DryOS - some success

ewavr

jeff666
The "traditional" method to start CHDK doesn't work with DryOS since it doesn't have the "Firm Update" Menu. Well, actually it seems like "Firm Update" is still there, but we don't know what enables it, yet.

"Firm update" menu appears if firmware file extension is "FI2" (not "FIR").

jeff666
will be available after I figure out how "task_CaptSeqTask" works.

You can compare part of "CaptSeqTask" @0xFFC4CC10 (for A720) and sub_FFD5C2C4_my() in A710 sources - they are very similar. And also sub_FFD0A3CC for A720 and sub_FFD5F178_my() in A710 sources.

GrAnd

ewavr

jeff666
The "traditional" method to start CHDK doesn't work with DryOS since it doesn't have the "Firm Update" Menu. Well, actually it seems like "Firm Update" is still there, but we don't know what enables it, yet.

"Firm update" menu appears if firmware file extension is "FI2" (not "FIR").

But in the same time the string 'A/*.FIR' still persists in DryOS firmwares. ???

DataGhost

Possibly didn't notice this because it's not seen as a string and not nicely formatted, but the context clearly confirms what ewavr said, and it seems to be referenced:
(S5 code)

ROM:FF9AE394 off_FF9AE394: .long unk_FFA9635A @ DATA XREF: sub_FF9AE110+2Cr
ROM:FF9AE398 unk_FF9AE398: .byte 0x46 @ F @ DATA XREF: sub_FF9AE110+6Co
ROM:FF9AE399 .byte 0x49 @ I
ROM:FF9AE39A .byte 0x32 @ 2
ROM:FF9AE39B .byte 0
ROM:FF9AE39C unk_FF9AE39C: .byte 0x41 @ A @ DATA XREF: sub_FF9AE110+84o
ROM:FF9AE39C @ sub_FF9AE1B8+58o
ROM:FF9AE39D .byte 0x2F @ /
ROM:FF9AE39E .byte 0
ROM:FF9AE39F .byte 0
ROM:FF9AE3A0 aSS_16: .ascii "%s%s" @ DATA XREF: sub_FF9AE110+88o
ROM:FF9AE3A0 .byte 0
ROM:FF9AE3A5 .byte 0
ROM:FF9AE3A6 .byte 0
ROM:FF9AE3A7 .byte 0
ROM:FF9AE3A8 dword_FF9AE3A8: .long 0x57E8C @ DATA XREF: sub_FF9AE110+7Cr
ROM:FF9AE3A8 @ sub_FF9AE1B8+B0r ...
ROM:FF9AE3AC aVersioncheck: .ascii "VersionCheck" @ DATA XREF: ROM:FF9AE32Co
ROM:FF9AE3AC .byte 0
ROM:FF9AE3B9 .byte 0
ROM:FF9AE3BA .byte 0
ROM:FF9AE3BB .byte 0
ROM:FF9AE3BC aVersionid: .ascii "VersionID" @ DATA XREF: ROM:FF9AE350o
ROM:FF9AE3BC .byte 0
ROM:FF9AE3C6 .byte 0
ROM:FF9AE3C7 .byte 0

By the way, why doesn't the code-tag generate monospace output?

jeff666

DataGhost wrote:
Possibly didn't notice this because it's not seen as a string and not nicely formatted, but the context clearly confirms what ewavr said,

And a quick test confirms it, too.
There's still information to be found, since selecting the entry brings a friendly "Update File Error!!!" message. I tried renaming the .FIR generated by "make fir".

Cheers.

GrAnd

DataGhost wrote:
Possibly didn't notice this because it's not seen as a string and not nicely formatted...

IDA does not always determine correct type of the data. But you can help by pressing 'a' key for the address which contain a string.

ROM:FFD4CE74 off_FFD4CE74    DCD byte_FFE3EAD6                 ; DATA XREF: sub_FFD4CC04+2Cr
ROM:FFD4CE78 aFi2            DCB "FI2",0                       ; DATA XREF: sub_FFD4CC04+6Co
ROM:FFD4CE7C aA_5            DCB "A/",0                        ; DATA XREF: sub_FFD4CC04+84o
ROM:FFD4CE7C                                                   ; sub_FFD4CCAC+58o
ROM:FFD4CE7F                 ALIGN 4
ROM:FFD4CE80 aSS_14          DCB "%s%s",0                      ; DATA XREF: sub_FFD4CC04+88o
ROM:FFD4CE85                 ALIGN 4
ROM:FFD4CE88 dword_FFD4CE88  DCD 0x57E38                       ; DATA XREF: sub_FFD4CC04+7Cr
ROM:FFD4CE88                                                   ; sub_FFD4CCAC+B0r ...
ROM:FFD4CE8C aVersioncheck   DCB "VersionCheck",0              ; DATA XREF: ROM:FFD4CE0Co
ROM:FFD4CE99                 ALIGN 4
ROM:FFD4CE9C aVersionid      DCB "VersionID",0                 ; DATA XREF: ROM:FFD4CE30o
ROM:FFD4CEA6                 ALIGN 4

BTW. I have bo problem with [[sup][/sup]code] tag

GrAnd

jeff666
... selecting the entry brings a friendly "Update File Error!!!" message. I tried renaming the .FIR generated by "make fir".

I hope the cameraID you used for "make fir" conforms with the actual camera ID?
Then Canon guys could change encryption tables (as they constantly do for EOS cameras).

DataGhost

Finally! Progress! I rewrote my stuff today, actually reading what's happening, adding debug leds and such... I can now boot the OS entirely with my code... I figured out which sub in Startup_my is responsible for the autoboot stuff, so I commented it out :p I'll thoroughly investigate what it does later on, I don't really have time for that now, I should be studying :p
After booting, it complains the card is locked, of course.. and I can use the camera as I usually would, so that looks OK. Only thing is, when I start the camera in picture-mode, it actually starts in display-mode as well. This is probably due to diskboot.bin, though. I guess that can be fixed later on. It seems that it's loaded anyway, regardless of what mode the camera is started in.

Anyway, I'm not that familiar with tasks and how they interact with the OS yet, but could you just tell me what the blinker is supposed to do? Everything it does it blink the led once, when it's started... after that it doesn't really do anything anymore. I'm currently spawning spytask and blinker, I'll investigate more possibilities somewhere this week.
To whoever is interested: http://stack.dataghost.com/07012008072.mp4 notice the red led at the lower-right (write led) indicating boot() started, the AF led (long) indicating it's in Startup_my() and the AF led (short) indicating task_blinker was spawned, after which it boots normally 😀

GrAnd
BTW. I have bo problem with [[sup][/sup]code] tag

bo = no? I meant that the font isn't monospace, so the code looks messed up. I just don't really like that 😀

Edit: ah. I found something... I can confirm that spytask is called properly and actually works, I see a short blink for

*led = 0x46;
msleep(2000);

though not when I reverse those two lines. It seems that control is passed over and never returned for some reason.

Edit2: and the reason is... PEBKAC! I should really look for what is happening before saying "it doesn't work!". msleep calls _SleepTask and I haven't made chdk aware of its location yet.

Edit3: Yay, it's blinking, I can use buttons as long as it displays "Card locked", after that the keyboard is dead and it won't turn off. It still behaves strangely, I'll look into properly fixing that later on. I'm calling it a day.

jeff666

@DataGhost: Great that you're making progress.

I did some investigation on "task_CaptSeqTask" and called the raw-save-function at some point that should be appropriate.

The resulting file doesn't look like what I had expected. Obviously the memory location and the size of the raw-buffer need to be adjusted.

char *hook_raw_image_addr()
{
    return (char*)(0x10400000+0x164000+0xBF0);
}

char *hook_raw_image_addr()
{
    return (char*)(0x10400000+0x164000+0xBF0);
}

Now I wonder where these numbers come from and what they mean.

ewavr

jeff666
[code]
char *hook_raw_image_addr()
{
return (char*)(0x10400000+0x164000+0xBF0);
}
[/code]

Now I wonder where these numbers come from and what they mean.

Somewhere there is a function, which uses the strings "CRAW BUF", "CRAW BUF SIZE" (in A710 @0xFFEBC23C, in A720 @0xFFDAB204). Likely that in A720 hook_raw_image_addr() should return 0x10F6C860, and hook_raw_size() - 0x9DCCE0 (this is very strange, because for A630 (also 8 MP) this value is 0x9E6F10).

Edit: Maxtrix size should be 3336x2480 (0xD08*0x9B0, can be found @0xFFDA3720). 3336*2480*10/8=10341600(0x9DCCE0). This is new matrix type for dcraw converter.

DataGhost

As I said before, the LED thing didn't really get me excited. Now I'm at the point that it's beginning to get exciting, though 😀

http://stack.dataghost.com/08012008078.mp4 (My Nokia N80 sucks at making movies, and focus.... well, it doesn't do that.)
There is still much to be done, though... this is currently forced, keyboard isn't hooked, I had to disable some more functions or the spytask process would crash, locking my camera (when calling histogram functions), etc, etc, etc. It's exciting to finally get some reward for the hard work 😀

DDMan

Great work, Dataghost!

I like your "boot screen"! 😉

Keep up the good work. Many camera users will thank you! 😁

lukg

mmm i can't see the video...anyway, great works!!! I read this thread everyday...my italian S5 is happy to know this progress!
byeee

jeff666

ewavr wrote:
Somewhere there is a function, which uses the strings "CRAW BUF", "CRAW BUF SIZE" (in A710 @0xFFEBC23C, in A720 @0xFFDAB204).
Edit: Maxtrix size should be 3336x2480 (0xD08*0x9B0, can be found @0xFFDA3720). 3336*2480*10/8=10341600(0x9DCCE0). This is new matrix type for dcraw converter.

Ok. I looked at the firmware and share your insights, still I don't get the data I expected. Is it possible that valid raw data is only available at a very special moment?

Right now I call the save-raw-hook in the function that draws the preview-image (the one that is shown right after shooting and which disappears after some seconds) at 0xFFC4CC94 (I call the hook before this command).

A few things on the jumptable.
First entry is loc_FFC4CBAC. This is #0, no information on this one.
#1 is called on shoot
#3 seems to be the default when not doing anything.
#4 is called to display the preview (which I hook to save the raw-portion of the memory)
#5 is called to display the detailed preview (after pressing DISP)

I also found out that darkframe-subtraction is done in sub_FFC794E0. Some other things must happen there, since the camera crashes when I skip this call to avoid NR.

Back to raw: After shooting is done, I call save-raw, a file gets written, it has a reasonable length (about 10mb) but it doesn't contain the expected contents. I tried to load the file in RawTherapee and FastStone Viewer - both failed, then I looked for a signature ("HEAPCCDR") but it didn't occur anywhere in the file.

I modified the raw-location to save exactly 10mb from 0x10000000 on to see if the signature occurs earlier in memory - without success.

If anybody is interested in investigating, here's the file: http://www.zshare.net/download/6323281977facf/
The image itself should be completely overexposed and have few spots that aren't maxed out.

Cheers.

OmniGhost

I took a look at the data and cannot find anything about it that looks like any form of picture... at all.. although i did find some interesting text strings..

diagnosis() rev0.03 2004/11/08 Satoshi NaitoŠ

jp56_common() rev-0.11 2005/01/31 author naito.satoshi@canon.co.jp / hiwatashi.saku@canon.co.jp

enter AF Point Light Metering Superfine Fine Normal Drive Mode AiAF Self-timer AF-assist Beam Auto Rotate Center Weighted Avg. Evaluative Spot Flash Sync 1st-curtain 2nd-curtain Red-Eye MF-Point Zoom Flash Adjust Auto Manual Distance Units Slow Synchro Save Settings Direction Change settings Mark all images? Mark all Adobe RGB Converter None Safety Shift Postcard 1600x1200 Date Stamp Date Date & Time * fps Frame Rate RAW AF Frame Center AiAF FlexiZone Standard Fast Frame Rate Compact Hold Save Original Rec IS Mode Continuous Shoot Only Panning Grid Lines Foliage Snow Beach Fireworks Underwater Indoor Portrait Kids&Pets Night Snapshot Set up Date/Time mm/dd/yy dd/mm/yy yy/mm/dd Shutter Volume Language Video System Playback Vol. Start-up Vol. Operation Vol. Selftimer Vol. Format Mute Volume Power Saving Auto Power Down Display Off * min. Low Level Format Create Folder Create New Folder Auto Create Time Monthly Sunday Monday Tuesday Wednesday Thursday Friday Saturday Daily Reset All White Balance Auto Day Light Tungsten Cloudy Fluorescent Fluorescent H Custom Custom1 +/- (Exp.) +/-(Flash) Flash Output shots New File Overwrite Landscape Night Scene Vivid Neutral Sepia B/W My Colors Custom Color Custom Timer Delay Shots sec. Jump 10 Images Jump 100 Images Jump Shot Date Jump to Movie * images Jump to Folder Order Reset Set up Set up Print Type Standard Index Both Date On Off File No. *prints * prints * images Transfer Order Qty. of Images Exit Play First Frame Next Frame Previous Frame Last Frame Slow Motion Record Pause Register Sound Start-up Image All Evaluate White Bal. Press SET/* to print Erase? Erase all images? Erase Set Date/Time. Mark all Clear all Clear all settings? Reset settings to default? Format memory card? Busy. Protected! No Image. Naming error! Image too large. Incompatible JPEG Unidentified Image Cannot rotate Cannot magnify! *KB used *MB used *GB used Loading image... Too many marks. Cannot complete! Unselectable image. Cannot edit Cannot record! Cannot print! Incompatible WAVE Change the batteries Save current settings? Cannot register this image! Register? Quit without registering? Quit without saving? Card locked! Card locked! Memory card full Memory card error No memory card Overheated! Shutting down. Style Image Standard Multiple Borders Bordered Borderless Change print style Now printing Print Print all marked images Print remaining images Resume Stop No paper No ink Ink cassette error Paper jam Communication error Could not print * images x * images remaining Stop printing? Trimming Readjust trimming * copies Cannot trim Change print style Paper Card #1 Card #2 Card #3 LTR A4 Printer in use Printer warming up Low ink level Paper lever error Waste tank full Printer cover open No print head Printer error Media type error Continue N Paper and ink do not match Recharge the printer battery Paper has been changed Incompatible paper size Incompatible ink size Paper Settings Default Change paper settings Image Optimization Index printing not supported Paper Size Paper Type Page Layout Next Previous OK Paper Error Ink Error Hardware Error File Error On Off Default Vivid NR Vivid+NR Default 9x13cm 13x18cm 10x14.8cm CreditCard 4"x6" 5"x7" A4 8.5"x11" Roll 9cm Roll 13cm Roll 4" Roll 21cm 8.9x25.4cm A3 11"x17" Default Plain Photo Fast Photo Default Bordered Borderless 2-up 4-up 8-up 9-up 16-up 20-up 8"x10" Bordered* Face* Both Date File No. N-up Fixed Size 4"x8" Movie Print ID Photo Long Side Short Side Incompatible paper size Print error Check print settings copies Next * images/pg Caption Caption Single Sequence Auto Manual Stitch Assist Movie Macro Custom Shutter Speed Priority Aperture Priority Program Auto Auto Red-Eye Reduction Red-Eye Reduction On On Off Single Shot Continuous 2 sec. Self-Timer 10 sec. Self-Timer Custom Timer Infinity Manual Focus Auto ISO * Direct Transfer All Images New Images DPOF Trans. Images Select & Transfer Wallpaper Transfer images? Transferring... Cannot transfer! Widescreen Print Select Images & Qty. Select All Images Clear All Selections Print Settings Clear DPOF data Deselect all images Lens Retract Print Method Auto Cannot modify image Save new image? Display new image? Lens error, restart camera Set 1 print per image My Colors Off Print all selected images ï € High ISO Auto Yes No Red-Eye Correction Start Add Frame Delete Frame *x Disp. Overlay 3:2 Guide Standard Print output tray is full Cartridge not compatible Fine Art Semi-gloss 35-up* 20-up* Ink absorber full Red-Eye1 Red-Eye2 Cannot modify Firmware Ver. * Face Detect Aquarium Normal Cannot modify Set 1 print per selected image Safety FE *KB *MB *GB Not Assigned Digital Tele-converter ND Filter On ND Filter Off LP Safety MF Set * button Custom White Balance Resize Add Remove Remove Frame Flash Mode Auto Manual Shutter Sync. AF Frame Size Normal Small Cannot select! A3+/13x19" 4"x7.1" 10"x12" Hold * to move to center

00002030: OPTICAL_ZOOM_MIN_POS
ed
Ó ( 00002030: ST_OPTICAL_WIDE_TERM
ght
ÈÓ 00002030: UnpressZoomLever
Ô , ) 00002030: DispSwCon_TurnOnDisplayDevice
0
8Ô , , 00002030: LogicalEvent:0x313d:adr:0,Para:0
dÔ 00002030: _EntryStartRecMode
caœÔ , , 00002030: CaptModeChanger_CheckRTCRrepared
ÄÔ 00002030: DispSw: Unlock
ìÔ 00002030: DispSwCon:Unlock
$Õ , + 00002030: DispSwCon_MuteOffPhysicalScreen
`Õ 0 ! 00002040: MuteOffPhysicalScreen
hysicalScreen
ˆÕ 00002050: _DecideModeDial
0¼Õ ( " 00002050: No Change Capture Mode
_E
Ö 8 5 00002060: LogiEvnt_NotPowerType:0x09a4:adr:0,Para:0
EffDÖ 8 5 00002060: LogiEvnt_NotPowerType:0x09a2:adr:0,Para:0
ivehÖ 00018720: PressSwOne
00 Ö , 00018720: SSAPI:: UsingRaw[0]
:FC_STB_S
ÈÖ 00018720: ShootState:0x1
ðÖ 00018720: ShtCon_Activate
o× 00018720: DispSw: Lock
L× , ! 00018720: ShtCon_PrepareCapture
C_STB_E
x× 00018720: DSIC:61,0
Mode = 0
˜× 00018720: DSIC:e,0
Ô× 0 . 00018720: Window:EffectiveLockPhysicalScreen
Ø 0 0 00018720: Window:IneffectiveLockPhysicalScreen
LØ 0 , 00018730: LogicalEvent:0x3135:adr:0,Para:0
]
UlØ 00018730: DSIC:e,0
¨Ø 0 ! 00018740: SSAPI:😛repareCapture
M:ZM_RST_E
ªUÐØ 00018750: ShootState:0x2
øØ 00018750: ClearEventComp
ad8Ù 4 2 00020010: ShootSeqToUI:0x2006:adr:0x3bd,Para:957
0xdÙ 00020020: ShtCon_SetPreCapt
pSwˆÙ 00020020: DSIC:62,0
ÄÙ 0 . 00020020: Window:EffectiveLockPhysicalScreen
00 Ú 0 0 00020180: Window:IneffectiveLockPhysicalScreen
,Ú 00020200: ShtCon_ResetShtMode
wXÚ 00020200: _EntryPrepareShoot
€Ú 00020200: ShootState:0x7
00¤Ú 00022160: PressSwTwo
ÜÚ , 00022160: SSAPI:: UsingRaw[0]
tartRecMode
Û 00022160: ShootState:0x8
fP,Û 00022160: ShootState:0x9
MuPÛ 00022160: DSIC:14,0
|Û 00022160: _MuteOn
dr:0,Para:0
Û 00022170: DSIC:42,0
urnØÛ , * 00022170: DispSwCon_MuteOnPhysicalScreen
crÜ 00022170: MuteOnPhysicalScreen
0Ü 00022170: SSAPI::ShootPicture
TÜ 00022180: DSIC:63,0
Ü xÜ 00022410: UnpressSwTwo
¨Ü $ 00022500: UnpressSwOne
ableArea
ªUàÜ , , 00028530: ShootSeqToUI:0x2022:adr:0,Para:0
Ý 00028530: DSIC:64,0
ªU(Ý 00029060: DSIC:44,0
fec`Ý , + 00029070: DispSwCon_MuteOffPhysicalScreen
eÝ $ ! 00029070: MuteOffPhysicalScreen
_M´Ý 00035960: DSIC:45,0
000àÝ 00035960: SSAPI:: UsingRaw[1]
UÞ 00036250: DSIC:46,0
fecDÞ 4 3 00036250: ShootSeqToUI:0x2007:adr:0x498,Para:1176
opÞ 00036250: SSAPI:: UsingRaw[0]
iœÞ 00036250: SSAPI:: UsingRaw[0]
ÈÞ 00036260: SSAPI:: UsingRaw[0]
0ß @ = 00036260: ShootSeqToUI:0x2001:adr:0x19980218,Para:429392408
ªUPß 0 ' 00036260: Sht_CancelStrobeChargeTimer
creen
ªUtß 00036260: DSIC:4b,0
fec¤ß $ # 00036260: _CaptureStanbyForReview
S(Ð ªUªUªUªUªUªU ˜ à9 ¸Ï ,¦Áÿ,¦Áÿèß ªUªUªUªU Àß CameraLog

let me know if this helps..

GrAnd

jeff666
Back to raw: After shooting is done, I call save-raw, a file gets written, it has a reasonable length (about 10mb) but it doesn't contain the expected contents. I tried to load the file in RawTherapee and FastStone Viewer - both failed, then I looked for a signature ("HEAPCCDR") but it didn't occur anywhere in the file.

As Ewavr said: "This is a new matrix type for dcraw converter." So, no program should understand your raw. You should add the new size to dcraw source, compile it and try to convert to jpeg.
And there is no signature in raw-file from CHDK. It contains just the data from the sensor, not more. The "HEAPCCDR" - is for native Canon CRW-file.

DataGhost

Well, I shot a few RAW images from my S5 😀 I've never really worked with RAW images before (let alone dcraw), so I don't know if I'm doing it right... but it seems like I only get 'good' output when I set the top margin to 15 px (it should be 16 px according to the offset relative to the generated .jpg file, but I don't get *ANY* green except for in overexposed areas in that case, my image will be purple and I lose quite a bit of information when I do manage to get the colors somewhat correct). Actually, I do not see a positioning difference between 15 and 16 but I do still see a difference between these and the 'reference'. This is possibly caused by the sharpening the camera applies, though. Judge for yourself, I'll try setting it to 17 in a bit 😀 Anyway, even then, it's very green (is that supposed to happen?). It can be fixed by telling dcraw where to find something white, else it's a bit hard to fix... but I just need minor modifications afterwards, so that's fine, I guess 😀 .

RAW image converted to jpeg, set the white balance to something sensible, NO noise reduction (notice the hot pixels, especially in the dark areas), no shapening, and I made it a bit brighter.
'Reference' jpg image made by the camera, auto white balance (it's way off) and quite dark.
Settings: ISO 80, 1.6", F8. I should have shot with a lower F-number, I guess.. but it's a bit hard to tell through a live hexdump :p

About the RAW conversion strangeness:
top_margin=15 No whitebalance, no postprocessing (wall color is really close though, better than in my processed image, but the screen should be #FFFFFF)
top_margin=16 No whitebalance, no postprocessing. I don't know what causes this but it's clearly unusable. Possibly a misalignment (starts at byte 2 instead of byte 0 or vice versa?) but I'd expect it to be correct for even offsets, not for odd ones..

Adding support in dcraw was straightforward, just search for 'S3 IS', copy that part and paste it right below there, changing the appropriate values, so you'll end up with the following code:

} else if (!strcmp(model,"PowerShot S5 IS")) {
height = 2448;
width = 3264;
raw_height = 2480;
raw_width = 3336;
top_margin = 15;
left_margin = 24;
load_raw = &CLASS canon_a5_load_raw;

I *think* these margin values are correct, but it's mostly trial-and-error.

Also, you'll need to add the filesize to the table (located elsewhere, search for "S3 IS" again) so the file can be identified

{ 10341600, "Canon", "PowerShot S5 IS",0 },

This might cause a problem though, but it's just minor. The offsets, sizes and such appear to be exactly the same as in the A720, so the only problem this will cause is that A720 files are identified as S5IS files. This shouldn't really matter, though, as I expect both cameras to generate the same data.
The above mentioned problems could also be caused by the canon_a5_load_raw function, but as I said, I don't know too much about RAW photography and I especially don't know how to interpret the sensor data (yet), so this will have to do.

ewavr

Good work!
Can you also upload RAW file (zipped)?

DataGhost

Oh yes, of course. That's what I forgot 😀 There you go. It didn't compress that well, but it at least shaves 3MB off.

Edit: my dcraw.c might be useful as well.

jeff666

my dcraw.c might be useful as well.

Very good.

While you are on it, could you have a look at the NR-handling? I'm back at work and don't have much time anymore.

If we control NR, we should have a (mostly) complete port of trunk and can start to port the changes to a newer branch with more features.

Cheers.

DDMan

Hi Jeff,
could you maybe upload your latest CHDK port for the A720, so people like me can test things like DataGhosts findings.
I'm very anxious to see the port and will help as much as I can. By the way I'm a software developer as well, so if time allows it I will dive into programming too. 😉
Thank you in advance!

Cheers and greetz from Fellbach at night 😉

« Previous Page Next Page »