IXUS75/SD750 1.01a (Finished) | 1.00b (Testing 100%) | 1.02a (Testing 100%)

[TPC]

Update June 8th, 2008

Rebuild of the 1.02a has been posted.

Significant progress on the 1.00b port has been made. Only the stubs entry file remains. If the first 1.00b build isn't posted tonight, check back here tomorrow. Update: the first build of the 1.00b has been posted below.

Update June 5th, 2008

Look for the next build of the 1.02a port and the first build of the 1.00b port on Sunday.

Update May 10th, 2008

The first 1.02a port was released last night, but it was crashing cameras, so I have re-checked my stubs_entry files and made a few corrections.  The latest is available below.


Update May 7th, 2008

CHDK got posted on Slashdot and a number of other sites, and in the comments I noticed some people looking for the SD750... so I put the ports a little higher on my priority list. The 1.02a port will be available for testing this weekend.

Update April 22nd, 2008

Reference:
Wiki page: SD750 - CHDK Wiki
My porting walkthrough for this cam: IXUS75/SD750 1.01a - Port (Maybe) Finished

CHDK Releases:
SD750 1.00b (Testing): zShare - chdk_sd750_100b_08jun08_2109.zip
SD750 1.01a (Done): zSHARE - chdk_sd750_101a.zip
SD750 1.02a (Testing): zSHARE - chdk_sd750_102a_08jun08_1547.zip.zip Test, report results

I'm currently working on the 1.01b and the 1.02a firmware versions.

I hope to have CHDK for these versions posted in a few days. I will need help testing.

I am not working on the 1.01a as I believe it is finished. If you have a dump of another version, please post it or message me.

That is all.

Original Post ============================================================

Hello,

I noticed there wasn't any development in progress for the IXUS75/SD750 (according to the wiki) so I decided to start working on my own SD750. After several days of blinking/analysis I managed to get the firmware out of it...

...however now that I have the firmware I've run into a problem while using IDA.

I followed this guide:

Loading dump to IDA - CHDK Wiki

I'm using the SD1000 1.01b firmware for comparison, and in IDA there are many entries in the Names window that correspond to the missing functions in the stubs_entry files. There's also alot of blue in the graph at the top of the IDA window. Everything looks fine.

When I load the SD750 firmware and apply the signature file/run the CHDK IDC script, the Names window is comparatively sparse (though a ton of entries still show up) and the color graph has very little blue. The other major thing that happens is in the log window at the bottom, I get many "ROM:FFXXXXXX: Can't find name (hint: use manual arg)" messages. Also, there are alot of unresolvable addresses (highlighted in red) in the IDA disassembly viewing window.

From looking at the firmware in a hex editor I know that this is a VxWorks 5.5 camera, so I know I can't be applying the wrong FLIRT signatures/running the wrong CHDK IDC file.

So, my question/request is this: can someone have a look at the IDA database file (below) and see what it is that I'm doing wrong, or give me a hint on how to proceed?

SD750 Dump (1.01a):

EDIT: See link below...

IDA Database file(s):

Link removed, out of date


==========
Bonus Info
==========

For those that are just passing by the thread searching for random bits of info on dumping this camera, here's the LED addresses for SD750:

#define LED_AF 0xc02200C0
#define LED_PR 0xc02200CC
Firmware starts at 0xFF810000

[GrAnd]

It seems that you edited the dump in a editor which replaces Unix-like end of line code 0x0A with DOS-like 0x0D, 0x0A. You can use zSHARE - primaryixus75_sd750-101b.bin for comparison.
If you keep the original (non-edited) dump, please share it.

[TPC]

It appears that, in addition to the DOS newline problem you mentioned, I failed to properly dump two of the 4096 1K blocks, thereby crippling the firmware image and causing IDA to become quite confused about halfway through the dump...

I've fixed both problems and the dump appears to have disassembled correctly in IDA. So far many of the subroutine addresses in 1.01A are the same as those in 1.01B. Thanks for your help, I never would have figured out the newline problem on my own.

Here's the corrected dump, version 1.01a:

zSHARE - ixus75_sd750_101a.zip

[somacore]

Did you use the udumper to get your dump? I have an SD750 1.02A and might be able to do the dump from udumper. Not sure about a blinker dump though.

[TPC]

No, I haven't messed any with the udumper.  I modified the blinker code (whichever one it is that sends crc16 data for each block) and wrote 3 separate programs in VC++ to interpret the output from an ASCII audio file.  My waveforms in Adobe Audition didn't look anything like what was shown in the wiki so I had to improvise...

...which eventually lead to the problem that I had today. For some reason one of my programs wasn't writing in binary mode. Oops.

Keep checking back, I hope that one day soon I can post a ported build so that someone else can benefit from my work.

[GrAnd]

@somacore
whim has got his dump of SD750 using udumper - [DOWNLOAD LINKS] Firmware dumps available. Ask him.

[TPC]

For those that are following along, I've gotten CHDK to boot on the SD750 101a. The 101b firmware looks mighty similar and it might work there too.

Before you get all excited, this is not a complete port, the lens does not extend and none of the keys work (yet). If you have an SD750 101a/b/whatever, please try this and see if it works for you too.


** EDIT Link out of date... please see post below.

[somacore]

Tonight I was able to disassemble my dump in IDA, and it all looks good.

What do I do next? I want to get this thing going!

I'm uploading my .idb file now, can you guys use that or should I save it as something else?


edit: I have the 1.02a posted above, maybe you could take a crack at that? I'll post the link to my .idb file when it's done uploading (40Megs)

[somacore]

For those that are following along, I've gotten CHDK to boot on the SD750 101a. The 101b firmware looks mighty similar and it might work there too.

Before you get all excited, this is not a complete port, the lens does not extend and none of the keys work (yet). If you have an SD750 101a/b/whatever, please try this and see if it works for you too.


zSHARE - chdk_trunk_sd750_101a.zip

This works for my 1.02a camera. The firmware update is a success but none of the buttons work, and it appears the camera is off. Great work!

[mrproper]

Nice to see the Ixus75 will be available, I have an eager friend drooling over CHDK and waiting for this particular build

Can we ask how long it might take to have a fully functional build?

[TPC]

Alright, got the keyboard working. The camera seems to take JPEG pictures fine but barfs a bunch of random trash data into a CRW file when I try RAW mode. Movie recording mode crashes the camera. The "circle" menu likes to get in the way and mess up the CHDK menu.

But, it works, and if you'd like to play with the progress, here you go:

EDIT: Link removed, out of date, keep scrolling...

Now, it's 11:25PM here in Texas. I'm off to bed. I will continue working on it tomorrow...

[somacore]

I'll try to work on it today if possible. Good work, TPC

edit: Looks like your firmware doesn't work on 1.02a at all. Firmware upgrades fine but camera doesn't start or come on at all. I'm not a programmer, so not sure what the next steps are. I'll keep reading up on it.

Same results with my 2Gig card and my 512 meg card.

[TPC]

Update: still working on it, minor fixes.

I have two problems I'm running into now:

-First, when I try to override the shutter speed and take a picture, the camera chirps and flashes the AF LED like normal, then shuts down. I've been all over the trunk scripts and I can't figure out the sequence of function calls associated with this action so that I can find the address that needs to be changed. Can someone provide a hint?

-Second, in video recording mode: before modifying movie_rec.c, the camera would pause for about a half second and then shut down after full-pressing record in video mode. After modification it locks up and then shuts down after a few seconds. Nothing is written to the SD card.

Here's my platform source, if anyone would care to have a look:

EDIT: Link removed, out of date

IDA database:

EDIT: Link removed, out of date

[TPC]

No hints? Hmm, that's okay, I figured it out myself.

Here's the latest firmware:

zSHARE - chdk_sd750101a_05apr08_2341.zip

Right now the only problem that I can find is that the zebra feature works just fine most of the time, then randomly explodes with garbled over/under exposure colors. Occasionally the entire screen blinks underexposed, and then the keyboard locks up.

But, like I said, that's the only problem. Zebra seems to work okay about 80% of the time. Must be the planets aligning.

So, there you go, everything else works - AV override, video, RAW, SD card space, battery meter, all that fun CHDK stuff. Hopefully someone can test it out for a few days. Meanwhile I'll put together the wiki page and see about getting the code into the trunk.

Woo.

[GrAnd]

FYI... Just discovered... SD1000 (IXUS70) has two firmware versions 1.01a and 1.01b, which seem to be compatible as have a minor differences. It seems we have the same situation here: 1.01a and 1.01b are almost the identical.