code you HAVE RUN on your dslr

owerlord

I want to ask what code you have run on your camera. Succesfully? Faulty? Effects? Wierd effects?
Please describe exacly what code, on which camera, and what it have done.

Less ideas in this thread - more facts please.

owerlord

Runned by me on 400D:

1. code without attached data pack (0 in address of the pack). - Camera didn't run it - said it's corrupt.
2. infinite loop with attached empty data pack - Camera hung (succes 😀
3. setting memory like in eventproc_EdLedBlink - No led blinked :-\
4. jump to the FF810000 - no effect
5. eventproc_SelfReset - reseted to the loading process. effect: "Loading..."-black-"Loading..."-black ...
6. I runed vxWorks create+close procedures from the firmware (1.1.1) on file A:\SUC.TXT - didn't create a file on the CF card :\

Any ideas what next to run ? 😀

WARNING: running the eventproc_SelfReset is hazardous - once my camera wanted to load firmware even after getting the batteries out. I think that I took out the batteries in the wrong moment of code. Only method I found to restart my camera was to write the orginal firmware to the CF and load it.

WARNING: when I jumped to FF810000, and after I opened the CF cover - it hanged with wierd display - I had to pull out the small 3V battery to reset

Seklth

Yes, no use SelfReset... it's bad... i took out batteries it more wrong moment - and now my camera in service-center for repair =)

One way for find restart - analyse code of dialog MnFirmVersionUp - see function CreateDialogBox_MnFirmVersionUp in this idb. I cann't understand, where handled press of "set" button =)

ftp://80.92.105.79/pub/seklth/CHDK/400D_E4KR3111_FF810000.idb

@owerlord
if you found some OS and C function - strcpy, memcmp, etc - please, public it

PhyrePhoX

Seklth
i took out batteries it more wrong moment - and now my camera in service-center for repair =)

are they repairing it for free? what did you tell them?

Seklth

PhyrePhoX

Seklth
i took out batteries it more wrong moment - and now my camera in service-center for repair =)

are they repairing it for free? what did you tell them?

yes, free. i have service guarantee. nothing original - "my camera not worked (not power on)" =)

owerlord

What is the best way to public my findings? .map? Is there a way to export from IDA only these names that I entered? atleast the names that are not sub_ ?

Seklth

Good, if you create "Dump data base to IDC". Edit this idc more easer to public only need funtions)

owerlord

I had no time to do it - but I will soon.

In the mean time:
7. runned task_Startup by BL to it, and then eventproc_EdLedBlink. Nothing happened.

I don't know how to restart the system. How chdk does anyway?

jeff666

owerlord
I don't know how to restart the system. How chdk does anyway?

CHDK restarts the cam by executing restart-code.

Check your firmware for the string "Restart called". If it exists it is probably used in the restart-function. Call this function to restart the camera.

Cheers.

Seklth

Nothing.

Code have string
FW:FFB6C018 DCD atRestart ; "tRestart"

But near not have any "understandable" fun?tion, that restarted.

jeff666

Seklth
Nothing.

Bummer.

Digic2 and Digic3 all use identical reset-code which looks like this:

asm volatile(
"MRS R1, CPSR\n"
"BIC R1, R1, #0x3F\n"
"ORR R1, R1, #0xD3\n"
"MSR CPSR_cf, R1\n"

"LDR R2, =0xC0200000\n" These two lines...
"MOV R1, #0xFFFFFFFF\n" ...are characteristic
"STR R1, [R2,#0x10C]\n"
"STR R1, [R2,#0xC]\n"
"STR R1, [R2,#0x1C]\n"
"STR R1, [R2,#0x2C]\n"
"STR R1, [R2,#0x3C]\n"
"STR R1, [R2,#0x4C]\n"
"STR R1, [R2,#0x5C]\n"
"STR R1, [R2,#0x6C]\n"
"STR R1, [R2,#0x7C]\n"
"STR R1, [R2,#0x8C]\n"
"STR R1, [R2,#0x9C]\n"
"STR R1, [R2,#0xAC]\n"
"STR R1, [R2,#0xBC]\n"
"STR R1, [R2,#0xCC]\n"
"STR R1, [R2,#0xDC]\n"
"STR R1, [R2,#0xEC]\n"
"STR R1, [R2,#0xFC]\n"

"MOV R1, #0x78\n"
"MCR p15, 0, R1,c1,c0\n"
"MOV R1, #0\n"
"MCR p15, 0, R1,c7,c10, 4\n"
"MCR p15, 0, R1,c7,c5\n"
"MCR p15, 0, R1,c7,c6\n"
"MOV R2, #0x40000000\n"
"ORR R1, R2, #6\n"
"MCR p15, 0, R1,c9,c1\n"
"ORR R1, R1, #6\n"
"MCR p15, 0, R1,c9,c1, 1\n"
"MRC p15, 0, R1,c1,c0\n"
"ORR R1, R1, #0x50000\n"
"MCR p15, 0, R1,c1,c0\n"

"MOV R3, #0xFF0\n"
"LDR R1, =0x12345678\n" LDR Rx, =0x12345678 shouldn't occur to often, as well.
"ADD R3, R3, #0x4000000C\n"
"STR R1, [R3]\n"

"MOV SP, #0x1900\n"
"MOV LR, PC\n"
"MOV PC, %0\n"
: : "r"(dst_void) : "memory","r1","r2","r3");

Something you might look for in IDA are these commands:
"LDR R2, =0xC0200000\n"
"MOV R1, #0xFFFFFFFF\n"

They should be characteristically enough to start a search for, although the registers may be different. I've seen "LDR R2.../MOV R1..." as well as "LDR R1.../MOV R0...".

You may also look for LDR Rx, =0x12345678 to identify the reset-function.

Check for matches, and if you find some, check if the surroundings match the remaining reset-code.

Cheers.

Seklth

@jeff666
Thanks, i find identical code by "0xC0200000" value.

FW:FF810190 Restart

http://volohova.zelnet.ru/400D_Restart.txt

added:
i see powershot firmware - it is function sysInit, not Restart

maybe run code, that jeff666 posted?

Seklth

Decrypted FIR file with header loaded by 0x00800000
MAIN_FIRMWARE section (from data packs) loaded by 0xFF810000.

You can check address, if see start code, example
FWLDR:008000B0 LDR PC, =loc_8000D0 ; Indirect Jump
FW:FF810080 LDR PC, =sub_FF8100A0 ; Indirect Jump

jeff666

Seklth
@jeff666
Thanks, i find identical code by "0xC0200000" value.

FW:FF810190 Restart

This looks great. A jump to this function should restart the cam.

If this works, the next step would be to duplicate the original restart-code from IDA into your own function and change the location it branches to.

Note that the code you posted seems incomplete. It ends with
ADR SP, Restart
MOV R11, #0
MOV R0, #2
B sub_FF810B7C

Restart points (probably) to 0xFF810000 or something near there. But this code doesn't jump there. Instead it continues execution at 0xFF810B7C.

At 0xFF810B7C you will probably find something like "BX SP" or "LDR PC, SP" or just "RET" (or something totally different that I can't think of right now).

Please post that code as well. I'd like to see it.

Cheers.

Seklth

@jeff666
This code - function sysInit, not Restart (i see it later). All addresses - indentical, as sysInit in sd750.
Maybe run code, that you posted - from powershot?

owerlord

Anybody runned this code?
I runed the FF810190 and nothing happened :\

owerlord

Found the vxWorks reboot and sysToMonitor procedures.
Runned the sysToMonitor - same efect as eventproc_SelfReboot :

Loading ... | black | Loading ... | blank | Loading ... | ...

It's wierd - becose main feature of the sysToMonitor is to jump to Rom start. But jumping to rom start didn't do anything.

Note: Even the orginal canon loader don't reboot the system. It writes to unload the batteries :\

Seklth

owerlord
Found the vxWorks reboot and sysToMonitor procedures.

Please post addresses, that you found 😉

owerlord

I wanted to - but the idc file IDA produces is just gigantic ! I cannot edit it out.
Is there a way to export names added by me ? At least these witch are blue (not sub_ ?) in IDA?
I can post adreses I remember I found:

ROM:FFB4A33C reboot
ROM:FF810418 sysToMonitor
ROM:FF873F90 checkForFirmup_

ROM:FF8100A0 romStart
ROM:FF810B7C usrInit

And some code with names I identyfied:
usrInit:

usrInit                                 ; CODE XREF: romStart+24p
ROM:FF810B7C                                                           ; usrEntry+8j ...
ROM:FF810B7C
ROM:FF810B7C                   var_14          = -0x14
ROM:FF810B7C                   var_10          = -0x10
ROM:FF810B7C
ROM:FF810B7C 30 40 2D E9                       STMFD   SP!, {R4,R5,LR} ; Store Block to Memory
ROM:FF810B80 00 40 A0 E1                       MOV     R4, R0          ; Rd = Op2
ROM:FF810B84 08 D0 4D E2                       SUB     SP, SP, #8      ; Rd = Op1 - Op2
ROM:FF810B88 B8 50 9F E5                       LDR     R5, =0x2A550    ; Load from Memory
ROM:FF810B8C D7 FD FF EB                       BL      sysHwInit0      ; Branch with Link
ROM:FF810B90 B4 00 9F E5                       LDR     R0, =dword_DFB0 ; Load from Memory
ROM:FF810B94 05 10 60 E0                       RSB     R1, R0, R5      ; Rd = Op2 - Op1
ROM:FF810B98 8E D3 0C EB                       BL      bzero           ; (what, how many)
ROM:FF810B9C AC 30 9F E5                       LDR     R3, =sysStartType ; Load from Memory
ROM:FF810BA0 00 00 A0 E3                       MOV     R0, #0          ; Rd = Op2
ROM:FF810BA4 00 40 83 E5                       STR     R4, [R3]        ; Store to Memory
ROM:FF810BA8 09 36 0D EB                       BL      intVecBaseSet   ; Branch with Link
ROM:FF810BAC 02 10 A0 E3                       MOV     R1, #2          ; Rd = Op2
ROM:FF810BB0 01 00 A0 E3                       MOV     R0, #1          ; Rd = Op2
ROM:FF810BB4 51 05 0D EB                       BL      sub_FFB52100    ; Branch with Link
ROM:FF810BB8 96 38 0D EB                       BL      excVecInit      ; Branch with Link
ROM:FF810BBC D9 FD FF EB                       BL      sysHwInit       ; Branch with Link
ROM:FF810BC0 00 00 A0 E3                       MOV     R0, #0          ; Rd = Op2
ROM:FF810BC4 42 05 0D EB                       BL      cacheEnable_    ; Branch with Link
ROM:FF810BC8 01 00 A0 E3                       MOV     R0, #1          ; Rd = Op2
ROM:FF810BCC 40 05 0D EB                       BL      cacheEnable_    ; Branch with Link
ROM:FF810BD0 4F 04 0D EB                       BL      classLibInit    ; Branch with Link
ROM:FF810BD4 EF BA 0C EB                       BL      taskLibInit     ; Branch with Link
ROM:FF810BD8 74 30 9F E5                       LDR     R3, =off_D840   ; Load from Memory
ROM:FF810BDC 74 20 9F E5                       LDR     R2, =unk_298A0  ; Load from Memory
ROM:FF810BE0 00 10 93 E5                       LDR     R1, [R3]        ; Load from Memory
ROM:FF810BE4 70 00 9F E5                       LDR     R0, =unk_28DE0  ; Load from Memory
ROM:FF810BE8 01 3C A0 E3                       MOV     R3, #0x100      ; Rd = Op2
ROM:FF810BEC 1F CC 0C EB                       BL      qInit           ; Branch with Link
ROM:FF810BF0 68 30 9F E5                       LDR     R3, =off_D880   ; Load from Memory
ROM:FF810BF4 68 00 9F E5                       LDR     R0, =unk_D6E8   ; Load from Memory
ROM:FF810BF8 00 10 93 E5                       LDR     R1, [R3]        ; Load from Memory
ROM:FF810BFC 1B CC 0C EB                       BL      qInit           ; Branch with Link
ROM:FF810C00 60 30 9F E5                       LDR     R3, =off_D7C4   ; Load from Memory
ROM:FF810C04 60 00 9F E5                       LDR     R0, =unk_25A20  ; Load from Memory
ROM:FF810C08 00 10 93 E5                       LDR     R1, [R3]        ; Load from Memory
ROM:FF810C0C 17 CC 0C EB                       BL      qInit           ; Branch with Link
ROM:FF810C10 6D A7 0C EB                       BL      workQInit       ; Branch with Link
ROM:FF810C14 E6 FD FF EB                       BL      sysMemTop       ; Branch with Link
ROM:FF810C18 00 40 A0 E3                       MOV     R4, #0          ; Rd = Op2
ROM:FF810C1C 00 30 A0 E1                       MOV     R3, R0          ; Rd = Op2
ROM:FF810C20 03 CB A0 E3                       MOV     R12, #0xC00     ; Rd = Op2
ROM:FF810C24 05 20 A0 E1                       MOV     R2, R5          ; Rd = Op2
ROM:FF810C28 40 00 9F E5                       LDR     R0, =usrRoot    ; Load from Memory
ROM:FF810C2C 01 19 A0 E3                       MOV     R1, #0x4000     ; Rd = Op2
ROM:FF810C30 00 C0 8D E5                       STR     R12, [SP,#0x14+var_14] ; Store to Memory
ROM:FF810C34 04 40 8D E5                       STR     R4, [SP,#0x14+var_10] ; Store to Memory
ROM:FF810C38 F9 C5 0C EB                       BL      kernelInit      ; Branch with Link
ROM:FF810C3C 08 D0 8D E2                       ADD     SP, SP, #8      ; Rd = Op1 + Op2
ROM:FF810C40 30 80 BD E8                       LDMFD   SP!, {R4,R5,PC} ; Load Block from Memory

usrRoot procedure:

 usrRoot                                 ; DATA XREF: ROM:off_FF810C70o
ROM:FF810A20                                                           ; ROM:off_FF810DECo
ROM:FF810A20
ROM:FF810A20                   var_14          = -0x14
ROM:FF810A20                   var_10          = -0x10
ROM:FF810A20
ROM:FF810A20 30 40 2D E9                       STMFD   SP!, {R4,R5,LR} ; Store Block to Memory
ROM:FF810A24 01 40 A0 E1                       MOV     R4, R1          ; Rd = Op2
ROM:FF810A28 00 50 A0 E1                       MOV     R5, R0          ; Rd = Op2
ROM:FF810A2C 08 D0 4D E2                       SUB     SP, SP, #8      ; Rd = Op1 - Op2
ROM:FF810A30 F2 C9 0C EB                       BL      eventLibInit    ; Branch with Link
ROM:FF810A34 8C C2 0C EB                       BL      semBLibInit     ; Branch with Link
ROM:FF810A38 5F BE 0C EB                       BL      semMLibInit     ; Branch with Link
ROM:FF810A3C 84 C1 0C EB                       BL      semCLibInit     ; Branch with Link
ROM:FF810A40 3D C6 0C EB                       BL      semQLibInit     ; Branch with Link
ROM:FF810A44 E9 AF 0C EB                       BL      wdLibInit       ; Branch with Link
ROM:FF810A48 02 DC 0C EB                       BL      taskHookInit    ; Branch with Link
ROM:FF810A4C 04 10 A0 E1                       MOV     R1, R4          ; Rd = Op2
ROM:FF810A50 05 00 A0 E1                       MOV     R0, R5          ; Rd = Op2
ROM:FF810A54 13 EF 0C EB                       BL      memInit         ; Branch with Link
ROM:FF810A58 04 10 A0 E1                       MOV     R1, R4          ; Rd = Op2
ROM:FF810A5C 05 00 A0 E1                       MOV     R0, R5          ; Rd = Op2
ROM:FF810A60 ED EC 0C EB                       BL      memPartLibInit  ; Branch with Link
ROM:FF810A64 F4 30 9F E5                       LDR     R3, =sysMmuLibInit ; Load from Memory
ROM:FF810A68 00 30 93 E5                       LDR     R3, [R3]        ; Load from Memory
ROM:FF810A6C 00 00 53 E3                       CMP     R3, #0          ; Set cond. codes on Op1 - Op2
ROM:FF810A70 01 0A A0 E3                       MOV     R0, #0x1000     ; Rd = Op2
ROM:FF810A74 0E 00 00 0A                       BEQ     loc_FF810AB4    ; Branch
ROM:FF810A78 0F E0 A0 E1                       MOV     LR, PC          ; Rd = Op2
ROM:FF810A7C 03 F0 A0 E1                       MOV     PC, R3          ; Rd = Op2
ROM:FF810A80 00 00 50 E3                       CMP     R0, #0          ; Set cond. codes on Op1 - Op2
ROM:FF810A84 01 0A A0 E3                       MOV     R0, #0x1000     ; Rd = Op2
ROM:FF810A88 09 00 00 1A                       BNE     loc_FF810AB4    ; Branch
ROM:FF810A8C EC D4 0C EB                       BL      sub_FFB45E44    ; Branch with Link
ROM:FF810A90 00 00 50 E3                       CMP     R0, #0          ; Set cond. codes on Op1 - Op2
ROM:FF810A94 01 20 A0 E3                       MOV     R2, #1          ; Rd = Op2
ROM:FF810A98 C4 00 9F E5                       LDR     R0, =(dword_1916+2) ; Load from Memory
ROM:FF810A9C 04 00 00 1A                       BNE     loc_FF810AB4    ; Branch
ROM:FF810AA0 C0 30 9F E5                       LDR     R3, =unk_197C   ; Load from Memory
ROM:FF810AA4 00 10 93 E5                       LDR     R1, [R3]        ; Load from Memory
ROM:FF810AA8 D1 D4 0C EB                       BL      sub_FFB45DF4    ; Branch with Link
ROM:FF810AAC 00 00 50 E3                       CMP     R0, #0          ; Set cond. codes on Op1 - Op2
ROM:FF810AB0 09 00 00 1A                       BNE     loc_FF810ADC    ; Branch
ROM:FF810AB4
ROM:FF810AB4                   loc_FF810AB4                            ; CODE XREF: usrRoot+54j
ROM:FF810AB4                                                           ; usrRoot+68j ...
ROM:FF810AB4 D8 00 0D EB                       BL      getErrorNumber  ; Branch with Link
ROM:FF810AB8 00 20 A0 E3                       MOV     R2, #0          ; Rd = Op2
ROM:FF810ABC 00 10 90 E5                       LDR     R1, [R0]        ; Load from Memory
ROM:FF810AC0 02 30 A0 E1                       MOV     R3, R2          ; Rd = Op2
ROM:FF810AC4 A0 00 9F E5                       LDR     R0, =ausrRootMMUconfigurationf ; Load from Memory
ROM:FF810AC8 00 20 8D E5                       STR     R2, [SP,#0x14+var_14] ; Store to Memory
ROM:FF810ACC 04 20 8D E5                       STR     R2, [SP,#0x14+var_10] ; Store to Memory
ROM:FF810AD0 24 FF 0C EB                       BL      printExc        ; Branch with Link
ROM:FF810AD4 01 00 A0 E3                       MOV     R0, #1          ; Rd = Op2
ROM:FF810AD8 17 E6 0C EB                       BL      reboot          ; Branch with Link
ROM:FF810ADC
ROM:FF810ADC                   loc_FF810ADC                            ; CODE XREF: usrRoot+90j
ROM:FF810ADC 00 10 A0 E3                       MOV     R1, #0          ; Rd = Op2
ROM:FF810AE0 88 00 9F E5                       LDR     R0, =usrClock   ; Load from Memory
ROM:FF810AE4 CA 86 0C EB                       BL      sysClockConnect ; Branch with Link
ROM:FF810AE8 3C 00 A0 E3                       MOV     R0, #0x3C ; '<' ; Rd = Op2
ROM:FF810AEC 58 86 0C EB                       BL      sysClockRateSet ; Branch with Link
ROM:FF810AF0 EE 86 0C EB                       BL      sysClockEnable  ; Branch with Link
ROM:FF810AF4 32 00 A0 E3                       MOV     R0, #0x32 ; '2' ; Rd = Op2
ROM:FF810AF8 94 E5 0C EB                       BL      selectInit      ; Branch with Link
ROM:FF810AFC 01 0A A0 E3                       MOV     R0, #0x1000     ; Rd = Op2
ROM:FF810B00 AC FE FF EB                       BL      usrBootLineParse ; Branch with Link
ROM:FF810B04 68 20 9F E5                       LDR     R2, =anull_1    ; Load from Memory
ROM:FF810B08 32 10 A0 E3                       MOV     R1, #0x32 ; '2' ; Rd = Op2
ROM:FF810B0C 14 00 A0 E3                       MOV     R0, #0x14       ; Rd = Op2
ROM:FF810B10 72 F3 0C EB                       BL      iosInit         ; Branch with Link
ROM:FF810B14 81 D9 0C EB                       BL      ttyDrv          ; Branch with Link
ROM:FF810B18 6E FF FF EB                       BL      usrSerialInit   ; Branch with Link
ROM:FF810B1C 9F F7 0C EB                       BL      hashLibInit     ; Branch with Link
ROM:FF810B20 01 00 A0 E3                       MOV     R0, #1          ; Rd = Op2
ROM:FF810B24 45 02 0D EB                       BL      envLibInit      ; Branch with Link
ROM:FF810B28 16 E3 0C EB                       BL      sigInit         ; Branch with Link
ROM:FF810B2C 57 00 0D EB                       BL      sub_FFB50C90    ; Branch with Link
ROM:FF810B30 40 30 9F E5                       LDR     R3, =consoleFd  ; Load from Memory
ROM:FF810B34 32 10 A0 E3                       MOV     R1, #0x32 ; '2' ; Rd = Op2
ROM:FF810B38 00 00 93 E5                       LDR     R0, [R3]        ; Load from Memory
ROM:FF810B3C 41 F0 0C EB                       BL      logInit         ; Branch with Link
ROM:FF810B40 F5 12 0D EB                       BL      stdioInit       ; Branch with Link
ROM:FF810B44 E7 FF 0C EB                       BL      fioLibInit      ; Branch with Link
ROM:FF810B48 66 E5 0C EB                       BL      selTaskDeleteHookAdd ; Branch with Link
ROM:FF810B4C F5 3A 0D EB                       BL      cplusCtorsLink  ; Branch with Link
ROM:FF810B50 5A FE FF EB                       BL      usrAppInit_0    ; startup?
ROM:FF810B54 08 D0 8D E2                       ADD     SP, SP, #8      ; Rd = Op1 + Op2
ROM:FF810B58 30 80 BD E8                       LDMFD   SP!, {R4,R5,PC} ; Load Block from Memory
ROM:FF810B58                   ; End of function usrRoot

Most of the names are from Tornado 2.2 online manuals.

Seklth

owerlord
Found the vxWorks reboot and sysToMonitor procedures.
Runned the sysToMonitor - same efect as eventproc_SelfReboot :

how you start sysToMonitor function?
jump to this?

what sysToMonitor do:
if
0x810000 = MOV R0, #2
0x810008 = "Copy"
It jump to 0xFF810004 (condition - seg 0x810000= seg 0xFF810000)
else - it jump 0x810000

Maybe you test run this function without this compares?
and also test run this R0 = 0, 1, 2