the sx20 porting thread

dfabio

I tried the beta version of the chdk for the sx20is version F. It appears to be missing the badpixel checking files. I tried the file from the s5is and it did not seem to finish. Any suggestions?

-revelation-

I just bought my first camera, a Canon Powershot sx20is. And I just read about chdk. Awesome. Is it possible to shoot RAW images with my camera, if I use chdk? I'm a total noob so help me please.

If it is possible, could you explain how to do it?

I have the ver gm 1.00f firmware.

Thanks in advance,
Dieter

britbloke

I just recievied my SX20IS and have checked the firmware and it seems like I have a newer version; 1.02C

And I was REALLY hoping to get superfine mode working on this camera. Guess I have a long wait ahead 🙁

neszt

britbloke
I just recievied my SX20IS and have checked the firmware and it seems like I have a newer version; 1.02C

And I was REALLY hoping to get superfine mode working on this camera. Guess I have a long wait ahead 🙁

You can help us to

1. determine the full version

2. dump the firmware if you can

britbloke

neszt

britbloke
I just recievied my SX20IS and have checked the firmware and it seems like I have a newer version; 1.02C

And I was REALLY hoping to get superfine mode working on this camera. Guess I have a long wait ahead 🙁

You can help us to

1. determine the full version

2. dump the firmware if you can

I tried to dump the firmware with UDumper and Cardtricks (DryOS). UDumper didn't give me any data when I checked the Hex, and the same happened with Cardtricks.

viulian

I'm trying to understand the code of the existing jogdial task. It seems that some of the code from the task is from the firmware itself, however, I wonder why the differences:

chdk code:

                "LDR     R0, [SP,#0x4]\n"
 // these ones seem to be from: ff860334
                "AND     R4, R0, #0xFF\n"
                "AND     R0, R0, #0xFF00\n"
                "CMP     R0, #0x100\n"

However, the firmware is a bit different at the first LDR instruction (#8 instead of #4):

ff860330: 	e59d0008 	ldr	r0, [sp, #8]
ff860334: 	e20040ff 	and	r4, r0, #255	; 0xff
ff860338: 	e2000cff 	and	r0, r0, #65280	; 0xff00
ff86033c: 	e3500c01 	cmp	r0, #256	; 0x100

Also, some values that are a bit off:

chdk:

                "LDR     R0, =0x23E4\n"
                "MOV     R2, #0\n"
                "LDR     R0, [R0,#8]\n"
                "ADD     R1, SP, #0x4\n"
                "BL      sub_FF837F08\n"
                "TST     R0, #1\n"
                "LDRNE   R1, =0x226\n"

firmware:

ff86030c: 	e59f02d0 	ldr	r0, [pc, #720]	; ff8605e4: (0000257😎 
ff860310: 	e3a02000 	mov	r2, #0	; 0x0
ff860314: 	e590000c 	ldr	r0, [r0, #12]
ff860318: 	e28d1008 	add	r1, sp, #8	; 0x8
ff86031c: 	ebff63b4 	bl	ff8391f4 <_binary_H__chdk_dissasemble_dump_bin_start+0x291f4>
ff860320: 	e3100001 	tst	r0, #1	; 0x1
ff860324: 	159f12d0 	ldrne	r1, [pc, #720]	; ff8605fc: (00000226)

a) why the first ldr in firmware loads from 00002578 but chdk uses 0x23E4 ?
b) why the second ldr loads from #12 but in chdk loads from #8 ?
c) why the first add in firmware uses #8 but chdk uses 0x4 ?

neszt

viulian
I'm trying to understand the code of the existing jogdial task. It seems that some of the code from the task is from the firmware itself, however, I wonder why the differences:

If you are talking about my code for SX20, the "existing jogdial task" is not exists. 😀

I used SX10 code for reference firmware (and a lot of code from sd980), and I didn't implement Jogdial task at all.

https://chdk.setepontos.com/d/4348/362

viulian

Ok 😀 now is clear. I thought you did work on it but was not completed.

However, I tried to understand what goes on, and I was able to find many pieces of the code put in the SX20 method (yours) in the actual firmware (1.00f). Hence, it is probably similar and may be easy to port. It still takes time for me (no IDA pro here), but I hope I can get it done. I hate when using the jog dial in the play mode and the images also flip by.

Also, is it enough just to uncomment it in the task creation method ? Or other things need to be done just to start testing newer code that I plan updating ?

anjomi

I'm having trouble getting CHDK working with my SX20IS (1.00f)

I've loaded all the files onto my SD card, and when I lock the card and start the camera, everything works OK. I get the CHDK flashscreen, and I can get the CHDK menu up. However, when I switch to record mode the camera just switches off.

If I unlock the SD card CHDK doesn't load, and I can't find the 'firmware update' menu item that's meant to manually load CHDK.

So I can get CHDK to work, but can't take any pictures!

Any help would be appreciated.

viulian

Where did you take the CHDK folder from ? It may have some script to start when you press the shutter in record mode. If so, please remove chdk.cfg file (settings file) from CHDK folder, and try again. If there's no file like that, I'm out of ideas ...

anjomi

anjomi
I'm having trouble getting CHDK working with my SX20IS (1.00f)

I've loaded all the files onto my SD card, and when I lock the card and start the camera, everything works OK. I get the CHDK flashscreen, and I can get the CHDK menu up. However, when I switch to record mode the camera just switches off.

If I unlock the SD card CHDK doesn't load, and I can't find the 'firmware update' menu item that's meant to manually load CHDK.

So I can get CHDK to work, but can't take any pictures!

Any help would be appreciated.

OK, don't worry about this. I found that if I press the video record button it swaps to record mode. After I do that once, the play/record button swaps between modes OK.

somspaple

i could finally get the CHDK work on my sx20is. firmware version 1.00F. thanks for the release.

procedure i followed or resolved to:
1. after loading the 'locked' card with CHDK: start the camera in 'play' (pic view) mode. chdk splash screen appears.
2. press the print shortcut button on the left top corner of the camera and press shutter button. this starts camera in shoot mode with lens popping out.

issues that i am facing:
1. can not seem to find the 'superfine' option in the chdk menu that is discussed earlier in the thread. am i missing something here.
2. i can not view the pics(not 'raw' but other jpeg pics) captured in the preview (paly) mode nor on the pc screen if i connect camera directly to pc. i have to use a card reader to access the pics. this is really annoying.
3. though the camera is capturing the pics in 'raw' format with .raw extension it is not being recognised by any of the softwares inlcuding picasa and rawtherapee.

gratch

Hello,
any news about porting CHDK for 1.02b firmware? Is it totally different than 1.00f? I'm very interested in any piece of information 😀

viulian

neszt, you were right. I found the location of the JogDial task on SX20 1.00f and it's similar to SD980 it starts at ff86029c and ends at ff860660 (included).

Now, I need to understand how / where where to insert the code to 'eat' the jog dial events when ALT menu is up.

So is it enough to uncomment the jogdial task in taskCreateHook (with the proper address of course) and it should work ?

I try to analyze a lot before trying on the camera - the plastic cover of the card seems so fragile..

krichy

xavan
Thank you Neszt for your remarks, so I have to make some adjustments to my RS232 converter.
I did the dump twice and I got 2 identical files (checked with fc);
What program do you use to check the CRC ?

Dear hackers,

I've got my new sx20 with 1.02b, but i cant start the blinker software even on my sd card. i've followed instructions on chdk's site, but when i switch on the cam, its normal screen is displayed, nothing happens.

thanks in adv

neszt

krichy
Dear hackers,

I've got my new sx20 with 1.02b, but i cant start the blinker software even on my sd card. i've followed instructions on chdk's site, but when i switch on the cam, its normal screen is displayed, nothing happens.

thanks in adv

Probably you are in the same problem, i was:

https://chdk.setepontos.com/d/4188/77

1. compile the blinker source (with arm cross compiler)
2. make bootdisk.bin from it (use pack.bat)
3. start the cam in play mode (use the play button to switch on, not the on/off)
4. select firm update from menu

viulian

I don't understand why, in SX20, the value(s) in taskCreateHook, such as:

...
	if (p[0]==0xFF89A8CC)	p[0]=(int)init_file_modules_task;
...

do not match the address in the firmware itself. The ASM code in init_file_modules_task does exist in the firmware, but it starts at address: ff89c2c4 and not FF89A8CC. Why the huge difference (almost 0x2000 bytes)?

I've checked the SX10 port: there's a perfect correspondence between the values found in taskCreateHook and the addresses in the firmware (for JogDial and init_file_modules_task at least).

I did identify the JogDial task in SX20 firmware (starting at address 0xff86029c) however, JogDial_task_my() wasn't executed if I used the 0xff86029c as equality check in taskCreateHook. I tried to understand what is the *p in the taskCreateHook.

After some lost battles with the code, and I found that taskCreateHook is called with 67 different addresses (how did I find it? I modified the get_prop in ubasic to show me some arrays that I populate in boot.c / taskCreateHook, which I then printed on the screen using print commands within a script).
BTW: I love Canon, I will always buy Canon - so many things going on on this little thing, I'm amazed!

Pour revenir a nos moutons: I needed a way to narrow down these 67 values. I was sure that one of them is the JogDial task address - but oh, 67 to check! Eventually, I tought that if there's such a discrepancy (~0x2000 bytes) for init_file_modules_task, what if the same applies for JogDial task? I might as well try to find which of 67s *p values are within +/- 0x2000 bytes from the real one in the firmware.

Lo and behold! I ended up with 4 values. Acceptable but risky a bit (I was not checking 63 left).
I proceeded to update the taskCreateHook with each of the 4 values, hoping to see the JogDial affected somehow. Murphy effect applied, only the last value had an effect. The other three values either crashed the camera, or the JogDial worked as before, scrolling both the selected menu item as well as the pictures in preview mode.
The fourth one blocked the JogDial completly, absolutely no movement of rotation - only navigate up, down, left, right.

I'm thus happy that the JogDial doesn't work anymore 😁 😳 .

Value is:

if (p[0]==0xff85f3cc)	p[0]=(int)JogDial_task_my;

neszt: how did you find the other values in taskCreateHook ?

acid2000

If anyone is interested in the 102b i've started a port myself. I've got CHDK booting code of the card and am in the process of getting the splash screen up and running.

I could do with some help checking the stubs_Entry.s. I've got a status page at:

https://chdk.setepontos.com/d/5006

neszt

viulian
I don't understand why, in SX20, the value(s) in taskCreateHook, such as:

[code]...
if (p[0]==0xFF89A8CC) p[0]=(int)init_file_modules_task;
...[/code]

Because there is the function "task_InitFileModules". 😀

do not match the address in the firmware itself. The ASM code in init_file_modules_task does exist in the firmware, but it starts at address: ff89c2c4 and not FF89A8CC. Why the huge difference (almost 0x2000 bytes)?

Hmm. As i see, the task_InitFileModules is definitely at 0xFF89A8CC. (in firmware SX20 1.00F)

neszt: how did you find the other values in taskCreateHook ?

With the help of reference firmwares. (SX10, SD980)

neszt

acid2000
If anyone is interested in the 102b i've started a port myself. I've got CHDK booting code of the card and am in the process of getting the splash screen up and running.

I could do with some help checking the stubs_Entry.s. I've got a status page at:

https://chdk.setepontos.com/d/5006

Very Good!

Anyway, my opinion is, starting a new thread for SX20 1.02B is a bad idea. It's better keeping forces in one thread for a model.

« Previous Page Next Page »