drewm1980
Rookie
 Offline
Posts: 8
|
 |
« on: 13 / November / 2009, 02:00:19 » |
|
Welcome to the S90 porting thread! If you were already planning on working on a S90 port and actually know what you're doing, please free to join / hijack the thread. I'm new to CHDK and reverse engineering, but I'm an electrical engineer and I've done some DSP and microcontroller programming. I'm a grad student at UIUC in Champaign-Urbana, Illinois, USA. If you live in town and want to help on the port, please contact me at drewm1980@gmail.comCheers, Drew |
|
|
|
|
Logged
|
|
|
|
|
|
|
RaduP
|
|
« Reply #2 on: 13 / November / 2009, 09:03:43 » |
|
It is good that you are an electrical engineer. Grab a phototransistor, an oscilloscope, an USB to serial cable (you can use the COM port on the back of your PC if you have one, but it can be inconvenient to go with the oscilloscope under your desk).
The most important thing is to find the proper delay in blinking the LED, to synchronize it with the COM (ideally, 9600 bauds).
|
|
|
|
|
Logged
|
|
|
|
Camera Obscura
Newbie
Offline
Posts: 3
|
|
« Reply #3 on: 14 / November / 2009, 17:04:39 » |
|
From what I've read here I thought it wouldn't work, but I decided to go ahead and try doing a firmware dump on my S90 with Cardtricks/Udumper. Sure enough, no luck.  |
|
|
|
|
Logged
|
|
|
|
drewm1980
Rookie
Offline
Posts: 8
|
|
« Reply #4 on: 18 / November / 2009, 16:15:30 » |
|
Thanks for the links guys! I actually already have a huge pile of reflective object sensors lying around, and one of them might even still be hooked up to the analog input of an arduino running code that automatically sets the input threshold. How many KB should I be expecting for the firmware? If it's small, maybe I'll just dump it onto the arduino all at once.
Or should I keep it simple and put the phototransistor output through a comparator and into the mic input on my laptop? If someone already has slick software that can automate the re-digitization, I might as well take advantage of it.
Cheers,
Drew
|
|
|
|
|
Logged
|
|
|
|
drewm1980
Rookie
Offline
Posts: 8
|
|
« Reply #5 on: 18 / November / 2009, 17:35:53 » |
|
I was able to capture a .wav file that shows six spikes corresponding to the transitions of three pulses I generated by half-shuttering with the autofocus LED turned on. Hopefully at RS232 rates the exponential decay won't be an issue. My card reader will arrive tomorrow, so I'm done for the day. Let me know if anyone gets the camera to respond to firmware or blink out it's firmware. Cheers, Drew
|
|
|
|
|
Logged
|
|
|
|
drewm1980
Rookie
Offline
Posts: 8
|
|
« Reply #6 on: 20 / November / 2009, 17:11:41 » |
|
I'm having trouble getting the camera to respond to firmware Formatted a 128MB SD card using the shell script from http://cowboytronic.com/chdk/chdk_prep.dmg. Seemed to work exactly as advertised. By default this created partitions: CHDK, FAT16, 16 MB CAMCARD, FAT32, the remaining 105 MB For the following I'm ignoring the CAMCARD partition and using the CHDK partition. Verified that the camera does indeed display more detailed firmware information with a "Ver.req" file on the disk. The info matches what is on the wiki. Deleted the Ver.req file Tried using the diskboot.bin from led_finder_by_jeff666.zip downloaded from http://drop.io/chdkdevelopment:Copied the diskboot.bin file to the card, made sure my mac didn't add any extra files or screw up the permissions. Locked the card and inserted it into camera. Camera did not show any change of behavior aside from warning me that the disk is locked. Tried both booting in both shooting mode and play mode, and with the file named diskboot.bin and DISKBOOT.BIN Please chime in if you notice that I forgot something, otherwise I figure my next step is to buy/borrow a cheap supported camera and verify that the blinker works on that camera. Thanks! |
|
|
|
|
Logged
|
|
|
|
|
whim
|
|
« Reply #7 on: 20 / November / 2009, 17:51:45 » |
|
Hi drewm1980,
I'm not sure about this (never used jef666's ledblinker) but i know it dates from before encrypted DISKBOOT.BIN's,
so you will probably need to use dancingbits on it (you can find the source in the CHDK source /tools directory)
The newer cams use 2 or 3 as version parameter ( usage: dancingbits <in file> <out file> <version> )
judging by the link, you're on MacOS, so unfortunately i can't help you find a binary.
HTH,
wim
|
|
|
|
|
Logged
|
|
|
|
drewm1980
Rookie
Offline
Posts: 8
|
|
« Reply #8 on: 20 / November / 2009, 18:57:43 » |
|
Hi drewm1980,
... encrypted DISKBOOT.BIN's,
so you will probably need to use dancingbits on it (you can find the source in the CHDK source /tools directory)
The newer cams use 2 or 3 as version parameter ( usage: dancingbits <in file> <out file> <version> )
judging by the link, you're on MacOS, so unfortunately i can't help you find a binary.
Thanks wim! I'll try that. I'll be doing most of my work on Debian; was just tinkering around a bit on my mac laptop at home. I think I have the gcc arm cross compiler toolchain set up, but I haven't tested it yet. |
|
|
|
|
Logged
|
|
|
|
rachelkitty
Rookie
Offline
Posts: 19
|
|
« Reply #9 on: 31 / December / 2009, 19:33:50 » |
|
Having spent a chunk of the evening swapping cards in and out using the diskboot.bin and the LED finder code, I can confirm that the LED address for the S90 is 0xC0223030. Now, guess I'll need to try and dig out an old mouse to cannibalise...
EDIT: Can't find my soldering iron at present, and don't seem to have a spare photosensort of any sort. Will blink out firmware saturday if i can get the bits i need.
|
|
|
|
« Last Edit: 31 / December / 2009, 22:05:05 by rachelkitty »
|
Logged
|
|
|
|
drewm1980
Rookie
Offline
Posts: 8
|
|
« Reply #10 on: 01 / January / 2010, 21:47:22 » |
|
Having spent a chunk of the evening swapping cards in and out using the diskboot.bin and the LED finder code, I can confirm that the LED address for the S90 is 0xC0223030. Now, guess I'll need to try and dig out an old mouse to cannibalise...
Great news! How did you dance the binary? I never was able to get the camera to respond. If I were home I'd like to take another shot at dumping the firmware using your binary, but I won't be home for a couple weeks yet. Cheers, Drew |
|
|
|
|
Logged
|
|
|
|
rachelkitty
Rookie
Offline
Posts: 19
|
|
« Reply #11 on: 01 / January / 2010, 22:31:03 » |
|
Great news! How did you dance the binary? I never was able to get the camera to respond. If I were home I'd like to take another shot at dumping the firmware using your binary, but I won't be home for a couple weeks yet.
Cheers,
Drew
diskboot.bin of the jeff666 LED finder and danced version 3. Took a few compiles to binary search the address range. All being well, I should be able to pick up some components tomorrow and get the firmware blinked out, other software methods haven't proven successful so far. |
|
|
|
|
Logged
|
|
|
|
McAllister
Newbie
Offline
Posts: 2
|
|
« Reply #12 on: 02 / January / 2010, 01:56:51 » |
|
sounds like the first step is nearly done. can't expect chdk for my s90 but unfortunatly ive got no clue about c or assambler so i dont see a way to help out. as you can see im a newbie in this so if there is anything i can do pls bring it up here  |
|
|
|
|
Logged
|
|
|
|
|
ERR99
|
|
« Reply #13 on: 02 / January / 2010, 11:42:01 » |
|
I can confirm that the LED address for the S90 is 0xC0223030. Now, guess I'll need to try and dig out an old mouse to cannibalise...
I am currently working on the G11 CHDK port, and what i can say is, that the G11 also uses this adress for AF-Light. For dumping the G11 code via LED i used the grand_blink_g7 code with this delay for 9600 bps: "#define DEL 1260*2", maybe this is also need for the S90. Or if you use the "Blinker_Java_Version_by_Sirius", i used "#define DELAY_COUNT 154 " for a successfull 9600bps dump. The used HW of S90 and G11 are not so different i think, and so the delay values could be equal.  |
|
|
|
|
Logged
|
|
|
|
rachelkitty
Rookie
Offline
Posts: 19
|
|
« Reply #14 on: 02 / January / 2010, 14:34:35 » |
|
I am currently working on the G11 CHDK port, and what i can say is, that the G11 also uses this adress for AF-Light. For dumping the G11 code via LED i used the grand_blink_g7 code with this delay for 9600 bps: "#define DEL 1260*2", maybe this is also need for the S90. Or if you use the "Blinker_Java_Version_by_Sirius", i used "#define DELAY_COUNT 154 " for a successfull 9600bps dump. The used HW of S90 and G11 are not so different i think, and so the delay values could be equal. These days I have no machine with a serial port at all. I'll have to try soundcard. I have my doubts that this will work too well. EDIT: Spent far too long on this now, cannot get the adc.exe to do anything with the recordings at all and have no serial port to be able to do anything else with. OK, I dug out my old amiga for something with a serial port on and am dumping to that edit: can't seem to find a good distance for solid data transmission. |
|
|
|
« Last Edit: 02 / January / 2010, 20:07:21 by rachelkitty »
|
Logged
|
|
|
|
|
