Yet).

Best of luck with this and keep us informed on the progress.

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: new firmware of NX500

Will? That's quite old...released in august.

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: firmware hack download?

NewToCameras has suddenly disappeared. I guess he received some form of threatening like a cease and desist.

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: NX300 firmware hack to remove video recording limitations

Nobody seems interested, or knowledgeable enough, to do this.

As said before, the only guy reaching a 'goal' was NewToCameras, that suddenly disappeared after hacking nx300 fw.

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
Ari Aikomus
Ari Aikomus Veteran Member • Posts: 9,354
Re: new firmware of NX500

tecnoworld wrote:

Will? That's quite old...released in august.

Yep, sorry, that's new to me I just bought NX system (NX500).

-- hide signature --

- Ari Aikomus -
'Why should I feel lonely ? is not our planet in the Milky way?'

lamer01 Junior Member • Posts: 48
Re: firmware hack download?

tecnoworld wrote:

NewToCameras has suddenly disappeared. I guess he received some form of threatening like a cease and desist.

Well, once the cameras are officially discontinued then we can proceed.

CraigVMN Contributing Member • Posts: 536
Re: NX300 firmware hack to remove video recording limitations

If you could figure out how to get the NX500 to shoot 4k on the full sensor (no extra crop) that would be epic

 CraigVMN's gear list:CraigVMN's gear list
Samsung NX500 Samsung NX 50-200mm F4-5.6 OIS Samsung NX 12-24mm F4-5.6 ED Samsung NX 45mm F1.8
tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: firmware hack download?

Will they ever be officially discontinued? I mean...Samsung is trying to disappear without declaring that.

Anyway I'd really like to know what happened to NTC. He was about to delve into NX1 code and try and unleash some features.

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
otto k Senior Member • Posts: 2,110
Re: firmware hack download?

Wild guess? He lost interest when he realized that in time needed to do anything meaningful with the firmware he could do something more interesting or better paying? And let's not forget that he has nx300 and no easy way to test anything on other cameras...

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: firmware hack download?

Perhaps but I don't think so. His last msgs were full of enthusiasm.

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
Kisaha Senior Member • Posts: 2,213
Re: firmware hack download?

Perhaps but I don't think so. His last msgs were full of enthusiasm.

I hope the guy is well (having the hicups for sure!) and I couldn't care less about firmwares, and what not. He already has offered to the system more than I ever will. Or maybe he is not new to the camermas anymore!

tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: firmware hack download?

Of course that's my hope as well. He was a very valuable element in nx camp.

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
WSO87 New Member • Posts: 1
Re: NX300 firmware hack to remove video recording limitations

Hi, about the fw of NX300 that you hacked (video time limit) can i use on my NX3000(three thousand)?

vatazhka
vatazhka Regular Member • Posts: 355
Re: NX300 firmware hack to remove video recording limitations

otto k wrote:

First thing would be to extract the root filesystem from firmware file (binwalk is your friend) and go from there with extracting startup files and scripts, etc. I did some poking around in NX500 FW and there's a set of interesting utilities that enable one to adjust zoom, focus, etc (basically anything you can do with remote sdk for nx1) from command line but I have no way to access the command line (and I don't have nx500... Yet).

Which version did you disassemble?  I had issues with the newest release (v1.11) as the layout had changed.  I could not follow my usual routine as the rootfs image seems to be compressed.

-- hide signature --

Check here if your Samsung NX / NX mini camera & lens firmware is up to date!

 vatazhka's gear list:vatazhka's gear list
Samsung NX1000 Samsung NX mini Samsung NX500 Samsung NX 20-50mm F3.5-5.6 ED Samsung NX 50-200mm F4-5.6 OIS +3 more
tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: NX300 firmware hack to remove video recording limitations

For ages I've been asking for a 'focus bracketing' for nx1.

Could it be possible through these commands? All I need is the camera to focus on a point selectable by user, then shoot, change focus by a delta, shoot again and so on (for about 30 shoots).

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
otto k Senior Member • Posts: 2,110
Re: NX300 firmware hack to remove video recording limitations

It was 1.11, but it is compressed, not sure if it's rootfs or a container that also contains rootfs (like a compressed filesystem). Does anyone have 1.10 or 1.0?

I'll post what I found inside when I get back home.

@tecnoworld Isn't it already possible with finder80 program?

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
tecnoworld
tecnoworld Veteran Member • Posts: 7,232
Re: NX300 firmware hack to remove video recording limitations

Otto, not that I know, not automatically at least ..

 tecnoworld's gear list:tecnoworld's gear list
Samsung TL500 Samsung NX100 Samsung NX200 Samsung NX300 Samsung NX1 +15 more
otto k Senior Member • Posts: 2,110
Some interesting things from NX500 firmware - LONG POST!
1

Fair warnings:

1. I dont have NX500 or NX1
2. Firmware is compressed in such a way that I'm unable to properly extract most files (they are corrupt) and as such I have no way to currently "hack" firmware. Doeas anybody have older version(s)?
3. IMHO - tools available in firmware are really for service people - there are things that require specialized external equipment, but also tools that control
very low level stuff like RAM access or DMA, SPI, etc - it would be **VERY** easy to brick one's device by executing them without any documentation.

That said, here goes short version:

It is possible that scan.sh file is executed from SD card on WiFi scanning, or inbuilt iwlist if nothing is found on the card. Maybe someone with NX500 or NX1 could check?

HDMI can output 480, 576, 720 and 1080 (no 2160) but there appears to be support for up to 240fps (at least as a value in a table).

Also, file names nx_cs.adj is definitely searched for on SD card (also alt.adj, nx_dev.adj, paf_adj_restore.adj, etc). Also, iperf is used for testing Wifi

Regarding sensor modes (for video): FHD, Cinema, Video60, Video120, Video240, VideoHFull, VideoFull, ModeQHD, UD, UD_Crop1, UD_Crop2, 720P60
If UD is UHD there are at least three different crops, tecno will love this
There seem to be 7 movie modes 0 - 6 (0:UHD/1:UHD_D/2:FHD/3:CINEMA/4:HD/5:VGA/6:QVGA) - can someone check if they are all present in menus? (**two** UHD + CINEMA - it that 4k?)

Frame rates go from 4fps to 240fps in many increments. Pixels can be read in 10, 12 and 14 bits.

There are a bunch of functions that (it looks like that to me) call directly HW functions of DRIMe5,
all prefixed with d5_ like d5_ep_3dlut_op_init (oh, yeah, there is code for loading custom LUTs), d5_ep_top_change_jpeg_moa_for_conti_cap, d5_ipc_set_dram_addr, etc.

Supported lens by this FW (sorry, no unknown lenses
NX 30mm F2
NX 18-55mm F3.5-5.6
NX 50-200mm F4-5.6
NX 20-50mm F3.5-5.6
NX 20mm F2.8
NX 18-200mm F3.5-6.3
NX 60mm F2.8 Macro
NX 16mm F2.4
NX 85mm F1.4
NX 45mm F1.8
NX 45mm F1.8 [T6] 2D/3D
NX 12-24mm F4-5.6
NX 16-50mm F2-2.8 S
NX 10mm F3.5 Fish Eye
NX 16-50mm F3.5-5.6 Power Zoom

You can even control liveview gain from x1 to x32 (so, from ISO100 to ISO3200?) and separate gains for R, G and B.

SD card is probed for some files like dpc_faf (fast AF) dpc_vfaf (very fast AF - hilarious).

"Raw" RAW files can be dumped to card to file named RAW_someid.raw (they are just dumps of reads from the sensor, no EXIF, etc).

For color shading servicing you need 16-50pz.

Apparently there are three different AWB modes in there: EX2F, NX200 and NX1.

It seems to me that focus position is recorded to MakerNotes filed in EXIF, as well as data on focus contrast etc (could be useful to someone).

Also, there is **extensive** debugging and service logging in firmware, seriously, it's incredible what data seems to be possible to be gathered
(e.g. SD card file paflog0.txt contains detailed AF values with, I kid you not, average and standard deviation for bunch of parameters, etc).

Examples of available service mode commands (IIRC it's a single tool called **st** with many many commands and parameters) are in next post (MOD can delete it if it's too long).

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
otto k Senior Member • Posts: 2,110
WARNING - VERY LONG POST - Some interesting things from NX500 FW

Examples of available service mode commands (IIRC it's a single tool called st with many many commands and parameters, these could be valid commands for *.adj files - I don't know):

Capture Debug Command Usage :
usage: st cap capt [command] [param]
loglevel
report
liveview
movie
single start
conti
burst
aeb
wbb
pwb
panorama
3dshot
bulb
cwb
stop
trace
counterlog
timer
callback
mf on / off
lens init
iris [open / preview / drive Fnumber]
ois [, mode]
quality [sfine / fine / normal / raw / rawsfine / rawfine / rawnormal / sraw]
size [full / n1 / n2 / n3 / n4 / w1 / w2 / w3 / w4 / s1 / s2 / s3 / s4]
hdr [off / on / art]
nr [off / ltnr / adnr]
init
strobe [init / charge / on / off / pre]
still3d
caf [start / stop]
ael [on / off]
afl [on / off]
smart
capprint [on / off]
bestface
shlag
3dfps
event [save / print / test]
multiexp [, max (count), on/off]
motionshot [, max (count), on/off]
light [on / off] [body / strobe]
conticonti
portrait
hdrart
motionphoto
lls
movieaf [start / stop]
movietouchaf [start / stop]
focusaid [start / stop]
dpreview [start / stop]
pgshift [up / down / reset / countreset]
fdrun [start / stop]
objecttrk [start / stop]
setois [active / idle]
beauty
mfenlarge [permit / prohibit / toggle]
moviefade
remotevf [start / stop]
changemode
iqstub [ae / af / awb / iqif / all] [on / off]
mcb [category id] [setting id] [length] [data]
logtest
sas [trigger]

usage: st cap log [command]
st cap log help
display this information
st cap log
dump out capture log.
st cap log off
turn off a7 console
st cap log clear
clear capture log.

usage: st cap path [command]
st cap path dump
dump all registers
st cap path dump ep
dump EP registers
st cap path info
display all information
st cap path info ep
display EP information

usage: st cap back param [param1] [param2]...
[run/stop Command]
st cap back param [run/stop] [still/live/all]
[clean Command]
st cap back param clean [still/live/all]
[show Command]
st cap back param show [still/live/all] [ipc/ldc/rsz/all]
[cnt Command]
st cap back param cnt [display count]
[status Command]
st cap back param status

Parameter names: IPC, LDC, RSZ, etc - dealing with very low level stuff (DMA, R/W, etc)

Various other parameters like:

lcd v0_only/v1_only/g0_only/g1_only/default
smartfilter_test on/off
beautyface_test on/off
panorama_test on/off
highiso on/off
bestface facelist facenum
bestface replace facenum photonum
bestface save
bestface cancel
naejae on/off
preflash on/off
adjust on/off
waterfall on/off
lls on/off
5out on/off
dbg on/off
newbeauty fail/success/done

st cap fenx - used for controlling live view (too long of a usage section)

usage: st cap live [command] [param1] {param2}
start
startPP
startFisheye
stopFisheye
startSSS
stopSSS
iZoom n
rvf
lock
unlock
fade
adjust
change
update
mfzoom 0 - 1 (0:off/1:on)
afmode 0 - 2 (0:enable/1:disable/2:fastAF)
freeze
release
loglevel 0 - 9(0:Nothing-9:Always)
setpath 0 - 2(0:OTF/1:IPCout/2:RawOut/3:Ldc Out/4:120FPS OTF/5:120FPS IPC out
6:120FPS Raw Out/7:120FPS Ldc Out/8:panorama/9:MFZoom)
sd streammode 0 - 14
outputdisplay 0 - 6
mfzoomenable 0 - 1 (0:off/1:on)
focuspeakenable 0 - 1 (0:off/1:on)
sensorframerate 12,15,20,24,25,30,40,50,60,100,120,240
outputframerate 12,15,20,24,25,30,40,50,60,100,120,240
adjustmfzoomrate 0 - 4 (OFF,x3,x5,x8,x1)
pafmode 0 - 1 (0:off/1:on)
dataframerate 12,15,20,24,25,30,40,50,60,100,120,240
smartfiltermode 0 - 16 (15:SmartFilerOFF)
smartautoenable 0 - 1 (0:off/1:on)
fdenable 0 - 1 (0:off/1:on)
ldcenable 0 - 1 (0:off/1:on)
mfassist 0 - 2 (x3,x5,x8)
zoommagnification 0 - 4 (x1,x1.2,x1.4,x1.7,x2.0)
nrmenable 0 - 1 (0:off/1:on)
moviefade 0 - 3 (0:Off,1:In,2:Out,3:InOut)
hdmioutsize 0 - 3 (0:480,1:576,2:720,3:1080)
panoramatype 0 - 1 (0:2D,1:3D)
stoptype 0 - 2 (0:StateDependency ,1:NormalStop,2:ForceStop)
moviemode 0 - 6 (0:UHD/1:UHD_D/2:FHD/3:CINEMA/4:HD/5:VGA/6:QVGA)
startmode 0 - 1 (0:AllPath/1:PPonly)
multiexpo 0 - 3 (0:off/1:on/2:save all/3:result only)
stp 0 - 1 (0:off/1:on)
dump 2 - 5 (cnt)
cleanout (stop/start)
log ([ldc] print)
mvstmp 0 - 2 (0:clear/1:start/2:print)

Service files are everywhere, for example sumps for anything like:
ois_read.csv
ois_centering.csv
result,lens_ois1,lens_ois2,lens_ois3,lens_ois4,lens_ois5,lens_ois6
ois_gyro.csv
GYRO_X,GYRO_Y,GYRO_Z,RESULT

Memory Dump Test
/mnt/mmc/dump_test.txt
/mnt/mmc/dump_rw_test.txt

Then there is focusing:
alt_focus
alt_focus Start Step %d

usage: st cap lens oper_focus [param]
[step]
- division of focus
oper_focus Start
oper_focus Start Step %d

usage: st cap lens [command] [param]
* command list *
[attatch] set attatch flags
[rport] read ports
[log] Lens debug log level set
[general] Show Lens general info
[sdget] Show Lens Specific Data
[pdget] Show Lens Property Data
[zoom] current zoom point Data
[alt_iris] Iris moving test
[oper_iris] Iris operation test
[alt_focus] Focus moving test
[oper_focus] Focus operation test
[focus_pos] Show current focus position
[wport] write ports
[fwupdate] update lens fw
[power] power on, off
[polling] start,stop polling rb,mount
[focus] [near | far] focus move to near or far
[status] Show status of DET, RB, Current state, NextState, Eventflag
[wreg] write spi [Lens to Body]
[spi] select spi mode
[3d] check 3D mode and 3D lens position
[3dmode] 3d status and SW information
[rb] RB status
[trace] display communicate trace
[sync] sync signal on/off
[info] display Lens Information
[af] display af area Information
[getrange] display focus range and iris range
[trace]
[sync]
[info]
[type]
[3dlo]
[3dro]
[state]
[cmd]
[vf_on]
[adj_awb]
[range]
[lensinfo] lens information
[lensproperty] lens property information
[reset] lens reset command
[dis_tmout] lens state time out disable
[lensversion] lens version check in sd card and body
[ifn] [on | off] ifn function on / off
[ifn_en] [6] ifn_enable degree 6
[op_supp] [op code] check operation support
[ctti] send test change_tracking_target_info op
[backlash] get lens backlashn

DP debug console command:
usage : st cap dp [command] [param]
log [on/off]
error [on/off]
warnning [on/off]
normal [on/off]
framerate [on/off]
msg [on/off]
cb [on/off]
3d [on/off]
all [on/off]
set draw box
erase box
panelinit
image
layer [grp/vid] [win0/win1] [on/off]
hdmisize
hdmi
evf
box

 otto k's gear list:otto k's gear list
Canon EOS 600D Samsung NX1000 Samsung NX500 Samsung NX 30mm F2 Pancake Samsung NX 20-50mm F3.5-5.6 ED +6 more
Keyboard shortcuts:
FForum MMy threads