Ixus Wireless - SD430 Porting thread

ahull

I also took a quick look through the firmware, lots of interesting stuff in the PRIMARY.BIN strings. The camera seems to use PTP over wireless in a similar manner to the way you hint at here.

There are also a lot of test routines in the ROM, including some references to SSID that appear to be Canon test network credentials.

You are correct when you say the setup is all done from the PC, so its a little less sophisticated in that sense than the modern WiFi cameras.

Sniffing USB is certainly an option, and I may well go down this route. I do actually have access to both a Windows box and VM and a Mac, so I may well end up using these to make some progress. I downloaded the MAC software .dmg and had a quick trawl through it to see if I could match up some strings or strike it lucky with a bit of XML or whatever, but nothing jumped out.

Ultimately it would be interesting to add the ability to connect to networks from the camera, but this is not really necessary.

Setting up the network from CHDKPTP would be a neater solution, and for that I would presumably need to figure out what exactly the Canon software does.

I'll keep digging, and let you know if I make any progress.

ahull

I suspect this may be of some interest, looks like a similar XML settings page to the one you describe, so we may well also serve up a similar web service..

ffaf3e0c ?xml version="1.0"?
ffaf3e20 presentationURL
ffaf3e30 deviceList
ffaf3e3c eventSubURL
ffaf3e48 controlURL
ffaf3e54 SCPDURL
ffaf3e5c serviceId
ffaf3e68 serviceType
ffaf3e74 service
ffaf3e7c serviceList
ffaf3e90 serialNumber
ffaf3ea0 modelURL
ffaf3eac modelNumber
ffaf3eb8 modelName
ffaf3ec4 modelDescription
ffaf3ed8 manufacturerURL
ffaf3ee8 manufacturer
ffaf3ef8 friendlyName
ffaf3f08 deviceType
ffaf3f14 device
ffaf3f1c URLBase
ffaf3f24 urn:schemas-upnp-org:device-1-0
ffaf3f44 root
ffaf3f4c urn:schemas-upnp-org:service-1-0
ffaf3f70 scpd
ffaf55e4 <%s>%s</%s>%s
ffaf5680 <ns:%s xmlns:ns="%s">%s</ns:%s>%s
ffaf5744 <%s>%d</%s>%s
ffaf57e0 <%s>%s%d</%s>%s
ffaf5890 <%s>%s
ffaf5898 <%s %s="%s">%s
ffaf597c </%s>%s

ffaf1b90 _LEV
ffaf1df0 ssdp:all
ffaf2bcc http://
ffaf2bd4 upnp:rootdevice
ffaf2be4 %s:%d
ffaf3884 URLBase
ffaf388c minor
ffaf3894 major
--
ffaf597c </%s>%s
ffaf5b2c upnp:rootdevice
ffaf5b3c http://
ffaf5b44 text/xml
ffaf76f8 %s%s:%d
ffaf7840 %s::%s%d
ffaf784c %s::%s
ffaf78f4 %s/%d.%d
ffaf80d4 !!!Record List is full!!!
ffaf843c http://
ffaf8a28 close
ffaf8a30 sockOpenConnection() failed
ffaf8f10 HTTP/
ffaf8f18 EXT:
ffaf8f28 MAN:
--
ffb09e88 urn:schemas-upnp-org:device:Basic:
ffb09eac Canon
ffb09eb4 http://www.canon.com/
ffb09ecc Canon Digital Camera
ffb09ee4 CameraSvcDesc.xml
ffb09ef8 urn:schemas-canon-com:service:ICPO-CameraService:
ffb09f2c urn:schemas-canon-com:serviceId:ICPO-CameraService-1
ffb09f64 control/CanonCamera/
--
ffb9d8f0 gfff
ffb9d948 xmlns
ffb9d950 http://www.cipa.jp/dps/schema/
ffb9d970 input
ffb9d978 output
ffb9d980 result
ffb9d988 vendorName
ffb9d994 productName

I think I will need to set up the wireless from Windows, this it starting to look interesting, 😁

reyalp

There are a bunch of eventprocs related to wireless, some similar to modern cams, and some not so much.

debugCmd.* look interesting, as do tm.*

Also worth noting, since this is a vxworks camera, it presumably uses the normal VxWorks network stack. A lot of vxworks documentation is available through google.

Setting up the connection of chdkptp (usb) may present other problems, because (on modern cameras at least) only one of PTP/USB and PTP/IP can be active at a time.

here's my random string of the day from the Wireless firmware... "TwinkleNight" -

And here's mine:
"[CWS] Something happen?"

😉

ahull

There are quite a number of strings like that, I'm intrigued by...

"ffff0df5 Is it all right? (N/y)"

Its looking like I'm going to be a little busy with other things over the next couple of weeks, but if I get a chance, I'm going to have a crack at reverse engineering the camera setup proceedure from Windows at some stage, I'm curious to see where it stored the WiFi settings on the camera. Once I have that figured out, I should be able to make some progress.

reyalp

ahull
I'm going to have a crack at reverse engineering the camera setup proceedure from Windows at some stage, I'm curious to see where it stored the WiFi settings on the camera. Once I have that figured out, I should be able to make some progress.

On elph130, my impression is that the actual settings (known APs, keys etc) are stored somewhere on the wifi module rather than camera flash. I'm not totally certain of this though, and haven't looked enough at sd430 to know if it is the same.

Comparing ROM dumps after registering a connection may clear may or may not clear things up. I did this with elph130 but the results were a bit ambiguous. There were some wifi-related changes but they didn't obviously contain the connection info.

Another thought:
The test functions would be a lot easier to use if you had a way to send to the camera standard input. Obviously you would do this by wiring to the uart, but software ways should be possible too. This may be somewhat easier on vxworks because the driver system is documented.

Microfunguy

ahull I do actually have access to both a Windows box and VM and a Mac

Do you, or have you ever, had Mac working in a VM ?

ahull

Microfunguy

ahull I do actually have access to both a Windows box and VM and a Mac

Do you, or have you ever, had Mac working in a VM ?

Thats an interesting question. Yes and no, would be the answer. I have had PearPC working in the past, but don't currently have a working disk image. It is pretty easy to set up and run, and I suspect it might be about the right vintage to run the Ixus Wireless software. I may try this. It will run *some* versions of MacOSX (I can't remember which ones). I also own an ancient early iMac.

I haven't run the latest version of MacOSX in an emulator though, no, but I think this is actually fairly easy with Qemu.

I also played with BasiliskII a long time back, it was also quite entertaining for re-living the Mac Classic 68k mac days.

Microfunguy

ahullIt will run *some* versions of MacOSX

I have installed some versions OK but never got them to launch.

I think this is actually fairly easy with Qemu.

I shall research that.

ahull

Not perhaps very interesting, but I just ran binwalk over an IxusWireless dump. So far I haven't managed to do anything particularly useful (apart from extracting a bunch of .jpgs which make up the the startup splash images and the timezone selection backgrounds.)

The output from binwalk seems to indicate a few false positives (those TIFFS at the start for example), but I'll provide the log of the results below for your amusement.

ahull@ahull-T430:~/Desktop/Personal/CanonCameras$ binwalk --dd=jpeg:jpeg /home/ahull/Desktop/Personal/IxusWirelessSD430/PRIMARY.BIN.SD430 

DECIMAL       HEX           DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
245508        0x3BF04       TIFF image data, little-endian
245512        0x3BF08       TIFF image data, big-endian
264692        0x409F4       TIFF image data, little-endian
600792        0x92AD8       YAFFS filesystem
709756        0xAD47C       LZMA compressed data, properties: 0x40, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
709808        0xAD4B0       LZMA compressed data, properties: 0x40, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
718740        0xAF794       LZMA compressed data, properties: 0x40, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
718792        0xAF7C8       LZMA compressed data, properties: 0x40, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
1483988       0x16A4D4      LZMA compressed data, properties: 0xC0, dictionary size: 33554432 bytes, uncompressed size: 256 bytes
2419840       0x24EC80      LZMA compressed data, properties: 0x48, dictionary size: 16777216 bytes, uncompressed size: 16842752 bytes
2419860       0x24EC94      LZMA compressed data, properties: 0x49, dictionary size: 16777216 bytes, uncompressed size: 16842752 bytes
4308943       0x41BFCF      mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
4383641       0x42E399      Private key in DER format (PKCS#😎,
4399269       0x4320A5      LZMA compressed data, properties: 0xA2, dictionary size: 4194304 bytes, uncompressed size: 1703936 bytes
4416568       0x436438      LZMA compressed data, properties: 0x40, dictionary size: 16777216 bytes, uncompressed size: 83886080 bytes
4424753       0x438431      Copyright string: " 1984-2002 Wind River Systems, Inc.Inc."
5831516       0x58FB5C      Marvell Libertas firmware
5916160       0x5A4600      JPEG image data, JFIF standard  1.02
5916558       0x5A478E      JPEG image data, JFIF standard  1.02
6000196       0x5B8E44      JPEG image data, JFIF standard  1.01
6017820       0x5BD31C      JPEG image data, JFIF standard  1.01
6035816       0x5C1968      JPEG image data, JFIF standard  1.01
6053752       0x5C5F78      JPEG image data, JFIF standard  1.01
6072016       0x5CA6D0      JPEG image data, JFIF standard  1.01
6088720       0x5CE810      JPEG image data, JFIF standard  1.01
6105592       0x5D29F8      JPEG image data, JFIF standard  1.01
6122464       0x5D6BE0      JPEG image data, JFIF standard  1.01
6140640       0x5DB2E0      JPEG image data, JFIF standard  1.01
6157676       0x5DF56C      JPEG image data, JFIF standard  1.01
6174440       0x5E36E8      JPEG image data, JFIF standard  1.01
6191868       0x5E7AFC      JPEG image data, JFIF standard  1.01
6208824       0x5EBD38      JPEG image data, JFIF standard  1.01
6227432       0x5F05E8      JPEG image data, JFIF standard  1.01
6246760       0x5F5168      JPEG image data, JFIF standard  1.01
6264708       0x5F9784      JPEG image data, JFIF standard  1.01
6282580       0x5FDD54      JPEG image data, JFIF standard  1.01
6299340       0x601ECC      JPEG image data, JFIF standard  1.01
6316988       0x6063BC      JPEG image data, JFIF standard  1.01
6334024       0x60A648      JPEG image data, JFIF standard  1.01
6351020       0x60E8AC      JPEG image data, JFIF standard  1.01
6367904       0x612AA0      JPEG image data, JFIF standard  1.01
6385140       0x616DF4      JPEG image data, JFIF standard  1.01
6401972       0x61AFB4      JPEG image data, JFIF standard  1.01
6420312       0x61F758      JPEG image data, JFIF standard  1.01
6437084       0x6238DC      JPEG image data, JFIF standard  1.01
6455300       0x628004      JPEG image data, JFIF standard  1.01
6473000       0x62C528      JPEG image data, JFIF standard  1.01
6490592       0x6309E0      JPEG image data, JFIF standard  1.01
6508748       0x6350CC      JPEG image data, JFIF standard  1.01
6526492       0x63961C      JPEG image data, JFIF standard  1.01
6543592       0x63D8E8      JPEG image data, JFIF standard  1.01
6560356       0x641A64      JPEG image data, JFIF standard  1.01
6692371       0x661E13      LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: -1 bytes
6704044       0x664BAC      LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 61695 bytes
6810658       0x67EC22      LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 16777215 bytes
6965541       0x6A4925      LZMA compressed data, properties: 0xC0, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
6967161       0x6A4F79      LZMA compressed data, properties: 0x7E, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
6969861       0x6A5A05      LZMA compressed data, properties: 0xC0, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
6970221       0x6A5B6D      LZMA compressed data, properties: 0xC0, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
6972651       0x6A64EB      LZMA compressed data, properties: 0x7E, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
6973191       0x6A6707      LZMA compressed data, properties: 0xC0, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
6996411       0x6AC1BB      LZMA compressed data, properties: 0xC0, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
7061931       0x6BC1AB      LZMA compressed data, properties: 0xC0, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
7111251       0x6C8253      LZMA compressed data, properties: 0xC0, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
7118181       0x6C9D65      LZMA compressed data, properties: 0xC0, dictionary size: 2097152 bytes, uncompressed size: 2097172 bytes
7995564       0x7A00AC      JPEG image data, JFIF standard  1.01
8061100       0x7B00AC      JPEG image data, JFIF standard  1.01

It might be a neat trick to mount the yaffs file system, (if that is indeed what we are seeing).

ahull

I ran a similar binwalk over the SD1300 rom, which again allowed me to extract the splash image and the "?" bad things happened image.

binwalk -Me /home/ahull/PersonalApps/CHDK/romdumper/roms/SD1300/PRIMARY.BIN

Scan Time:     2014-01-18 23:02:30
Signatures:    212
Target File:   /home/ahull/PersonalApps/CHDK/romdumper/roms/SD1300/PRIMARY.BIN
MD5 Checksum:  14d1d5319a6ae325bdf328ead48fa2f9

DECIMAL       HEX           DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
1951695       0x1DC7CF      mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: SHA-1 hash
2845533       0x2B6B5D      LZMA compressed data, properties: 0x40, dictionary size: 131072 bytes, uncompressed size: 393216 bytes
2845701       0x2B6C05      LZMA compressed data, properties: 0x40, dictionary size: 262144 bytes, uncompressed size: 393216 bytes
2899694       0x2C3EEE      LZMA compressed data, properties: 0xC8, dictionary size: 4194304 bytes, uncompressed size: 30976 bytes
2899734       0x2C3F16      LZMA compressed data, properties: 0xC8, dictionary size: 4194304 bytes, uncompressed size: 31488 bytes
2899754       0x2C3F2A      LZMA compressed data, properties: 0x64, dictionary size: 4194304 bytes, uncompressed size: 29696 bytes
2929514       0x2CB36A      LZMA compressed data, properties: 0x90, dictionary size: 4194304 bytes, uncompressed size: 2304 bytes
3071476       0x2EDDF4      JPEG image data, JFIF standard  1.01
3164732       0x304A3C      LZMA compressed data, properties: 0xC0, dictionary size: 33554432 bytes, uncompressed size: 256 bytes
3190684       0x30AF9C      TIFF image data, little-endian
3190688       0x30AFA0      TIFF image data, big-endian
3191368       0x30B248      TIFF image data, little-endian
3539468       0x36020C      JPEG image data, JFIF standard  1.01


Scan Time:     2014-01-18 23:02:32
Signatures:    212
Target File:   _PRIMARY.BIN-0.extracted/304A3C
MD5 Checksum:  d41d8cd98f00b204e9800998ecf8427e

DECIMAL       HEX           DESCRIPTION
-------------------------------------------------------------------------------------------------------------------


Scan Time:     2014-01-18 23:02:32
Signatures:    212
Target File:   _PRIMARY.BIN-0.extracted/2B6B5D
MD5 Checksum:  d41d8cd98f00b204e9800998ecf8427e

DECIMAL       HEX           DESCRIPTION
-------------------------------------------------------------------------------------------------------------------


Scan Time:     2014-01-18 23:02:32
Signatures:    212
Target File:   _PRIMARY.BIN-0.extracted/2B6C05
MD5 Checksum:  d41d8cd98f00b204e9800998ecf8427e

DECIMAL       HEX           DESCRIPTION
-------------------------------------------------------------------------------------------------------------------

.. like I said, interesting perhaps, but not very useful. 😁

waterwingz

ahull
Not perhaps very interesting, but I just ran binwalk over an IxusWireless dump.

@ahull : looks like we need the ixus_wireless tests for manual focus ?
https://chdk.setepontos.com/d/11078
Do you have access to that camera ?

ahull

Done.. results here..
https://chdk.setepontos.com/d/11078/206

« Previous Page