Comments on: Ricoh Theta S Updater and Firmware Analysis

By: crypto512

crypto512 — Fri, 23 Sep 2016 22:20:17 +0000

Found my decoder here; will normally works will all Ricoh firmware.
https://github.com/crypto512/ricohdec

By: Gi Pi

Gi Pi — Sun, 04 Sep 2016 09:02:02 +0000

Indeed some files are not updated but I tried ThetaS-firmware-opening.ipynb (changing the firmware filename) and I obtained a new file with a lot of readable strings like @0x0011d1d4

TOPPERS/ASP Kernel Release %d.%X.%d for CRYSTAL(ARM946) (Jul 4 2016, 09:49:25)
Copyright (C) 2000-2003 by Embedded and Real-Time Systems Laboratory
Toyohashi Univ. of Technology, JAPAN
Copyright (C) 2004-2014 by Embedded and Real-Time Systems Laboratory
Graduate School of Information Science, Nagoya Univ., JAPAN

The algorithm is not perfect, some strings have the case flipped, An xml file exists at 0x2ce85a but after some tags become garbage.

By: Matthew Petroff

Matthew Petroff — Sat, 03 Sep 2016 19:10:17 +0000

In reply to Gi Pi. I had tried to find previous work on Ricoh's firmware but was unsuccessful. That repository looks quite interesting, but, sadly, there's no documentation, and I'm getting errors when I try to run some of the notebooks.

By: Gi Pi

Gi Pi — Sat, 03 Sep 2016 17:26:31 +0000

Maybe I can help you: I read your post and I get really interested to decode the firmware: looking at the data seems obvious that it’s neither (block) encrypted neither compressed since there are large blocks with constant data; I lose my mind for a day and looking at github I found a repository where a guy smarter than me sorted this out: roughly speaking the firmware is xored 0x200 bytes at times with a key of four bytes (the bytes that repeat along the block probably).

The repository is here https://github.com/trolldbois/theta/blob/master/ThetaS-firmware-opening.ipynb.