temperature sensors

[LjL]

insert by phyrephox: continued from here

All cameras? I was under the impression that only the higher-end ones and/or the ones with a proprietary battery had temperature sensors.

I think my A720IS just shoots a dark frame whenever the exposure time is more than 1 second...?

Anyway, if a thermometer is indeed available, then you could even just take a bias frame once, and then reconstruct dark frames on the fly based on shutter speed and temperature. Less accurate than a dark frame taken on the spot, but certainly a whole lot faster.

[reyalp]

All cameras? I was under the impression that only the higher-end ones and/or the ones with a proprietary battery had temperature sensors.

My a540 spends some time in Thermometer.c when it decides what dark frame setting should be used, and has strings relating to CCD and battery temp. In one of the other threads (or maybe the wiki) it was reported that (some ?) cameras would do the dark frame on short exposures if they were hot.

Code: [Select]

ROM:FFC1CCF8 0000000E C Thermometer.c                                                                                                               
ROM:FFC1CFB0 00000016 C GetBatteryTemperature                                                                                                       
ROM:FFC1CFC8 00000012 C GetCCDTemperature                                                                                                           
ROM:FFC1CFDC 00000016 C GetOpticalTemperature                                                                                                       
Of course, it's possible that not all cameras have these features, or that it just reports a yes/no rather than a temperature value.

edit:
it's also possible those strings refer to things that aren't present in all models, but are in all the firmwares.

[PhyrePhoX]

i once set my old nokia 3210 cellphone into netmon mode and among other things, could readout the temperature. i dont know how they did it, but the weird thing is, this was pretty accurately the temeperature outside of the cellphone.
imagine CHDK - now with Temp sensor, it will warn you to wear gloves when it is below 0 and will advise you to wear sunglasses and shorts when it's hot outside

[ewavr]

On A710:

GetOpticalTemperature: 33
GetCCDTemperature: 50 (after 2 minutes in live view mode)
GetBatteryTemperature: 32

Room temperature near 30C.
We need also atmosphere pressure meter in camera 

[PhyrePhoX]

haha again, please provide adresses or tutorial how to obtain these for other cameras
CHDK - the swiss army knife of photography and much more

[ewavr]

please provide adresses or tutorial how to obtain these for other cameras

How to obtain address of function, which name exists in firmware? Very simply (example for S3IS)
1. Seach string "GetCCDTemperature":

ROM:FF82D300                 CMNMI   R4, #0x11C00000 ; Set cond. codes on Op1 + Op2
ROM:FF82D304                 LDRVSB  R4, [R4,#-0x443] ; Load from Memory
ROM:FF82D308                 RSBVC   R7, R5, #0x6D   ; Rd = Op2 - Op1
ROM:FF82D30C                 RSBVCS  R7, R5, #0x61000000 ; Rd = Op2 - Op1

OMG, this is string, not code! Press 'A' key to convert into string:

ROM:FF82D300 aGetccdtemperature DCB "GetCCDTemperature",0 ; DATA XREF: sub_FF82D244+8Co

if IDA cannot find data reference to string, search it manually (press Alt+B and enter FF82D300)

2. Jump to reference:

ROM:FF82D2D0                 DCD aGetccdtemperature  ; "GetCCDTemperature"
ROM:FF82D2D4                 DCD loc_FF82D368
ROM:FF82D2D8                 DCD aGetbatterytemperature ; "GetBatteryTemperature"
ROM:FF82D2DC                 DCD loc_FF82D37C

Canon's firmware very often includes such lists - first item is name, second - address of function (for service purpose).

So, address of GetCCDTemperature is 0xFF82D368 (loc_FF82D368), address of GetBatteryTemperature is 0xFF82D37C etc.

P.S. Smart IDA scripts can do such things automatically.

[PhyrePhoX]

this LOOKS easy, but i am such a noob when it comes to IDA and assembly that i will probably never learn it - but others will do, that i'm sure, thanks!
i tried looking at these adresses two adresses you provided in the memory browser, but there wasnt anything in there. i CAN use the memorybrowser to read the temperature at these adresses, can't i?

[fudgey]

i tried looking at these adresses two adresses you provided in the memory browser, but there wasnt anything in there. i CAN use the memorybrowser to read the temperature at these adresses, can't i?

Umm.. if they are functions that return a temperature, no you cant.

Btw, not surprisingly, a570is 1.00e firmware has some familiar strings:
ffdeabe4 GetBatteryTemperature
ffdeabfc GetCCDTemperature
ffdeac10 GetOpticalTemperature
ffe1b7b4 CurrTemperature         

edit: and I suppose the function entry points are (no, haven't tried them):
GetOpticalTemperature ffdeac50
GetCCDTemperature ffdeac64
GetBatteryTemperature ffdeac78

[reyalp]

On A710:

GetOpticalTemperature: 33
GetCCDTemperature: 50 (after 2 minutes in live view mode)
GetBatteryTemperature: 32

Room temperature near 30C.
We need also atmosphere pressure meter in camera 

50c maybe we need a waterblock hardware mod

[PhyrePhoX]

[Hacki]

PhyrePhox just managed to get the adresses for SX100 1.00C:

Code: [Select]

NHSTUB(GetBatteryTemperature, 0xFFC3A350)
NHSTUB(GetCCDTemperature, 0xFFC3A2E0)
NHSTUB(GetOpticalTemperature, 0xFFC3A3C0)


[wontolla]

edit: attached build for s3is.

Nice!
I got at start-up:
opt: 24
ccd: 26
batt: 27
Room temp. (crappy thermo.): 24

Two questions for the more knowledgeable:

1.- Is the ccd temperature rise due to exposure to light or is it a consequence of being an electronic device? Or both?

2.- How the heck the camera can know the battery temperature? I guess the ccd has a tiny temp sensor somewhere, like PC microprocessors. But I doubt there is a sensor close to the battery compartment. Is this figure indirectly calculated? Maybe there is a formula that returns temperature given actual current flow or something?

[fudgey]

1.- Is the ccd temperature rise due to exposure to light or is it a consequence of being an electronic device? Or both?

Electric power dissipation.

2.- How the heck the camera can know the battery temperature? I guess the ccd has a tiny temp sensor somewhere, like PC microprocessors. But I doubt there is a sensor close to the battery compartment. Is this figure indirectly calculated? Maybe there is a formula that returns temperature given actual current flow or something?

A battery heat sensor may be thermally coupled to one of the battery terminals, which are metal and thus tend to warm up to pretty much the same temperature as the battery. Also, our battery compartments are not ventilated, so it may suffice to measure its ambient temperature. Whichever option happens to be mechanically cheapest...

[PhyrePhoX]

Its not that i found the adresses on my own,ida practically rubbed my nose into it! Had it set up the wrong way at first,reyalP helped me. Then for the sx100 i tried it loading the same way,but that was wrong,being a dryos device startadress etc are different.the wiki doesnt say so,i'm gonna change that.
Anyhow,finding these adresses is basically now only a matter of time.not brains. Loading a dump the first time into ida takes about 20 minutes on my slow box.
Expect a thermometer for all cams all to soon!

[Hacki]