SX110IS - howto start porting

nomi_68k

Hi, I'm a newbie of CHDK with some knowledge of assembly (but not ARM assembly :'( ).
I did the dump of the firmware of my SX110IS and I disassembled it with IDA, helped by some sigs and idc.
The problem is that I can't find in all the wiki a full and well structured tutorial on how to proceed with the porting of CHDK.

Can someone help me with a good link?

Until now I found the first two parameters for the porting of CHDK on this camera:

char *hook_raw_image_addr()
{
//Found at ROM:FFE60B00
// ROM:FFE60B50 LDR R6, =0x10805040
// ...
// ROM:FFE60BA8 MOV R1, R6
// ROM:FFE60BAC ADR R0, aCrawBuffP ; "CRAW BUFF %p"

return (char*)0x10805040;
}

long hook_raw_size()
{
// Found at ROM:FFE60B00
// ROM:FFE60BB4 LDR R1, =0xEC04F0
// ROM:FFE60BB8 ADR R0, aCrawBuffSizeP ; "CRAW BUFF SIZE %p"
// ROM:FFE60BBC BL sub_FFCE7000

return 0xEC04F0;
}

Thanks for any help.

=============
My camera info is:
--------------------------
Canon PowerShot SX110 IS
P-ID:3192 PAL D

Firmware Ver GM1.00B
NoError
Jun 25 2008 15:08:34
---------------------------
Adj Ver.009.006

IS Firm Ver. 3.00
IS Param Ver. 3.00
---------------------------

ewavr

nomi_68k
long hook_raw_size()
{
return 0xEC04F0;
}

14 bit RAW? 😛

reyalp

nomi_68k
Hi, I'm a newbie of CHDK with some knowledge of assembly (but not ARM assembly :'( ).
I did the dump of the firmware of my SX110IS and I disassembled it with IDA, helped by some sigs and idc.
The problem is that I can't find in all the wiki a full and well structured tutorial on how to proceed with the porting of CHDK.

Can someone help me with a good link?

Nope. Assuming you've already found For Developers - CHDK Wiki no better link exists. Nor is one likely to appear, because step by step tutorials aren't a substitute for understanding.

If you cannot figure out what you need to do based on examining the current sources and pages found under For Developers - CHDK Wiki you need to study them further or give up. Basically, you have to make everything under loader and platform for your camera, as described in Adding support of a new camera. You can refer to existing ports to verify that you've correctly identified the corresponding things in your port, and to understand what those files do in the first place. There is no short cut, you have to actually understand how CHDK works to make a successful port. The best place to get this understanding is from the source. That's a lot of work, but only a small part of the effort needed to get your port running.

This thread: How does CHDK start running may help you get started.

If you are unfamiliar with ARM architecture and assembler, refer to the excellent documentation available freely from ARM. There's links to the most pertinent documents in Developer Technical Documents. Assuming you have sufficient general understanding of assembler and computer architecture, you can easily teach yourself everything you need to know about ARM from there.

If you have specific questions about particular aspects CHDK, there are people here who will gladly answer them.

PhyrePhoX

you should also read the huge thread about the g9 porting (for example, there are more similar threads for different cameras)

nomi_68k

ewavr
14 bit RAW? 😛

The SX100IS digicam has:
long hook_raw_size()
{
return 0x9DCCE0;
}

It's a 8Mpixels, so .... 10 bit RAW??? 😐:

I don't know... 🧑‍🎄

nomi_68k

reyalp
Nor is one likely to appear, because step by step tutorials aren't a substitute for understanding.

I hope to be able to explain my point without misunderstanding due to my bad english.
I know that you are right about the necessity to understand all the process. And I know that all GPL software are done by the efforts of volunteers with no obligation.
So I'm really grateful to all of you.
But.... hey boys.... this is the most hard way! 😀
In my perspective, a tutorial could be useful only to organize some little information as:
1) The list of functions that anyone must find into a disassembled firmware;
2) The list of hardware pointers (leds, keyboard,free RAM ecc..)

Anyway, why I can find only few IDA database (idb) of disassembled firmware? For example it will be useful for me to find the SX100IS firmware fully disassembled.

Thanks again and happy new year! 🧑‍🎄

ewavr

nomi_68k
It's a 8Mpixels, so .... 10 bit RAW??? 😐:

Yes, 10 bit RAW for all CHDK ported cameras.

Anyway, why I can find only few IDA database (idb) of disassembled firmware?

Do it yourself in 10-20 minutes from dump using IDA scripts and signatures for CHDK (Loading dump to IDA - CHDK Wiki).

For example it will be useful for me to find the SX100IS firmware fully disassembled.

Maybe not only SX100, but also A650, A720 (it seems that these CHDK ports are complete and bug-free).

nomi_68k

ewavr
Yes, 10 bit RAW for all CHDK ported cameras.

Sorry, I can't understand:
10 bits for every channel (R, G and B) for a total of 30 bits or a total of 10 bits?
In the second case is the sensor able to record 1024 colours only?? :'(

Thanks

fudgey

nomi_68k
10 bits for every channel (R, G and B) for a total of 30 bits or a total of 10 bits?
In the second case is the sensor able to record 1024 colours only?? :'(

10 bits for each channel, but we don't have RGB pixels; it's a Bayer matrix: http://en.wikipedia.org/wiki/Bayer_filter.

And the sensor is analog, there's just usually too much noise in point&shoot cameras to bother using more than 10 bits (considering more bits require more processing power and memory i.e. time and money) so Canon doesn't even though the A/D converter in some schematic snippet was actually a 12-bit chip.

reyalp

nomi_68k
In my perspective, a tutorial could be useful only to organize some little information as:
1) The list of functions that anyone must find into a disassembled firmware;
2) The list of hardware pointers (leds, keyboard,free RAM ecc..)

If you look through an existing ports platform/<camera>/sub/<firmware version>/*.S these things are pretty obvious. See also include/lowlevel.h and platform/generic/*, and be sure you understand Signature finder - CHDK Wiki
The list of addresses you want is right there, and unlike a tutorial, it's never out of date!

You need to understand these things anyway. If you don't have the time/skill/energy to understand this part of CHDK, you won't make a successful port.

Anyway, why I can find only few IDA database (idb) of disassembled firmware? For example it will be useful for me to find the SX100IS firmware fully disassembled.

For any camera with a dump available, load the bin, apply the vxworks or dryos FLIRT, run the idc scripts. I suggest doing this with all the reference firmwares, and whatever camera is most similar to your own. You can also work backwards from the sig_ref*.txt or stubs_entry.S/stubs_entry_2.s from any camera.

nomi_68k

I'm starting to understand some things. 😀
So thanks very much for all you guys that are helping me.

With the "blink_g7" program (a little modified 😉 ) I can confirm the LED's address:

#define LED_AF 0xC02200C0 // AutoFocus
#define LED_BLUE 0xC02200C4 // printer button
#define LED_RED 0xC02200C8 // next to the play button, rather orange
#define LED_GRN 0xC02200CC // in the same position as above, but in green

I'have just modified the SX110IS section of the wiki with these informations.

fe50

@nomi_68k

Since the original DryOS CHDK.idc script does not run all sub scripts correctly, i use modified versions of the IDC scripts: ida-chdk-idc-dryos-singlerun.7z instead. The main script CHDK.idc runs all other scripts automatically, manual definition of the ROM_START address is not required anymore (MinEA() used instead).
This way you you can easily run all needed scripts with a single click...

PhyrePhoX

fe50 - this does not apply to vxworks i guess?

fe50

PhyrePhoX
fe50 - this does not apply to vxworks i guess?

No - GrAnd's DryOS CHDK.idc didn't call all needed (sub)scripts, so i thought this is only DryOS related...
Therefore (ok - also 'cause of my lazyness 😉 ) i modified the scripts for my needs.
This way i can use my A64-3400 machine as a stove...just starting 5 to 7 IDA sessions, loading the firmwares, applying the signatures, then start the CHDK.idc scripts - voila, after a recreative, long power walk (with great power metal mp3's on my shuffle as you know) over the cold (-12° C) & snowy (~6 cm) "swabian mountains" the dumps are disassembled, IDA is ready and sleeps, the room is warm & full of CPU exhaust 😁

Maybe i'll have a look to the VxWorks scripts, too...

OT-PS: You should be happy now, finally snow in Berlin 🧑‍🎄

PhyrePhoX

this would explain why i couldnt find some things sometimes when i had a dryos firmware loaded in ida. nice.
well, feel free to take a look at the vxworks idc as well 😉 i still wonder why you refuse to code for chdk and just do the (also much needed) "dirty work" in the wiki - thanks a million!
yeah, i'm quite happy it snowed in berlin, though in a big city snow tends to get really ugly after a few days, and this is the case now 🙁

nomi_68k

How can I find the correct value for RESTARTSTART?

I can follow the execution of the program (debugging with leds) along the loader....resetcode\main.c, but it can't reach the startup() into the platform\generic\main.c :'(

Thanks

nomi_68k

nomi_68k
but it can't reach the startup() into the platform\generic\main.c

Sorry for my mistake.
Now I can follow the boot process until the boot() into platform\sx110is\sub\100b\boot.c.

However I still need to understand howto find the correct value for RESTARTSTART

Thanks

whoever

nomi_68k
However I still need to understand how to find the correct value for RESTARTSTART

See here https://chdk.setepontos.com/d/2361/2 , if it helps

bcc139

Hi, I just got a camera and wish to help you on porting sx110 CHDK.

I'm quite new on IDA and assembly stuff. But I want to try.

Can you please create a project on http://www.assembla.com for sx110 porting such that everybody can share the code for the development ?

Thanks.

Obihoernchen

1. Thank you nomi_68k for your work!
2. I updated the Wiki and added the Porting features to it: http://chdk.wikia.com/wiki/SX110IS
3. maybe this: https://chdk.setepontos.com/d/2654 or this: https://chdk.setepontos.com/d/237 can help you too. I think they are nearly the same.