Pentax K30 firmware checksum

# RE'ed by Shodan

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace PentaxK30CRCCheck
{
    class Program
    {
        static void Main(string[] args)
        {
            FileInfo fileA = new FileInfo(args[0]);

            var bytesA = File.ReadAllBytes(fileA.FullName);

            Program p = new Program();
            var success = p.checkFirmwareChecksum(bytesA, 524, 0);
            success &= p.checkFirmwareChecksum(bytesA, 524, 0);


        }

        // reverse byte order (32-bit)
        public static UInt32 BigEndianToLittleEndian(UInt32 value)
        {
            return (value & 0x000000FFU) << 24 | (value & 0x0000FF00U) << 8 |
                   (value & 0x00FF0000U) >> 8 | (value & 0xFF000000U) >> 24;
        }

        public static UInt32 GetValueFromFirmware(ref byte[] firmware, int offset)
        {
            var tmp = BitConverter.ToUInt32(firmware, offset);
            return BigEndianToLittleEndian(tmp);
        }

        bool checkFirmwareChecksum(byte[] firmware, int cameraDebugId, int index)
        {
          int[] cameraDebugIdLocations = {0x788, 0x600088, 0x788, 0x4FFF0, 0};

          bool result = false;
          var debugIdIndex = 2 * cameraDebugIdLocations[index];
          var cameraDebugIdValueInFirmware = GetValueFromFirmware(ref firmware, debugIdIndex);
          if (cameraDebugIdValueInFirmware == cameraDebugId)
          {
            var counter = 0;
            // Do some initial checks for magic values in the firmware
            var cameraMagicChecksumValue = 0x10001 * cameraDebugId;
            do
            {
                int[] locationOfCheckSumMagicValueLocations = {0x7FC, 0x57FFFC, 0x5FFFFC,
                                                0x600080, 0x600080, 0x61FFF8,
                                                0x7FC, 0x57FFFC, 0x5FFFFC,
                                                0x4FFFA, 0x4FFFA, 0x4FFFA,
                                                0, 0, 0};
                const UInt32 magicValue = 0xA55A5AA5;

                var indexIntoFirmware = 2 * locationOfCheckSumMagicValueLocations[3 * index + counter];
                var firmwareValue = GetValueFromFirmware(ref firmware, indexIntoFirmware);
                bool valueInFirmwareIsValid = cameraMagicChecksumValue == firmwareValue;

                if (valueInFirmwareIsValid)
                {
                    var newIndex = (indexIntoFirmware + 4);
                    var newValue = GetValueFromFirmware(ref firmware, newIndex);
                    valueInFirmwareIsValid = newValue == magicValue;
                }

                if (!valueInFirmwareIsValid)
                {
                    return false;
                }
                ++counter;
            }
            while ( counter < 3 );

            // interesting early exit here that bypasses the firmware checksum!
            int[] locationOfChecksumOverrideBits = {
                                               0x7FC, 0x57FFFC, 0x5FFFFC,
                                               0x600080, 0x600080, 0x61FFF8,
                                                0x7FC, 0x57FFFC, 0x5FFFFC,
                                                0x4FFFA, 0x4FFFA, 0x4FFFA,
                                                0, 0, 0};

            int indexToMagicCrcOverrideByte = 2 * locationOfChecksumOverrideBits[index];
            var crcOverrideValue = GetValueFromFirmware(ref firmware, indexToMagicCrcOverrideByte);

            if ( crcOverrideValue == UInt32.MaxValue)
            {
                return true;
            }

            int[] checkSumStartAddresses = { 0, 0x600000, 0, 0x10000, 0 };
            int[] totalAmountTOCheckSum = { 0x300000, 0x10000, 0x300000, 0x20000, 0 };

            UInt32 checkSumValue = 0;
            int addressToProcess = 2 * checkSumStartAddresses[index];
            int totalNumberOfDwordsToCheck = totalAmountTOCheckSum[index];
            // this looks like the main firmware checksum
            var count = 0;
            while (addressToProcess > count)
            {
              var valueAtOffset = GetValueFromFirmware(ref firmware, addressToProcess);
              totalNumberOfDwordsToCheck += 4;
              ++count;
              checkSumValue += valueAtOffset;
            }
            if (checkSumValue == 0)
            {
                result = true;
            }
          }
          return result;
        }
    }
}