EOS Lens protocol analyse - anybody intresting?

[_MAG_]

Kit lens inside:

in 7380  you see small holes. So you can made a cable and connect him to analyse device.
in 7382 you see apperture limiter. When you zoom you lens apperture limiter mooving and close some contacts.
If you need internal acces to pins in you kit lens- detach him from BACK part. NOT FROM FRONT. If you detach kit lens from front you cant re-assemble him (like me).
In 7398 you see back part of kit lens. I insert my screw in small "hole" in rear part and remove back lens.
I use kit back lens for do this macrofoto. I dont know how many dioptrium they have (+2 i sink).

[macrobob]

Hello, just joined but also need to control lens for focus stepping via external sw, so far
pin 1 no contact
pin 2 gnd  largest contact area, <1R to battery longest contact
pin3 5V supply
pin4 comms slow rising edge comms when shutter half pressed
pin5 comms data when menu pressed
pin6 clock bursting
pin 7 Gnd <1R to p2

i plan to use the eos SW for my 450D to step focus and analyse the comms to the lens to isolate the focus stepp commands. clock on pin 5 is 78KHz, possibly I2c but i only had 20 mins. good news is its  all slow and within pic capability. more to follow.

[MarsWalker]

Hi to all.

What we need to try is, using the same lens (sigma not working in canon eos digital) try to see the output using a Canon EOS prior to 300D/10D and then with a 350D or superior.

Most sigma lens (prior to 2000 I think) return an ERROR99 when used with the new canon EOS bodys.

If only we could find out what is the major change maybe we could create a "ring" between camera and lens that overcome that problem.

Am I making any sense ?

Best regards to all,

Raul Costa

[Goldenspark]

Hi _MAG_ I am interested in your project.
I would like to go further and not just decode the lens protocol. This only allows you to gain some control over normal operation.
What I would like is to be able to re-program my lenses, that is to write different parameters to the EEPROM.
I am particularly interested in the autofocus offset adjust that is used in calibration.
There is also the IS parameters for those lenses that have it, where you can tweak the sensitivity.

The problem here is that we would need to understand how to put the lens' processor into program mode.

Canon techs have a computer program that does this, but it does not appear to have "escaped" to cyber space as far as I can tell.

[_MAG_]

if you intresting i foto all chips in this board.

macrobob
i sink need OLD kit lens like mine. Its have oldest and slow protocol..
For better i sink need use 1 EF macrorings with some modding. Need to add cable, and analyse "live" signal.

[PhyrePhoX]

guys, there is an update: in a german dslr forum some users have made some serious successful analyzes of the protocol.

http://www.dslr-forum.de/showthread.php?p=6429331

you only need a german to english translation

[lorenzo353]

guys, there is an update: in a german dslr forum some users have made some serious successful analyzes of the protocol.

http://www.dslr-forum.de/showthread.php?p=6429331

you only need a german to english translation

they are using this USB logic analyser :
http://www.usbee.com/sx.html

only 129$ !

[_MAG_]

[_MAG_]

i have CanonServiceManual(EF-50-28-15)
read him. maybe this manual help you
http://www.sendspace.com/file/zfl1qs

[_MAG_]

-deleted

[fsnfs]

they not release protocol. they sell only a device. I think we need undersand protocol to add no-af lens af confirmation in firmware. Of course maybe in firmware this been simple (disable check) or maybe needed transfer "virtual data" from "original lense"

HI _MAG_
I have the same idea of this
I also hope to enable no-af lens af confirmation by using non-AF old lens.

Is the firmware of 400D cracked? 
Can it add a funtion to enable af confirmation by software now?

[arm.indiana]

Hi,

here is another reference: http://wapedia.mobi/en/Canon_EF_lens_mount?t=5.
why not also analysis firmware code ?

Arm.Indy

[arm.indiana]

Hi,

"LCOM_" string in the firmware means Lens Communication.

100eb8 (Reached->LCOM_AF_FINISHED FOCUS_OK )
 101590 SetReqForNear Go on LCOM_FAR_SEARCH (NEnd=%d)
 1015c0 SetReqForNear LCOM_FAR_SEARCH -> LCOM_NEAR_SEARCH
 101840 SetReqForFar Go on LCOM_NEAR_SEARCH (FEnd=%d)
 101870 SetReqForFar LCOM_NEAR_SEARCH -> LCOM_FAR_SEARCH
 1018d0 SetReqForReachedEnd LCOM_FAR_SEARCH -> LCOM_NEAR_SEARCH
 101908 SetReqForReachedEnd LCOM_NEAR_SEARCH -> LCOM_FAR_SEARCH
 102908 SetReqForInfPint Set LCOM_TMNL_FINAL_FOCUSING
 108808 SetSearchCtrl EVALUATING (LCOM_REST)
 1088ac EvaluateContrast1 Receive LCOM_TMNL_FINAL_FOCUSING
 108c44 EvaluateContrast1 EVALUATING (LCOM_WAIT_TO_AE)
 108e58 (Reached->LCOM_FOCUS_MOVING )
 108e78 (Reached->LCOM_WAIT_TO_SEARCH_STOP )
 108ea0 (Reached->LCOM_SEARCH_STOPPED )
 108ec0 -> LensRequest == LCOM_AFTER_SEARCH
 109c80 CkLensEnd LCOM_REACHED_END (SEARCH LensEnd) EndCnt(F=%d, N=%d)
 109cf8 CkLensEnd LCOM_DELAYED_NG_1 (LEGACY LensEnd READY)
 109d2c CkLensEnd LCOM_DELAYED_NG_1 (LEGACY LensEnd)
 109ea4 CkLensEnd LCOM_DELAYED_NG_1 (LEGACY LensEnd GoOnLimit)
 109edc CkLensEnd LCOM_DELAYED_NG_2 (LEGACY LensEnd FACE_SHORT)
 109f14 CkLensEnd LCOM_REACHED_END (LEGACY LensEnd)
 109fa4 CkLensEnd LCOM_DELAYED_NG_2 (LEGACY ScanEnd)
 109fd4 CkLensEnd LCOM_DELAYED_NG_2 (LEGACY ScanEnd GoOnLimit)
 10a00c CkLensEnd LCOM_DELAYED_NG_2 (LEGACY ScanEnd FACE_SHORT)
 10a044 CkLensEnd LCOM_GO_ON_SCAN (LEGACY ScanEnd)
 10a27c SetSearchStopCtrl LCOM_OCCURED_ERROR
 10aef4 CkLensInfo Recognized LCOM_WAIT_TO_AE
 4a7a38 SetReqForFUnexp Avoid LCOM_NEAR_UNEXPLORED (RStep=%d > MStep=%d)
 4a7ac4 SetReqForNUnexp Avoid LCOM_NEAR_UNEXPLORED (RStep=%d > MStep=%d)
 4a8318 CkLensEnd LCOM_DELAYED_NG_1 (LEGACY LensEnd MaxEndCount) EndCnt(F=%d, N=%d)
 4a8364 SetSearchStopCtrl LCOM_WAIT_TO_SEARCH_STOP -> LCOM_SEARCH_STOPPED


from 550D/1.0.8 FW

Arm.indy

[_MAG_]

CkLensInfo Recognized
wery intresting

i sink be intresting to bypass LensRequest function. replace
108ec0 -> LensRequest == LCOM_AFTER_SEARCH to 10aef4 CkLensInfo Recognized LCOM_WAIT_TO_AE

or something like this.

maybe better if you repost this in http://www.dslr-forum.de/showthread.php?t=649529&page=28
forum.

[arm.indiana]

Hi,

in 550D, there is a function called  "send_LensBP".

this function use a BIG table (from 0xff487a38 to 0xffaaed4) which record seems to have 11 bytes each.
does this table data make sense to you (see below the beginning and the end) ? is it part of the Lens protocol ?

I can send the complete table if needed.

Indy

Code: ASM

1. ROM:FF01D7DC send_LensBP_data                        ; DATA XREF: create_MainMessQueue+48o
2. ROM:FF01D7DC
3. ROM:FF01D7DC var_C           = -0xC
4. ROM:FF01D7DC
5. ROM:FF01D7DC                 STMFD   SP!, {R4,LR}
6. ROM:FF01D7E0                 SUB     SP, SP, #0x30
7. ROM:FF01D7E4                 MOV     R4, R1
8. ROM:FF01D7E8                 MOV     R0, R1
9. ROM:FF01D7EC                 BL      compute_lens_data_offset
10.  
11.  
12. ROM:FF07C314 compute_lens_data_offset                ; CODE XREF: send_LensBP_data+10p
13. ROM:FF07C314                 MOV     R1, #0xB
14. ROM:FF07C318                 MUL     R0, R1, R0
15. ROM:FF07C31C                 LDR     R1, =lens_data_maybe
16. ROM:FF07C320                 ADD     R0, R0, R1
17. ROM:FF07C324                 BX      LR
18. ROM:FF07C324 ; End of function compute_lens_data_offset
19.  
20.  
21. [code=asm]ROM:FF487A38 lens_data_maybe DCB 0,0,0,0,0,0,0,0,0,0,0
22. ROM:FF487A38                                         ; DATA XREF: compute_lens_data_offset+8o
23. ROM:FF487A38                                         ; ROM:off_FF07C328o
24. ROM:FF487A38                 DCB 0xBC,0xF9,0xCD,0xFE,0xA4,0x9D,0xBD,0x65,0x3A,0xA0,0
25. ROM:FF487A38                 DCB 0,0,0,0,0,0,0,0,0,0,0
26. ROM:FF487A38                 DCB 0xB3,0x49,0x47,0x25,0x25,0x6D,0xB8,0x4F,0xBE,0x66,1
27. ROM:FF487A38                 DCB 0xD7,0xE9,0xBB,0xE2,0x1C,0x66,0xD8,0x85,0xC4,0x5C,4
28. ROM:FF487A38                 DCB 0xD6,0x8C,0xC8,0xE2,0x21,0x77,0xDE,0xCD,0xC5,0x12,5
29. ROM:FF487A38                 DCB 0xDB,0xE3,0x3F,0x2B,0xAC,0xD5,0xD4,0xD0,0xC9,0x40,7
30. ROM:FF487A38                 DCB 0xD9,0xB8,0x44,0x18,0x26,0x60,0xDB,0x8F,0xC8,0x37,0xB
31. ROM:FF487A38                 DCB 0x50,0x58,0xBD,0xDA,0x31,0x70,0x59,0x98,0xC1,0x6B,0x21
32. ROM:FF487A38                 DCB 0x55,0x70,0xC8,0x2B,0x9C,0x9D,0x5A,0x8C,0x39,0xED,0x22
33. ROM:FF487A38                 DCB 0x54,0x63,0x40,0x7B,0xB2,0xE5,0x55,0xA0,0xC0,0x5B,0x27
34. ROM:FF487A38                 DCB 0x57,0xEE,0x44,0x96,0x1A,0x25,0x58,0x7E,0xC2,4,0x2A
35. ROM:FF487A38                 DCB 0x53,0xF,0xB9,0x39,0x2C,0x36,0x52,0x11,0xC0,0x6A,0x13
36. ROM:FF487A38                 DCB 0x58,0xC7,0xC8,0x20,0x1A,0x2C,0x59,0x17,0x48,0x20,0x13
37. ROM:FF487A38                 DCB 0x54,0xFB,0xA3,0x91,0x9E,0x64,0x50,0x8E,0xC7,0xEF,0x16
38. ROM:FF487A38                 DCB 0x59,0xD3,0x44,0x95,0xA3,0xA5,0x59,0x41,0x33,0x27,0x18
39. ROM:FF487A38                 DCB 0x4E,0x40,0xB5,0xF0,0x28,0xE,0x46,0x73,0xC7,1,0xFF
40. ROM:FF487A38                 DCB 0x4D,0xAC,0xC8,0x33,0x99,0x57,0x46,0x85,0xC7,0x4F,0
41. ROM:FF487A38                 DCB 0x4F,0x97,0x24,0xB7,0xA7,0xF8,0xC7,0x15,0xBE,0x8B,0
42. ROM:FF487A38                 DCB 0x4E,0x7C,0x44,0xBD,0xA4,0xF8,0xC6,0x80,0xBC,0xDF,0
43. ...
44. ROM:FF4AAE5B                 DCB 0xD2,1,0xC8,0x52,0xA1,0xAD,0xD3,0xAC,0xCB,0x2C,4
45. ROM:FF4AAE5B                 DCB 0xC8,0xC5,0x3B,0x25,0xAA,0x78,0xD6,0x6C,0xC7,0xC6,5
46. ROM:FF4AAE5B                 DCB 0xC4,0xC5,0x44,0x92,0x28,0x6A,0xD6,0xBA,0xC7,0xD9,5
47. ROM:FF4AAE5B                 DCB 0xD2,0x24,0xB6,0xE8,0x27,0xFE,0xCE,0x43,0xCB,0x69,3
48. ROM:FF4AAE5B                 DCB 0xD2,0x76,0xC8,0x55,0xA1,0x54,0xC5,0x5F,0xCB,0x65,3
49. ROM:FF4AAE5B                 DCB 0xB2,0xC5,0x3B,0xD,0xAA,0x63,0xD6,0xEC,0xC1,0x68,4
50. ROM:FF4AAE5B                 DCB 0x47,0xF6,0x44,0x93,0x28,0x66,0xD7,0x42,0xC1,0x84,4
51. ROM:FF4AAE5B                 DCB 0xD2,0x62,0x29,0xBE,0x1E,0x7A,0xC7,0x4C,0xCB,0xA2,3
52. ROM:FF4AAE5B                 DCB 0xD2,0xBA,0xC8,0x57,0xA1,0x17,0x4A,0x60,0xCB,0x9C,3
53. ROM:FF4AAE5B                 DCB 0x48,0x8B,0x3A,0xFF,0xAA,0x56,0xD7,0x55,0xC2,0xF2,3
54. ROM:FF4AAE5B                 DCB 0x4C,0x72,0x44,0x94,0x28,0x63,0xD7,0xB1,0xC3,7,3
55. ROM:FF4AAED4
56.  

[/code]