Camera Firmware Hacks Are Back – AI-Assisted Mods Add Shutter Angle, Open Gate RAW and Film Looks

How To

by Nino LeitnerToday

Subscribe to How To

Shutter angle on a Sony a7 IV, OG4K open-gate CinemaDNG on a SIGMA fp, higher bitrates on a Nikon Z30 and in-camera film looks on a 2005 Canon EOS 5D: a new wave of community camera mods is adding features the manufacturers never shipped. Many of the developers say openly that AI assistants helped them take the firmware apart, and in this overview I look at what the projects do, how they work and what can go wrong.

This article is the start of a CineD series, and I look at each project in more detail in the next parts. The trigger for the current attention was a video by photographer and YouTuber Tony Northrup, titled “I hacked my camera with AI (and so can you)”. But the projects themselves have been piling up on GitHub for weeks, for Sony, SIGMA, Nikon, Canon, Ricoh and Hasselblad cameras. We have already reported on two of them: the SIGMA fp open-gate hack that records 3K 3:2 CinemaDNG from the full sensor, and the return of Magic Lantern with a new developer team and support for more Canon DSLRs. Let me say this clearly before we go further: all of these projects are unofficial and experimental, and you use them at your own risk.

We are currently witnessing an avalanche of software projects – not only unofficial camera hacks – because vibe coding is allowing non-developers to make all kinds of tools without knowing a single line of code.

An old idea with new tools

Camera hacking is not new, and some of the most popular filmmaking cameras of the last 15 years owe part of their reputation to it. Magic Lantern started on the Canon EOS 5D Mark II in 2009 and later brought RAW video to a list of Canon DSLRs. Entire productions were shot that way, such as the feature documentary Sea Gypsies on the 5D Mark III with Magic Lantern RAW. Around the same time, the GH1 and then the Panasonic GH2 hack raised the bitrate of Panasonic’s AVCHD codec far beyond the factory setting, and Panasonic even said publicly that it was impressed with the hackers’ work. In 2016, a developer known as ma1co removed the 30-minute recording limit on several Sony Alpha, RX and NEX cameras through Sony’s PlayMemories app system.

What all of these had in common was a small group of people who could read disassembled code, document firmware structures and write patches in assembly. That is the part that is changing now.

What AI changes, and what it does not

The developer behind fpSup for the SIGMA fp, who goes by bei, 夏曉雨 or ijigen, describes how AI decompiled the fp firmware and found a factory shell and an AutoRun.txt file that the camera runs from the SD card at startup. The project now publishes “AI Skills”, which are instruction files written for an AI assistant, so that other users can have their own assistant drive the camera over USB and build new tools. The Sony a7 IV project, the Wonder Lantern project for the Nikon Z30 and the Ricoh GR tools all come with long, carefully worded documentation of a kind that I am almost 100% certain was written with AI help (but that’s just my guess from reading them).

The same fpSup developer also gives the most useful warning I have read in all of this: “Please treat all of this as reference, not truth. My AI has made many mistakes, and some of them may still be in my research notes or Skills.” In my opinion, that sentence describes the whole movement. AI makes it much faster to find a hidden setting in a firmware file. It does not test whether your clip has a corrupt frame on minute 14, and it does not tell you whether a change will survive the next cold boot. The serious projects separate “verified on a camera” from “found in the code” in every table, and that is what you should look for before you try anything.

Sony a7 IV: shutter angle through service mode

The Sony a7 IV feature research project is the one most likely to interest video shooters. On an a7 IV with firmware 6.02, the developer changed one stored setting through Sony’s USB service mode, using the existing Sony-PMCA-RE tool, and after a cold boot the camera showed the shutter-angle icon and 180° in Movie mode. Nothing is flashed: the method writes a backup property, and writing the old value back restores shutter speed. The project documentation lists angle values from 360° down to 5.6°, which can be written directly, while the README still says that the dial and touch controls do not yet reach the internal angle setter on firmware 6.02.

The other findings are research, not features. The firmware contains a custom LUT implementation with 16 user slots and .cube parsing, but a separate condition still keeps it hidden. It names a 5016 x 3344 3:2 scan mode, which looks like the full-height 5K readout Sony uses on the FX5, but the developer found no matching encoder profile, so open-gate recording on the a7 IV is not proven. A de-squeeze display with 1.3x and 2.0x settings is listed as a “strong candidate, untested”. Sony gives shutter angle to its Cinema Line cameras, including the FX30, and not to the Alpha bodies. (Sony, if you are reading this, a shutter-angle menu on the a7 IV would cost you a firmware update and would make a lot of hybrid shooters happy.)

Owners of older Sony bodies have a different route. Cameras such as the original a7, a7 II, a6000, a6300, RX100 III to V and RX10 II and III supported Sony’s PlayMemories Camera Apps, and with Sony-PMCA-RE photographers now reinstall official Sony apps such as multiple exposure, Light Painting, Star Trail and Digital Filter, with AI assistants guiding them through the process.

SIGMA fp: from 3K to OG4K

When we covered the SIGMA fp open-gate mod at the end of September, it recorded 3K 3:2 CinemaDNG to an external SSD. The fpSup project has moved quickly since then. Its Res-Custom card now offers five extra CinemaDNG formats next to UHD and FHD: OG2K at 2000 x 1334, a Super 16 crop at 2096 x 1238, OG3K at 3008 x 2000, and OG3.5K and OG4K at 3456 x 2304 and 3840 x 2560 from a full 1:1 readout scaled in the camera’s image processor. The three formats S16, OG3.5K and OG4K come from developer Jose Hurtado.

The other fpSup tools are just as interesting for a camera that many of us bought for its RAW output. fpSup-Lossless uses the camera’s own hardware codec, which the stock firmware never uses for video, to compress CinemaDNG losslessly; according to the project, a 3K 12-bit frame of 9.1 MB typically becomes about 3.2 MB. Gyro2 writes motion data into each CinemaDNG frame for stabilization in Gyroflow, RAW-View shows where highlights clip in the 12-bit RAW, and ScreenFlip rotates or mirrors the rear screen. Everything loads into memory from the SD card and nothing is written to the camera’s flash, but it works only on the original fp with firmware Ver.5.02. The fp L, with its different sensor, is not supported. With the SIGMA FP2 now offering 6K open gate officially, it is a nice irony that the original fp gets open gate from its community in the same month.

Nikon Z30: Wonder Lantern

Wonder Lantern Z30 calls itself an experimental project “similar to Magic Lantern”, but it works differently. A builder tool takes the official Nikon Z30 firmware C 1.20, which the user supplies, checks its size and checksum, applies patches and outputs a modified firmware module. The feature list includes three bitrate profiles (Stock, Balanced and High), slow-motion recording extended to 25 minutes, a live-view page with histogram and level, zebras in photo mode, exposures up to 900 seconds, six photo aspect ratios with a live-view mask, custom shutter sounds and a film-style date stamp for JPEGs. A recent update extends the bitrate profiles to 4K, with up to 200 Mbps instead of 144 Mbps. The maintainer is transparent about the problems: earlier builds had playback and crop regressions, and the playback fix in the current version was confirmed by one user’s retest. Because this approach installs modified firmware, it carries more risk than the card-loaded projects.

Canon: Magic Lantern and the film-look projects

On Canon, the new work builds on more than 15 years of Magic Lantern. The Magic Lantern team stresses that it is not modified firmware but a program that runs alongside Canon’s software, loaded from the memory card each time the camera starts. The newest projects use that base for photography. Soup Engine gives the original EOS 5D from 2005 thirteen film looks and saves a developed JPEG next to the untouched RAW file, and community ports now exist for the EOS 7D, 50D and 700D. The Ritual by Latent Studios brings its film looks to the EOS 5D, 5D Mark II and 5D Mark III on a pay-what-you-want basis. These are stills tools, but they show how much life is left in bodies that Canon stopped supporting long ago.

Stills cameras get attention too

The Ricoh GR series has three active projects. GRKit adds film looks with live preview, XPan and other crops, date imprints, grain and now a bloom and halation effect to the GR III, GR IIIx and GR IV, and it runs from the SD card. GR Mod is a desktop tool that builds modified firmware with features such as a Direct Flash mode, and GR4-MonoUnlock brings the six black-and-white looks of the GR IV Monochrome to the standard GR IV, three of them in movie mode. On Hasselblad, a research project reached continuous autofocus and eye recognition on the first X2D 100C and 907X, but by November 6 its developers had stopped the public release and taken the related toolkit offline. A separate extension adds a six-frame 400MP pixel-shift mode to the X2D II 100C. FUJIFILM owners have a first public mod as well: FujiMod adds 23 features to the X70 compact, including a 65:24 aspect ratio, snap focus, extra film simulations, an anamorphic de-squeeze and F-Log recording. It runs from the SD card or installs as a firmware update, and photographers such as Jonas Rask have already posted results with it. Its developers work together on the Discord server of Fujihack, the older FUJIFILM research project.

Card, setting or patched firmware

For anyone thinking about trying one of these mods, the method matters more than the feature list. There are three basic approaches. The first loads extra code from the memory card at startup and leaves the camera’s flash untouched, as Magic Lantern, fpSup and GRKit do; take the card out and the camera is stock again, although Magic Lantern and GRKit first switch on a boot or script setting. The second changes a stored setting through a service mode, as the Sony a7 IV project does, which is also reversible as long as you keep a backup of the original values. The third patches the firmware itself, as Wonder Lantern, GR Mod and GR4-MonoUnlock do, and it is the only approach where a failed install can leave you with a camera that does not start.

All of these projects are tied to exact firmware versions, because the patches target fixed memory addresses. fpSup works on fp firmware Ver.5.02 only, “not 5.02 or newer”, and Wonder Lantern accepts one file with one SHA-256 checksum. A firmware update from the manufacturer can therefore end the mod, or worse, interact with it in ways nobody tested. GR4-MonoUnlock also states that installing modified firmware may void your warranty, and that applies to the others as well.

What manufacturers could learn from this

Most of these features already exist in the cameras. Shutter angle is in the a7 IV firmware, a 3:2 full-sensor mode is in the fp, and higher bitrates and longer slow motion are within reach of the Z30’s hardware. My feeling is that manufacturers hold them back for product-line reasons rather than technical ones, and the hacks make that easy to see. GoPro chose another path years ago with GoPro Labs, official experimental firmware that adds features which are off by default, and it still updates it for its newest cameras. I would love to see more manufacturers try something similar for older bodies instead of leaving the job to the community.

What comes next in this series

In the next articles, I go deeper into the projects that matter most for video: fpSup on the SIGMA fp with its open-gate formats and lossless CinemaDNG, the Sony a7 IV shutter-angle research and what else sits in its firmware, Wonder Lantern on the Nikon Z30, and Magic Lantern with its new film-look projects on Canon. A shorter piece covers the Ricoh GR and Hasselblad mods, and a final explainer looks at how the methods work and how to judge a project before you try it.

None of the cameras in this overview needs to be bought new to run these mods, and several are discontinued. Of the bodies that are still in production, the Sony a7 IV sells for $1,998 at B&H and €2,010 at CVP, and the Nikon Z30 and the original SIGMA fp are listed at B&H.

Have you ever installed a hack or a mod on one of your cameras? Which hidden feature would you like to see on your camera next? Let me know what you think in the comments below!