Canon EOS M5 [M5] [EOS_M5]

zsolex

Are you planning to support M5?

From Magic lantern: "Please note: some Canon EOS M cameras (M3, M5, M10) are based on PowerShot firmware. It's much easier to port CHDK on these cameras."

Ant

First of all we have to make sure that M5 is Powershot.
There must be somebody, who can make a firmware dump using the universal dumper

I don't expect ML on Digic 6 cameras until they find a replacement for cache hacks.

Hardware_Hacker

Ant
First of all we have to make sure that M5 is Powershot.

ML Topic: EOS M5 - 80D in your "pocket" (Read 2302 times)
http://www.magiclantern.fm/forum/index.php?PHPSESSID=8ovfrgoep9mcola6lij27bqai7&topic=17889.msg172178#msg172178

"...Like the M3 the M5 will soon or later run chdk. Just check the menus and you will see for yourself..."
"...The firmware isn't based upon dslr code so porting to chdk is much easier..."

H-H

reyalp

Hardware_Hacker
"...Like the M3 the M5 will soon or later run chdk. Just check the menus and you will see for yourself..."
"...The firmware isn't based upon dslr code so porting to chdk is much easier..."

Without a dump, it's impossible to say if CHDK can support it or how much effort will be required, so these statements should be taken as speculation.

Ant

~~At least we need to know the extension of the firmware update file (*.FI2 for CHDK, *.FIR for ML)~~
It uses *.FI2

Sapporo

Ant
First of all we have to make sure that M5 is Powershot.
There must be somebody, who can make a firmware dump using the universal dumper

I don't expect ML on Digic 6 cameras until they find a replacement for cache hacks.

Tried with no result.

I used a 512 MB SD card, I low level formatted it in my M5, used EOScard and marked SCRIPT. After that I put script.req and extend.m at the root of the card. I started the camera in play mode and pressed SET.

EOS_DIGITAL.zip

1.32KB

srsa_4c

Sapporo
Tryed with no result.

That's a great result, actually. The script has actually run (without crashing the camera), and it successfully created the log file.
It proves that the firmware is still Powershot based.

However, we know nothing about the DIGIC 7. The "not found!" message means that
- the firmware signature has changed AND/OR
- ROM size has changed or it is mapped to a different address

You could try the script I posted here, but please uncomment all mydump function calls in it. (uncomment = remove the apostrophe)

Sapporo

srsa_4c

Sapporo
Tryed with no result.
That's a great result, actually. The script has actually run (without crashing the camera), and it successfully created the log file.
It proves that the firmware is still Powershot based.

However, we know nothing about the DIGIC 7. The "not found!" message means that
- the firmware signature has changed AND/OR
- ROM size has changed or it is mapped to a different address

You could try the script I posted here, but please uncomment all mydump function calls in it. (uncomment = remove the apostrophe)

Fixed

EOS_DIGITAL.7z

825.06KB

srsa_4c

SapporoFixed

The archive size itself says a lot (way too small). The segments seem to contain the same data (lens correction related, not firmware).
That means we're experiencing a huge architectural change.
Since I have no idea where to find the ROM, a different approach is needed.

Following script will try to dump (almost) 256MB of RAM(?) starting at address 0x100. It's unlikely to contain the whole firmware, but it might have pointers.

private sub RegisterProcs()
	' Newest cams (Dryos rel 43 and later) only have System.Create()
	' on older dryos cams SystemEventInit is an alias for System.Create()
	' ExecuteEventProcedure does is not registered by default on vx,
	' but calling an unregistered is not fatal
	if System.Create() = -1 then
		SystemEventInit()
	end if
	if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
		ExecuteEventProcedure("UI.CreatePublic")
	end if
end sub

private sub InitMsg()
	lcdmsg = ExecuteEventProcedure("LCDMsg_Create")
	msgstr = AllocateMemory(80)
end sub

private sub PutMsg(msg)
	if lcdmsg >= 0 then
		LCDMsg_SetStr(lcdmsg,msg)
	end if
end sub
 
private sub Initialize()
	RegisterProcs()
	InitMsg()
	PutMsg("Dumping RAM")

	dumpfile = Fopen_Fut("A/0x100.BIN","w")
	if dumpfile <> 0 then
		Fwrite_Fut(0x100,0xFFFFF00,1,dumpfile)
		Fclose_Fut(dumpfile)
		Wait(500)
		PutMsg("done")
	else
		PutMsg("file error")
	end if
	FreeMemory(msgstr)
end sub

It's untested, hopefully usable.
If the CPU has an MMU, the result is probably unpredictable. If this isn't working either, we'll have to find event procedures that give hints about memory mapping.

Sapporo

srsa_4c

SapporoFixed

The archive size itself says a lot (way too small). The segments seem to contain the same data (lens correction related, not firmware).
That means we're experiencing a huge architectural change.
Since I have no idea where to find the ROM, a different approach is needed.

Following script will try to dump (almost) 256MB of RAM(?) starting at address 0x100. It's unlikely to contain the whole firmware, but it might have pointers.
[code]private sub RegisterProcs()
' Newest cams (Dryos rel 43 and later) only have System.Create()
' on older dryos cams SystemEventInit is an alias for System.Create()
' ExecuteEventProcedure does is not registered by default on vx,
' but calling an unregistered is not fatal
if System.Create() = -1 then
SystemEventInit()
end if
if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
ExecuteEventProcedure("UI.CreatePublic")
end if
end sub

private sub InitMsg()
lcdmsg = ExecuteEventProcedure("LCDMsg_Create")
msgstr = AllocateMemory(80)
end sub

private sub PutMsg(msg)
if lcdmsg >= 0 then
LCDMsg_SetStr(lcdmsg,msg)
end if
end sub

private sub Initialize()
RegisterProcs()
InitMsg()
PutMsg("Dumping RAM")

dumpfile = Fopen_Fut("A/0x100.BIN","w")
if dumpfile <> 0 then
Fwrite_Fut(0x100,0xFFFFF00,1,dumpfile)
Fclose_Fut(dumpfile)
Wait(500)
PutMsg("done")
else
PutMsg("file error")
end if
FreeMemory(msgstr)
end sub
[/code]It's untested, hopefully usable.
If the CPU has an MMU, the result is probably unpredictable. If this isn't working either, we'll have to find event procedures that give hints about memory mapping.

Screen turned black after 1 second and nothing more happend. I will try again with a bigger card when I get home. 512 MB may be too small.

Ant

Try to start at address 0x100000

Sapporo

I will be back home in maybe 6 hours.

srsa_4c

Sapporo
Screen turned black after 1 second and nothing more happend.

That's a crash. You could try getting the romlog.

I will try again with a bigger card when I get home. 512 MB may be too small.

It's unlikely related to card size.
I have a feeling that the days of dumping arbitrary memory are over...

Anyway, please watch this thread, I (or someone else) will likely post something new to try.

c_joerg

srsa_4c
I have a feeling that the days of dumping arbitrary memory are over...

A friend has a G7x mark II. Do you would expect the same problems with a dump on the G7x mark II?

reyalp

c_joerg
A friend has a G7x mark II. Do you would expect the same problems with a dump on the G7x mark II?

We don't know what to expect, but it would be interesting to find out. (edit: Past experience would suggest D7 cameras would behave similarly, but it's realy just a guess)

Sapporo

Ant
Try to start at address 0x100000

Same thing. The screen became black.

Sapporo

srsa_4c

Sapporo
Screen turned black after 1 second and nothing more happend.
That's a crash. You could try getting the romlog.

I will try again with a bigger card when I get home. 512 MB may be too small.
It's unlikely related to card size.
I have a feeling that the days of dumping arbitrary memory are over...

Anyway, please watch this thread, I (or someone else) will likely post something new to try.

I replaced the code in extend.m with the romlog code. Correct?

EOS_DIGITAL.7z

30KB

srsa_4c

Sapporo
I replaced the code in extend.m with the romlog code. Correct?

Yes, whatever script you intend to run, it must be placed into the extend.m file.
The romlog is OK.
What I see is
- this is still 32 bit ARM
- exception vector 0x10, data abort (can this be caused by permission problems?)
- one of the registers holds 0x100, the start address in the script
- SP is at 0x5E3558 which looks like a regular RAM address
- R0 is 0x4044F6E0, looks like an uncached RAM address
- PC is 0xDFFD41C8, could be a TCM
- LR is 0xE00278A1, thumb address, there are more 0xexxxxxxx addresses on stack

I think the ROM is located above 0xe0000000.

Modified the blind dumper to dump four 16MB segments, starting at 0xe0000000.

dim f,a,startadr=0,romsize=0x1000000,msgstr=0

private sub mydump(c)
        startadr = c * 0x1000000
        startadr = startadr + 0xe0000000
        sprintf(msgstr,"A/DUMP%0X.BIN",c)
        LCDMsg_SetStr(a,msgstr)
        f=Fopen_Fut(msgstr,"w")
        Fwrite_Fut(startadr,romsize,1,f)
        Fclose_Fut(f)
        Wait(500)
end sub

private sub Initialize()
	UI.CreatePublic()
	a=LCDMsg_Create()
	LCDMsg_SetStr(a,"Running")
	System.Create()
	msgstr = AllocateMemory(80)

        mydump(0)
        mydump(1)
        mydump(2)
        mydump(3)

        LCDMsg_SetStr(a,"Done")
	FreeMemory(msgstr)
end sub

Ant

srsa_4cModified the blind dumper to dump four 16MB segments, starting at 0xe0000000.

According GK.LOG, there should be 32MB at least:

JediDraw
02,  579,0,0x23aa220,0x23cd360,e1812a58,0
03,  846,0x23aa220,0x23cd360,2,0,0xbff0056c

Sapporo

srsa_4c

Sapporo
I replaced the code in extend.m with the romlog code. Correct?

Yes, whatever script you intend to run, it must be placed into the extend.m file.
The romlog is OK.
What I see is
- this is still 32 bit ARM
- exception vector 0x10, data abort (can this be caused by permission problems?)
- one of the registers holds 0x100, the start address in the script
- SP is at 0x5E3558 which looks like a regular RAM address
- R0 is 0x4044F6E0, looks like an uncached RAM address
- PC is 0xDFFD41C8, could be a TCM
- LR is 0xE00278A1, thumb address, there are more 0xexxxxxxx addresses on stack

I think the ROM is located above 0xe0000000.

Modified the blind dumper to dump four 16MB segments, starting at 0xe0000000.
[code]dim f,a,startadr=0,romsize=0x1000000,msgstr=0

private sub mydump(c)
startadr = c * 0x1000000
startadr = startadr + 0xe0000000
sprintf(msgstr,"A/DUMP%0X.BIN",c)
LCDMsg_SetStr(a,msgstr)
f=Fopen_Fut(msgstr,"w")
Fwrite_Fut(startadr,romsize,1,f)
Fclose_Fut(f)
Wait(500)
end sub

private sub Initialize()
UI.CreatePublic()
a=LCDMsg_Create()
LCDMsg_SetStr(a,"Running")
System.Create()
msgstr = AllocateMemory(80)

mydump(0)
mydump(1)
mydump(2)
mydump(3)

LCDMsg_SetStr(a,"Done")
FreeMemory(msgstr)
end sub
[/code]

Done. File too big for CHDK and uploaded at http://www.filedropper.com/eosdigital