Eos 400d ( Rebel XTI )

[thaibv]

Hi,

@ahoffmannphotography
if you can see the blue led blink when turn on your 400d with a CF card in, your cam is ready for the hack,  it must be something wrong with firmware or .bin file.
please make sure your cam run lastest firmware ver: 1.1.1 and use your cam to format your card (don't format in windows).  then use cardtricks to make it bootable, use HxD to change label.

edit: if your card already have the hack installed and your cam hang, not bootup, format it in windows first, after that insert into your cam and format it again.

edit2: Please read the guide from Raingrove here: http://chdk.setepontos.com/index.php/topic,3290.msg38630.html#msg38630

[tetu_024]

I Followed the Instructions and they work great. One thing i would like to ask is how to does spot metering work. I managed to switch meter from partial to spot but i don't know which area is being metered? Does it work like center metering ?

[ahoffmannphotography]

wow just got it to work absolutely incredible!!!! Thanks everyone for your help! One more question, when i try to do the shutter actautions thing i get the .txt file and then search for "release" but it says that this word has not been found?

This is what I got (sorry for the long post):

  2373:  108110 [!] sz: 03, code: B8, hex: 03B800
  2374:  108110 [!] sz: 03, code: 8D, hex: 038D00
  2375:  108120 [MC] T:0002, S:0100, 46
  2376:  108120     sw:0184(0000)
  2377:  108120 [MC] T:0004, S:0100, 47
  2378:  108120     act:0141
  2380:  108120 [!] sz: 04, code: 31, hex: 04310101
  2381:  108120 [MC] T:0001, S:0100, 48
  2382:  108120     info:0049
  2383:  108120 [STM] event: 1, 00:00:000, 0
  2385:  108130 [!] sz: 04, code: 74, hex: 0474EF01
  2386:  108140 [MC] T:0001, S:0100, 49
  2387:  108140 [MAIN] Temp. 239(EF)
  2388:  108140 [FACE] Temperature:31 TempGain:0
  2389:  118760 [!] sz: 04, code: A7, hex: 04A70000
  2390:  118760 [!] sz: 04, code: A8, hex: 04A80000
  2391:  118760 [!] sz: 05, code: 8C, hex: 058C000000
  [TFT-OLC] Notify Change.
------------------
--- Change OLC ---
------------------
 String   :
2392:  118760 [!] sz: 0A, code: 81, hex: 0A815016000044003000
  2393:  118760 [!] sz: 04, code: 80, hex: 04800000
  2394:  118760 [!] sz: 04, code: 80, hex: 04800100
  2395:  118760 [!] sz: 03, code: 8D, hex: 038D00
  2396:  118760 [!] sz: 03, code: 8D, hex: 038D00
  2397:  118760 [!] sz: 03, code: 51, hex: 035101
  2398:  118760 [MC] T:0002, S:0100, 50
  2399:  118770     sw:0167(0000)
  2400:  118770 [MC] T:0002, S:0100, 51
  2401:  118770     sw:0168(0000)
  2402:  118770 [MC] T:0004, S:0100, 52
  2403:  118770     act:0140
  2404:  118770 [MAIN] Olc Counter 0000
  2405:  118770 [MC] T:0004, S:0100, 53
  2406:  118770     act:0129
  2407:  118770 [MC] T:0004, S:0100, 54
  2408:  118770     act:0128
  2409:  118770 [MC] T:0004, S:0100, 55
  2410:  118770     act:0128
  2411:  118770 [MC] T:0004, S:0100, 56
  2412:  118770     act:0141
  2413:  118770 [MC] T:0004, S:0100, 57
  2414:  118770     act:0141
  2415:  118770 [MC] T:0001, S:0100, 58
  2416:  118770     ctrl:0081
  2417:  118770 [MAIN] Idle to GUI.
  2418:  118770 [!] sz: 04, code: 74, hex: 0474EF01
  2419:  118780 [MC] T:0001, S:0100, 59
  2420:  118780 [MAIN] Temp. 239(EF)
  2424:  118780 [MC] T:0012, S:0100, 60
  2425:  118780 [MC] T:0012, S:0100, 61
  2428:  118790 [FACE] Temperature:31 TempGain:0
  2431:  118790 [!] sz: 04, code: 74, hex: 0474EF01
  2432:  118790 [MC] T:0001, S:0100, 62
  2433:  118790 [MAIN] Temp. 239(EF)
  2434:  118790 [FACE] Temperature:31 TempGain:0
  2435:  118810 [!] sz: 0A, code: 81, hex: 0A81502C000054103000
  2436:  118810 [MC] T:0004, S:0100, 63
  2437:  118810     act:0129
  2438:  118860 [MC] T:0012, S:0100, 64
  2440:  118880 [!] sz: 03, code: 8D, hex: 038D00
  2441:  118880 [MC] T:0004, S:0100, 65
  2442:  118880     act:0141
  2447:  118900 [MC] T:0007, S:0100, 66
  2448:  118900 [MAIN] StartFaceSensor.
  2449:  118900 [MAIN] FaceSensor On(0)
  2450:  118900 [MAIN] cannot TFT OLC. 1, 0, 00000002
  2451:  118900 [MC] guimode_idle
  2452:  118900 [MC] GUI Changed :1
  2453:  118900 [!] sz: 0A, code: 81, hex: 0A81502D000054003000
  2454:  118900 [STM] event: 1, 00:00:000, 0
  2455:  118900 [MC] T:0004, S:0002, 67
  2456:  118900     act:0129
  2457:  118900 [FACE] StartFaceSensorReadyToActive: state = READY[2]
 

[ahoffmannphotography]

 2458:  118900 [DISPPOW] Turn Off Start
  2459:  118900 [LCD] DisableLcdController
  2460:  118920 [MC] T:0028, S:0002, 68
  2461:  118920 [MAIN] TFT OLC
  2462:  118920 [LCD] EnableLcdBackLight
  2463:  118920 [FACE] FaceStatus: state =  0
  2467:  118920 [MC] T:0006, S:0002, 69
  2474:  118930 [MC] T:0007, S:0002, 70
  2475:  118930 [MC] GUI Changed :7
  2476:  118930 [STM] event: 1, 00:00:000, 0
  2483:  119060 [DISPPOW] Turn Off Complete
  2484:  119060 [DISPPOW] Turn On Start
  2500:  119310 [LCD] EnableLcdController
  2501:  119310 [DISPPOW] Turn On Complete
  2502:  119490 [!] sz: 0A, code: 81, hex: 0A81502D000054003000
  2503:  119490 [MC] T:0004, S:0002, 71
  2504:  119490     act:0129
  2505:  120040 [!] sz: 0A, code: 81, hex: 0A81502D000054003000
  2506:  120040 [MC] T:0004, S:0002, 72
  2507:  120040     act:0129
  2508:  120540 [!] sz: 0A, code: 81, hex: 0A81502D000054003000
  2509:  120540 [MC] T:0004, S:0002, 73
  2510:  120540     act:0129
  2511:  121090 [!] sz: 0A, code: 81, hex: 0A81502D000054003000
  2512:  121090 [MC] T:0004, S:0002, 74
  2513:  121090     act:0129
  2514:  121590 [!] sz: 0A, code: 81, hex: 0A81502D000054003000
  2515:  121590 [MC] T:0004, S:0002, 75
  2516:  121590     act:0129
  2517:  122140 [!] sz: 0A, code: 81, hex: 0A81502D000054003000
  2518:  122140 [MC] T:0004, S:0002, 76
  2519:  122140     act:0129
  2520:  122640 [!] sz: 0A, code: 81, hex: 0A81502D000054003000
  2521:  122640 [MC] T:0004, S:0002, 77
  2522:  122640     act:0129
[TFT-OLC] Notify Change.
------------------
--- Change OLC ---
------------------
 String   :
 Av     : F1.8
  2523:  122820 [!] sz: 05, code: 8C, hex: 058C000000
  2524:  122820 [!] sz: 04, code: 80, hex: 04800000
  2525:  122820 [!] sz: 0A, code: 81, hex: 0A815016000044003000
  2526:  122820 [MC] T:0004, S:0002, 78
  2527:  122820     act:0140
  2528:  122820 [MAIN] Olc Counter 0000
  2529:  122820 [MC] T:0004, S:0002, 79
  2530:  122820     act:0128
  2531:  122820 [MC] T:0004, S:0002, 80
  2532:  122830     act:0129
  2534:  128210 [!] sz: 04, code: AE, hex: 04AE0000
  2535:  128210 [MC] T:0002, S:0002, 81
  2536:  128210     sw:0174(0000)
  2537:  128220 [MC] T:0012, S:0002, 82
  2538:  128220 [MC] T:0012, S:0002, 83
  2539:  128240 [!] sz: 18, code: 90, hex: 1890010300000002FF015016004800000000501
  2540:  128250 [!] sz: 1A, code: 91, hex: 1A9100000005010000010100000000000001000
  2541:  128250 [!] sz: 16, code: 92, hex: 169200000000000000010000000000000000000
  2542:  128250 [!] sz: 04, code: 93, hex: 04930201
  2543:  128250 [!] sz: 04, code: 31, hex: 04310101
  2544:  128250 [MC] T:0005, S:0002, 84
  2545:  128250     info:0144
  2546:  128250     info:0145
  2547:  128250     info:0146
  2548:  128250     info:0147
  2549:  128250 [MC] T:0001, S:0002, 85
  2550:  128250     info:0049
  2551:  128260 [STM] event: 1, 00:00:000, 0
  2552:  128260 [STM] event: 1, 00:00:000, 0
  2553:  128260 [STM] event:12, 00:00:000, 0
  2554:  128260    SB : r-----FF, 22
  2555:  128260 [MC] T:0012, S:0002, 86
  2556:  128260 [!] sz: 03, code: 5C, hex: 035C01
  2557:  128260 [MC] T:0001, S:0002, 87
  2558:  128260     ctrl:0092
  2559:  128260 [MAIN] Idle to GUI.
  2560:  128260 [AS] Interval : 126s
  2561:  128260 [MAIN] ActiveSweep to GUI at Terminate.
  2562:  128260 [STM] event:21, 00:00:000, 0
  2568:  128280 [MC] T:0006, S:0040, 88
  2577:  128330 [MC] T:0007, S:0040, 89
  2578:  128330 [AS] Interval : 126s
  2579:  128330 [MC] guimode_idle
  2580:  128330 [MC] GUI Changed :1
  2581:  128330 [STM] event: 1, 00:00:000, 0
  2584:  128340 [MC] T:0007, S:0040, 90
  2585:  128340 [MC] GUI Changed :3
  2586:  128340 [STM] event: 1, 00:00:000, 0
  2590:  128360 [AS] Interval : 126s
  2591:  128370 [MC] T:0006, S:0040, 91
  2592:  128370 [!] sz: 04, code: 62, hex: 04628001
  2593:  128370 [MC] T:0001, S:0040, 92
  2594:  128370     ctrl:0098
  2595:  128370 [GUI-AS] startMnActiveSweepExec
  2598:  128390 [MC] T:0006, S:0040, 93
  2599:  128400 [AS] Interval : 126s
  2600:  128400 [AS] Start Active Sweep.
  2601:  128420 [AS] Pattern : 1
  2602:  128420 [AS] AS_CHK success. L->H->L
  2603:  128420 [AS] go pattern.
  2604:  128420 [AS]    pulse 92.
  2608:  128470 [AS]    pulse 93.
  2609:  128520 [AS]    pulse 94.
  2610:  128570 [AS]    pulse 95.
  2611:  128630 [AS]    pulse 96.
  2612:  128680 [AS]    pulse 97.
  2613:  128730 [AS]    pulse 98.
  2614:  128780 [AS]    pulse 99.
  2615:  128830 [AS]    pulse 100.
  2616:  128880 [AS]    pulse 101.
  2617:  128930 [AS]    pulse 102.
  2618:  128980 [AS]    pulse 103.
  2619:  129030 [AS]    pulse 104.
  2620:  129080 [AS]    pulse 105.
  2621:  129130 [AS]    pulse 106.
  2622:  129180 [AS]    pulse 107.
  2623:  129230 [AS]    pulse 108.
  2624:  129280 [AS]    pulse 109.
  2625:  129340 [AS]    pulse 110.
  2626:  129390 [AS]    pulse 111.
  2627:  129440 [AS] End Active Sweep.
  2629:  129440 [MC] T:0006, S:0040, 94
  2630:  129440 [MAIN] Idle to GUI.
  2644:  129500 [MC] T:0007, S:0040, 95
  2645:  129500 [AS] Interval : 0s
  2646:  129500 [AS] Cannot act by OVERRUN
  2647:  129500 [MC] guimode_idle
  2648:  129500 [MAIN] RequestShutDown
  2649:  129500 [MC] GUI Changed :1
  2650:  129500 [DISPPOW] EnableTurnOnDisplay
  2651:  129500 [MC] T:0013, S:0040, 96
  2652:  129500 [STM] event: 1, 00:00:000, 0
  2653:  129500 [DISPPOW] Turn Off Start
  2654:  129500 [LCD] DisableLcdController
  2655:  129510 [FACE] StopFaceSensorToReady: state = ACTIVE[3]
  2656:  129510 [FACE] StopFaceSensorToIdle: state = READY[2]

[thaibv]

I Followed the Instructions and they work great. One thing i would like to ask is how to does spot metering work. I managed to switch meter from partial to spot but i don't know which area is being metered? Does it work like center metering ?

evaluative:  mesure whole viewframe
spot:  3% at the center
partial: ~10% at the center
center weight: not sure 40 or 60% viewframe but 10% at the center is most impacted

get the .txt file and then search for "release" but it says that this word has not been found?

You forget to set spot mesure before take out card and view file .txt
Read guide step 11

[ahoffmannphotography]

wonderful thanks got it to work. wow 30,000 shutter actuations didnt think itd be that many

[hersa_wex]

Hello,

I have some question.

You mention about

please make sure your cam run lastest firmware ver: 1.1.1 and use your cam to format your card (don't format in windows).  then use cardtricks to make it bootable, use HxD to change label.

But in the 3rd step update firmware with testfir.fir, then the cam will blank screen. Need to remove battery and card. Do I need to insert the CF card into the cam and on it to format the card? Then only use cardtrick to make my CF bootable?

3. empty your CF, download testfir.fir from http://chdk.setepontos.com/index.php/topic,1618.0.html and copy it into the root of your CF.

4. insert CF, and then run firmware update again using testfir.fir the screen will go blank. wait 5 minutes, turn off, take battery out and back in.

5. insert CF into card reader and perform a quick format.

Please advise. Thank you.

[thaibv]

Hi,

after run testfir.fir, pullout and reinsert battery, no need to remove CF card. then turn on and format the card using camera menu.

[hersa_wex]

Thanks for the reply. I did it. 

[cat]

Thanks a lot Thaibv 4 such a gr8 effort & hardwork to empower the cams with more features. 

The hack got installed successfully.
But strangely i managed w/o HxD step.Did not find anything like 0x47.  There were hex addresses only & as per ur earlier clue, the rows & columns didn't match to show number 47.

+ earlier, the cardtricks said my 4gb cf needs to be formatted as fat16 & now my cf shows up on computer as canon dc drive.

Nothing to worry since hack works like charm.  But just wana know more reg details of loading it correctly.I'm about to mod couple of my friends' Powershots too.

Wishlist-

1]Just like iso hack, can u hack shutter speed too? Precise in camera Long exposures more than 30 secs in bulb mode viz 60, 80, 120sec upto 5 min. So no need to pack/carry crappy 555 timer based intervalometer[& its battery] for night photography & startrails

2]Currently only 3 custom pic.styles are supported. Can we have Custom profiles like 40D which remember  other settings like mode/metering/iso etc?

[thaibv]

Hi,
@cat
Sorry I'm wrong, Cardtrick only work with fat 16 (just edited my previous post)
So use your cam to format your 4g card then use HxD to change label.

Tried hack shutter speed already, but canon protect the shutter very carefully. Can set the speed to 1/5000, 1/8000 but when taking picture it change to 1/4000. Becoz it is a precise and expensive component so not try hard to hack it

[thaibv]

Hi again,
Have a day off today, The Nation Day of Vietnam (2 Sep.). Nowhere to go so playing with camera and code.

Here my lastest release http://code.google.com/p/400d/downloads/list
New:
- Correct Evaluative mode set (now you can open dialog and press set button to active Evaluative mode, dont have to move cursor)
- Focus frame pattern. add 42 more patterns for your 400d, dont know 40d, 50d or higher models have this feature or not.
  Not easy to make it work, but the final code is very simple.

How to choose Focus frame pattern:
Normal use:  
- Press focus frame button to show FP dialog, use main dial or Up/Down/Left/Right button to choose focus point.
- Press focus frame button again to close dialog.

Pattern use:
- Fast press forcus frame button twice to show FP dialog. if you hear a beep and the dialog showed, use Direct Print button to change pattern (if you press the focus frame button not fast enough, the dialog not showed).  
- Press focus frame again to return to default canon focus frame mode.  

Hope ours Direct Print button not died too soon

[gescheit]

Good news:) 

[Foldesa]

Hello again.
Sorry for a long time missed out, but I have very little time for programming.

thaibv you've made great process grats :-)

As I was trying to get AUTO ISO work I found out the correct values for shutter speeds. You can see them in the bottom of this post. The current shutter speed can be found at *(int*)(0x16b7c). So a simple "minimum shutter speed" auto iso can be written easily. But I didn't find any data corresponding to lens focal distance. This is required to make a really good auto iso.
In the next 3 weeks I can't access my laptop. Thaibv if you feel enough time on your hands, maybe you can implement a small while loop for a simple auto iso. If not i will post it in a few weeks.

Regards A

1/4000 0x98
1/3200 0x95
1/2500 0x93
1/2000 0x90
1/1600 0x8d
1/1250 0x8b
1/1000 0x88
1/800  0x85
1/640  0x83
1/500  0x80
1/400  0x7d
1/320  0x7b
1/250  0x78
1/200  0x75
1/160  0x73
1/125  0x70
1/100  0x6d
1/80   0x6b
1/60   0x68
1/50   0x65
1/40   0x63
1/30   0x60
1/25   0x5d
1/20   0x5c
1/15   0x58
1/13   0x55
1/10   0x53
1/8    0x50
1/6    0x4c
1/5    0x4b
1/4    0x48
0"3    0x45
0"4    0x43
0"5    0x40
0"6    0x3d
0"8    0x3b
1"     0x38
1"3    0x35
1"6    0x33
2"     0x30
2"5    0x2d
3"2    0x2b
4"     0x28
5"     0x25
6"     0x24 or 0x23
8"     0x20
10"    0x1d or 0x1c
13"    0x1b
15"    0x18
20"    0x15 or 0x14
25"    0x13
30"    0x10
Bulb   0x0c

[Zibri]

Hi again,
Have a day off today, The Nation Day of Vietnam (2 Sep.). Nowhere to go so playing with camera and code.

Here my lastest release http://code.google.com/p/400d/downloads/list
New:
- Correct Evaluative mode set (now you can open dialog and press set button to active Evaluative mode, dont have to move cursor)
- Focus frame pattern. add 42 more patterns for your 400d, dont know 40d, 50d or higher models have this feature or not.
  Not easy to make it work, but the final code is very simple.

How to choose Focus frame pattern:
Normal use:  
- Press focus frame button to show FP dialog, use main dial or Up/Down/Left/Right button to choose focus point.
- Press focus frame button again to close dialog.

Pattern use:
- Fast press forcus frame button twice to show FP dialog. if you hear a beep and the dialog showed, use Direct Print button to change pattern (if you press the focus frame button not fast enough, the dialog not showed). 
- Press focus frame again to return to default canon focus frame mode. 

Hope ours Direct Print button not died too soon

Nice work, but when shooting at 50 ISO all pictures are overexposed