Fujifilm Camera History ‐ RE perspective - tiredboffin/fffw GitHub Wiki

Prehistory

The Fujifilm Fujix DS-1P camera, released in 1988, is considered the first "truly digital" camera. However, it is likely not very feasible to reverse-engineer today, as finding both the necessary software and compatible hardware is extremely difficult, if not impossible.

Note: Interestingly, the camera was developed in collaboration with Toshiba, so it may not be a coincidence that several Fujifilm digital cameras utilized Toshiba MIPS CPUs until at least 2003–2004, such as the FinePix S7000 bridge camera.

Ancient History (2006-2010)

Fujifilm began using ARM processors around 2006, as seen in models like the F30 and F80 EXR (see CPU and OS History). These models ran on a single-core ARM 1136F-S CPU with the Norti MiSPO RTOS.

Classical Antiquity (2010-2016)

With the introduction of the X100, Fujifilm migrated to a new and more powerful "EXR Processor" SoC that featured a dual ARM Cortex-R4F CPU running an unidentified RTOS (TBD). This ARMv7-R-based CPU lacks an MMU, instead implementing the simpler, potentially faster ARM Protected Memory System Architecture. This architecture makes "EXR Processor" cameras somewhat more accessible for reverse engineering due to the absence of address translation, also making them easier to exploit.

Note: Dual-processor Cortex-R4 systems are not standard, and the SoC has other unique characteristics. For more details, see EXR Processor.

In 2012, the original "EXR Processor" SoC was upgraded to the "EXR Pro Processor" design, first seen in the X-E1 and X-Pro1 models. This update added an image processing co-processor as a standalone module while retaining the original "EXR Processor" as the primary SoC.

A new "EXR II Processor" SoC was introduced in 2013, integrating the image co-processor into a single module. The X100S was the first X-series camera based on this new SoC. Fujifilm continued using the "EXR II" SoC until 2016 with models like the X-E2s.

In total, there are over 20 cameras based on the "EXR" and "EXR II" processors. While they vary in hardware—such as sensor size, resolution, EEPROM chips, and DRAM—they share key elements like the boot ROM, kernel loader, RTOS, and significant portions of low-level application code. From a reverse-engineering standpoint, they are quite similar, allowing most techniques and tools to be applied across all "EXR*" cameras with minimal modifications.

However, software differences across models—even with identical hardware—can still be significant. For example, X-E2 firmware versions v3 and v4 differ substantially in software.

Middle ages (2016-2021)

With the X100F, Fujifilm introduced the "X Processor Pro" SoC, based on a dual-core ARM Cortex-A7 architecture running the ThreadX SMP RTOS.

From a reverse-engineering perspective, the inclusion of a standard GIC interrupt controller, a conventional SMP implementation, and the availability of the ThreadX source code make it easier to understand the design and logic of the low-level subsystems. Fujifilm also retained the same abstraction layer between the RTOS and application code, allowing findings from "X Processor Pro" cameras to be applied to earlier "EXR" models. Reversing of the more recent cameras can shed light on antique models.

With the X-T3, the "X Processor Pro" was upgraded to the "X Processor 4," featuring a quad-core ARM Cortex-A7. However, from a reverse-engineering perspective, it appears quite similar to the "X Processor Pro."

Starting with the X-H1, some cameras also include a Renesas RX module (and later, an RL78 module), believed to control in-body image stabilization (IBIS), though this remains to be confirmed.

Modern History (2022-)

The new "X Processor 5" SoC was first introduced in the X-T5 camera. This SoC is based on a quad-core ARM Cortex-A53 and runs the ThreadX SMP ARM64 RTOS, with Linux handling some network-related tasks.

It includes references to the CEVA XM6 IP, which is likely the engine behind subject auto-detection.

Reverse engineering the "X Processor 5" is quite similar to working with the "X Processor Pro/4," though it requires adjustments for 64-bit addressing.

To be continued...