I have started to try to reproduce your success on my
S5IS.
Nice to see you back. For those who don't know, geekmug did the first S5 firmware dump.
Some immediate problems I ran into were that I hadn't located some of the functions you have..
perhaps you can provide some guidance as to how you did so. In contrast, I think I located maybe a couple functions that you didn't.
To find out the rough location of a function use the DRYOS-IDA-function-list.txt file in my zip and look at the a720-firmware. I did the same using the stubs_entry.S from the
a710 to find some of the functions in dryos.
In general I find it a good idea to put the IDA-function-list into the archives we post. It helps the other developers to reproduce and/or check our success. You get the list from the context-menu in the IDA functions-window. Just copy-n-paste into a text file. Also write the time of creation into the file, as this information is subject to change.
You can find CreateTaskStrict by looking for the usage the string "StrictWrapper.c"
I'm not sure if we really need this function, but it a useful information, nonetheless. The A720-firmware doesn't mention "StrictWrapper.c" anywhere. Instead it refers to "KernelMisc.c". The functions remain the same, though. It seems like canon renamed one of their source files.
IsStrobeChargeCompleted can be found by looking at its SSAPI counterpart which can be found by looking for the use of "SSAPI::IsStrobeChargeCompleted". I've also mapped out the open/read/write/close/lseek functions via the Fx_Fut functions..
Everything that's mentioned somewhere with its name is fairly easy to find. Fun are the file-operations. They appear several times, work differently and are all used independent of the functions that follow the other naming convention.
Nevertheless, the biggest problem I have at the moment is locating some of the setup code that you did and some of the hardware addresses (like in entry.S, the control for the SD Card power).. I'm not sure how you figured these things out other than blind guessing.. 😐:
Well, I sent my camera to Chuck Norris and asked him to interrogate it. Two days later it returned and promised to be much more cooperative as long as I don't send it to Chuck, again 😁
Actually such things can be found out by using text search. Have IDA search the disassembly of a known camera for "=0xC02200". One of the hits should look somewhat like
LDR R2, 0xC0220000
MOV R3, #0x44
STR R3, [R2, #0x48]
If the address you are looking for is actually 0xC0220048, you found the location in the explored firmware. Look at the corresponding location in your own firmware and you should see the address for your camera.
Basically, everything you put in "used during init"
Forget this! That was an idea I had when I started, but it turns out that it's nonsense. These are addresses used in uHwSetup. It is one of the duplicated functions in boot.c. These names are used
only in boot.c and the code itself is just a duplicate from the original firmware. So just stick to sub_XXXXXXXX and write descriptive names in the comment.
I have a whole list of SetupTask_x entry points
I think "SetupTask_x" is misleading. The code you found are the tasks itself. Only a fraction of them has anything to do with a setup-process. I suggest you stick to "task_x". Btw, I'm not 100% consistent, either. My "task_Startup" is just named "Startup".
Nevertheless, any wisdom you can provide to finding those or for finding everything having to do with the keyboard, as I have had zero success there either.
For the keyboard you will only need one name: "PhySw".
Actually there is a "task_PhySw" which is spawn directly from "task_Startup".
ROM:FF823668 task_PhySw
ROM:FF823668 STMFD SP!, {R4,LR}
ROM:FF82366C LDR R4, =0x1CD0 <-- ---------- this is physw_run
ROM:FF823670 B loc_FF823688
ROM:FF823674 loc_FF823674
ROM:FF823674 MOV R0, #0xA
ROM:FF823678 BL sub_FF82AC20 ; SleepTask(10)
ROM:FF82367C BL sub_FF823A6C <-------- This is kbd_p1_f
ROM:FF823680 CMP R0, #1
ROM:FF823684 BLEQ sub_FF82330C <--------- This is kbd_p2_f
...
ROM:FF823A6C kbd_p1_f ; CODE XREF: task_PhySw
ROM:FF823A6C STMFD SP!, {R1-R5,LR}
ROM:FF823A70 MOV R4, #0
ROM:FF823A74 BL sub_FF823990 <- this is kbd_read_keys
ROM:FF823A78 LDR R1, =0x11AB0 <-- kbd_p1_f_cont entrypoint here
I hope this will get you an Idea. Just ckeck the entrypoints in my stubs_entry_2.S, find them in the a720-firmware and locate the same code in your own. Btw, since I had the S5-firmware opened: your physw_status is 0x11ABC.
It seems like the S5 doesn't have kbd_power_on and kbd_power_off. You might want to have a look how the kbd is handled with the S3.
So, I have been working against GrAnd's branch..
Hell! That causes some major headaches 😀
No, actually it's useful if we get a branch that's current. You may just have to figure out some things on your own as you are the first one to do it.
Cheers.
