Camera Hacker

: :

Add Comment | Related Links | TrackBack
Related Content

Ricoh R7 - possible FW hack for RAW

Hi folks,

Few days ago I examined the Ricoh R7 firmware file (available here ) and found an interesting information inside. It's a known fact that each camera is capable of RAW writing. But many of them don't have the RAW writing implemented or just disabled in menu. And according of my below find, it's more than possible that the Ricoh R7 have just disabled RAW menu/output. This is what I find in FW file:

-> [NG] RAW�t��
-> [NG] �e��s�� 3264�~2448
-> [NG] �e��s�� 3264�~2176
-> [NG] �e��s�� 2592�~1944
-> [NG] �e��s�� 2048�~1536
-> [NG] �e��s�� 1280�~960
-> [NG] �e��s�� 640�~480

All lines under the "RAW" represent JPEG output and are visible in camera menu. Well, not exactly in this form. In the camera menu it's listed like this: F3264, F3:2, N2592,...

What do you think guys? Is there any experienced FW hacker willing to look at this?
Tue, 18 Mar 2008 13:25:55 +0000

That's very interesting, indeed. So is the firmware in non-compressed and non-encrypted format? What exactly is in the camera menu?

One thing you might consider doing is to obtain the Ricoh GR Digital firmware and compare to it. Because it supports RAW from the factory, maybe you can see a difference and an easy modification to the Ricoh R7 firmware.

Chieh Cheng
Tue, 18 Mar 2008 17:37:25 +0000

Well, the firmware file seems to be un-encrypted. At least some of its parts? Knowledgeable people can clearly recognize where starts the FW resources (menu strings, images, sounds, etc..) and some parts of the code are visible too. I already checked the GRD/GRD2 and GX100 FW and these R7 strings are not in these firmwares.

My guess is that these strings I found in R7 FW may be a part of the ifdef, which is simply not required in GRD/GX100 FW, because of native RAW support in these cameras? Who knows? But the truth is that some parts of the Ricoh FW are "easily" readable. Unfortunately, I'm not a FW hacking expert ;)
Tue, 18 Mar 2008 21:25:48 +0000

Here is what the actual menu looks like. Interesting thing is that I don't see the 'F', the 'N', "F3:2", "(8M)", and etc. in the vlaunch3 firmware.

Attached Image:

Pic Quality Size Menu.png

Chieh Cheng
Wed, 19 Mar 2008 08:02:35 +0000

For those of you without an UNIX operating system, attached is the "strings" output of vlaunch3. It basically contains all of the readable text in vlaunch3.

Attached File: vlaunch3 strings output.txt (144 KB)

Chieh Cheng
Wed, 19 Mar 2008 08:04:34 +0000

Add Comment | Related Links | TrackBack
Related Content

Did your message disappear? Read the Forums FAQ.

Add Comment

Spam Control | * indicates required field
Your Name: *
Remember Me!
Comment: *
File attachment is optional. Please do not attach a file to your submission unless it is relevent.
Attach File:
(20 MB Max)
Spam Protection: * Answer of 0 + 9?
Click button only once, please!


TrackBack only accepted from WebSite-X Suite web sites. Do not submit TrackBacks from other sites.

Send Ping | TrackBack URL | Spam Control

No TrackBacks yet. TrackBack can be used to link this thread to your weblog, or link your weblog to this thread. In addition, TrackBack can be used as a form of remote commenting. Rather than posting the comment directly on this thread, you can posts it on your own weblog. Then have your weblog sends a TrackBack ping to the TrackBack URL, so that your post would show up here.

Messages, files, and images copyright by respective owners.