Fujifilm Custom Firmware, USB Code Execution

Channel:

Daniel C

Subscribers:

547

Published on October 14, 2021 3:14:06 AM ● Video Link: https://www.youtube.com/watch?v=aIswNirEsD4

Duration: 0:20

510 views

8

Milestone for Fujihack project:
After some 50 million crashes, firmware updates, and many ARM assembly debugging sessions, I can now run whatever I want, from USB.

After finding picture related function that I coult inject custom
code into, I (via memory search) found some text that PTP get_device_info returns, and a memcpy function that seems to be used everywhere in the code.

I then hijacked the memcpy function and devised a syncing mechanism that sent memory bytes into the string I found, so I could grab it accurately via USB.

Once I got a few megabytes, I was able to locate the PTP code in RAM and hijacked it with my own code.

Source code: https://github.com/petabyt/fujifilm