fi2 encoder/decoder

[ewavr]

Good news, user with nick Memset from russian forum post fi2 encoder/decoder sources (VS2008) - http://www.zshare.net/download/5442672723de0f15/ with comment:

How to get keys:
get somethere G9-100F full dump (8MB) and G10-100F full dump (8MB).
G9: G9-100F (D III key ?)
IV: 16 bytes starting from 0x3154D0 (in FW)
key: 16 bytes starting from 0x7E31F0 (in RomStarter)
G10: G10-100F (D IV key ?)
IV: 16 bytes starting from 0x387A3C (in FW)
key: 16 bytes starting from 0x7E368C (in RomStarter)

Warning: keys in keys.h are invalid (to avoid Canon complaint), read instruction above to get it from dumps.
edit: Link is changed to obtain up-to-date version.
I compiled it and it really works (can decode g9.fi2)!

[whim]

@ewavr

that's great news !! that opens up the possibility of having the 'firmware update' CHDK start method
available on all supported DryOS cams too, right ?
And I'm sure - when ready - it will make CHDK less confusing for noobs with new cams & large cards ...

wim 

edit: any idea how difficult it will be to find the addresses for the other DryOS cams ?

[ewavr]

any idea how difficult it will be to find the addresses for the other DryOS cams ?

It is very easy, reference to first key located at beginning of ROMStarter (0xFFFF0004), to find second key search "RSBNE   R1, R1, #0x10" instruction in code and next function uses second key.

I inspected A720 and SX100 firmwares, it have the same keys as for G9.
It is really great job.

Unfortunately I cannot test the packer, because I have VxWorks camera...

[PhyrePhoX]

finally! great job - to all those involved. now we are nearing 1.0.0 again

in order to avoid canon problems, we *could* set up a system so that the keys are NOT in svn but for example on the autobuild server only - or MAYBE extracted from the bins EACH time compilation is started (this means the keys are NOT permanently stored somewhere, only in RAM).
could you perhaps build a test CHDK *.fi2 for an owner of a dryos device to test?

edit: could you perhaps post a link to the russian forum (pm maybe)? google can translate it for me

[ewavr]

This encoder/decoder also needs porting to gcc/linux.

could you perhaps build a test CHDK *.fi2 for an owner of a dryos device to test?

Attached CHDK in fi2 format for G9 (1.00d and 1.00g(=1.00f)).
edit:

could you perhaps post a link to the russian forum (pm maybe)?

Unfortunately no, it was private correspondence (via PM in ixbt.com forum). Public part of this discussion starts here.
edit2: Unfortunately Google and www.translate.ru cannot translate this page - text remains in Russian.

[bongo_bingo]

Hi all,
I tested the g9-100g.fi.2, it loads on my 100f!

[PhyrePhoX]

could you perhaps post a link to the russian forum (pm maybe)?

Unfortunately no, it was private correspondence (via PM in ixbt.com forum). Public part of this discussion starts here.
edit2: Unfortunately Google and www.translate.ru cannot translate this page - text remains in Russian.

yeah, somehow google doesnt want to translate it. but it works when you cut & paste the text to whatever translating website/tool you are using. it's a funny mix between english & russian words, but you can get the overall meaning. thanks for the link.

Hi all,
I tested the g9-100g.fi.2, it loads on my 100f!

so, CHDK loads? this is great News!

[ewavr]

I tested the g9-100g.fi.2, it loads on my 100f!

Well, if it works, I attach compiled binaries here (without any warranties, please perform virus scan before run).
Tuning for different cameras:
 - copy diskboot.bin from CHDK to program folder instead of dummy diskboot.bin (probably not encoded for a590/ixus80)
 - change in my.map value 0x0000315A to real camera PID (0x315A is PID for G9).
 - change in pack.bat "-sys" key value to:
    'G9' for digic3 cameras without diskboot.bin encoding (a650/a720/sx100/s5/g9 etc.)
    'A590' for digic3 cameras with diskboot.bin encoding (a590/ixus80)
    'G10' for digic4 cameras

Then start pack.bat file, copy ps.fi2 file to card and test how "firm update" works...

edit: tested remotely (by e-mail) on SX100 (PID=0x315E), it works!

[PhyrePhoX]

great
now as i understand it, somebody somehow must translate it so it fits into the chdk toolchain somehow and can be executed on the autobuild servers (of course on local copies as well).
btw hacki and i were wondering in irc why so many great hackers/coders use windows

[whim]

why so many great hackers/coders use windows

i would say ... because Windows forces you to become a hacker just to keep it running:

if you don't it will run you - that's how it is designed, just take a look under the hood of Vista & 7 ... 

wim

edit: disclaimer: this in no way implies i consider myself great at either hacking or coding 

[Hacki]

I got it running under linux with some help of a friend Actually he got it running - (seba-geek.de - DDoS his website a little, he'll be happy about some hits)

http://mighty-hoernsche.de/chdk/fi2encdec.tar.bz2

There ya go. Even with a makefile.

[whim]

tried with attach+instructions from ewavr's Reply #7 on A590 101B, PID=0x0000315D

non-danced diskboot.bin -> pack.bat -> ps.fi2 -> "update error"
non-danced diskboot.bin -> pack.bat -> ps.fi2 -> dance -> "update error"
danced diskboot.bin -> pack.bat -> ps.fi2 -> "update error"
danced diskboot.bin -> pack.bat -> ps.fi2 -> dance -> "update error"

edit: now more understandable, i hope ...

[ewavr]

http://mighty-hoernsche.de/chdk/fi2encdec.tar.bz2
There ya go. Even with a makefile.

Yes, it works under Windows! (when I change in Makefile "-lz" to "libz.a"), SX100 boots.

[ewavr]

tried on A590 101B -> firm update error

With which version of packer?

should ps.fi2 be danced afterwards, maybe ?

Maybe no...

edit: "firm update error" means that PID or keys are invalid. If diskboot.bin is invalid, camera crashes.

[whim]

With which version of packer?

edit: see previous posts' edit: used archive+instructions from your post #7
edit2: used diskboot.bin freshly generated from trunk 688

wim

edit3: changes: pack.bat -> '-sys g9' to '-sys a590'
                       my.map -> 'HDR 0x000315A' to 'HDR 0x000315D'
         then tested as per my previous post