ma1co / Sony-PMCA-RE

Reverse Engineering Sony Digital Cameras
MIT License
2.1k stars 235 forks source link

Clean HDMI on NEX-6 #249

Open ghost opened 3 years ago

ghost commented 3 years ago

Is there a Clean HDMI-out app? I heard of this project from people trying to get clean HDMI out of their NEX-6 cameras (for use on pc's), however, I can't seem to find it anywhere.

Not here: https://sony-pmca.appspot.com/apps I don't see it mentioned anywhere else. This seems to be it (I think): https://github.com/lucaspape/PMCA-CleanHDMI from @lucaspape But there is no APK in the release section, and the repository has no "issues" section to post and ask the developer. I have no clue how to get that to install on my camera.

lucasl0st commented 3 years ago

I don’t have an apk uploaded because you shouldn’t use my solution, the quality is not 1080p.

The solution here works perfectly: https://github.com/ma1co/OpenMemories-Tweak/issues/70#issuecomment-701657731

You should be able to enter the commands using telnet and after a reboot (and changing the camera mode to video) you should be able to get good quality clean HDMI video.

ghost commented 3 years ago

I don’t have an apk uploaded because you shouldn’t use my solution, the quality is not 1080p.

The solution here works perfectly: ma1co/OpenMemories-Tweak#70 (comment)

You should be able to enter the commands using telnet and after a reboot (and changing the camera mode to video) you should be able to get good quality clean HDMI video.

But it seems that method does not work on NEX-6 https://github.com/ma1co/OpenMemories-Tweak/issues/70#issuecomment-846250580

lucasl0st commented 3 years ago

I uploaded an APK now here: https://github.com/lucaspape/PMCA-CleanHDMI/releases/tag/1.0

This is just basically a camera preview with all the visual stuff missing, its not good because the quality is bad and I cant figure out how to change ISO/SP/AP because if I call the functions just nothing at all happens.

ghost commented 3 years ago

I uploaded an APK now here: https://github.com/lucaspape/PMCA-CleanHDMI/releases/tag/1.0

This is just basically a camera preview with all the visual stuff missing, its not good because the quality is bad and I cant figure out how to change ISO/SP/AP because if I call the functions just nothing at all happens.

I see, it seems the problem is not easy to solve (yet) but I do really appreciate your work. I just tested the apk, when running it the screen goes black for a short while, then comes back without any of the OSD, but then after like 30seconds it seems the app craches and the camera reverts back to regular camera mode (with everything showing). While the app is working (and OSD is hidden) the HDMI output is dead (only shows on camera's own display, nothing goes out HDMI).

I feel like there still should be a way to get clean HDMI out of the NEX-6.

We know it has Display info presets (big font, histogram, level, Display all, etc). Maybe we can overwrite one of these presets and "empty" it to at lease get rid of OSD that overlaps the video. As for effects and noise canceling, those go on when the camera is recording video, so maybe we can trigger the movie recording mode without it saving the recording to a file? Setting the aspect ratio in image settings to 16:9 and in setup setting "Wide image" to display "full screen" gets rid of the vertical black back on the right of the output. Also, when initializing movie record mode, the OSD temporarily disappears and reappears. Maybe this event can be frozen midway through before the record mode OSD is rendered?

There's also the possibility that the NEX-6 uses a value other than 0x01070a47 for displaying OSD overlays.

Maybe if we can get some logs out of the camera during OSD preset switching, we can find out where and how it controls them. I don't know how someone found out about 0x01070a47 working for the other cameras, but maybe we can use the same method they used, but instead on a NEX-6.

mungewell commented 3 years ago

@horusra How far down the path of wild speculation do you want to go???

I had noted on https://github.com/ma1co/OpenMemories-Tweak/issues/25 that some of the '.so' libs appear to have Backup key addresses

    1b84:       0a55            lsrs    r5, r2, #9
    1b86:       0107            lsls    r7, r0, #4
    1b88:       088e            lsrs    r6, r1, #2   <----- hey, we know that 0x0107088e is a key!!
    1b8a:       0107            lsls    r7, r0, #4

It appears that viewUnified4.so has a lot of these. So I extracted and sorted them, and then matched them up to keys in the Backup.bin file(s).

Comparing with a5000 it seems that the Nex-6 does NOT reference 0x01070a47, in fact that whole section is missing suggesting that Sony switched up they way they store that information (if that functionality previously existed).

But with some brute forcing of the keys that DO exist you might be able to track something down. If you make the assumption that it's 1 byte key, and that it's factory set to 0x01, you can try changing various keys to see what happens.

nex6_view4_targets.txt a5000_view4_targets.txt

Screenshot_2021-07-21_18-32-25

ghost commented 3 years ago

@mungewell How do you suggest I go about doing this (to be honest it's a bit over my head) Is there a way to change these keys without making them permanent or without bricking the camera? Can we maybe use adb to create a full backup of the camera to restore if it gets bricked?

Is there a way to have an app just cycle through these keys on startup and show the key that was change previously or something? (since the effect is only shown after restart)

Or can we debug on runtime (or read logs or something) so we can see what keys change when screen display settings are changed?

Going through all these keys trying to figure out which ones disables OSD on HDMI out is doable, but I wouldn't know what to do if/when it goes wrong. Also, do you yourself have access to a NEX-6?

mungewell commented 3 years ago

Firstly, the camera is good at protecting itself. The factory defaults are stored within the FW installer, and once 'on-camera' it will maintain a 'reset' value to re-apply when camera is factory reset. I have not (yet) had a problem I couldn't fix with factory reset, but normally I just have to set a specific key back to it's original setting.

Setting the keys to custom value can be done 2 ways:

  1. Install the Tweak application - which is awesome anyhow. The you can enable the WiFi and then enable Telnet, after that you can telnet into the camera to get a shell and use the 'bk.elf' command to read/set keys.
  2. PCMA-Console Python script is normally used to install Tweak, but itself contains a shell mode. This again gives you the ability to run 'bk.elf', but does so when the camera is in an installer more - which means that less interactive to change a key and see the result.

You can also use to PCMA-Console to grab the whole Backup.bin file if you need to take a local copy.

Making the assumptions about '1 byte long set to 0x01' gives you 28 keys to check, some of these are probably already known... I don't have a Nex6 but I imagine that it wouldn't take too long to cycle through them.

bk.elf r 0x0107xxxx - read key to confirm it's original value
bk.elf w 0x0107xxxx 00 - write to 0 and look for effect on monitor
bk,elf w 0x0107xxxx yy - either rejoice, or set the key back to it's original value
repeat for all keys. :-)

You are looking for a very specific behavior, with an external monitor hooked up you should know the result almost immediately.

My next camera addition needs a mic, so looking for Nex7, a6300 or a6500 at a good price. May give in to the lure of full frame ;-)

Good luck, Simon

ghost commented 3 years ago

@mungewell Thanks for the instruction! Yes, I can hook my NEX-6 to my monitor and use PCMA-Console to change keys and check what happen. That should take effect instantly without restarting (I think). Regarding the 28 keys, is this the list? I only found 17 searching nex6_view4_targets.txt for lines that included size=0x0001, attr=0x01 image I'll also look into how to backup and restore things using PCMA-Console

mungewell commented 3 years ago

@horusra The attr is NOT the value of the key, I believe it is a bit-field describing how to handle the key (that would be a @ma1co question).

id=0x0107009e, size=0x0001, attr=0x60:
  01

It's not that key BTW... I think that one is 'AVCHD framerate', 0x01 = i60 or i50 (depending on NTSC/PAL operation). 0x03 is 24fps if you want to go cinematic.

Fr0zenfire commented 3 years ago

@mungewell Thanks for the instruction! Yes, I can hook my NEX-6 to my monitor and use PCMA-Console to change keys and check what happen. That should take effect instantly without restarting (I think). Regarding the 28 keys, is this the list? I only found 17 searching nex6_view4_targets.txt for lines that included size=0x0001, attr=0x01 image I'll also look into how to backup and restore things using PCMA-Console

Did you get anything useful from your experimentation? Just curious

ghost commented 3 years ago

@mungewell Thanks for the instruction! Yes, I can hook my NEX-6 to my monitor and use PCMA-Console to change keys and check what happen. That should take effect instantly without restarting (I think). Regarding the 28 keys, is this the list? I only found 17 searching nex6_view4_targets.txt for lines that included size=0x0001, attr=0x01 image I'll also look into how to backup and restore things using PCMA-Console

Did you get anything useful from your experimentation? Just curious

Not really, even though "size" of some keys is 1, they still have weird settings, for example:

/ # bk.elf r 0x01070019
id:01070019 size:1 data:
0B

/ # bk.elf r 0x01070023
id:01070023 size:1 data:
FF

/ # bk.elf r 0x0107067b
id:0107067b size:1 data:
0B

so I don't really know what to do with these

a couple can't be written to:

/ # bk.elf r 0x01070148
id:01070148 size:1 data:
01,
/ # bk.elf w 0x01070148 00
id:01070148 size:1 data:00,
write error

/ # bk.elf r 0x0107034a
id:0107034a size:1 data:
10,
/ # bk.elf w 0x0107034a 00
id:0107034a size:1 data:00,
write error

/ # bk.elf r 0x010703fd
id:010703fd size:1 data:
01,
/ # bk.elf w 0x010703fd 00
id:010703fd size:1 data:00,
write error

/ # bk.elf r 0x010709ed
id:010709ed size:1 data:
01,
/ # bk.elf w 0x010709ed 00
id:010709ed size:1 data:00,
write error

/ # bk.elf r 0x01070925
id:01070925 size:1 data:
01,
/ # bk.elf w 0x01070925 00
id:01070925 size:1 data:00,
write error

I've gone through most of the key, and haven't once noticed any change at all while using telnet with the camera hooked up to my monitor

dired commented 2 years ago

Hey, I just published a "new" PMCA that I called PMCA-HDMICam. It forks from the current master and simply disables the "Camera" bar. Not sure if this is any more helpful than what @lucaspape did (i.e. the app not crashing), - I for myself noticed some different bevahiour as I layed out in the repo's readme. Anyway you can directly try the "new" apk from here

GreyAsteroid commented 1 year ago

If anyone here is still interested, the solution posted here works for the NEX-5R/N for clean 1080p60 HDMI. I would assume this also works for the NEX-6 but it needs to be tested.

romanctp commented 2 months ago

Hey, I just published a "new" PMCA that I called PMCA-HDMICam. It forks from the current master and simply disables the "Camera" bar. Not sure if this is any more helpful than what @lucaspape did (i.e. the app not crashing), - I for myself noticed some different bevahiour as I layed out in the repo's readme. Anyway you can directly try the "new" apk from here

You're awesome! this worked on my Nex-6. Quick and easy. Thank you!

romanctp commented 2 months ago

@dired one question though... on camera, when I turn off face tracking, it turns off, but on HDMI, even though it's OFF, it still has that blue tracking box on a person's face... any idea how to turn that one off? thanks

SOLUTION FOUND: it was Windows 10 Camera app that adds it!! feel stupid lol