├── README.md
├── capture_emount.sh
├── decode_emount.sh
├── emount_plotdata.py
└── multidecode.mk


/README.md:
--------------------------------------------------------------------------------
1 | Miscellaneous tools and scripts for reverse engineering Sony's E-mount lens protocol
2 | 
3 | I'll organize/document this better later - but take a look at my libsigrokdecode repo along with my sigrok_dumps repo
4 | 


--------------------------------------------------------------------------------
/capture_emount.sh:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 | sigrok-cli -d fx2lafw -c samplerate=6M --continuous -C D0=BODY_VD_LENS,D1=VCC,D2=LENS_CS_BODY,D3=RXD,D4=TXD,D5=BODY_CS_LENS -t VCC=1 -w -O srzip -o $1
3 | 


--------------------------------------------------------------------------------
/decode_emount.sh:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 | sigrok-cli -i $1 -P sony_emount:rx_cs=LENS_CS_BODY:rx=RXD:tx=TXD:tx_cs=BODY_CS_LENS
3 | 


--------------------------------------------------------------------------------
/emount_plotdata.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/python
  2 | 
  3 | import argparse
  4 | import binascii
  5 | import struct
  6 | import matplotlib.pyplot as plt
  7 | import numpy as np
  8 | 
  9 | parser = argparse.ArgumentParser(description='Process emount data')
 10 | parser.add_argument('--infile', dest='infile', help='input file')
 11 | 
 12 | args = parser.parse_args()
 13 | 
 14 | infile=open(args.infile,'r')
 15 | 
 16 | def apertureval(fstop):
 17 |     return hex(int((16.0+2*log(fstop,2))*256.0))
 18 | 
 19 | def valtoaperture(val):
 20 |     return 2**(val/512.0-8.0)
 21 | 
 22 | #The following is based on info obtained from Leegong's firmware reverse engineering
 23 | #Last entry in each of these arrays appears to be unused
 24 | #Length of each subgroup in lens status message group 5
 25 | group5_lens = [8, 1, 8, 3, 0x0A, 0x1C, 2, 6, 1, 2, 8, 6, 6, 6, 1]
 26 | #Length of each subgroup in lens status message group 6
 27 | group6_lens = [2, 0x0B, 9, 4, 6, 7]
 28 | 
 29 | seen_lens = []
 30 | 
 31 | timespos = []
 32 | mpos1 = []
 33 | mpos2 = []
 34 | speeds_p = []
 35 | speeds_s = []
 36 | #times32 = []
 37 | #mpos32_1 = []
 38 | #mpos32_2 = []
 39 | #times34 = []
 40 | #mpos34 = []
 41 | 
 42 | times1D = []
 43 | pos1D = []
 44 | 
 45 | times1C = []
 46 | pos1C = []
 47 | 
 48 | times1F = []
 49 | pos1F = []
 50 | 
 51 | times22 = []
 52 | pos22 = []
 53 | 
 54 | times3C = []
 55 | pos3C = []
 56 | 
 57 | aperturetimes = []
 58 | apertures1 = []
 59 | apertures2 = []
 60 | 
 61 | aperturestattimes = []
 62 | aperturestats1 = []
 63 | aperturestats2 = []
 64 | 
 65 | times_cslot1 = []
 66 | types_cslot1 = []
 67 | cslot1_lens = [0x1D, 0x20]
 68 | 
 69 | times_cslot2 = []
 70 | types_cslot2 = []
 71 | cslot2_lens = [0x16, 0x17, 0x1a, 0x1b, 0x1e, 0x24, 0x27]
 72 | 
 73 | lasttime = None
 74 | lastpos_p = None
 75 | lastpos_s = None
 76 | speedp = None
 77 | speeds = None
 78 | 
 79 | min_pos = 99999999999999
 80 | max_pos = 0
 81 | 
 82 | for line in infile:
 83 |     [sigrok_parser, data] = line.split(':',1)
 84 |     [pktts,data] = data.split(',',1)
 85 |     pktts = float(pktts)
 86 |     [lenstr,data] = data.split(',',1)
 87 |     pktlen = int(lenstr.split(':',1)[1],16)
 88 |     payloadlen = pktlen - 8
 89 |     [ftype,snum,speed,rxtx,data] = data.split(',',4)
 90 |     rxtx = int(rxtx.split(':',1)[1])
 91 |     if hex(pktlen) not in seen_lens:
 92 |         seen_lens.append(hex(pktlen))
 93 |     pktdata = bytearray.fromhex(data.split('\"',2)[1])
 94 |     if(rxtx == 0):
 95 |         bytesproc = 0
 96 |         while(bytesproc < payloadlen):
 97 |             cmdid = pktdata[bytesproc]
 98 |             if(cmdid == 0x6):
 99 |                 timespos.append(pktts)
100 |                 string6 = str(pktts) + ": Group 6:"
101 |                 sum6 = 1
102 | #                print str(pktts) + ": Group 6"
103 |                 for j in range(len(group6_lens)):
104 |                     #print "\tSubgroup " + str(j) + ": " + binascii.hexlify(pktdata[bytesproc+sum6:bytesproc+sum6+group6_lens[j]])
105 |                     if((j == 12) | (j == 13)):
106 |                         string6 += " Sg " + str(j) + ": " + binascii.hexlify(pktdata[bytesproc+sum6:bytesproc+sum6+group6_lens[j]])
107 |                     sum6 += group6_lens[j]
108 |                 motorpos1 = struct.unpack('<H', pktdata[bytesproc+3:bytesproc+5])[0]
109 |                 string6 += " Pos: " + str(motorpos1)
110 |                 print string6
111 |                 if(motorpos1 == 0):
112 |                     motorpos1 = None
113 |                 #This looks like a Metabones IV bug
114 |                 elif(motorpos1 == 0x7fff):
115 |                     print str(pktts) + ": Metabones bug 1"
116 |                     motorpos1 = None
117 |                 elif(motorpos1 == 0xa000):
118 |                     print str(pktts) + ": Metabones bug 2"
119 |                     motorpos1 = None
120 | #                elif(motorpos1 == 0x01c0):
121 | #                    print "Metabones bug 3"
122 | #                    motorpos1 = None
123 |                 else:
124 |                     if(motorpos1 > max_pos):
125 |                         max_pos = motorpos1
126 |                     if(motorpos1 < min_pos):
127 |                         min_pos = motorpos1
128 |                 motorpos2 = struct.unpack('<H', pktdata[bytesproc+21:bytesproc+23])[0]
129 |                 if(motorpos2 == 0):
130 |                     motorpos2 = None
131 | 
132 |                 mpos1.append(motorpos1)
133 |                 mpos2.append(motorpos2)
134 |                 if(lasttime):
135 |                     if(motorpos1 is not None):
136 |                         speedp = (motorpos1-lastpos_p)/(pktts-lasttime)
137 |                         lastpos_p = motorpos1
138 |                     else:
139 |                         speedp = None
140 |                     if(motorpos2 is not None):
141 |                         speeds = (motorpos2-lastpos_s)/(pktts-lasttime)
142 |                         lastpos_s = motorpos2
143 |                     else:
144 |                         speeds = None
145 |                 speeds_p.append(speedp)
146 |                 speeds_s.append(speeds)
147 |                 lasttime = pktts
148 |                 if(motorpos1):
149 |                     lastpos_p = motorpos1
150 |                 if(motorpos2):
151 |                     lastpos_s = motorpos2
152 |                 #May actually be multiple status responses, but so far always seem to be the same order
153 |                 #but I should look for potential patterns when motorpos2 is 0
154 |                 bytesproc += 40
155 |             elif(cmdid == 0x05):
156 |                 string5 = str(pktts) + ": Group 5:"
157 |                 sum5 = 1
158 |                 #print str(pktts) + ": Group 5"
159 |                 for j in range(len(group5_lens)):
160 |                     #print "\tSubgroup " + str(j) + ": " + binascii.hexlify(pktdata[bytesproc+sum5:bytesproc+sum5+group5_lens[j]])
161 |                     if((j == 12) | (j == 13)):
162 |                         string5 += " Sg " + str(j) + ": " + binascii.hexlify(pktdata[bytesproc+sum5:bytesproc+sum5+group5_lens[j]])
163 |                     sum5 += group5_lens[j]
164 |                 print string5
165 |                 #TODO:  Use the info leegong provided to decode this packet in more detail
166 |                 bytesproc += 97
167 |                 aperturestattimes.append(pktts)
168 |                 #Aperture is bytes 1-2 and 3-4
169 |                 #One appears to lead the other - I'm guessing a predicted/current or current/last like motor pos
170 |                 #Possible reason for publishing "last" is to mitigate the impact of a lost response message
171 |                 (aperture1,aperture2)=struct.unpack_from('<HH', pktdata, offset=1)
172 |                 aperturestats1.append(valtoaperture(aperture1))
173 |                 aperturestats2.append(valtoaperture(aperture2))
174 |                 #Bytes 78 and 79 repeat the two bytes of the last 0x2F command
175 |                 #Strangely, 0x2F hops between the two command timeslots depending on where in the focusing phase
176 |                 #you are
177 |             elif(cmdid == 0x1C):
178 |                 #Fairly certain this ACKs a 0x1C (stop) command
179 |                 bytesproc += 2
180 |             elif(cmdid == 0x1D):
181 |                 #Fairly certain this ACKs a 0x1D (move lens absolute/relative) command
182 |                 #Determine what the payload of this means, if anything
183 |                 bytesproc += 2
184 |             elif(cmdid == 0x1F):
185 |                 #ACKs a semi-autonomous hunt command - need to look at timing of this,
186 |                 #does it ACK the start of hunt, or the end - if end should be rare as
187 |                 #0x1F is usually interrupted by a subsequent 0x1D or 0x3C
188 |                 bytesproc += 2
189 |             elif(cmdid == 0x20):
190 |                 #Only seen in the same status slot as group 5, and only seen reported by the Techart EOS-NEX III in Fn mode
191 |                 bytesproc += 12
192 |             elif(cmdid == 0x22):
193 |                 bytesproc += 3
194 |             elif(cmdid == 0x3C):
195 |                 #ACKs a "move at speed" command?  When???  Need further investigation
196 |                 bytesproc += 4
197 |             else:
198 |                 print "Unknown response ID seen: " + hex(cmdid) + " in packet with len " + hex(pktlen)
199 |                 break
200 |             
201 |     else:
202 |         bytesproc= 0
203 |         while(bytesproc < payloadlen):
204 |             cmdid = pktdata[bytesproc]
205 |             if(cmdid == 0x1C):
206 |                 #Stop lens movement
207 |                 bytesproc += 1
208 |                 times1C.append(pktts)
209 |                 pos1C.append(lastpos_p)
210 |             elif(cmdid == 0x1D):
211 |                 #Absolute or relative motor movement, as fast as possible
212 |                 times1D.append(pktts)
213 |                 print str(pktts) + ": " + binascii.hexlify(pktdata[bytesproc:bytesproc+5])
214 |                 (positioncmd, cmdtype) = struct.unpack('<hH', pktdata[bytesproc+1:bytesproc+5])
215 | #                if(positioncmd == 0):
216 | #                    positioncmd = None
217 |                 if((cmdtype == 0x3cff) | (cmdtype == 0x400) | (cmdtype == 0x8300) | (cmdtype == 0x4300) | (cmdtype == 0x300)):
218 |                     #Only seen during the microstepping phase of legacy-adapter CDAF
219 |                     #Relative positioning - TODO, determine if 0x400 needs to be divided by 2
220 |                     #0x8300 and 0x4300 are probably something else after further investigation...
221 |                     positioncmd += lastpos_p
222 |                 elif((cmdtype == 0) | (cmdtype == 0x4000) | (cmdtype == 0x8000)):
223 |                     #Absolute movement.  Used rarely in legacy-adapter CDAF, is nearly
224 |                     #100% of legacy-adapter PDAF commands, and the majority of native AF-C commands
225 |                     #Rarely if ever seen for native AF-S
226 |                     #0x4000 is really rare - if it appears, seems to be near beginning of native AF-C
227 |                     #after some 0x22s are fired
228 |                     #I've seen 0x8000 once - only during a trace of a badly-behaving MBIV 0.52Adv +
229 |                     #EF50/1.8 STM
230 |                     positioncmd *= 1
231 |                 else:
232 |                     raise ValueError("Unknown cmd type " + hex(cmdtype) + " seen for cmdid 0x1D");
233 |                 pos1D.append(positioncmd)
234 |                 bytesproc += 5
235 |             elif(cmdid == 0x03):
236 |                 #Commands aperture and a whole bunch of other stuff
237 |                 aperturetimes.append(pktts)
238 |                 (aperture1,aperture2)=struct.unpack_from('<HH', pktdata, offset=4)
239 |                 apertures1.append(valtoaperture(aperture1))
240 |                 apertures2.append(valtoaperture(aperture2))
241 |                 bytesproc += 21
242 |             elif(cmdid == 0x04):
243 |                 #??????? commands
244 |                 bytesproc += 14
245 |             elif(cmdid == 0x22):
246 |                 #Another form of absolute motor movement.
247 |                 #I've only seen it for native AF-C, usually near the beginning of
248 |                 #AF tracking
249 |                 #Also seems to always be in the same frame as a 0x1D mode 0000 with the same
250 |                 #absolute position - what is the purpose of this?
251 |                 print str(pktts) + ": " + binascii.hexlify(pktdata[bytesproc:bytesproc+3])
252 |                 data22 = struct.unpack('<H', pktdata[bytesproc+1:bytesproc+3])[0]
253 |                 times22.append(pktts)
254 |                 pos22.append(data22)
255 |                 bytesproc += 3
256 |             elif(cmdid == 0x2F):
257 |                 #This odd beast hops between the first and second command timeslot, and is usually
258 |                 #echoed within a few cycles in bytes 78/79 of a 0x05 status response
259 | #                print str(pktts) + ": " + binascii.hexlify(pktdata[bytesproc:bytesproc+3])
260 |                 bytesproc += 3
261 |             elif(cmdid == 0x3C):
262 |                 #Move motor at a commanded speed and direction until told otherwise
263 |                 # - or you hit a limit?  Need to analyze when this gets ACKed
264 |                 print str(pktts) + ": " + binascii.hexlify(pktdata[bytesproc:bytesproc+8])
265 |                 bytesproc += 8
266 |                 times3C.append(pktts)
267 |                 pos3C.append(lastpos_p)
268 |             elif(cmdid == 0x1F):
269 |                 #Semiautonomous hunt - move quickly away from subject as fast as possible,
270 |                 #then advance towards subject at reduced speed
271 |                 #"away from subject" determined with PDAF hint.  If PDAF not available, always
272 |                 #advance forwards initially
273 |                 #This is the most common native AF-S command, but it can also be seen in
274 |                 #legacy-adapter CDAF - in which case an LA-EA3 appears to emulate reduced
275 |                 #speed using rapid microstepping of the lens as evidenced by the "jitter" of
276 |                 #a speed plot.
277 |                 print str(pktts) + ": " + binascii.hexlify(pktdata[bytesproc:bytesproc+14])
278 |                 bytesproc += 14
279 |                 times1F.append(pktts)
280 |                 pos1F.append(lastpos_p)
281 |             else:
282 |                 print "Unknown command ID seen: " + hex(cmdid)  + " in packet with len " + hex(pktlen)
283 |                 break
284 |                     
285 | #    if pktlen == 0x30:
286 | #        motorpos1 = struct.unpack('<H',pktdata[3:5])[0]
287 | #        times30.append(pktts)
288 | #        mpos30_1.append(motorpos1)
289 | #        if(motorpos1 > max_pos):
290 | #            max_pos = motorpos1
291 | #        if(motorpos1 < min_pos):
292 | #            min_pos = motorpos1
293 | #
294 | #        motorpos2 = struct.unpack('<H',pktdata[21:23])[0]
295 | #        if(motorpos2 == 0):
296 | #            motorpos2 = None
297 | #        mpos30_2.append(motorpos2)
298 | #
299 | #        if(lasttime):
300 | #            speedp = (motorpos1-lastpos_p)/(pktts-lasttime)
301 | #            if(motorpos2):
302 | #                speeds = (motorpos2-lastpos_s)/(pktts-lasttime)
303 | #            else:
304 | #                speeds = None
305 | #        speeds30_p.append(speedp)
306 | #        speeds30_s.append(speeds)
307 | #        lasttime = pktts
308 | #        lastpos_p = motorpos1
309 | #        lastpos_s = motorpos2
310 | #        
311 | #
312 | #    if pktlen == 0x32:
313 | #        firstcmd = pktdata[0]
314 | #        if(firstcmd == 0x1D):
315 | #            offset = 2
316 | #        elif(firstcmd == 0x1C):
317 | #            offset = 2
318 | #        elif(firstcmd == 0x1F):
319 | #            offset = 2
320 | #        elif(firstcmd == 0x06):
321 | #            offset = 0
322 | #        else:
323 | #            print "Saw unknown command " + hex(firstcmd)
324 | #            break
325 | #
326 | #        times32.append(pktts)
327 | #        motorpos1 = struct.unpack('<H',pktdata[offset+3:offset+5])[0]
328 | #        if(motorpos1 == 0):
329 | #            motorpos1 = None
330 | #        mpos32_1.append(motorpos1)
331 | #        motorpos2 = struct.unpack('<H',pktdata[offset+21:offset+23])[0]
332 | #        if(motorpos2 == 0):
333 | #            motorpos2 = None
334 | #        mpos32_2.append(motorpos2)
335 | #    if pktlen == 0x34:
336 | #        firstcmd = pktdata[0]
337 | #        if(firstcmd == 0x3C):
338 | #            offset = 4
339 | #        elif(firstcmd == 0x06):
340 | #            offset = 0
341 | #        else:
342 | #            print "Saw unknown command " + hex(firstcmd)
343 | #            break
344 | #        motorpos1 = struct.unpack('<H',pktdata[offset+3:offset+5])[0]
345 | #        if(motorpos1 == 0):
346 | #            motorpos1 = None        
347 | #        times34.append(pktts)
348 | #        mpos34.append(motorpos1)
349 | #
350 |                
351 |     if pktlen in cslot1_lens:
352 |         times_cslot1.append(pktts)
353 |         types_cslot1.append(cslot1_lens.index(pktlen))
354 | 
355 |     if pktlen in cslot2_lens:
356 |         times_cslot2.append(pktts)
357 |         types_cslot2.append(cslot2_lens.index(pktlen))
358 |         
359 | seen_lens.sort()
360 | 
361 | print seen_lens
362 | 
363 | #print motordata
364 | plt.figure(1)
365 | plt1 = plt.subplot(211)
366 | plt1.plot(timespos,mpos1,'b',timespos,mpos2,'r')
367 | plt1.plot(times1D,pos1D,'co', times1C, pos1C, 'rx')
368 | plt1.plot(times1F,pos1F,'y^',times3C,pos3C,'g^',times22,pos22,'b^')
369 | types_cslot2 = np.array(types_cslot2)
370 | #plt.vlines(times_cslot2,18000+types_cslot2*250,18250+types_cslot2*250)
371 | #plt.axis([6.2,7.2,18500,19500])
372 | 
373 | plt2 = plt.subplot(212,sharex=plt1)
374 | plt2.plot(timespos,speeds_p,'b',timespos,speeds_s,'r')
375 | plt2.axhline(color='k')
376 | 
377 | #plt3 = plt.subplot(313,sharex=plt1)
378 | #plt3.semilogy(aperturetimes,apertures1,'b',aperturetimes,apertures2,'r')
379 | #plt3.semilogy(aperturestattimes,aperturestats1,'c',aperturestattimes,aperturestats2,'g')
380 | #plt3.axis([None,None,-0.5,6.5])
381 | #plt.axis([6.2,7.2,-0.5,6.5])
382 | 
383 | #plt.subplot(313)
384 | #plt.plot(times_cslot1,types_cslot1,'m*')
385 | #plt.axis([None,None,-0.2,1.2])
386 | 
387 | print("Min position: " + str(min_pos) + ", max position: " + str(max_pos))
388 | plt.show()
389 | infile.close()
390 | 
391 | 
392 | 


--------------------------------------------------------------------------------
/multidecode.mk:
--------------------------------------------------------------------------------
1 | %.txt: %.sr
2 | 	/media/extradisk/adodd/emount/sigrok_data/decode_emount.sh $< &> $@
3 | 
4 | all: $(subst .sr,.txt,$(wildcard *.sr))
5 | 


--------------------------------------------------------------------------------