Eos 400d ( Rebel XTI )

[gratiz]

can someone tell me where i can grab a dump of the firmware on which this stuff work ?

i would like to port that stuff to the 1000D.

thanks

[thaibv]

Hi,

@Lefty, T.B., nikta
sorry for the late, i've just have a vacaction.
yeah, you are right, the last release have a bug.
Pls download the correct one here: http://depositfiles.com/files/jbygql51l

@denis-cubic
Shot many pic at iso 16, 32, 40, 50, 80 but i think it really iso 116, 132, 140, 150, 180 respectively

@photogenic
Really dont understand your question, each pic already have their own unique 4 digit number yet.

@gratiz
1000d is new model, you will lost guarranty if try this

[gratiz]

it doenst modify anything in flash. only in the ram so i dont think it can destroy anything.
i allready wrote a dumper for the firmware. deassembled it and now i want to search for the needed functions
offsets and try some of the first builds.

so maybe someone can help me out with a 400d dump to compare the functions ....

[thaibv]

it doenst modify anything in flash. only in the ram so i dont think it can destroy anything.

The test.fir change boot flags in your cam's cmos rom, so your cam can boot up from card.

Dont know whether 1000d use VxWork or DryOS, pls read other topics.
if it use vxwork, there are alot text string and code for debug. Let search for string ex: ISO, 1600, 800, 400, 200, Av,Tv, A-DEP... or longer: StartUp, FileCounter, FaceSensor, LcdController, GUI Changed.

 

[gratiz]

the 1000D uses vxworks like the 400D.

strings:
"host:/tornado2.2/target/proj/juno/default/vxWorks"
ROM:FF810008 aCopyright19992 DCB "Copyright 1999-2001 ARM Limited",0xA
ROM:FF810008                 DCB "Copyright 1999-2001 Wind River Systems, Inc."

sig also work fine

and the code also gets loaded to 0x1900 like with the 400D

ROM:FF8100DC                 MOV     R12, SP
ROM:FF8100E0                 STMFD   SP!, {R4,R11,R12,LR,PC}
ROM:FF8100E4                 SUB     R11, R12, #4
ROM:FF8100E8                 MOV     R4, R0
ROM:FF8100EC                 LDR     R3, =0x37840
ROM:FF8100F0                 SUB     R2, R3, #0x1900
ROM:FF8100F4                 MOV     R3, R2,LSR#2 
ROM:FF8100F8                 LDR     R0, =off_FFD51840
ROM:FF8100FC                 MOV     R1, #0x1900
ROM:FF810100                 MOV     R2, R3
ROM:FF810104                 BL      sub_FF81011C
ROM:FF810108                 MOV     R0, R4
ROM:FF81010C                 BL      usrInit
ROM:FF810110                 LDMDB   R11, {R4,R11,SP,PC}


i allready compared the dump with a 1.0.8 400D dump and its near the same. thats why it shouldnt be a big problem to port it to the 1000D.

ROM:FFFF439C aEos_develop    DCB "EOS_DEVELOP",0     ; DATA XREF: sub_FFFF4144+11Co
ROM:FFFF439C                                         ; sub_FFFF4144+138o ...
ROM:FFFF43A8 aBootdisk       DCB "BOOTDISK",0        ; DATA XREF: sub_FFFF4144+12Co
ROM:FFFF43A8                                         ; sub_FFFF4144+148o ...

is also there and ..

ROM:FFFF30B4 aAutoexec_bin   DCB "AUTOEXEC.BIN",0    ; DATA XREF: sub_FFFF3004+48o
ROM:FFFF30B4                                         ; sub_FFFF3004+6Co

[nicholas-c]

Great work on the ISO hack. Next thing 3200 in the menu and visual hack for the entire menu system?
60, 70, 80, 90, 100 second etc exposures would be useful, dont have a remote and holding shutter for bulb sucks

[tetu_024]

Could someone please help me on how to install it on my canon 400d. if i understand correctly the firware is loaded from the CF instead from the ROM of the camera. Thus if you replace the CF then the camera would boot from the original ISO? Thanks In Advance.

[T.B.]

Yes.

[raingrove]

HOWTO:

1. use a fully charged battery. you need CF card reader and windows. on a mac, use windows under bootcamp/vmware fusion.

2. update to latest firmware (1.1.1) by downloading the latest firmware, copying it into the root of CF, and running "update firmware" in the setup menu.

3. empty your CF, download testfir.fir from http://chdk.setepontos.com/index.php/topic,1618.0.html and copy it into the root of your CF.

4. insert CF, and then run firmware update again using testfir.fir the screen will go blank. wait 5 minutes, turn off, take battery out and back in.

5. insert CF into card reader and perform a quick format.

6. IF Card <= 4GB (fat12/fat16)

download cardtricks: http://chdk.wikia.com/wiki/Cardtricks run it, choose CF drive, tick "cf boot sector" and then click "make bootable."

ELSE IF card > 4GB (fat32)

use HxD : http://mh-nexus.de/en/downloads.php?product=HxD run as administrator, goto extras -> options -> security -> uncheck "open disk as readonly by default", then open CF card using the 5th button (cd, floppy and HDD icon) in the toolbar, then carefully write "EOS_DEVELOP" at 0x47 and "BOOTDISK" at 0x5C. save and exit.

7. download autoexec.bin from here: http://depositfiles.com/files/jbygql51l copy it into CF.

8. safely remove CF, insert it into camera, if the blue print led of the camera briefly lights up when the camera is turned on, the hack is successfully loaded.

9. to use additional ISO values, choose one of the 100,200,400,800,1600, and then push the print button to access more ISOs. (80/100/125/160/200/250/320/400/500/640/800/1000/1250/ 1600/2000/2500/3200)

ISO levels 16/32/40/50 can also be enabled if you go to menu and turn "shoot without CF" ON, but not sure if they really work (i see no difference.)

10. to use spot metering, go to metering selection screen, then push the print button. to go back to "evaluative metering", you have to select other metering modes first, and then back to "evaluative metering", because the camera thinks you are at "evaluative" although you are at "spot metering".

11. to view shutter actuation count, which was only viewable by canon themselves, go to menu, push print button, push menu button again twice, ("factory menu" appears), enter factory menu, then push print button to enter "debug mode". after a beep, go back and set spot metering. and you will see the camera writing something to the CF (CF light). eject CF, insert it into card reader, you will see a file called STDOUT.txt, search the textfile for "Release". there you see a number and that is the shutter count.

thanks very much thaibv and Foldesa of CHDK for this wonderful hack.

[thaibv]

Hi all,

@raingrove:
Thanks for a great guidance.

Let me make some comments.

4. insert CF, and then run firmware update again using testfir.fir the screen will go blank. wait 5 minutes, turn off, take battery out and back in.

The testfir.fir make changes to 400d's boot flags immediately, so count down from 10 after testfir.fir blank your display screen. No need to wait 5 minutes.


9. ......
ISO levels 16/32/40/50 can also be enabled if you go to menu and turn "shoot without CF" ON, but not sure if they really work (i see no difference.)

I think iso 16/32/40/50 are same as iso 160/132/140/150. Please test and post your comments so i can decide to keep them available or not

10. .... to go back to "evaluative metering", you have to select other metering modes first, and then back to "evaluative metering", because the camera thinks you are at "evaluative" although you are at "spot metering".

I will correct it soon and upload .bin file and source code too

-- ------FYI-------------
Dont have much time so no big Progress.   Realy got stuck finding how to make and display a custom dialog. Not success to understand Canon's CreateDialogBox function (in firmware). It is very complicated.  I dont know much about VXwork and Camera hardware. Still google for some documents.

so inform you some ideas
- Found out that there are alot focus point combinations others than Canon defaults such as cross; all points at top, at bottom, at left, at right; center point and 4 nearest points ...  i'm trying to make it work.
- Not sure if it can be enable focus confirmation for manual lens or not. if yes, you dont have to spend too much money  for AF confirm mount (i have some M42 lens  ).
- Can we partition CF card to protect boot loader and the bin file from format or erase.
- 60, 70, 80, 90, 100 second etc exposures would be useful, dont have a remote and holding shutter for bulb sucks (as requested by nicholas-c)

[raingrove]

2 sec self-timer would be nice.

[ahoffmannphotography]

Hi.
 So I dont know much about software codes and stuff like that. I was able to load the test firmware. But because my CF Card is formatted as FAT32 i need to change something with a hex editor. I have the editor but i dont know what 0x5C or 0x47 means. How do i find where to edit the hex code??
 Thanks so much!!!!!

[Lefty]

Hi ahoffmannphotography,

to find the address is not difficult.
Open your HxD and look to the left side. There are the offsets of the address.
If you want to find address 0x5C go to offset 00000050 (this is the row you want to find).
Now you have to find the right column... go to column 0C ... thats it you are on Address 0x5C.

The same for address 0x47: go to row 00000040 and to column 07

Now you can change the strings on the right side of the HxD window.

Hope this is helpful for you!

[Zibri]

Hi all,

@raingrove:
Thanks for a great guidance.

Let me make some comments.

4. insert CF, and then run firmware update again using testfir.fir the screen will go blank. wait 5 minutes, turn off, take battery out and back in.

The testfir.fir make changes to 400d's boot flags immediately, so count down from 10 after testfir.fir blank your display screen. No need to wait 5 minutes.


9. ......
ISO levels 16/32/40/50 can also be enabled if you go to menu and turn "shoot without CF" ON, but not sure if they really work (i see no difference.)

I think iso 16/32/40/50 are same as iso 160/132/140/150. Please test and post your comments so i can decide to keep them available or not

10. .... to go back to "evaluative metering", you have to select other metering modes first, and then back to "evaluative metering", because the camera thinks you are at "evaluative" although you are at "spot metering".

I will correct it soon and upload .bin file and source code too

--------FYI-------------
Dont have much time so no big Progress.   Realy got stuck finding how to make and display a custom dialog. Not success to understand Canon's CreateDialogBox function (in firmware). It is very complicated.  I dont know much about VXwork and Camera hardware. Still google for some documents.

so inform you some ideas
- Found out that there are alot focus point combinations others than Canon defaults such as cross; all points at top, at bottom, at left, at right; center point and 4 nearest points ...  i'm trying to make it work.
- Not sure if it can be enable focus confirmation for manual lens or not. if yes, you dont have to spend too much money  for AF confirm mount (i have some M42 lens  ).
- Can we partition CF card to protect boot loader and the bin file from format or erase.
- 60, 70, 80, 90, 100 second etc exposures would be useful, dont have a remote and holding shutter for bulb sucks (as requested by nicholas-c)

GREAT WORK.
Focus point patterns could be cool.
Also different self timer options could be great.

Keep it up, dude!

[ahoffmannphotography]

Hi,

First of all thanks Lefty for your help. I had absolutely no idea what all that means. But I think I did something wrong.
 So i followed the instructions, and  when I pop in my CF card with the .bin file., my camera turns on because I can see the green light turn on, but the screen is black and the camera is unresponsive. When I remove the CF card, the camera works fine so I must have done something wrong with the CF Card.

http://farm3.static.flickr.com/2509/3862382228_8a256c81dc_o.png

This is a screenshot of the hex editor and what I did to the CF Card. I was wondering if anyone could tell me if i did anything wrong on that step of the process. If not what else could I have done wrong?

 I greatly appreciate the help!


Edit:
  I also tried modifying my fat16 CF card by changing he strings at 0*40 and 0*2B but that gets the same results. Do I need to extract the .bin file?

Edit2:
 I just redid the entire process. Now when i turn my camera on and look through the viewfinder, I see the green bar on the bottom but I cant take a picture. The AF works when i press the shutter down half way but nothing happens when I push it down all the way. The screen is black and no other buttons seem to work. When i try to turn off my camera it wont so I have to remove the battery. And the blue light does not light up when I turn the camera on. Can anyone help me?