With the three new sections decoded and a change I’ve made to the sections.txt file, I figure its time to share the code with whomever wants it. The updates in this version are:

• Parses CMbP Sections
• Parses CMbH Sections
• Parses CMbT Sections
• Adds support for identifying section by unique ID in secitons.txt
• Drops support for counting section occurrences in sections.txt
• Lots of ugly unformatted output

To specify the identifier for a section, add the integer representation for the identifier after the section name in sections.txt. If you look at the sections.txt file included below, you’ll see a ID specified for the FBIN secton. This is to help the script identify sections for now, untill all the sections are IDed and parseable. The string “FBIN “occurs in several places in the file though there is only one occurace of FBIN that represents a section identifier. Hence, the support for including a section identifier (which is the 4 bytes following the section name)

You can download the new script here.

Categories: SD14 Firmware Hacking
1 Comment »

So, the CMbT section is pretty easy as well. The section is basically comprised of a Title or variable name string and then the value. It appears that these are all some sort of test stings. There is one interesting lesson learned from CMbT sections. If you recall, in my post about FBIN section, it looked like FBIN was part of a CMbT section. We’ll look a little closer, but first the layout for the CMbT section:

CMbT Section:
The following is given in order of occurance
Length    Description
0×04        Section Identifier (= CMbT)
0×04        Unknown (Section Version? =0×00 01 00 00 could be minor/major)
0×04        Section Length
0×04         Unknown
0×04        Unknown (possibly related to overall string length? its close)
Variable    Title String.
0×04        The string length
Variable    the string

The title string appears to represent the name of a variable and the string appears to be the value of that variable. There are very few of these CMbT sections, and the text in each indicates that these are some sort of test strings. Here is a list of the variable/value pairs:

CamsettingsInfo: Camsettings-F13-SD14-PP
CalibrationInfo: This is a sample calibration camfile, used for debugging SD7 cameras. In production cameras (and ones which have really been calibrated), it will contain more interesting data specific to each camera.
ColorspaceTestText:      Colorspace is sRGB!
ContentSummary:  Sample Calibration for 3rdES SD7
ColorspaceTestText:      Colorspace is sRGB-Enhanced!
ColorspaceTestText:      Colorspace is AdobeRGB!

Now, lets take a closer look at one CMbT section, again this is in the s14v101.bin file. The section begins at 0×048c30:

0004:8C30 | 43 4D 62 54  00 00 01 00  4C 00 00 00  14 00 00 00 | CMbT....L.......

0004:8C40 | 28 00 00 00  43 6F 6C 6F  72 73 70 61  63 65 54 65 | (...ColorspaceTe

0004:8C50 | 73 74 54 65  78 74 00 00  1C 00 00 00  43 6F 6C 6F | stText......Colo

0004:8C60 | 72 73 70 61  63 65 20 69  73 20 73 52  47 42 2D 45 | rspace is sRGB-E

0004:8C70 | 6E 68 61 6E  63 65 64 21  00 00 00 00  46 42 49 4E | nhanced!....FBIN

0004:8C80 | 02 00 01 00  18 00 00 00  2E 4F AE B1  0E 00 00 00 | .........O®±....

In red is the section length = 0×4c. Adding this to the position of the start of the section 0×048C30 + 0×4C = 0×47C7C. This means the values in blue are not part of the CMbT section! FBIN is its own section, we can add this to the sections.txt file.

So, it appears that these are test texts, but we did learn that FBIN is its own section. As we saw before, the FBIN section contains the Xilinx bit file that describes the programming of the FPGA.

Categories: SD14 Firmware Hacking
No Comments »