How to force camera out of PTP mode?

[fudgey]

Hi...

I was playing around with scriptable REC/PLAY mode switching and USB on my a570is 1.00e and I've gotten a bit stuck trying to exit PTP mode to continue with REC mode. The problem is that I can either crash the camera or cleanly power off but I can't get back to REC mode after a PTP transfer without physically removing the USB cable (yes, I could cook up the electronics to do that but I'd rather not).

This problem isn't surprising, because even without CHDK the camera powers off if I switch it to REC mode before removing the USB cable (this only happens if there's a computer software on the other end that activates a PTP session; if I set hal in Ubuntu to ignore the camera all is well).


I've found that the firmware functions AC:PB2Rec() and AC:Rec2PB() somewhat work for switching between REC and PLAY modes when called from Lua (there are some caveats, like PB2Rec must first be called with lens closed or Rec2PB won't work, calling PB2Rec in REC mode crashes the cam, and CHDK and even get_mode() get confused about which mode is active... but shooting and USB both work).

So the question is, does someone (ewavr?) have an idea how to stop PTP, for instance by making the camera believe USB cable has been detached? I tried some things with these without success:

NHSTUB(EnterToRecFromPlay, 0xffea3f10)
NHSTUB(EnterToPlayFromRec, 0xffea3f64)
NHSTUB(PB2Rec, 0xffc119b8)
NHSTUB(Rec2PB, 0xffc119f8)
NHSTUB(SetUSBToDCPMode, 0xffe10dc4)
NHSTUB(ForceQuitPTPMode, 0xffd8e1a0)
(that last one is an unlucky guess for a string that sounded very promising)

I tried looking into the string DisconnectUSBCable but it's referenced dynamically from a list of strings and that code is a bit too complex for me to unravel.

There's been some talks about keyboard override of the rec/play switch, but couldn't find the code (best I could find was one sdm changelog mentioning it but it's nowhere to be found in more recent sdm source or its scripting manual). But a keyboard hack shouldn't work either because as I mentioned, the camera powers off if it's switched to REC mode during a PTP session.

[ewavr]

How about "logical" disconnecting USB cable from camera? In any kbd.c present code like:

if (conf.remote_enable) physw_status[2] = physw_status[2] & ~(SD_READONLY_FLAG | USB_MASK);

which "disconnects" cable from camera.

edit: In my private build camera stays in PTP mode if camera is switched to record mode.
   

[PhyrePhoX]

btw here is the source for the keyboard rec/play override: CHDK Mode Dial Support

edit: hm, i thought this mod was able to control play/rec, but looking at the source, i think it doesnt O_o

[fbonomi]

phyrphox, supporting rec / playback support switch is very similar to mode dial support. It's just an issue of changing masks and bits in the same variables.

In effects, I am now playing with an Ixus 80 where there is no dial and the rec / playback switch has a third position (photo / video / playback).

I have been anyway able to switch mode.

But I am afraid what fudgey is saying happens at a much lower level, PTP mode being somehow an "override" for all the modes.

[zeno]

Phyrephox is right, the source on my website does not have the record/playback switch (which I built just for the a570 for someone). As fbnomi says, it was a relatively simple addition. I'll be making a diff (against the latest Allbest) available in the next day or so.

I'm very interested in how to do this mode switching on cameras such as the Ixus 80, my own attempts to figure out what to do on an Ixus 70 failed completely.

[fudgey]

How about "logical" disconnecting USB cable from camera? In any kbd.c present code like:

if (conf.remote_enable) physw_status[2] = physw_status[2] & ~(SD_READONLY_FLAG | USB_MASK);

which "disconnects" cable from camera.

Thanks. I now tried

void kbd_disable_usb(void)
{
    physw_status[2] = physw_status[2] & ~(SD_READONLY_FLAG | USB_MASK);
} 

and the camera still crashes at PB2Rec().

edit: In my private build camera stays in PTP mode if camera is switched to record mode.

How does that happen? With these?
NHSTUB(DisableNotificationPTP, 0xFFE4D6E4)
NHSTUB(EnableNotificationPTP, 0xFFE4D6F8)

They are laid out similarly in a570 1.00e but could you educate me how to deduce those those entry points from the disassembly?

[ewavr]

How does that happen? With these?
NHSTUB(DisableNotificationPTP, 0xFFE4D6E4)
NHSTUB(EnableNotificationPTP, 0xFFE4D6F8)

Not here. DisableNotificationPTP() prohibits the "black camera screen" on USB transfer.

See usb_controller_magic camera variable:
if (get_usb_power()) usb_controller_magic=0; // when camera switched to record mode
if (get_usb_power()) usb_controller_magic=1; // when camera switched to playback mode

For A570 address of this variable is 0x53B20.

They are laid out similarly in a570 1.00e but could you educate me how to deduce those those entry points from the disassembly?

In generally, these functions  can be found as follows (my example for a570 1.01a. Why not 1.00e explained below):
 - search in "string window" for function name:

ROM:FFD8E11C aEnablenotificationptp DCB "EnableNotificationPTP",0 ; DATA XREF: ROM:FFD8E0C8

Jump to reference (ROM:FFD8E0C8):

ROM:FFD8E0C8                 DCD aEnablenotificationptp ; "EnableNotificationPTP"
ROM:FFD8E0CC                 DCD loc_FFD8DF8C       

Here at FFD8E0C8 pointer to function name, at FFD8E0CC pointer to entry point. So, address of EnableNotificationPTP is
FFD8DF8C:

ROM:FFD8DF8C loc_FFD8DF8C                            ; DATA XREF: ROM:FFD8E0CCo
ROM:FFD8DF8C                 LDR     R2, =0x53B28    ; "Canon A-Series Firmware"
ROM:FFD8DF90                 MOV     R3, #1          ; Rd = Op2
ROM:FFD8DF94                 MOV     R0, #0          ; Rd = Op2
ROM:FFD8DF98                 STR     R3, [R2]        ; Store to Memory
ROM:FFD8DF9C                 MOV     PC, LR          ; Rd = Op2

But very starange thing. In my dump of a570 1.00e I see:

ROM:FFD8E054                 DCD aEnablenotificationptp ; "EnableNotificationPTP"
ROM:FFD8E058                 DCD loc_FFD8DF18

and....

ROM:FFD8DF18                 LDR     R8, [SP,#0x18]  ; Load from Memory
ROM:FFD8DF1C                 TST     R1, R8          ; Set cond. codes on Op1 & Op2
ROM:FFD8DF20                 BNE     sub_FFD8DF44    ; Branch
ROM:FFD8DF24                 B       loc_FFD8DF2C    ; Branch

Maybe dump of A570 1.00E is broken. Dump from drop.io have same error.  Maybe error was made at dump blinking.
Can you make new dump of your camera (using universal dumper or modified dump_memory() function in core/main.c)?

[fudgey]

Not here. DisableNotificationPTP() prohibits the "black camera screen" on USB transfer.

See usb_controller_magic camera variable:
if (get_usb_power()) usb_controller_magic=0; // when camera switched to record mode
if (get_usb_power()) usb_controller_magic=1; // when camera switched to playback mode

For A570 address of this variable is 0x53B20.

Ok, will look in to that later.

In generally, these functions  can be found as follows (my example for a570 1.01a. Why not 1.00e explained below):

Ah, now that you reminded me I've done that before but forgot all about it. 

Maybe dump of A570 1.00E is broken. Dump from drop.io have same error.  Maybe error was made at dump blinking.
Can you make new dump of your camera (using universal dumper or modified dump_memory() function in core/main.c)?

The original & old blinked dump from >year ago was broken, there is/was a newer one from universal dumper or internal memdump out there that gives a saner result:

Code: ASM

1. ffd8df18:       e59f200c        ldr     r2, [pc, #12]   ; ffd8df2c: (00053b28)
2. ffd8df1c:       e3a03001        mov     r3, #1  ; 0x1
3. ffd8df20:       e3a00000        mov     r0, #0  ; 0x0
4. ffd8df24:       e5823000        str     r3, [r2]
5. ffd8df28:       e1a0f00e        mov     pc, lr

The one in drop.io is significantly different from mine in a binary diff when cropped to same length so I guess it's the old broken one from some old collection.

[fe50]

...The original & old blinked dump from >year ago was broken, there is/was a newer one from universal dumper or internal memdump out there that gives a saner result:
...The one in drop.io is significantly different from mine in a binary diff when cropped to same length so I guess it's the old broken one from some old collection.

Can you pls. upload your dump somewhere (e.g. at zShare), then i'll replace the broken one (from GrAnd's old packages) on drop.io...done.

[fudgey]

I think I've got it now... didn't test it much, but after I fixed entry point for "Force Quit PTP Mode" and added a call to "RefreshUSBMode" after it (got the idea from ewavr's a710 remote code), it looks like I'm now able to get back to REC mode from play mode PTP transmission with AC:PB2Rec. I wouldn't be surprised if other means (keyboard hack) of switching between REC and PLAY could work as well. The other ways should be preferred, since PB2Rec/Rec2PB have issues as I mentioned above.

Basically this means it should now be possible to write a webcam timelapse script that stores images on the PC, for instance by having the PC poll USB for the camera (Lua switches to play mode after each image to wait for PC to download), PC then gets & removes all new images, then have the script either wait for the PC to transfer some dummy file to the camera or have Lua wait for the new images to disappear and switch back to REC mode for some more shooting action.

One other thing that would be good to figure out is how to have the camera keep the lens out when switching to play mode while usb cable is connected (because my a570is seems to always instantly hide the lens when switching to PLAY from REC, if USB is connected even though it normally doesn't).

[zeno]

I wouldn't be surprised if other means (keyboard hack) of switching between REC and PLAY could work as well. The other ways should be preferred, since PB2Rec/Rec2PB have issues as I mentioned above.

I've produced a diff (against rev596) of my 'dial mode' changes for the a560, a570 ad a720, which include the ability to switch between record and play on the a570. However I don't know where to put the diff. Where do such things go?

[fudgey]

I've produced a diff (against rev596) of my 'dial mode' changes for the a560, a570 ad a720, which include the ability to switch between record and play on the a570. However I don't know where to put the diff. Where do such things go?

If you can't think of anything better, try the old thread at http://chdk.setepontos.com/index.php/topic,488.0.html.

[fe50]

...However I don't know where to put the diff. Where do such things go?

You can upload it to the CHDK Bugtracker, it's not only for bugs, also for diff's & patches, language files, docus, scripts, tools etc., files up to 2MB can be uploaded.

btw - on the Ixus 860 you can switch between playback and record mode with the PLAY button, so a keyboard hack should be possible.

[zeno]

My patch (for the A560, A570 and A720) is now on the Bugtracker -  0000118: Diff file to provide dial mode switching in scripts - CHDK Bugtracker