code you HAVE RUN on your dslr

owerlord

Found a vary important thing:
ROM:FFB06868 RegisterListOfEvents

It registers events from a list like
"Name"
eventproc_Name
...

NEW: at the end of Startup_Task functions is called with starts a console - it waits for input - that why I think startup don't return.

owerlord

I blink-tested the my rewriten romstart->task_startup path. It's not working.

Everything is executed until the
kernelInit( my_usrRoot, ...)

I call the firmware kernelInit procedure - And the my_usrRoot is never runned.

option a) the kernelInit haven't run the my_usrRoot, but restarted something - and that why the menu apears.

option b) the system clock is changed so much that my led blinking isn't recordable.

NEW: checked twice - when I comment out the my_usrRoot or my_AppInit - the menu don't start. My blinking don't work after kernelInit.

NEW: the clock is fastened 2^4 times - with that modyfication - the blinking works. whole path works perfectly.
The best thing now would be propably to rewrite the startup task :\

NEW: 1. all functions up to Startup task are runned imediatly - so the delay have to be in the startup.

I found the CF installation procedure:

ROM:FFABCAD4 CFBigFunction

It install's the filesystem. but is runned throu an adres from the memory (0000BFDC+4)

NEW: Problem. blinking isn't working when started later in the Startup task. I don't know why exacly - but I think it's becose interrupts take place or the clock time is changed in backgroud. in efekt led blinks delays are unreadable.

owerlord

I wrote a driver for the led-output, and redirected the stdout and stderr on it. problem is that the sending is with errors. (changed characters and so).

Here is a log of messages from loading until the menu apears (where the errors begin) and then I press "jump" couple of times. Read on 😀

Begin
Begin
Begin
Begin
?oFDromStart
usrInit
usrKernelInit
class
task
qInit1
qInit2
qInit3
workqinit
sysmemtop
usrRoot
blDrv()
DrvInstall...
malloc...
DevAdd...
blDrv Installed
AppInit
Startup - start
Starting test
/blink/0 tes/blink/0 test - 2/2
Redirecting stdout and stderr
Redirection succesfull
test exit
InitializeIntercom
[TFT-OLC] Notify Change.
-- ----------------
--- Change OLC ---
------------------
 String   :
 Mode   : 0
 Tv     :
 Av     : F00
 ISO    : AUTO
 WBMode : 0
 MesMode: 0
 AFMode : 0
 Drive  : 0
 AFPoint: 0
 format : 0
 size   : 0
 quality: 0
 Battery: 0
x-x--v-----c--
/ t Ilrto; zi*x-----r----b---c--
Mea?e   anO4cDIALxiweei 1
Byc x   5D9 --- --r-h--u---c-MCngWRvvWtetnuctn
x   6:  3046 [D-GI]ReuetR=0x0
x   7:  n0460 [DP-UInDigipCaabiit=00
   x8:m  30460 [-UInCL PM_Enilog FmF1  30&70[D-GUI] Free PinerPoprt
    1: n 3k47;[MC],T:0007nS:00, 9T    1z n 3470[M] GUInChage| :
 F 3:   347 [AIN] EnabteStDwnz m14:  n38970 [CM]InitilizComContrl
    17😖 979 [TOM]ROMegisteqLsTrnserBR{   18:  3970 [RTOM]TO_RBiRequeetransfeCBR

 x  J9:   380 [ATr]nitilizFATrasmissinLineecker n 20:  3900VB:0
n  2J: k 3910aRM]T_egistNotiyCnnetDT
   22: c 3910[GI] DTDIxO?Eh
m   36:  39920 [F]AccessTimngh I 250n
 m 4: a4020[M] T:008S:000, 0
    1:  4420 [MAI] DivStte0
    &9:F 40450 [F]FP_etFilSize :nFI{GetFieSizerr (A/MSiUTPRINTMRK
   0:   4051{[AIN] RmanCuser : 5799W    1: c 4510[SM]evnt:22,n0000:000, 04   52q
  400 SBn: -----FF, ,   5:  40510[STM]event:10,00:0000 0  54[  x4010 SB: -----FF
, d   51 x 40510[STM]evnt:12,,000000, 0zF   56  x4010 SBa m-----FF,
   5  4010[SM]mevet:12,x0q00:000, 0)   58[  m4050 iSB: -----FF,    59 n4010[MA :
000,S:001_ J
   40:mn 451 [C]:001 S0001,12
  c614  4050 MAIN]xileCountvr  0(0)
x{  62:  40510 [AI] BurCntr p0_  63[  x40510 MAN]nFull CF
 , 6:  4520 [MAIN] TFTk.Ccn  65p 40520 ZAIN]nFULL C WRNINGT    66: x 40520aMIg (
gi_nicomp)
a 7:   40520 [AI] aIntializ Cmpltep
n 68:a 4052 [C];T:012, S:100,x13,  69h  m4050 MCg T0002, l:100  14
   70:  4020  sw:060000)
F  1:  4052 [TM e*n: 1 0:000,
 F 72: n 4020[M] T:004 S:100, 5
    z3: 52      act:0129
   4:a 40530 [C]T:000, S:1000,16b  7[  m0530 g crl008
 x{ 76:  453 [MAIN] FLLCFWARNING.
  80  4050 C{T0006, :10017W  mn85:  4040 [M] T006,mS:000 1
   86: ;m4k54 [M] T:012, S1000, 19
m   7:a 4054 [UI PstQR  0000000
  k88t 40540 MCLT:000, :100) 20
  8   40540      ctrl?080
    x6:  4j55 [C],T:007 S[010,21
  m97  4050 MC G Chanhdm:7
  c98F  4050 STM] een:L 0:00:00,0
 n 12:  62 [DISPOW TrnOnmtat
x  4  0620 [UI] GetQ :00000000
a 08  4060 C T:01, :00022| 109  k400 [MAN] PLY BUSY EN.
  116   4060 mMA] 8680002 < 8680340b  24p 4070 mP FP_GetFileSze  FIO_eetFileiznE
r (:/IS/ATXERMR
 .1n3😖{ 4087 [LCD] EablLcdCotrolle
 m 1:  4k70[DSPOW Trn On omwe
   19😖{ 489 [9]nT:0007 S010,23
  a40:  4080 LCD EabeL+dBackLgh  a4: m 4090[MN FaceSens/ fz1)
  a42n  0890 MC GI hangedx2
   43h 40890 mSTM ent:21, 0:0:00,,0
 14c  90 [FM eent: 1W0000:00,  14:  4900[FCE Stp
ceensroReady stte= DLE[5T   15:  4530[MC] :0029, S:10, 4
  1v0:{ 7610 [pC]nT:000 S:010,5
   161h   7060 g4ctl:09T   162: x{70610[Sc]event:21,,0000:000, 0z,  163  50 [MC]
 T002, S:040 26  x16   9590x     sw:0162000)
   165[  m9890 MC T0002, S:0040, 27 n6:   98890  sw:062x0000)
,  167t J01490 MC T:0002, S:040_ 28
  16:  01490     sw:0162000)
   69[  J4 0n[MC] T?0, S:040)F29
  17  0490i sw:062&000)
   171[  J7440 MC T00, :040 30
n x17  07z0 sw:0620000)
,  173[  J10740 MC T?0, S:040) 3  17z 110_40     w:062B0000)
   175[  3d90 [MC] T[0002,:0040 32
  174: 1890      w:62(000)_,  177  J8390 [MC] T0k2, S:0040 33'  1n: 118390 w:160
00)z   179t J1690 MC T000, :040 34
  c18 12190,     sw:062000)
  82[  470 MC T002, :0040, 35
  c18 24790      sw:062&0000)

And don't you dare say that the errors are too bad to read it! I tried many algoritms to make it better - it's the best I can get!

NEW: The problem is that the led-output is so slow that the output of the diffrent tasks merge (even with semaphores aplied). If I would have a function witch would give me some actual-task-identyfier - I would disect it. the second option is to make a biiig buffor - I will test it tomorow.

owerlord

Ok, done. I got the blocking mechanizm right. Now it's readable.

As earlyer - here's a log of messages from loading the program until the menu apears and couple of "JUMP" press (other buttons don't do anything.

Begin
Begin
Begin
Begin
sbanromStart
usrInit
usrKernelInit
class
task
qInit1
qInit2
qInit3
workqinit
sysmemtop
usrRoot
blDrv()
DrvInstall...
malloc...
DevAdd...
blDrv Installed
AppInit
Startup - start
Starting test
/blink/0 tes/blink/0 test - 2/2
Redirecting stdout and stderr
Redirection succesfull
test exit
InitializeIntercom
vTFT-OLC] Notify Change.
------------------
--- Change OLC ---
------------------
 String   :
 Mode   : 0
 Tv     :
 Av     : F00
 ISO    : AUTO
 WBMode : 0
 MesMode: 0
 AFMode : 0
 Drive  : 0
 AFPoint: 0
 format : 0
 size   : 0
 quality: 0
 Battery: 0

? --------------------------------------
? /*         ICU Information          */
? --------------------------------------
? ModelName       : Canon EOS 400D DIGITAL
? FirmwareVersion : 1.1.1
? BodyID          : (hmmm - it's a bit risky 😀
? --------------------------------------
[CmndMgr]WARNING: OverWrite Operation Function?
[DM] dmStart
     6:   30120 [DP-GUI] RequestRet=0x0
a    7:a  30120 [DP-GUI] DigipCapabirity=0x0/v    8:a  30120 [DP-GUI] CALL DPM_EndDialog
    10:   30130 [DP-GUI] Free PrinterProperty
    b1,V  30130 [MC] T:0007, S:0001, 9/v   b2:   30130 [MC] GUI Changed :1
a   13:   30130 [MAIN] EnableShutDown
    17:   30280 [CM]InitializeComControl
    18:   30290 [RTOM]RTOM_RegistRequesetTransferCBR
    19:   30290 [RTOM]RTOM_RegistRequesetTransferCBR
    20:   30290 [FATr]InitializeFATransmissionLineChecker
    21:   30290 VBUS:0
    22:   30290 [RTOM]RTOM_RegistNotifyConnectDT
    23:   30290 [GUI] DT_DISCONNECT
    36:   30300 [CF] AccessTiming: I/O 250nS
    40:   30340 [MC] T:0008, S:0001, 10
    41:   30340 [MAIN] DriveState:0
    49:   30340 [FP] FP_GetFileSize : FIO_GetFileSize Err (A:/MISC/AUTPRINT.MRK)

    50:   30350 [MAIN] RemainCluster : 57991
    51:   30350 [STM] event:22, 00:00:000, 0
    52:   30350         SB : r-----FF, 3
    53:   30350 [STM] event:10, 00:00:000, 0
    54:   30350         SB : r-----FF, 3
    55:   30350 [STM] event:12, 00:00:000, 0
    56:   30350         SB : r-----FF, 3
    57:   30350 [STM] event:12, 00:00:000, 0
    58:   30350         SB : r-----FF, 3
    59:   30350 [MC] T:0010, S:0001, 11
    60:   30350 [MC] T:0011, S:0001, 12
    61:   30350 [MAIN] FileCounter : 0(0)
    62:   30350 [MAIN] BurstCounter : 0
    63:   30350 [MAIN] Full CF
    64:   30350 [MAIN] TFT OLC
    65:   30350 [MAIN] FULL CF WARNING.
    66:   30350 [MAIN] (gui_initcomp)
    67:   30350 [MAIN] (Initialize Complete.)
    68:   30350 [MC] T:0012, S:1000, 13
    69:   30350 [MC] T:0002, S:1000, 14
    70:   30350          sw:0160(0000)
    71:   30350 [STM] event: 1, 00:00:000, 0
    72:   30350 [MC] T:0004, S:1000, 15
    73:   30350          act:0129
    74:   30350 [MC] T:0001, S:1000, 16
    75:   30350          ctrl:0080
    76:   30350 [MAIN] FULL CF WARNING.
    80:   30350 [MC] T:0006, S:1000, 17
    85:   30350 [MC] T:0006, S:1000, 18
    86:   30350 [MC] T:0012, S:1000, 19
    87:   30350 [GUI] PostQR : 00000000
    89:   30350 [MC] T:0001, S:1000, 20
    90:   30350          ctrl:0080
    96:   30350 [MC] T:0007, S:0100, 21
    97:   30350 [MC] GUI Changed :7
    98:   30350 [STM] event: 1, 00:00:000, 0
   102:   30350 [DISPPOW] Turn On Start
   104:   30350 [GUI] GetQR : 00000000
   111:   30350 [MC] T:0018, S:0100, 22
   112:   30350 [MAIN] PLAY BUSY END.
   119:   30350 [MAIN]  868003024 < 868003040
   127:   30360 [FP] FP_GetFileSize : FIO_GetFileSize Err (A:/MISC/AUTXFER.MRK)
   136:   30380 [LCD] EnableLcdController
   137:   30380 [DISPPOW] Turn On Complete
   142:   30380 [MC] T:0007, S:0100, 23
   143:   30380 [LCD] EnableLcdBackLight
   144:   30380 [MAIN] FaceSensor Off(1)
   145:   30380 [MC] GUI Changed :2
   146:   30380 [STM] event:21, 00:00:000, 0
   147:   30380 [STM] event: 1, 00:00:000, 0
   148:   30380 [FACE] StopFaceSensorToReady: state = IDLE[5]
   161:   30670 [MC] T:0001, S:0100, 24
   162:   30670          ctrl:0092
   163:   30670 [STM] event:21, 00:00:000, 0
   164:   35360 [MC] T:0029, S:0040, 25
a  166:   45640 [MC] T:0002, S:0040, 26
   167:   45640          sw:0162(0000)
a  168:   49090 [MC] T:0002, S:0040, 27
   169:   49090          sw:0162(0000)
   170:   53390 [MC] T:0002, S:0040, 28
   171:   53390          sw:0162(0000)
   172:   57690 [MC] T:0002, S:0040, 29
   173:   57690          sw:0162(0000)

brainwash

Great find!
Are those printfs used by developers for debugging purposes? If that's true then there must be some debug interface attachable to it (USB?). I'm working with an embedded device (VxWorks) that takes commands on serial port and also is able to install a USB driver.
Unfortunately my line of expertise is not C but Java, but maybe I can help.

owerlord

the messages are debug. propably the camera have a serial port (I think its in the battery slot. But I wasn't able to connect to it (I'm better at software then hardware 😀, so I decided to redirect the output on the blinking led. The camera have even a shell - but the led is one direction protocol 😉

_MAG_

--- Change OLC --- info block wery intresting. I think it is "default" value.
so if ist safe try change him. Example:
Tv : 1.8
AFPoint: 1 (i think 0 if off. other in number of AF point selected by default)
AFMode : 1 (0 off 1 on)
//////
i sink Drive : 0 - is manual or AF mode switch.

I sink we can cumunicate with camera by FaceSensor. They have 2 Pos on and off
so we can transfer binary data 1 & 0 from PC by simple led.
I sink sensor state if 0 (face not present - light detected) and 1 (face close light - face present). To transfer data maybe need invert 1 and 0 before transfer - becouse in normal state Led on is 1, Led off -0.

ryanpg

I have the 400D and inside the battery compartment there are a total of 16 contacts. These 16 contacts are divided into two banks of eight each. Looking at a picture of the battery grip (which I do not own) http://farm1.static.flickr.com/159/362241002_e027d93d53.jpg?v=0 there are 12 pins used. The inner row on both sides of the compartment/grip are filled, this leaves the two foremost and two rearmost outside contacts unused by the grip. Note: the grip does provide some functionality in addition to extra battery. Here's another image http://www.bhphotovideo.com/images/largeimages/458075.jpg

So looking down into the battery compartment with the lens facing away and the lcd towards you, you get:

++ + -
++ + -
- + ++
- + ++

Plus means used by the grip, minus means not used by the grip. So perhaps these four contacts are for debugging?

Hope this helps.

ryanpg

Also, I'm not sure how similar the 300D and the 400D are but here's an interesting thread with some debugging tips - all related to the 300D however:

CANON EOS 300D Digital Rebel Firmware Hacking Forums -> The 300d debug port

owerlord

my problem with the above-battery pins is very simple - I tried some methods to connect to them - and nothing worked. I tried to make a fake battery with connectors - but I can't make (or buy) connectors that are on springs - like the litle connectors on top of the grip. I tried it couple days ago.

WARNING: don't try to use hard pins or wire endings. the flat connectors on the bottom of the battery compartment are fragile - you can deform them - I tested - you don't have to.

DataGhost

Also keep in mind that (also because someone said it in that article above) the camera likely operates at TTL, which you should NOT hook up directly to your computer, either device might (will) break.

owerlord

That why I wrote the driver. Now I'm reading what's camera is writing without connecting anything wierd to my camera in real time 😀

I think that camera have a debug level mechanism and I think I know where. Problem is it's initialized after my code leaves. Some of the log have too small level to write out. Another target to get to.

Seklth

you see bootloader fot find other (re)start code?)

_MAG_

You can see what adress in mem writes every default value(--- Change OLC --- block)?
i sink when OS in camera load this data maybe changed (need check this if you can)...

ryanpg - i post this link in EOS Lens protocol analyse - anybody intresting? topic.

i found info - need to connect comparator, but i dont know why they need. For analyse pins need osciloscope before you connect something to you PC. If you do something wrong - you camera dead.

owerlord

Seklth
you see bootloader fot find other (re)start code?)

Actually, I didn't find any thing usefull in the bootloader, yet. I don't know what code (firmware or bootloader) is runned when the battery is closed.

_MAG_
You can see what adress in mem writes every default value(--- Change OLC --- block)?
i sink when OS in camera load this data maybe changed (need check this if you can)...

The values printed in the OLC are properties changed and stored by "PropertyServer". It's an instance and it have interface like "GetSomething" "SetSomething" "LoadSomething" "SaveSomething" - And the last two of them are for writing and loadin it from the 3V memory I think.

That's for answering, now for my findings. For those of you that work on 400D, I have a big present 😀 Full (debug level=1) log from the loading until state 0x40, and then pressed jump, menu, trash, jump, and others. Only jump(162) and trash(165) are making any effect. based on the earlyer logs I found the place where keys are made the messages for MainControll (T=2). But I can't find why and where are the other keys blocked !? It's now the most important thing to find, becose if I could unblock them, I could do something usefull and dump the logs.

The full log is in the attachment

EDIT: log changed. thanks _MAG_ 😀

log1.txt

41.32KB

Seklth

> I don't know what code (firmware or bootloader) is runned when the battery is closed.
Of course bootloader) bootloader have jump to firmware.

_MAG_

hmm i see you press ALL keys. Hard analyse why they key not work or what they do.
I sink
MC ot is Main control (button pressed)
PM - power message (ignor him i dont know why need switch porer mode many times)
FC - flash card control

in 162 and 165 use sw operator outher used by control or action.
i sink 0160 work too (they use sw too) but i dont know how.
You can post outher keys adress (if you know?). Some key do something but i dont know what key..

owerlord

mainControl is a task. It controls nearly all activities. It have a message queue with messages like (T=something, arg1 , arg2). T=2 is sent by pressed keys. arg1 with T=2 is the key number within 160 to 191. The message sw: ... is the effect of the message sent to the MainControl. Thing is, that I steped up the ladder looking where it is sent and I end up on some class instance. I don't know what calls it.
The other keys (sw: ...) are called by other instances (they are emulations of key presses).

_MAG_

350D and 400d have A-DEP mode who set fied of deep. Elder models have more advanced mode DEP.
First half-press shutter button measure (by central sensor) distance to first object, second distance to second object, third halfpress set needed focus distance and diaphragm, that both object been in DOF
You sink possible to add this feature to 350d and 400d?

mx3

_MAG_
You sink possible to add this feature to 350d and 400d?

lets port CHDK first

owerlord can you check if autoexec.bin is launched on 400D?

it seems it is a way to run code on dslrs without packing and encryption. see my comments

can you confirm it?

« Previous Page Next Page »