HV30 Firmware Analysis

Official Firmware Update

Canon has released an update to version 1.0.1.0.

Where and how to get the firmware and a serial number:

http://nl.canon.be/Support/Consumer_Products/products/camcorders/Digital/HDV_series/HV30.aspx?faqtcmuri=tcm:43-538497&page=1&type=

http://www.dvinfo.net/conf/showthread.php?t=121518

Encryption

The encryption key is the same as for the HF10/100. Firmware decoder [1]

File Structure

The basic firmware update file structure is the same as for the HF10/100, see HF10/100 File Structure.

The differences are:

• 4 bytes at 0x10004, which need to match VEFX
• 2 bytes at 0x10008 (???)

Version 1.0.1.0

This update consists of 1 section only, although it contains code for at least two different targets.

Content Overview

• 0x0 - 0x600000 First and only section, including the first unencrypted 0x10010 bytes
  • 0x200000 MIPS
  • 0x400000 FR71
• 0x2C footer

Interesting Addresses

• 8bit monochromatic bitmaps
  These bitmaps consist of a 2-byte header containing the bitmap width (first byte) and the width that the bitmaps gets stretched to when displayed. The bitmaps are always 18 pixels high and aligned to 2 bytes (probably, can't remember). All fonts are included as well.
  • 0x49EC00 - 0x52719E
• bitmaps of variable size
  There's a second type of bitmap with a 4-byte header, with the first 2 bytes being the bitmap width and the other 2 bytes the bitmap height. There are probably more bitmaps / bitmap sections than listed here, unfortunately it's not one continuous section.
  • 0x35441A to ?? (a few ones) 1byte align
  • 0x35E30A
  • 0x357FAC - 0x3A917F 1byte align (includes e.g. the transition effects animations)

Update Process

The update process is basically the same as the HF10/100 Update Process.

The differences are:

• The filename has to be VEF[0-9].FIM
  • The firmware searches for a file in descending order from 9 to 0. On the HF10/100 its 9 to 1.

Processor and architecture

Fujitsu FR71 core

---

MB8AA101

http://www.compitech.ru/html.cgi/arhiv/04_07/stat_fuj2.htm

FR FAMILY INSTRUCTION MANUAL http://edevice.fujitsu.com/fj/MANUAL/MANUALp/en-pdf/CM71-00101-5E.pdf

MIPS core

---

MIPS INSTRUCTION MANUAL http://www.cs.tau.ac.il/~afek/MipsInstructionSetReference.pdf

MIPS16 EXTENSION MANUAL http://www.weblearn.hs-bremen.de/risse/RST/docs/MIPS/MD00076-2B-MIPS1632-AFP-00.96.pdf

CODE/DATA location

MIPS core:

0xBFA00000 - 0xBFBFFFFF is the lower 2MB block of DATA/CODE where the first block (0x000000 - 0x200000) of the FW update file is mapped to.

0xBFC00000 - 0xBFDFFFFF is another block of 2MB ROM containing additional code/data for the MIPS core, not present in the FW update file; this block also contains MIPS16 code, which means the MIPS core also supports the MIPS16 instruction set.

FR71 core:

0x04000000 - 0x04BFFFFF is the main 4MB block of DATA/CODE where the second block (0x200000 - 0x600000) of the FW update file is mapped to.

RAM location

MIPS core:

FR71 core:

0x00000000 - 0x000FFFFF RAM block where part of the ROM code is copied to

0x002C0000 - 0x002DFFFF RAM block where part of the ROM code is copied to

0x00400000 - 0x0047FFFF SRAM

Special locations

MIPS core:

FR71 core:

0x01723000 - RAM

0x01725E00 - ???????? RAM: global data for IEEE 1394 (Firewire) communication

0x01725ED4 - 0x01725FA4 RAM: IEEE 1394 Control ROM Storage

0x01900000 - 0x0193FFFF RAM: Framebuffer 1

0x01940000 - 0x0197FFFF RAM: Framebuffer 2

0x021E0000 - ???????? MMIO

0x021F2000 - ???????? MMIO

0x05000000 - ???????? MMIO Firewire port controls

Things TODO

• many