EOS 550D / T2i / Kiss X4

[lorenzo353]

the 500D got announced in march'09 and we only just got a FW update for that one so it could be quite a while before we'll see an 'official' update

new lenses and a 580 flash remplacement are coming, which requires updates...

[luastoned]

new lenses and a 580 flash remplacement are coming, which requires updates...

Sounds good, I hope that someone can wrap up something cool.

Any updates yet?

[Tarren]

Speaking of the recent firmware update for the T2I...........I purchased the Kiss 4 for my mother-in-law (problem starts there <grin>)...........and she only speaks Spanish/Portuguese.

I think the model I bought was made for the Japanese market, just has Japanese and English in the system.

I've looked everywhere, tried everything, I need to find a way to install the other languages.

Does anyone have a language dump, or a way to install the other languages?  I was hoping this firmware update would fix it, but nope.

[lorenzo353]

See 'setup menu'
http://www.dpreview.com/reviews/canoneos550d/page10.asp

Lorenzo

[holamanola]

New firmware update!

Download it here:

http://www.canonrumors.com/2010/07/rebel-t2i550d-firmware-1-0-8/

[Tarren]

New firmware update!

Download it here:

http://www.canonrumors.com/2010/07/rebel-t2i550d-firmware-1-0-8/

I updated the firmware on the Kiss 4 Japanese model, with 1.0.8..........to no avail.

Only Japanese and English in the menu

[annod04]

who's driving this? Where are we now? decode the firmware of 1.0.8? Or getting the addresses?

[Yarvieh]

Current state is the same as it has been for months, we cannot decrypt the firmware due to the new encryption scheme. The new firmware uses the same scheme as the service one we had. So status for now is : Stuck, not knowing how to decrypt.

[peabody]

Is there any sense that at 9,538,460 bytes, the 1.0.8 extracted file is again compressed?  As compared to other similar cameras whose firmware has been decrypted?

Well, it doesn't look like any AES or compressed stuff starts until 0xbc, or possibly 0xc0, but if it's properly encrypted, we will need a mole.  :-)

[Zibri]

Hmm.. firmware seems to start at offset $bc

[Zibri]

Hmm.. I got an idea.. if there's a xor involved I hope I'll find it..

edit: false alarm

I tried a stupid thing.. I cerated a file which was a xor of the first firmware and the second. if there was a recurring xor pattern I should have seen it unless it's a variable algo.

I didn't

back to square one.

By the way, did anyone check the Service firmware?? It's much bigger than the normal one.. so maybe there are some useful backdoors/functions in there..

[Yarvieh]

Think I saw someone somwhere who uploaded the service FW to his cam but didn't see any differences in the menu's. Other then that we can't really check for backdoors given its encrypted.  I Wrote a quick app a while ago that was able to recover the XOR keys for any firmware given there was a big enough block of 00's in it, but it wasn't able to recover anything from the service 550d fw, so fairly sure they switched to something more secure, given they used it before my best guess would be AES128-CBC but in all honesty its a [admin: avoid swearing please] shoot, until someone obtains a dump in some other way its a guessing game with the odds heavily heavily stacked against you.

 

[arm.indiana]

Hmm.. firmware seems to start at offset $bc

Use this
http://groups.google.com/group/ml-devel/browse_thread/thread/79f08172a021fae3#
to parse the fir file...

yes, new protection on 550D updater, no more the xor scheme.

Arm.Indy

[nouchi]

Hello,

Is it possible to use an USB packet sniffer, to capture all the data exchanged during updating process, and eventually catch encryptions keys?
It was just an idea.......
Bad idea, update is made by SD card 

Emmanuel

[lorenzo353]

Hello,

Is it possible to use an USB packet sniffer, to capture all the data exchanged during updating process, and eventually catch encryptions keys?
It was just an idea.......
Bad idea, update is made by SD card 

Emmanuel

the update can be made using EOS utility (via PTP) or using a FIR file stored on the SDcard. and of course, the decryption is always done inside the camera: keys never leave the camera.

if you want to learn more see this discussion:
http://chdk.setepontos.com/index.php/topic,1999.0.html

Lorenzo