As there still seem to be quite some issue’s and support here seems to be really slow/bad, I figured to see if it’s possible to do some homebrew development ourselves by modifying the firmware in the headset. This is a topic to share info and research about it.
So I’ve done some work already. First of all, we need a firmware to begin with I couldn’t find any to download, here on the forum are some links to previous versions but they’re all down. But this is the topic, including instructions to flash the FW: Firmware Trouble! - #23 by Tomkin
So then I searched for references in the pimax directories to a .dfu file. I’ve found one in the log and it works, the FW can be downloaded here: http://126.96.36.199/pitest/pidfu/jdisplay/j230/188.8.131.52.dfu
This BTW is newer than the version I’m currently running, I think this is a beta version. Anyway, I quickly found out that the firmware is unencrypted/unpacked, everything is in cleartext ! The FW is in the ‘dfu’ format, which is a propiatery format from “ST Microelectronics” and the file format is described here: http://rc.fdr.hu/UM0391.pdf
So it turns out there’s just 1 file in this image and for this particular image it starts at byte 0x125. It specifies a loading address of 0x8010000. On youtube there’s a video from someone who took the headset apart, it shows an ST microcontroller type SM32F, which is an 32 bits ARM microcontroller.
So, in short, you can cut out the first 0x124 bytes of the image, load it up in IDA pro, have it load at 0x8010000, specify ARM as architecture and it disassembles right away It starts with a function table (each 4 bytes) referencing several functions and the code starts at 0x8010244
So that’s where I’m at now. I’d be surprised if there’s anyone here who is a reverse engineer/hacker like me that can help out (we’re a rare breed these days it seems) but I figured I’d start this topic anyway. I’ll dive into all this myself and will see if it’s possible to do some modding.
Oh btw, there are no signatures that prevent modification, which is awesome There is a checksum though, as you can see in the file specification documentation I’ve posted earlier but that’s of course really easy to match.
BTW my first challenge would be to see if we can support 4k@30hz. It seems the headset garbles up when it receives 30 hz, but I think/hope this can be solved in FW.