EOS 550D / T2i / Kiss X4

[Zibri]

The updater just copies the fir file on the sdcard root then launches the built-in update routine.

I dissected all the SDK DLL searching for undocumented things.. I found a few, but nothing relevant.

[Zibri]

Code: [Select]

(e8kr7108.fir)
 ---flasher1---
 0x000: modelId = 0x80000270, (550D/T2i, DryOS)
 0x010: version = 1.0.8
 0x020: cheksum = 0xb783b90c OK
 0x024: flasher1 header start = 0xb0
 0x028: flasher1 payload start = 0x120
 0x02c: flasher2 start = 0xffffffff
 0x030: firmware start = 0x1beb40
 0x034: 0xffffffff
 0x038: file size = 0x918b9c (9.538.460 bytes) OK
 0x03c: 0x0
 0x040: xor seed = 0x76293ff4
 0x044: 0x00000004 0x00000000 0x00000020 0x00000024
 0x054: 0x00000044 0x000000b0
 0x05c: fw start-0xb0 ???  0x1bea90
 0x060: firmware start =  0x1beb40
 0x064: firmware length = 0x75a05c
 0x068: hmac-sha1 = 029090f19224f258cfdfe4d61c4f73c0af0def7c
 0x088: hmac-sha1 = 7698c8436744945e762bcf0a96935c17e973636f
 0x09c - 0x0af: 0x0
 ---flasher1 header---
 0x0b0: flasher1 payload length = 0x1bea20 starts at 0x120
 0x0b4: flasher1 ??? = 0x1bea20
 0x0b8: 0x0
 0x0bc: xor seed = 0x87353d20
 ---flasher1 payload---
 0x120 - 0x1beb3f: (ciphered data)
 ---firmware---
 0x1beb40: (+0x000), firmware header start = 0xc
 0x1beb44: (+0x004), firmware payload start = 0x7c
 0x1beb48: (+0x008), total firmware length = 0x75a05c. starts at 0x1beb40
 ---firmware header---
 0x1beb4c: (+0x00c), firmware payload length = 0x759fe0
 0x1beb50: (+0x010), firmware ??? = 0x759fda
 0x1beb54: (+0x014), 0x0
 ---firmware payload---
 0x1bebbc (+0x07c) - 0x918b9b: (encrypted data)


[Zibri]

It seems someone hacked / decrypted and re-encrypted the firmware!

Magic Lantern - 550D/T2i port

Where to get more infos on how to decrypt/modify it?

[arm.indiana]

just read this
http://groups.google.com/group/ml-devel/browse_thread/thread/f87188ddff2cf50

[arm.indiana]

New firmware update!

Download it here:

http://www.canonrumors.com/2010/07/rebel-t2i550d-firmware-1-0-8/

I updated the firmware on the Kiss 4 Japanese model, with 1.0.8..........to no avail.

Only Japanese and English in the menu

I'm very surprised, but there are functions in 550d/Kiss 4 (1.0. called "LimitLangJapan" (0xFF0978BC)
and "LimitLangOther" (0xFF097908). I strongly suspect it is to restrict available languages for models sold in Japan... which are cheaper than anywhere in the world.

Arm.Indy

[arm.indiana]

Code: [Select]

(e8kr7108.fir)
 ---flasher1---
 0x000: modelId = 0x80000270, (550D/T2i, DryOS)
 0x010: version = 1.0.8
 0x020: cheksum = 0xb783b90c OK
 0x024: flasher1 header start = 0xb0
 0x028: flasher1 payload start = 0x120
 0x02c: flasher2 start = 0xffffffff
 0x030: firmware start = 0x1beb40
 0x034: 0xffffffff
 0x038: file size = 0x918b9c (9.538.460 bytes) OK
 0x03c: 0x0
 0x040: xor seed = 0x76293ff4
 0x044: 0x00000004 0x00000000 0x00000020 0x00000024
 0x054: 0x00000044 0x000000b0
 0x05c: fw start-0xb0 ???  0x1bea90
 0x060: firmware start =  0x1beb40
 0x064: firmware length = 0x75a05c
 0x068: hmac-sha1 = 029090f19224f258cfdfe4d61c4f73c0af0def7c
 0x088: hmac-sha1 = 7698c8436744945e762bcf0a96935c17e973636f
 0x09c - 0x0af: 0x0
 ---flasher1 header---
 0x0b0: flasher1 payload length = 0x1bea20 starts at 0x120
 0x0b4: flasher1 ??? = 0x1bea20
 0x0b8: 0x0
 0x0bc: xor seed = 0x87353d20
 ---flasher1 payload---
 0x120 - 0x1beb3f: (ciphered data)
 ---firmware---
 0x1beb40: (+0x000), firmware header start = 0xc
 0x1beb44: (+0x004), firmware payload start = 0x7c
 0x1beb48: (+0x008), total firmware length = 0x75a05c. starts at 0x1beb40
 ---firmware header---
 0x1beb4c: (+0x00c), firmware payload length = 0x759fe0
 0x1beb50: (+0x010), firmware ??? = 0x759fda
 0x1beb54: (+0x014), 0x0
 ---firmware payload---
 0x1bebbc (+0x07c) - 0x918b9b: (encrypted data)


prefer the original tool = fir_tool.py, this one above is buggy and incomplete.
See http://groups.google.com/group/ml-devel/browse_thread/thread/79f08172a021fae3#

Arm.Indy

[manarak]

Hello all

Thank you for trying to improve the 550D's firmware.
I found this page because I am quite desperate for activating the AF microadjustment feature on my 550D.

Best of luck!

[arm.indiana]

in 550d 108

Code: ASM

1. ROM:FF406BA0                 CMP     R0, #0
2. ROM:FF406BA4                 BNE     loc_FF406BB0 <-- what about a patch to B here ?
3. ROM:FF406BA8                 BL      StartMnLanguageJapanApp  ; Japan/English menu only
4. ROM:FF406BAC                 B       loc_FF406D74
5. ROM:FF406BB0 ; ---------------------------------------------------------------------------
6. ROM:FF406BB0
7. ROM:FF406BB0 loc_FF406BB0                            ; CODE XREF: MnStartApp_StartSubMenu+22Cj
8. ROM:FF406BB0                 BL      StartMnLanguageApp ; all language
9. ROM:FF406BB4                 B       loc_FF406D74
10.  

follow progress of the analysis here:
http://groups.google.com/group/ml-devel/topics

you're invited to help...

Indy

[luastoned]

Any news on this?

[a1ex]

Yep, just subscribe to the magic lantern feeds

I use the following:
- ML wiki, http://magiclantern.wikia.com/wiki/Special:RecentChanges
- ML repo, http://bitbucket.org/hudson/magic-lantern/overview
- ML devel mailing list, http://groups.google.com/group/ml-devel
and, of course, CHDK forum and wiki.

[chuchin]

The main problem with magic lantern is that it's impossible to compile.

[a1ex]

Did you read this guide? It's not impossible, but I agree it's not very easy.
http://magiclantern.wikia.com/wiki/Build_instructions/550D

Did you ask for help on the wiki or on the mailing list? All the people who asked for help (including me) succeeded to build ML as far as I know.

[a1ex]

Just released an experimental version with cropmarks enabled (for now, it works on firmware 1.0.8 only):
http://groups.google.com/group/ml-devel/msg/5abd238291b1d2b3

Also, Arm.Indy released a version of Magic Lantern for 550D/1.0.9:
http://groups.google.com/group/ml-devel/browse_thread/thread/266542d8f2e65bc

Details on the wiki:
http://magiclantern.wikia.com/wiki/550D

[a1ex]

Since nobody liked my experimental build, here's another one, this time with zebras and histogram enabled:

http://groups.google.com/group/ml-devel/browse_thread/thread/e15fac669f293d2a

[a1ex]

GUI menus enabled; also lots of extra features (intervalometer, stack focus, remote shutter trigger with your own hand, bracketing, config file saving...)

http://groups.google.com/group/ml-devel/browse_thread/thread/97488a67eff87b7e