S90 Porting Thread

drewm1980

Welcome to the S90 porting thread!

If you were already planning on working on a S90 port and actually know what you're doing, please free to join / hijack the thread. I'm new to CHDK and reverse engineering, but I'm an electrical engineer and I've done some DSP and microcontroller programming. I'm a grad student at UIUC in Champaign-Urbana, Illinois, USA. If you live in town and want to help on the port, please contact me at drewm1980@gmail.com

Cheers,
Drew

reyalp

Welcome. If you haven't already, be sure to start by reading http://chdk.wikia.com/wiki/Adding_support_of_a_new_camera and http://chdk.wikia.com/wiki/For_Developers

According to the wiki for this camera http://chdk.wikia.com/wiki/S90 there is no firmware dump yet. As you may have noticed, the current udumper software method does not work on the recent cameras. You will probably want to take a look at the porting threads for other new cameras for more information.
Some of these are
sx200 https://chdk.setepontos.com/d/3994
sd980 https://chdk.setepontos.com/d/4228
ixus100 https://chdk.setepontos.com/d/3995
sx20 https://chdk.setepontos.com/d/4348

If you want some real time advice, there are frequently a few of us in #CHDK on the freenode IRC network.

RaduP

It is good that you are an electrical engineer. Grab a phototransistor, an oscilloscope, an USB to serial cable (you can use the COM port on the back of your PC if you have one, but it can be inconvenient to go with the oscilloscope under your desk).
The most important thing is to find the proper delay in blinking the LED, to synchronize it with the COM (ideally, 9600 bauds).

Camera Obscura

From what I've read here I thought it wouldn't work, but I decided to go ahead and try doing a firmware dump on my S90 with Cardtricks/Udumper.

Sure enough, no luck. 🙁

drewm1980

Thanks for the links guys! I actually already have a huge pile of reflective object sensors lying around, and one of them might even still be hooked up to the analog input of an arduino running code that automatically sets the input threshold. How many KB should I be expecting for the firmware? If it's small, maybe I'll just dump it onto the arduino all at once.

Or should I keep it simple and put the phototransistor output through a comparator and into the mic input on my laptop? If someone already has slick software that can automate the re-digitization, I might as well take advantage of it.

Cheers,
Drew

drewm1980

I was able to capture a .wav file that shows six spikes corresponding to the transitions of three pulses I generated by half-shuttering with the autofocus LED turned on. Hopefully at RS232 rates the exponential decay won't be an issue. My card reader will arrive tomorrow, so I'm done for the day. Let me know if anyone gets the camera to respond to firmware or blink out it's firmware. Cheers, Drew

drewm1980

I'm having trouble getting the camera to respond to firmware

Formatted a 128MB SD card using the shell script from http://cowboytronic.com/chdk/chdk_prep.dmg. Seemed to work exactly as advertised. By default this created partitions:
CHDK, FAT16, 16 MB
CAMCARD, FAT32, the remaining 105 MB
For the following I'm ignoring the CAMCARD partition and using the CHDK partition.

Verified that the camera does indeed display more detailed firmware information with a "Ver.req" file on the disk. The info matches what is on the wiki. Deleted the Ver.req file

Tried using the diskboot.bin from led_finder_by_jeff666.zip downloaded from http://drop.io/chdkdevelopment:

Copied the diskboot.bin file to the card, made sure my mac didn't add any extra files or screw up the permissions. Locked the card and inserted it into camera.

Camera did not show any change of behavior aside from warning me that the disk is locked.

Tried both booting in both shooting mode and play mode, and with the file named diskboot.bin and DISKBOOT.BIN

Please chime in if you notice that I forgot something, otherwise I figure my next step is to buy/borrow a cheap supported camera and verify that the blinker works on that camera. Thanks!

whim

Hi drewm1980,

I'm not sure about this (never used jef666's ledblinker) but i know it dates from before encrypted DISKBOOT.BIN's,
so you will probably need to use dancingbits on it (you can find the source in the CHDK source /tools directory)
The newer cams use 2 or 3 as version parameter ( usage: dancingbits <in file> <out file> <version> )

judging by the link, you're on MacOS, so unfortunately i can't help you find a binary.

HTH,

wim

drewm1980

whim
Hi drewm1980,

... encrypted DISKBOOT.BIN's,
so you will probably need to use dancingbits on it (you can find the source in the CHDK source /tools directory)
The newer cams use 2 or 3 as version parameter ( usage: dancingbits <in file> <out file> <version> )

judging by the link, you're on MacOS, so unfortunately i can't help you find a binary.

Thanks wim! I'll try that. I'll be doing most of my work on Debian; was just tinkering around a bit on my mac laptop at home. I think I have the gcc arm cross compiler toolchain set up, but I haven't tested it yet.

rachelkitty

Having spent a chunk of the evening swapping cards in and out using the diskboot.bin and the LED finder code, I can confirm that the LED address for the S90 is 0xC0223030. Now, guess I'll need to try and dig out an old mouse to cannibalise...

EDIT: Can't find my soldering iron at present, and don't seem to have a spare photosensort of any sort. Will blink out firmware saturday if i can get the bits i need.

drewm1980

rachelkitty
Having spent a chunk of the evening swapping cards in and out using the diskboot.bin and the LED finder code, I can confirm that the LED address for the S90 is 0xC0223030. Now, guess I'll need to try and dig out an old mouse to cannibalise...

Great news! How did you dance the binary? I never was able to get the camera to respond. If I were home I'd like to take another shot at dumping the firmware using your binary, but I won't be home for a couple weeks yet.

Cheers,
Drew

rachelkitty

drewm1980

Great news! How did you dance the binary? I never was able to get the camera to respond. If I were home I'd like to take another shot at dumping the firmware using your binary, but I won't be home for a couple weeks yet.

Cheers,
Drew

diskboot.bin of the jeff666 LED finder and danced version 3. Took a few compiles to binary search the address range. All being well, I should be able to pick up some components tomorrow and get the firmware blinked out, other software methods haven't proven successful so far.

McAllister

sounds like the first step is nearly done. can't expect chdk for my s90 but unfortunatly ive got no clue about c or assambler so i dont see a way to help out. as you can see im a newbie in this so if there is anything i can do pls bring it up here 😀

ERR99

rachelkitty
I can confirm that the LED address for the S90 is 0xC0223030. Now, guess I'll need to try and dig out an old mouse to cannibalise...

I am currently working on the G11 CHDK port, and what i can say is, that the G11 also uses this adress for AF-Light. For dumping the G11 code via LED i used the grand_blink_g7 code with this delay for 9600 bps:
"#define DEL 1260*2", maybe this is also need for the S90. Or if you use the "Blinker_Java_Version_by_Sirius", i used "#define DELAY_COUNT 154 " for a successfull 9600bps dump.
The used HW of S90 and G11 are not so different i think, and so the delay values could be equal. 😉

rachelkitty

ERR99
I am currently working on the G11 CHDK port, and what i can say is, that the G11 also uses this adress for AF-Light. For dumping the G11 code via LED i used the grand_blink_g7 code with this delay for 9600 bps:
"#define DEL 1260*2", maybe this is also need for the S90. Or if you use the "Blinker_Java_Version_by_Sirius", i used "#define DELAY_COUNT 154 " for a successfull 9600bps dump.
The used HW of S90 and G11 are not so different i think, and so the delay values could be equal. 😉

These days I have no machine with a serial port at all. I'll have to try soundcard. I have my doubts that this will work too well.

EDIT: Spent far too long on this now, cannot get the adc.exe to do anything with the recordings at all and have no serial port to be able to do anything else with.

OK, I dug out my old amiga for something with a serial port on and am dumping to that 😀

edit: can't seem to find a good distance for solid data transmission.

Camera Obscura

I just wanted to offer some words of encouragement to all of you on the S90 firmware dump. Thanks for giving this a serious effort!

The S90 is a fantastic camera with a lot of capabilities. But CKDK would allow for correcting one big deficinecy that I am not happy with - that is the low bit rate on the video.

Thanks!

rachelkitty

OK, well, finally managed to get stable data transmission with no errors but only at 1200bps. Dumping rom at the moment, gonna take a long time tho 😀

Microfunguy

Hope your batteries are fully charged 😀

rachelkitty

thankfully, yes, i'm keeping an eye on the last reached address tho, in case i need to recharge and restart later on.

rachelkitty

OK, this is the finished dump from address 0xFF810000. All addresses from 0xFF800000 to 0xFF810000 were value 0xFF. All addresses after the end of this file are value 0xFF as well.
http://rapidshare.com/files/330257144/S90_GM1.00C.bin

EDIT: New dump, 0xFF810000 - 0xFFFFFFFF, previous one was flawed