Sigma has released 8 versions of the SD14 firmware so far Ver 1.01 -> ver1.07. Ver 1.07 actually has two versions with it, 1.07_0 and 1.07_1. Once upon a time you could download all of them from Sigma’s website, though it looks like the early ones are not available any more. Good thing I kept a copy laying around.

The first and easiest thing to do is to open them with a hex editor and see whats inside. Perhaps we’ll get lucky and something will be readable. I used Okteta or KHexEdit, depending on which machine I’m on (I use linux, Fedora usually)

Sure enough, the folks at Sigma were kind enough to leave much of the file readable. There is a wealth of debug information in the files, for example, s14v101.bin opens with the following text:

SIGMA.COSD14....1.01............1.00.0.008..........20070411....

Hm, looks like this is Sigma Co’s SD14 firmware version 1.01 made on 04-11-2007 Easy enough. Surprising, a lot of information can be gathered just by looking at the firmware like this. as I noted here, the firmware contains a lot of debug information, in particular I found this to be interesting:

Specify which steps to skip in the Image Processing pipeline. 

FLAGS: 

Skip AutoAdjust = 0x00000001 

Skip LinLUT = 0x00000002 

Skip ColumnFilter = 0x00000004 

Skip ColumnFilterSegCapacitance = 0x00000008 

Skip SpatialGain = 0x00000010 

Skip ISOGain = 0x00000020 

Skip DriftCorrection = 0x00000040 

Skip FlareCorrection = 0x00000080 

Skip SatDetect = 0x00000100 

Skip BadPix = 0x00000200 

Skip RedSharp = 0x00000400 

Skip NeutHilitePixel = 0x00000800 

Skip NeutHiliteNeighbors = 0x00001000 

Skip NeutHiliteSmoothNeighbors = 0x00002000 

Skip Despeckle = 0x00004000 

Skip SpatialDQ = 0x00008000 

Skip ChromaBlur = 0x00010000 

Skip ColorDQ = 0x00020000 

Skip CorrectionMatrix = 0x00040000 

Skip ToneGamma = 0x00080000 

Skip Sharpen = 0x00100000  

These appear to be the descrete steps in the image processing pipeline. You can find this at offset 0×0AA846 in s14101.bin. Boy, I wonder what algorithms are going on behind the scenes there

So, as I said, much can be learned just by opening up the firmware in a hex editor and poking around.Thats what I’ll start off with. Open the firmware and see if there is anything I can pick out.

Now, of course many of these issues have been fixed, the Photo Pro software is now based off the excellent 2.x version as opposed to 3.0 (I’ve got some details on the company behind the 3.0 mess), and the firmware releases have seemed to subside. Perhaps they are now getting the bugs worked out of the camera.

The firmware however intrigued me, never before had sigma done this, released so many firmware versions for a camera. Recalling from memory, the SD9 had 1 update and the SD10 didn’t have any. If I have this wrong I’m sure someone will be so kind as to correct me. With all these versions of firmware sitting around out there, I got to thinking, I wonder whats in there.

It dawned on me that even though I have an engineering background, and at least some experience with embedded device programming (an old school project on a PPC 405GP) I really have no idea how to reverse engineer firmware.

You hear about it all the time, these l33t h4×0r$ reverse engineering DVD encryption, great work has been done hacking the low end Canon Powershots, and even phones getting a workover.

How do these people do it? How is the firmware decoded, how do they reverse engineer it? What does the firmware even look like? I decided that since the nice folks at Sigma gave us so many firmware versions, and even an excellent changelog between them, I figure that will a little time and effort, I could probably at least figure out what the firmware looks like, how to decode it, and hopefully how to change it and re-encode it. This would motivate me to buy an SD14!

Why? Because I’m curious. I like to make my own things. I like to understand how something works from the ground up. There are some features I want, and I don’t particularly think that Sigma is going to listen to me much (I tried once - didn’t happen) . I also think there is a good chance that I can actually do a better job.

So, what I’m going to do here is chronicle my adventure in attempting to become some elite firmware hacker. I’ll tell you all I know, and maybe, if anyone is paying attention, someone else might find it interesting.

Matt

A couple things to note:

I turn off course, fine, light and dark calibration. I use the alt calibration option. I think the per-pixel calibration that is stored in DRAM during the alt calibration is a bit off for the pixles near the top of the image. for example, see this image:

You can see the light band of pixels at the top of the image. This gets significantly better when stiwching from grayscale to color images. The color images come out very very grey. There are two things that I want to look into further:

• Better understanding/knowledge of the calibration. I think this will significantly improve image quality.
• Ensure that I’m operating the scanner ship in 14 bit mode, and that I’m getting out all 14 bits. If the chip is in 14 bit mode then there is no calibration data stored in DRAM (the space is used for pixel data.

Matt