Getting started?

[cnlohr]

Does anyone have any advice on how to get started with this toolset? I'm hoping to corrupt the on-screen stuff on my NEX-5N to get clean HDMI in record mode, i.e. just make all the fonts totally transparent.

[cnlohr]

Just what I've found so far:

This just works on Linux (including Ubuntu for Windows (Windows Subsystem Linux)) you just say 'make'

It then pops out:

/mnt/c/projects/nex-hack/bin/fwtool v0.6final (2013-08-07)
info at http://www.nex-hack.info

BE WARNED! This is unfinished and/or incomplete and/or untested code!
USE AT YOUR OWN RISK!

usage : /mnt/c/projects/nex-hack/bin/fwtool [-<mode>] [-<options>] file or directory

  mode :
    -x  eXtract firmware (default mode)
    -c  Create firmware (only rebuild FDAT, reencrypt&rebuild fwdata to date)
    -m  Modify firmware (not implemented yet)
    -h  show extended Help
    -t  show Todo list
  options :
    -d  Destination directory (eXtract only, optional)
    -i  set mInor version number in create or modify mode (default increment)
    -j  set maJor version number in create or modify mode (default leave)
    -l  Level to extract to or create from (default 127)

[cnlohr]

Unpacking works gloriously! I found the stuff I wanted to change rather quickly... But repacking... not so much.

/mnt/c/projects/nex-hack/bin/fwtool  -c Update_NEX5NV102-cnl.exe -d Update_NEX5n
V102
/mnt/c/projects/nex-hack/bin/fwtool v0.6final (2013-08-07)
info at http://www.nex-hack.info

BE WARNED! This is unfinished and/or incomplete and/or untested code!
USE AT YOUR OWN RISK!

destination directory makes no sense in create mode, ignored!
create: only repacking of level3 '*.mod.fsimg' files, encryption,
        and repacking to FirmwareData_*.dat implemented to date!

=== Repack '.mod.fsimg' files from 'Update_NEX5nV102/nexhack/level3' ===
===  to 'Update_NEX5nV102/nexhack/level2/FDAT_repack.bin' ===

fdat_repack(): Computed filesize '512' of 'FDAT_repack.bin' much to small!
fdat_repack() returned error!```

[cnlohr]

Aah, so you have to put copies of your files in the level3 folder, such that it looks like this:

Holy cow, this tool works (at least with an unmodified binary)
/mnt/c/projects/nex-hack/bin/fwtool  -c Update_NEX5nV102
/mnt/c/projects/nex-hack/bin/fwtool v0.6final (2013-08-07)
info at http://www.nex-hack.info

BE WARNED! This is unfinished and/or incomplete and/or untested code!
USE AT YOUR OWN RISK!

create: only repacking of level3 '*.mod.fsimg' files, encryption,
        and repacking to FirmwareData_*.dat implemented to date!

=== Repack '.mod.fsimg' files from 'Update_NEX5nV102/nexhack/level3' ===
===  to 'Update_NEX5nV102/nexhack/level2/FDAT_repack.bin' ===

Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs00.mod.fsimg
   126976
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs01.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs02.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs03.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs04.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs05.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs06.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs07.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs08.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs09.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs10.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs11.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs12.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs13.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs14.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs15.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs16.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs17.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs18.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs19.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs20.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs21.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs22.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs23.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs24.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs25.mod.fsimg
Opening: Update_NEX5nV102/nexhack/level3/FDAT_fs26.mod.fsimg
===   Model 'NEX-5N' set to version '1.04'   ===

=== Encrypt 'Update_NEX5nV102/nexhack/level2/FDAT_repack.bin' file ===
===  to 'Update_NEX5nV102/nexhack/level2/FDAT_reencrypt.bin' ===
===  with method defined by'Update_NEX5nV102/nexhack/level2/fwd_FDAT_chunk.DONT_TOUCH' ===

=== Repack 'Update_NEX5nV102/nexhack/level2/FDAT_reencrypt.bin' file ===
===  to 'Update_NEX5nV102/nexhack/level2' ===

=== Moved modified Firmware 'Update_NEX5nV102/nexhack/level2/FirmwareData_NexHack.dat' file ===
===  to 'Update_NEX5nV102/Resource/FirmwareData_NexHack.dat' ===
===  saving original Firmware to 'Update_NEX5nV102/Resource/FirmwareData_Original.dat.save' ===

Success!

And it flashed onto my device... Still...

One problem I am running into is that I need to modify the root filesystem and put it back into nflasha8... But I can't find any tool to convert the disk image back to put it in the .tar ... hmm ...

[cnlohr]

I guess I'll try manually editing...

cnlohr@DESKTOP-6VDBGQI:/mnt/c/NEX-HACK/Update_NEX5nV102/nexhack/level3$ ls
FDAT_fs00.fsimg  FDAT_fs00.mod.fsimg  FDAT_fw.mod.tar  FDAT_fw.tar  FDAT_header.DONT_TOUCH  FDAT_header.mod.DONT_TOUCH
cnlohr@DESKTOP-6VDBGQI:/mnt/c/NEX-HACK/Update_NEX5nV102/nexhack/level3$ mkdir fdat_fw
cnlohr@DESKTOP-6VDBGQI:/mnt/c/NEX-HACK/Update_NEX5nV102/nexhack/level3$ cd fdat_fw/
cnlohr@DESKTOP-6VDBGQI:/mnt/c/NEX-HACK/Update_NEX5nV102/nexhack/level3/fdat_fw$ tar xvfp ..\FDAT_fw.mod.tar

It untars to the current folder, so retaring should be possible. Now, just need to figure out how to modify nflasha8 hmm ... also hnnnggggg there is some sort of checksum protection on the file.

$ cat 0701_part_image_sum/part_image.sum
5,ffffffff,00000000,000001fd,0000df1f,000003e8,root,root,-1,-1,dev,
0,7b446d60,00763dc4,000001b4,0000df1f,000003e8,root,root,-1,-1,dev/nflasha3,
0,8daf3dab,018990b9,000001b4,0000df1f,000003e8,root,root,-1,-1,dev/nflasha8,

Oh, thank goodness.

8daf3dab

The second field is size. Which I won't need to change.

WRONG! According to the code:

// "Second wave" firmware contains "LZPT" image files:
// "0700_part_image/dev/nflasha3" (LZPT-compressed FAT filesystem),
// "0700_part_image/dev/nflasha8" (LZPT-compressed ext2 filesystem).
// The nex5r/nex6 and later may contain more "LZPT" images:

NOOOOOOOOOO

there is a lzpt_decompress but no a lzpt_compress :'(

[cnlohr]

Ok, forked the repo here: https://github.com/cnlohr/nex-hack . Hacked in new executable lzpt_writer but for some reason my images are much smaller than the original ones. When I try decompressing them, I get error compress method 78 hmm... TIL there is a difference between DEFLATE and LZ77. I feel like I learned this in college and promptly forgot.

Turns out Sony does publish their lz77 deflate algorithm on their site under the linux GPL disclosure. This does not work the way you would expect, and i am worried it may cause problems. The algorithm cannot take 64kB blocks as it's input. I've tried slicing it some weird ways in my repo, and eventually I got something that may be close enough, since nex-hack can decode it.

cnlohr@DESKTOP-6VDBGQI:/mnt/c/NEX-HACK/Update_NEX5nV102/nexhack/level3$ /mnt/c/projects/nex-hack/bin/lzpt_writer -i ../level5/nflasha8_usr_ext2.fsimg -o /mnt/c/temp/fdat_fw/0700_part_image/dev/nflasha8 does indeed seem to make valid disk images. I think I need to actually boot into Linux to fix up the .tar file.

[cnlohr]

Aaaaand I bricked it. It's in a reboot loop. It shows the image briefly before rebooting. Also, I had a number of changes I made to the filesystem. Foolishly I think one of the things I touched may have been the updater itself.

Anyone know if there's some way to force a recovery mode?

It looks like if I hadn't just corrupted the location of the font but actually let it load it may have been OK. As it stands, it looks like when anything that uses the font tries, it fails and causes a reboot.

[cnlohr]

Ok, so by both using my tool and corrupting the fonts, the camera gets stuck in an interminable boot loop. I don't think I have any way out :(. So this is the end of the line for me. Only use my tool if you don't care about the camera.

[FranzWegner]

Too bad, man :(
I was looking to achieve the exact same thing with the Nex 5N.

[cnlohr]

Chances are you could get it to work. I actually bought another few random NEX's off ebay used. I think my issue was by deleting the file, it caused the system to crash, and I deleted the font from something that started at start, so I couldn't ever get it back into the bootloader.