EOS 550D / T2i / Kiss X4

[holamanola]

New camera!

So, let's start the effort on porting CHDK to this!

[avi70]

I think the first thing would be to get a dump from one of the camera owners.

I hope I get purchase this camera in the near future and start working on porting its firmware.

For me the first thing would be to re-enable the AF-Micro-adjustment menu that's available on the 50D and 7D.

See you here later :-)

[Hardcore]

I have the t2i.  Not sure how to get a dump, but if you need anything, let me know as I would like to help get some upgraded features on the t2i.

[JeremyOne]

I also have the t2i and am a programmer by trade. I would love to get this project started, but I am unfamiliar as to what the first steps are.

From what I've read around other places the first step is to try and get firmware dump, which means you need to modify a official firmware flasher to dump the ROM un-encrypted. Right so far?

I've found this file that seems to be the firmware for the t2i/550d: http://www.megaupload.com/?d=8ZEF4W5T

The name of the file is "Ver103_ServiceOnly.zip" and contains a "B2704280.FIR" file.

Using a un-scientific test (opening the file in a hex-editor) the number 1.0.6 appears in almost the first part of the file. That seems consistent with a 5D flash file that I found. Though that would mean the zip file at minimum was mis-labeled.

So far, I don't think anyone has actually loaded or flashed this firmware file on their camera. I will try and see if the firmware loads on my t2i tonight when I have access to it. I don't think I will flash it, but if I can see it at least come up in the menus, that would be a good sign.

If anyone else has a better idea let me know.

[JeremyOne]

Update: The firmware linked does load and gets to the second update screen that looks like:

Firmware update program
-----------------------------------
Upgrade Firmware?
1.0.6 -> 1.0.6

[Cancel][OK]
-----------------------------------

I decided not to try and upgrade the firmware, I am worried that the firmware is not in English, and this is my primary camera.

The firmware is originally from this post: http://www.cinema5d.com/viewtopic.php?f=38&t=10380&st=0&sk=t&sd=a&start=30#p77953

And the poster says "from my Italian friends". Does anyone know if there's a way to tell what language the firmware is for?

At any rate, I think the next step is to split the firmware into the flasher and the update, I've found "dissect_fw3_2.exe" that works on the 5d and 7d.

[JeremyOne]

I've split the firmware, but I'm unsure on how to tell if it was decoded properly.

Any ideas? I will do more research.

[Yarvieh]

Its usually easy to tell by looking for clear text strings in the binary (open up a decoded 500d firmware and the enctypted 550d one in a hex editor, even if you have no idea what it all means its fairly easy to pick out which one is the encrypted one) , problem with the 550d fw is that the double xor encryption they used on all other camera's appears to be no longer used, they didn't just changed keys they seemed to have changed algorhitm! Which means unless someone is able to dump the actual code in the camera so we can look at the code you're hosed for now.

[JeremyOne]

Yarvieh: Do you know what other methods of dumping would be most promising?

[Yarvieh]

No idea.

[JeremyOne]

I was not able to see any clear text in the firmware updater, I will investigate other methods of dumping.

Thanks for your help.

[holamanola]

JeremyOne, you should definitely check the magiclantern forum and site. Trammel Hudson (The guy behind the project) has already made some advances in the 7D firmware, which probably has a lot in common with the 550D.

In case you don't know the project, here it is: http://magiclantern.wikia.com/

[lorenzo353]

I'm pretty sure this -service- firmware is NOT xor encoded.

update:
JemeryOne, thanks for testing it

Lorenzo

[JeremyOne]

To get the update to show, you must put the FIR file in the root of your SD card, then navigate in the 550d menu to where the firmware version is shown. Press select on the firmware version number and the next screen should show the available fir files on your SD card.

I've attached a photo of the firmware selector menu.

I've also been doing some other searching on the encoding / encrypting method used on the 550d, and several other people have also concluded that it is not xor encoded.

The next thing I'll be trying are the Magic Lantern tools to see if I can update a version of their fake firmware to load on the 550d.

This is the first time I've attempted anything like this, so it may be slow going.

[lorenzo353]

Jeremy One,

one clue: compare content at offset 0xb0 and content at the payload offset for this firmware.
then content in any other firmware at 0xB0... your conclusion ?

Lorenzo

[lorenzo353]

at payload+0xc sorry