darthnut/a7rv-firmware-analysis

The Sony a7R V firmware analysis project investigates the camera's internal operations, specifically focusing on focus-bracket cadence and service-mode authentication. The author reports that focus-bracket cadence is governed by two regimes: a short-stack regime limited by physical lens movement and a long-stack regime limited by a write-pipeline cliff. Static reverse engineering of the cpapp-b.bin binary and bench testing confirmed that neither regime is controlled by a patchable firmware timer. The write-cliff stall is an SDF develop-resource acquire retry loop that traces into the develop subsystem, where resource pools are runtime-configured rather than defined by static constants. While a 2-byte relaxation of an STP buffer-full gate was identified and verified in the binary, the author notes it does not affect the focus-bracket cadence. The project also mapped service-mode authentication protocols, noting that factory secrets are hardcoded and shared. The author emphasizes a working ethos of mapping and measuring before modification, explicitly stating that no untested changes should be flashed to the device. AI participation is credited to Claude Opus 4.8.