Camera - Ricoh Caplio R7, firmware hack
shot by RR30 after the fix for ERROR 00-00-00 30-01-23, thanks for the little boy to took this shot as RR30 is belong to his toy list since then.
A tech note about the information inside the firmware of the Ricoh Caplio R7 by analyse the firmware (version 1.26) of which provided once you brought the camera, it is available for download from the Ricoh website also. It is declared here without responsibility for any mis-use and risk at your own if any information received from this note below.
31/3/2008
Once download the firmware and decomprssed, two files are complied as vlaunch3 & vlaunch7, they have no file extension, and should be saved into SD card for firmware up-grade purpose. It is not the new stuff since DIY to fix RR30 error 00-00-00 30-01-23, the len stuck and the Ricoh technical support told for firmware update to resolve the problem but no any success. This R7 firmware package has exact file names presented but of course, the file content is different from the RR30 firmware package.
vlaunch7- this file has some string in ASCII format
vlaunch3 - this file has been dissambled to review the available information for any string in ASCII format. Registers of CPU dump, the string table in this firmware, contains the string like "R0 R1... R15", it is promising that a very possible CPU armed inside this camera, an ARM processor of which has 16 registers named from R0 to R15 respectively. It could be a snippet used to dump the CPU status for a debug session.
In case there really is an ARM processor, the vector table could be started from the lowest memory map as 0x00000000, see the reference from below,
http://www.dzkf.cn/html/qianrushixitong/2006/1218/1226_2.html
if vlaunch3 & vlaunch7 does not include any segment for a boot loader, the flash rom inside will has a shadedow area of which is really a part of boot loader, or the ROM does existed for this boot loader, and the initialized CPU will jump into flash rom area for operation.
if vlaunch3 & vlaunch7 does include the segment for a boot loader, the flash rom inside will / may has to be programmed completely whenever a firmware up-grade is taking place, include the boot loader code. the FLASH ROM will maps to 0x0000000 during boot, may or may not re-map after boot. The only left behind, need to know what is the CPU & memory map, it will be able to reverse the firmware completely.
Set the switch to [SCENE] then
holds button [PLAY] & [DISP] for few seconds, will display the list of ERROR HISTORY
holds button [PLAY] & [LEFT] for few seconds, will display the list of SHOT COUNT
holds button [PLAY] & [DOWN] for few seconds, will display the list of FIRMWARE VERSION
holds button [PLAY] & [UP] for few seconds, will display the command [EXECUTE]
holds button [PLAY] & [TIMER] for few seconds, will display the command [INITIALIZE THE SETTING]
