Specs:

• 20.3 Mp CMOS m43 sensor without AA filter
• 5184×3888 resolution
• 80 MP Pixel shift mode ala last Sony and Olympus cameras
• Oriented to photo guys, Panasonic marketing want G9 positioned further from GH5
• 4K 50/60fps video, no crop, on all the sensor, bitrate cut to 150 Mb/s
• 5 axis sensor based stab
• 6.5-stop Dual IS 2
• 3,680k-dot OLED LVF no blackout and 0.83x magnification
• Screen is not too good - 3 ” touchscreen, 1040kpts
• No flash like GH5
• WiFi and Bluetooth
• DFD autofocus, 255 points
• Shutter 1/8000 s – 60 s, Bulb (30 min max)
• Burst speed - 20 fps (AF-C), 60 fps (AF-S)
• Rear joystick
• Mono LCD on top
• Freeze and water proof up to -10 Celsius degrees
• Magnesium body
• 2x SD UHS-II slots
• USB 3.0 interface
• 6K Photo mode
• Large buffer with no slow down
• HDMI, remote control, microphone input, headphone output
• Li-ion 7.2V, 1860mAh, 14Wh battery
• Included - Belt, USB cable, charger
• 136.9 x 97.3 x 91.6 mm
• 658 g weight including battery and SD card
• Available in December 30
• $1699 body price at
  • https://www.amazon.com/Panasonic-Mirrorless-Megapixels-High-Resolution-DC-G9KBODY/dp/B0774KTV1X/
  • https://www.bhphotovideo.com/c/product/1367104-REG/panasonic_dc_g9kbody_lumix_dc_g9_mirrorless_micro.html
  • https://www.adorama.com/ipcg9.html
• UK pricing - £1499 body only, £1699 with Panasonic 12-60mm lens, or £2019 with LEICA 12-60mm lens.
• AU pricing - RRP AU $2499 body, AU $3499 for 12-60mm f/2.8-4.0 kit and, 12-35mm f2.8 for AU $3499.
• Grip at
  • https://www.amazon.com/Panasonic-Authentic-Vertical-joystick-DMW-BGG9/dp/B0774XGCDH/
  • https://www.bhphotovideo.com/c/product/1367122-REG/panasonic_dmw_bgg9_battery_grip.html
  • https://www.adorama.com/ipcdmwbgg9.html

Video modes

• 3840 x 2160 @ 60p at 150 Mbps, MP4, H.264, Linear PCM
• 3840 x 2160 @ 30p at 100 Mbps, MP4, H.264, AAC
• 3840 x 2160 @ 23.98p at 100 Mbps, MP4, H.264, AAC
• 1920 x 1080 @ 60p at 28 Mbps, MP4, H.264, AAC
• 1920 x 1080 @ 30p at 20 Mbps, MP4 or AVCHD, H.264, AAC
• 1920 x 1080 @ 60i at 24 Mbps, AVCHD, MTS, H.264, Dolby Digital
• 1920 x 1080 @ 60i at 17 Mbps, AVCHD, MTS, H.264, Dolby Digital
• 1920 x 1080 @ 23.98p at 24 Mbps, AVCHD, MTS, H.264, Dolby Digital

The .bin firmware you can download from Panasonic (https://av.jpn.support.panasonic.com/support/share2/eww/com/dsc/fts/zip/G9___V22.zip) has the "UPD " magic, followed by 8 bytes I couldn't associate, and then what seems like a product identifier "MC471" (MC = mirrorless camera?)

The interesting stuff starts at 0x2EC, where something which looks like a partition table starts. This section is 4884 bytes long (including some padding I believe) and contains 48 partitions which I managed to reverse engineer:

// 92 bytes - index entry of the partition listing struct partitionIndexEntry { char name[12]; // 12 bytes - name of the partition int offsetFile; // 4 bytes - offset in the firmware file int size; // 4 bytes - size of the partition int offsetMemory; // 4 bytes - offset in the memory on the camera int encryption; // 4 bytes - whether the partition is encrypted (0x3) or not (0x2) char checksum[32]; // 32 bytes - SHA-256 checksum of unencrypted partitions? char key[16]; // 16 bytes - encryption key?, if encryption == 0x3 char padding[16]; // 16 bytes - padding };

Reading that in in my custom C tool I've written for this logs out 48 partitions with their offset (in the firmware file, the real data starts at 0x1600) and size. I added automatic dd'ing so I now got 48 .bin files which are the extracted partitions out of the big firmware file. Adding all the sizes of the partitions together is also exactly the size of the original .bin minus the 0x1600/5120 bytes at the beginning which are the headers and partition table. You can download the extracted partition files here: https://drive.google.com/file/d/1P4681aZkRlCUuaiL10nH_En1g70iRLKS/view

Now, they obviously seem to be encrypted, and I haven't been able to figure out how. As you can see I was thinking whether the 16 byte long key in the partition index might be a key, because it's filled with zeros if encryption is 0x2.

This is my progress, I greatly appreciate any hints!