Information about Sony NEX, VG10, Alpha 560, Alpha 580

Hardware architecture

Photos

Lets look chip by chip

Samsung K4X56323PL-8GC6 chip - mobile DDR RAM.

Sony CDX9974GG chip - DFE.

Sony CDX4113GG chip - Audio/Video codec.

SEC K5W1G2GACM-BL60 chip - MLC chip, contains flash and RAM, image processor must be below this chip.

Note: VG10 contains another chip - ORX1G2G-06A.
Most probably VG10 has newer MLC with image processor added to same package.

Fujitsu MB44CO17B chip - DC/DC converter.

Toshiba TMP19A44FDAXBG chip - Main CPU.

Also not shown on photos is ADV7521NKBCBZRL-80 HDMI transmitter.

VG10 also have NN12926A-BB audio/video processor.

You can see how dated is NEX/VG10 design (same design used in SLT, Alphas, similar - in D7000 and K5).
They need Main CPU (Toshiba), DFE, Image processor (by Sony) and Image encoder (also by Sony).
Plus separate DDR and flash. Plus some chips for driving VF. Plus HDMI transmitter.
GH2 has only main LSI, MCP on top and few drivers. Funny.

Service manual for VG10

Sony VG10 video camera shares many parts with NEX compacts.

http://elektrotanya.com/?q=showresult&megnev=sony&megnev2=nex-vg10&kategoria=&kat2=all

Firmware

NEX-5 firmware upgrade is out at

http://support.sony-europe.com/dime/downloads/downloads.aspx?site=odw_ru_RU&f=FW_NEX5_V02&m=NEX-5

If you unpack contents of this exe file, you'll find many files.
Largest one is formware data file: FirmwareData_user_20.10.03.2010062822_205_02_loade r.dat
File looks encrypted.
Header format info: 0x89 0x55 0x46 0x55 0x0D 0x0A 0x1A 0x0A - start signature

Next all data is organized as follows

TypeField
dworddata_size
dwordtoken
bytesdata

Known tokens are : DATV, PROV, UDID, FDAT, DEND

SPUFirmwareUpdater.exe is updater software - it deals with camera.

Checks crc of different firmware parts (reads by 0x2000 parts and calculates CRC32) and sends firmware by small sections. If we'll be lucky, it'll decrypt packets before sending to camera. NEX3 and NEX5 images have many matched parts at the start.

Edit: Looking at upodate in more details tells that it do not perdorm firmware decryption.

Differential analysys

Here is visual differential analysys of NEX5 and NEX3 firmware files:

Note. Differential analysys tool will be released later, see Special tools.

Dumping

If you know programmer model that supports SEC K5W1G2GACM-BL60, contact me.

Linux kernel sources

Sony cameras run on Linux (Toshiba main CPU is for this).

Link to Sony NEX Lunix kernel sources and utilities sources:
http://www.sony.net/Products/Linux/DI/NEX-5.html

If someone will be able to compile and check them it'll be good.

Possible improvements

Cameras already maintain Full HD HDMI output during recording. Opening up regional change (making 25fps capable). And all modes for NEX5 and NEX3 (720p and 1080 respectively can be very useful). Upping bitrate even to 25-28Mbps is very good option too (as Sony AVCHD encoder is very good).

>> Discuss hacks at Personal-View.com


Page last modified on February 11, 2011, at 07:14 AM