Seklth
http://volohova.zelnet.ru/FuncListSave.rar
idc for save and load list of functions and my current list for 400D v1.1.1
see path in idc files - #define FILELIST "c:/funclist.txt"
owerlord
I run it as a function with one argument (starttype). And I think that if there is:
MOV R5, #0x81000000
MOV R5, R5,ASR#8
that means: 0xFF810000 not 0x00810000.
So it is:
IF 0xFF810000 != "MOV R0, #2" then jump 0xFF810000
IF 0xFF810000 == "MOV R0, #2" && 0xFF810008 = "Copy" then jump 0xFF810004
But it runs a function from vmLibInfo+0x14 if it is present in the memory. I don't know what it is - but jumping to the begining of the rom didn't do anything. mayby that function runs the "Loadin ..." ?
One more thing: I runed it with starttype=2. I can try some other - but I didn't find any place where the begining of rom uses this argument - I think it is discarted.
Seklth
owerlord
flags of starttype:
rebootLib
2 - its BOOT_CLEAR
owerlord
wierd: I just dicovered that the jump to romStart do something - but you have to wait a good bit.
But it's very wierd:
It restarts in the place where you leave the menu ("Version : 1.1.1") and only button that work is "Jump" and it acts like the "->" arrow. (modyfied: No - in fact it does what "Jump" does 😀
Freaky.
owerlord
the romStart from the firmware don't do what vxWorks ought to.
There are no starttype flags I think. It don't copy the .data segment - only writes the adreses to (buffor?) 0xC0A10000+indexes. I think it always zero-s the .bss segment. It's wierd - it means that there are some proces specyfic information out of .bss. But pulling out the battery resets them (but not the user config. Wierd.
Seklth
you test run code restart from powershot? with 0x12345678 flag?
owerlord
no. I runned the
ROM:FF8100A0 romStart
with 4 and 2 flags. same efect. after some time of blank, restarts at menu and only "jump" button works.
Seklth
run with another flag - nothing?
P.S. public you function list =)
owerlord
function list is attached. I exported it after appling some of yours.
What you all think is the next step?
option a) rewrite the romStart function and modyfie it so it will run some our code?
option b) trie to clear some of the memory before runing romStart and wait if it will restart fully this time?
Seklth
i think, if it possible - need doing dump full ROM&RAM. way a) =)
owerlord
After running the romStart I counted to 30 to get the menu back.
Now I'm rewriting the romStart - it have the delay also.
actually: I rewrited the romStart, usrInit, usrKernelInit, usrRoot, AppInit. first two work. I'm now searching for errors in the usrKernelInit - but the 30 sec delay is a real pain.
owerlord
romStart, usrInit, usrKernelInit, usrRoot works. usrRoot calls the orginal firmware usrAppInit_0.
when I run it, there is the same efect: back to menu, with only "jump" working.
when I make a fopen("A:\test.txt","w") and fclose - it made a diffrence:
menu apears - but the "jump" button don't work. file isn't writen either :\
I think the best thing now is to find what the firmware does before jumping to 0x800000. I can't find it.
NEW: the test was with an error: \ in place of /. when I made it right - the jump button works. but there is no file created :\
NEW: tested the eventproc_EdLedBlink after AppInit - nothing happened.
Seklth
>I think the best thing now is to find what the firmware does before jumping to 0x800000. I can't find it.
firmware jump to some "Firmware loader" code)) not to 0x800000.
test run eventproc_GenerateDDD =)
Seklth
>usrRoot calls the orginal firmware usrAppInit_0.
usrAppInit_0 - it is taskcreate_Startup.
.....
FW:FF81134C LDR R3, =task_Startup
FW:FF811350 LDR R0, =aStartup
FW:FF811354 STR R12, [SP,#4+var_4]
FW:FF811358 BL CreateTask
.....
1) maybe create our task with some code instead task_Startup
2) test run code (blink, GenerateDDD, example) in end of task_Startup
owerlord
mayby later - I'm now searching for some hints on these things:
1. what cause the delay in the code running.
2. what firmware do before running the code
2.a how it's blocking buttons and how to unblock them
2.b why after running it apears in the same place in menu
3. what exactly camera does when you insert the batteries
Seklth
>3. what exactly camera does when you insert the batteries
firmware not have this information\code. it in bootloader, or some other place. need dump...
if GenerateDDD creating file - it's good, and we can save dump =)
owerlord
romStart->...->AppInit rewriten. I registered a modyfied Startup task:
int my_Startup()
{ char* nm = "A:/TST.BIN";
int fl;
eventproc_Startup();
vx_file_unknown(nm);
fl = vx_creat_(nm);
vx_close_0(fl);
}
Didn't create the file:\ the fileprocedures are from the generateDDD event.
The frustrating thing is - I can't get any feedback. Anything that would confirm that my code is running properly !
Anybody found where the debug text are going ?
jeff666
owerlord
The frustrating thing is - I can't get any feedback. Anything that would confirm that my code is running properly !
The traditional method is LED activity. Turn on an LED and you know the code has been executed.
Anybody found where the debug text are going ?
Usually to the console (which is not available to the end-user). You may be able to redirect stdout/stderr to a file, but this is pure guesswork.
Cheers.
Seklth
@owerlord
run native eventproc_GenerateDDD don't create file too?
@jeff666
eventproc_EdLedBlink, what store dword to mem - not worked.
@owerlord
maybe need find over code, what working with led. you find hook buttons? button "direct print" have led)
jeff666
Seklth
eventproc_EdLedBlink, what store dword to mem - not worked.
Ever thought that Event Procedures might not work?
The P&S-cams clear the OS when "Firm Update" is selected. Close to nothing works then.
To light up an LED we write directly to MMIO-addresses. Read eventproc_EdLedBlink and check for write access between 0xC000000 and 0xC2000000. Chances are, that you find the correct MMIO-address and are able to control an led. Have a look at the camera-specific articles in CHDK-wiki to see a list of typical addresses.
Once you have an address, the LED should turn on if you write 0x46 or off if you write 0x44 to the location.
Cheers.
