Dump Ixus 960is

[tk-germany]

Hi @ all,
yesterday i finally got my new Canon Ixus 960 Is and would like to make a dump in hope to soon be able to use chdk on it.
But i'm new to firmwaredumping.

I Planned to use the led-blinker-way and buy a phototransistor today, i allready found a shop, where to buy here in berlin.
But now i read something about a new way without a cable etc. Just with a dumping-software on the sdcard.

My question is now: is this way allready available and "user-friendly"?
If it allready exists, is this kind of software allready usable, and where can it be found?

if it still does'nt work, i will blink the code, but then, where can i find the blinker-code?
as all links i found are outdated and not available anymore, please help me to enrich the kit with a new great canon-cam.

Thanks and greets from berlin/germany
TK

[whim]

You probably mean ewavr's universal dumper here: udumper

It is very convenient - the only 'drawback is that it does not give any feedback.
method:

- format a small (16M - 1G ) card in camera (avoid 2G and bigger)
- apply bootable.exe (in archive) on it (to make your cam recognize it as 'bootable')
- copy 'empty.dum' to the card
- copy one of the 'diskboot.bin' files to the card, choice depends on your cam OS.
  if you don't know, you'll have to try them until you succeed.
- write protect (w/ small tab on card) and insert card
- start cam in Review, not picture taking mode
- NOTHING will happen, don't worry, wait ~ 1 minute to be sure
- open battery compartment and remove battery
- remove card
- open 'empty.dum' in your favourite hex editor, if it contains anything apart from binary zeroes, you got it
- otherwise, start again with next 'diskboot.bin'
- to clean up you can remove 0x00's from the beginning of the file & 0xFF's from the tail end.

A VxWorks cam will have 'Copyright 1999-2001 ARM Limited' or similar at the beginning of the dump
In a DryOS cam the first bytes sofar have always been 'gaonisoyP'

hope this can save you from the much more complicated (?) blinking method

good luck & let us know how you get along,

wim
 
edit: corrected (see ewavr's comment )

[ewavr]

-=deleted=-

[whim]

@ewavr

sorry, i forgot about locking the card  - corrected

BTW what time would you recommend, is 1 min too much ?  And another Q if I may,
is there a preferred trying sequence (I mean DryOs -> VxW large -> VxW small or something)

[GrAnd]

-=deleted=-

edit: corrected (see ewavr's comment )

Funny... 

[ewavr]

BTW what time would you recommend, is 1 min too much ? 

5-10 sec. (write speed is above 1 Mb/s).

And another Q if I may,
is there a preferred trying sequence (I mean DryOs -> VxW large -> VxW small or something)

Maybe DRYOS for new cameras, VxWorks for old ones?

It would be great to put this instruction in Wiki.

[tk-germany]

I got it, and yes it starts with "gaonisoyP"
the dump can be found here:
linkchange to zshare
please insert it into the chdk!!!

sorry forgot version info:
Canon digital ixus 960 is
p-id:315F Pal D
Firmware Ver GM1.00D
NoError
Aug 23 2007 09:21:45

[jeff666]

I got it, and yes it starts with "gaonisoyP"

Wow - firmware dumping has really become easy. It took me a whole weekend to dump my cam, but that was ages ago, of course (which means: last november ).

Also the amount of dyros-cams is increasing. How fortunate someone figured out how those work

Cheers.

[GrAnd]

Also the amount of dyros-cams is increasing. How fortunate someone figured out how those work

Yes. Your work was very helpful when I ported SD870. The port is based on your code. With the comments it was not so difficult to do (despite it was my first port ). Thank You!

[tk-germany]

can in any way be verified that the dump is complete, at least when i view the file in hex editor?
e.g. are there any known last bytes that allways are in the end of the dumped data, so i or anyone else can see that the dump is a complete one, from the beginnig to the end?

yes the tutorial by whim was really great, maybe soemone can put it into the wiki, please, so it may help also others, as i realy almost gave up, searching for information about chdk and dumping etc, and i think, if it's easier to find how to do it, more people will do it!

Here is a small german translation,
i also added some information and hope it helps some people in dumping, maybe this also can be added into the wiki!


Tutorial: canon-firmwaredumping in 30 (+1) kleinen schritten:

00. cam kaufen, sd-karte kaufen/haben
01. udumper-archiv runterladen: udumper.zip - udumper - BADONGO
02. formatiert eine kleine (16M - 1GB) sdkarte in der kamera (vermeidet mehr als 2G)
03. karte in einen cardreader legen
04. wendet die bootable.exe (im archiv) auf die karte an
  (in der eingabeaufforderung "bootable.exe k:" (k: ist der laufwerksbuchstabe der karte, bitte auf den entsprechenden Buchstaben ändern)
  die macht die karte für die Cam bootfähig
05. die 'empty.dum'-Datei aus dem archiv auf die karte kopieren
06. bei einer älteren cam die 'diskboot.bin' aus dem VxWorks-Verzeichnis auf die karte kopieren
07. bei einer neueren cam die 'diskboot.bin' aus dem DryOS-Verzeichnis auf die karte kopieren
08. bei unsicherheit welche die richtige ist, einfach durchprobieren
09. schreibschutz der sd-karte aktivieren (kleiner schalter an der seite der karte)
10. karte in cam einlegen
11. cam im wiedergabemodus starten (nicht der photografiermodus sondern der, den man durch die "play-taste" aktiviert)
12. die cam wir KEIN zeichen von sich geben, das ist auch korrekt so
13. ungefähr eine minute warten, lieber länger als zu kurz
14. batteriefach öffnen und batterie entfernen
15. sdkarte entfernen
16. die 'empty.dum' in einem hex editor eurer wahl öffnen (wenn grad keiner zur hand, hier ist ein kleiner, installationsfreier freewareeditor: Freeware Hex Editor XVI32
17. prüfen ob die datei nun andere Zeichen als binäre "00" enthällt
  (am anfang und ende können immer noch "00" sein, da mehr speicher gedumped wird, als die firmware lang ist um wirklich alles zu erwischen, daher in der mitte mal schauen)
18. wenn daten vorhanden sind hat man's höchstwarscheinlich!
19. vxworks-firmware fangen meist mit 'Copyright 1999-2001 ARM Limited' an und DryOS mit 'gaonisoyP', wenn also eine ähnliche Zeichenkette am anfang steht, sieht das schon mal super aus.
19.1: Der Dump hört mit einer ganzen Reihe von FF's auf, wenn also der Anfang wie gerade geschrieben und das Ende mit Hexadezimalen FF's ist, ist der Dump komplett
20. wenn nur '00' in der datei enthalten sind, hat's nicht geklappt -> einfach nochmal ab schritt 04. beginnen und die nächste 'diskboot.bin' probieren
21. um die Firmware noch hübsch zu machen könnte man noch die 0x00'en von anfang und ende des dumps abschneiden (lieber weniger als zu viel abschneiden) und die firmware komprimieren
22. dann alle dateien von der sd-karte entfernen
23. die datei "ver.req" aus dem archiv auf die karte kopieren
24. karte in die cam legen und wieder playbackmodus starten
25. "func/set"-drücken und gedrückt halten und zusätzlich "disp." drücken
26. ein bildschirm mit der firmwareversion erscheint
27. Die zeile ala "Firmware Ver GM1.00E" ist wichtig: der Teil: "1.00E" ist die Firmware version -> notieren!
28. die sd-karte kann nun wieder formatiert und voll-fotografiert werden
29. firmware hochladen (zum Beispiel auf BADONGO oder ZShare)
30. link zum firmwaredump mit versionsinfo in den gewohnten 2 cdhk-foren (original-forum und deutsches chdk-forum (google: "chdk forum") posten

Greetz,
Tk

[whim]

28. die sd-karte kann nun wieder formatiert und voll-fotografiert werden

( Eng: 28. the card can now be reformatted and filled with photos )

Much better solution (IMHO): put a new 'empty.dum' on it and keep in your pocket/wallet/camera bag
in case you run into any other not-yet-supported cams 
Since 16-32 MB cards are pretty much useless these days, I now usually have a DryOs and a VxW
version with me all the time 

wim

[PhyrePhoX]

00. cam kaufen, sd-karte kaufen/haben

hehe, for our non german-readers, this means: in order to be able to dump firmware, you have to buy the cam first!

30. link zum firmwaredump mit versionsinfo in den gewohnten 2 cdhk-foren (original-forum und deutsches chdk-forum (google: "chdk forum") posten

i'm not a big fan of posting things "all over the web", but if it helps those germans who cant speak english its okay i guess. CHDKLover (from the german forum) seems to be a smart guy, he did some interesting code customizations (Canon / CHDK-Forum :: Thema anzeigen - Men?-Mod v2 being an example), too bad he doesnt share them with the rest of the world (english chdk forum would be a good start ).

28. die sd-karte kann nun wieder formatiert und voll-fotografiert werden

( Eng: 28. the card can now be reformatted and filled with photos )

Much better solution (IMHO): put a new 'empty.dum' on it and keep in your pocket/wallet/camera bag
in case you run into any other not-yet-supported cams 
Since 16-32 MB cards are pretty much useless these days, I now usually have a DryOs and a VxW
version with me all the time 

wim

good idea. just yesterday i was in a big "electronics store" fiddling around with lots of cams on display. next time i will see what i can do regarding smuggling in the sdcard with the dumper
too bad you cant have several dumps one SINGLE sdcard. or can you? perhaps with a little modification? this way you can dump several cams in one run.

[tk-germany]

i also allready thought about making a dump-card today... seems to be "gedankenübertragung" (transfer of thoughts)
do we allready have got a ixus 900 dump? as i can also get this from a friends cam with the smuggled dump-card

yes posting in different forums is not that nice as i know the nettiquette, but as you mentioned, some people try to keep information they have for theire own, and that's why i thought it would be good, to share the information with all people that can use it, but for sure, this forum is the most important one!!!

but still there is my question to complete the tutorial:
can in any way be verified that the dump is complete, at least when i view the file in hex editor?
e.g. are there any known last bytes that allways are in the end of the dumped data, so i or anyone else can see that the dump is a complete one, from the beginnig to the end?

edit:
Is it right the, if at the end of the Data in the Dumpfile are a lot of hexdecimal "FF" and the beginnig contains some of the previous written keywords, the dump is complete?

Do the ff's in the end, belong to the firmware or not?


edit2:
new downloadlink for the dump:
zSHARE - 960is.rar

[GrAnd]

Is it right the, if at the end of the Data in the Dumpfile are a lot of hexdecimal "FF" and the beginnig contains some of the previous written keywords, the dump is complete?

Your dump is complete. FF just means no data (clear block) is there.

[GrAnd]

Discussion about CHDKlover's menu mod is moved to CHDKlover's menu mod