ma1co / Sony-PMCA-RE

Reverse Engineering Sony Digital Cameras
MIT License
2.07k stars 229 forks source link

Reverse Engineering Sony Digital Cameras

This tool interfaces with Sony digital cameras through USB. It allows to tweak settings, dump firmware, and in some cases install custom Android apps.

Installation

There are two binaries:

Windows

The application should work fine on Windows using the operating system's mass storage and MTP USB drivers.

Download the latest stable release or the newest development build.

macOS

macOS binaries are also distributed, but less tested than the Windows equivalents. Getting the USB drivers to work may require some fiddling. To communicate with cameras in mass storage mode, Sony's Camera Driver has to be installed. Make sure to close all applications which could access USB drivers, including Photos, Dropbox and Google Drive.

The latest release binaries can be found in the release section.

Linux

The application uses Python 3 and should work fine on Linux using libusb drivers.

Clone or download this repository, then run the following commands:

pip install -r requirements.txt  # to install the dependencies
./pmca-console.py  # for the command line application
./pmca-gui.py  # for the gui application

Usage

There are three main modes of interfacing with a camera:

App Installer

If the camera supports PlayMemories Camera Apps (PMCA), it is possible to install custom Android apps using this tool. A list of supported cameras can be found here.

It is recommended to install the OpenMemories: Tweak app. This app allows to tweak settings and to start telnet and adb servers to execute code on the system.

Other apps are available. A list can be found here.

There are two ways to install apps:

Firmware Updater

Sony cameras can boot from a secondary partition for firmware updates. Using a custom firmware file, we can execute code in this mode. Note that the camera firmware itself remains untouched. The firmware update process is only used to execute custom code.

This mode does not require any special drivers, the operating system's mass storage USB driver is enough.

A list of supported camera models can be found here. Devices based on the CXD90045 and CXD90057 architectures are not compatible, since their firmware is cryptographically signed.

There are two ways to use this:

Note that this requires rebooting the camera to firmware update mode. You will be guided through this process.

Service Mode

Sony cameras have a USB mode called senser mode, which is used during servicing for calibration and other things. It can also be used to execute code on the running system.

Service mode has the best camera compatibility, but requires custom USB drivers.

It is currently only supported in the command line application:

Windows Drivers

To use service mode on Windows, custom drivers have to be installed using Zadig:

To be able to use the camera normally again, the libusb drivers have to be uninstalled in device manager.

Is it safe?

This is an experiment in a very early stage. All information has been found through reverse engineering. Even though everything worked fine for our developers, it could cause harm to your hardware. If you break your camera, you get to keep both pieces. We won't take any responsibility.

What about custom apps?

It is possible to develop custom Android apps for supported cameras. Keep in mind that they should be compatible with Android 2.3.7. Debug and release certificates are accepted by the camera. See PMCADemo for a demo app.

There are a few special Sony APIs which allow you to take advantage of the features of your camera. They can be used through OpenMemories: Framework.

Special thanks

Without the work done by the people at nex-hack, this wouldn't have been possible. Thanks a lot!