hacking Canon EOS 1000D

_MAG_

This camera announsed 13 June 2008. Some Q &A
1. what OS in this camera
maybe such as 40d or 450d. Now firmware in camera - version 1.0.3.
2. what need todo.
a) unhide|add Highlight Tone Priority
b) unhide spot Metering mode. (I know 400d have it but it hidden)
c) unhide hidden custom func.
d) video mode?

canon 300d was cut funktion and hacked. I hope we can hack this cutted camera too.

no firmware update now 🙁

marden

someone told me that you could only hack p&s cameras? and you say that 300d has been hacked? whick other dslr cameras have been hacked and where do you find those hacks?

fvdk

Here is the link to the 300D hack

CANON EOS 300D Digital Rebel Firmware Hacking Forums

dzsemx

most of the developers heard about the 300D hack...

300D was a digic 1 camera and basically it had X86 arhitecture and it has Datalight ROM-DOS as operating system, and the "camera.exe" was the main executable (nice, isn't it?).
But Digic II, III platform was built around 32bit ARM RISC processors, using proprietary operating system(Wvworks and Dryos), so it's totally different.

Btw the first step for hacking 1000D is to make some code working and make a firmware dump. See here for details:
Porting the CHDK - CHDK Wiki
good luck 😀

matteodv

Right we have an official firmware download 1.0.5 from canon
http://web.canon.jp/imaging/eosd/firm-e/eosdigital4/firmware.html

We now know that the 1000d runs VXworks with a DIGIC lll processor

Now Get Hacking !

gratiz

ive started to check the firmeware and im stuck as the same problem as the other guys that try to hack the 400d. i cant get the aes keys to decrypt the firmware ... maybe anyone had some progress with it.

gratiz

Did some deep searching last night. what i found is that only the Data Header seems to be crypted with AES ... maybe in the next days i will get some news how the header and the data can be decrypted ...

gratiz

ok got a full firmware dump from the ROM by the dumping method. will upload the dump asap...

gratiz

http://rapidshare.com/files/231899992/1000D_fw_1_0_5.bin.html

gratiz

There is no real progess so far ... as i dont have any experience with the chdk ... :/

The Spot Metering is definitly inside the firmware and should work in the liveview mode.

ROM:FFADBD80 aLvaeErrorIll_0 DCB "[LVAE] ERROR >> ILLEGAL_PARAMETER (LVAE_PARAMETER.WBGain) : Spot"
ROM:FFADBD80 ; DATA XREF: ROM:off_FFADC030o
ROM:FFADBD80 DCB "Metering()",0

what other missing functions would be interessting to find ?

CDL0012

[unknown]
Great to see that there are actually some people working on a hack for our DSLR...

Any progress so far?

It would be so great to have chdk or something similar on our cam...
Or at least some missing functions like the spot metering...

It would also be nice to match the RAW continuous shooting speed of an XSi of 3.0 fps instead of 1.5 fps.

Perhaps see where the firmware differs between the XSi and XS... since Canon released both firmware updates recently.

Basically the same hardware... seems like a firmware limitation.

gratiz

ive uploaded the firmware again.

http://rapidshare.com/files/248570405/ROM0.RAR.html

btw is there a 450D dump ?

CDL0012

Agreed...

I would think unlocking features would be much easier than getting new features. I wonder if it is just as easy to see the differences between the 450D dump and the 1000D dump to see where the FPS limitation is. Once the limitation is found, make the necessary hex edits to the 1000D and then recompile the firmware. Then with the new recompiled firmware, flash the camera.

I mean there is a high degree of risk and cost involved if it bricks your camera. But I don't know if there's maybe a way to unbrick the SLR easy to make this method a little safer?

Probably much easier said than done....

gratiz

i also got a 450D dump now and it looks like its the same firmware. both gets compiled out of the same project.

450D:

ROM:07810668 aFei00HostTorna DCB "fei(0,0) host:/tornado2.2/target/proj/juno/default/vxWorks h=100"
ROM:07810668 DCB ".100.100.100 e=100.100.100.200 u=target tn=targetname",0

1000D:
ROM:FF810668 aFei00HostTornado2_2Tar DCB "fei(0,0) host:/tornado2.2/target/proj/juno/default/vxWorks h=100"
ROM:FF810668 ; DATA XREF: ROM:off_FF81075Co
ROM:FF810668 DCB ".100.100.100 e=100.100.100.200 u=target tn=targetname",0

Maybe its enough to change the modell number @F8002014:

450D Model number:
00000176

1000D Model number:
00000254

gratiz

you can grab the firmware from here: http://chdk.setepontos.com/index.php?action=post;topic=2310.15;num_replies=19

but its the 1.0.9 firmware a dump of the 1.1.0 would be better :/

seb

Okay now with my fresh new account.
The only diffrence between 1.0.9 and 1.1.0 is the support for the new canon flash. So no importatant chnages were made. I think the 1.0.9 dump will it also do.
But hte question is now, whts the next step? I never worked with chdk before. Is there a 'quick start guide'?

speddish

Hi everyone, I'm new here and would know if there is any news, and if someone is still working on the 1000d project...
Bye

Edit: I'm a developer even if not experienced with this kind of matter... If there is something I can do I'm here!

jimajack

Good to see some activity with this one. I for one would love to see a custom firmware for the 1000D. It would be great if spot metering could be enabled.

Keep up the good work!

virility

would be sooo great, if you could change the 450d firmware into a 1000d firmware!!!

how far are you with this project?

paulpker121

Hats off to whoever is working on this!

I'd love spot metering, 3fps RAW, and ISO3200! Especially ISO3200.

Thank you all! Good luck with this project!