ixus90/sd790 IS porting

  • 331 Replies
  • 73500 Views
*

Offline brake

  • *
  • 23
  • IXUS90IS / SD790IS
ixus90/sd790 IS porting
« on: 24 / August / 2008, 03:43:56 »
Advertisements
Just letting people know that I'm working on this.

I've finished extracting all the functions for main.c and I've also found all of the functions for the stubs_entry_2.S file.

Now I'm just debugging. I'm able to get the camera to boot and flash debugging LEDs so the fun begins.


I should of course acknowledge all of chr's work. I've been able to work somewhat parallel to his work on the ixus80/sd1100 because of all of his posts, so thanks.

Status (29/08/08)

Lots of things don't work but:

boot.c : done

capt_seq.c : done

kbd.c : done except for the spin wheel

movie_rec.c : not started.

Now, I'm having major problems with the RAW file writing. The hook_raw_image_addr() is correct as per the disassembled firmware, but the file that is written doesn't contain the correct data. In fact, the first RAW file saved when you turn the camera on each time contains blocks of 0x00s and then blocks of 0xff. Just wondering whether the guys developing the ixus860/sd870 or chr with the ixus80/sd1100 had any similar problems and how they fixed it.

Filesystem memory isn't available for some reason. I'll have to go back and triple check that some of the stub addresses are correct. GetDrive_ClusterSize address was incorrect.

This is the firmware. This is sub-alpha, a number of features crash the camera (turning off while the lens is still out) so take care.

diskboot.bin - 0.16MB (Firmware)

trunk_492_ixus90.tar.bz2 - 2.88MB (Src)

Status 31/08/08

Custom ISO/Shutter values crash camera. Not sure where to look. RAW still not working. Movie functions still not even extracted from the disassembled firmware.
« Last Edit: 31 / August / 2008, 08:06:58 by brake »

*

Offline brake

  • *
  • 23
  • IXUS90IS / SD790IS
Re: ixus90/sd790 IS porting
« Reply #1 on: 26 / August / 2008, 07:09:56 »
Getting there...

*

Offline will

  • *
  • 26
  • IXUS 80IS fw 1.01a
Re: ixus90/sd790 IS porting
« Reply #2 on: 26 / August / 2008, 18:38:58 »
Good stuff brake! Keep going.

Re: ixus90/sd790 IS porting
« Reply #3 on: 27 / August / 2008, 21:39:56 »
Keep up the great work, I can't wait for this to work!


*

Offline brake

  • *
  • 23
  • IXUS90IS / SD790IS
Re: ixus90/sd790 IS porting
« Reply #4 on: 28 / August / 2008, 10:46:43 »
Update.

Please read OP and help if possible.

*

Offline chr

  • ***
  • 138
  • IXUS 82 IS
Re: ixus90/sd790 IS porting
« Reply #5 on: 28 / August / 2008, 12:40:01 »
Now, I'm having major problems with the RAW file writing. The hook_raw_image_addr() is correct as per the disassembled firmware, but the file that is written doesn't contain the correct data. In fact, the first RAW file saved when you turn the camera on each time contains blocks of 0x00s and then blocks of 0xff. Just wondering whether the guys developing the ixus860/sd870 or chr with the ixus80/sd1100 had any similar problems and how they fixed it.

I can confirm that on sd1100 with my chdk build raw seems to work ... let's say it writes files with data, not just 00 or ff, to SD but I haven't opened them yet. Need to get that raw tool to work.

Quote
Filesystem memory isn't available for some reason. I'll have to go back and triple check that some of the stub addresses are correct.
??? ?

*

Offline brake

  • *
  • 23
  • IXUS90IS / SD790IS
Re: ixus90/sd790 IS porting
« Reply #6 on: 28 / August / 2008, 21:25:05 »
Sorry, as in it doesn't tell me how much space I have on the flash card, it just always reads 0M.

With the RAW stuff, data is written, it's just the first 1/3 of the first file written just appears like newly initialized / unset memory.

Files after that contain data for the entire file.

The files aren't readable in any RAW file reader (first file I'm not surprised about) listed in the RAW FAQ. I understand that they don't have headers, but it appears that the data is just wrong.
« Last Edit: 28 / August / 2008, 21:29:18 by brake »

*

Offline chr

  • ***
  • 138
  • IXUS 82 IS
Re: ixus90/sd790 IS porting
« Reply #7 on: 29 / August / 2008, 10:59:13 »
Sorry, as in it doesn't tell me how much space I have on the flash card, it just always reads 0M.

Something you must check: "GetDriveFreeCluster" (or like this) autodetected in stubs_entry.S was wrong ... and in my buildchain the manual symbols in stubs_entry2.S did not override that ... it was vice versa here.

After "make" check core/main.dump !!! Look, which symbols were finally used.


*

Offline brake

  • *
  • 23
  • IXUS90IS / SD790IS
Re: ixus90/sd790 IS porting
« Reply #8 on: 01 / September / 2008, 09:19:40 »
This RAW problem is interesting to say the least, and I've run out of ideas.

The pointer to where the RAW data should be in memory is definitely correct, but there's just nothing there. I even manually edited core/raw.c to check whether there was some kind of linking error but same thing happens so it's not a problem with the raw_savefile() function not using the correct address.

ROM:FFA812AC loc_FFA812AC                            ; CODE XREF: sub_FFA81264+3Cj
ROM:FFA812AC                 LDR     R2, =0xE88
ROM:FFA812B0                 LDR     R1, =0x107D68C0
ROM:FFA812B4                 SUB     R3, R2, #0x3B4
ROM:FFA812B8                 ADR     R0, aCrwaddressLxCr ; " CrwAddress %lx, CrwSize H %ld V %ld\r"
ROM:FFA812BC                 STR     R3, [SP,#0x38+var_2C]
ROM:FFA812C0                 STR     R2, [SP,#0x38+var_30]
ROM:FFA812C4                 STR     R1, [SP,#0x38+var_34]
ROM:FFA812C8                 BL      sub_FF8FEF54
ROM:FFA812CC                 LDR     R3, [SP,#0x38+var_1C]
ROM:FFA812D0                 ADR     R0, aIntegposHLdVLd ; " IntegPos H %ld V %ld Size H %ld V %ld\r"...
ROM:FFA812D4                 STR     R3, [SP,#0x38+var_38]
ROM:FFA812D8                 ADD     R3, SP, #0x38+var_28
ROM:FFA812DC                 LDMIA   R3, {R1-R3}
ROM:FFA812E0                 BL      sub_FF8FEF54
ROM:FFA812E4                 MOV     R2, #0x2C
ROM:FFA812E8                 ADD     R1, SP, #0x38+var_34
ROM:FFA812EC                 MOV     R0, R4
ROM:FFA812F0                 BL      sub_FF848604
ROM:FFA812F4                 AND     R1, R0, #1
ROM:FFA812F8                 ADD     SP, SP, #0x30
ROM:FFA812FC                 LDMFD   SP!, {R4,PC}
ROM:FFA812FC ; End of function sub_FFA81264


There's actually a string "CrwAddress %lx, CrwSize H %ld V %ld" used at 0xffa812b8 that you can use to work out the RAW address which is of course 0x107D68C0 and you can also see the RAW width and height which are 0xE88 (3720) and the width 0xE88-0x3B4 (2772) which add up to the raw_size of 0xEC04F0 [(0xE88 * (0xE88-0x3B4) * 12 bit) / 8 bit] which you can find elsewhere in the disassembly. These are what I've used in lib.c to no avail.

capt_seq_hook_raw_here() is in the same place as in the ixus860/sd870 code. In fact the only difference in the function to the ixus860 code is lines 129/130. (Commenting these add results in no visible change in function of the camera.)


83 void __attribute__((naked,noinline)) sub_FF85E634_my() //#fs
 84 {
 85     asm volatile (
 86         "STMFD   SP!, {R4-R6,LR}\n"
 87         "LDR     R4, [R0,#0xC]\n"
 88         "LDR     R6, =0x19E8C\n"
 89         "LDR     R0, [R4,#8]\n"
 90         "MOV     R5, #0\n"
 91         "ORR     R0, R0, #1\n"
 92         "STR     R0, [R4,#8]\n"
 93         "LDR     R0, [R6,#0x24]\n"
 94         "CMP     R0, #0\n"
 95         "MOVEQ   R0, #2\n"
 96         "BLEQ    sub_FF858610\n"
 97         "BL      sub_FF93C144\n"
 98         "LDR     R0, [R6,#0x24]\n"
 99         "CMP     R0, #0\n"
100         "BNE     loc_FF85E6B4\n"
101         "MOV     R0, R4\n"
102         "BL      sub_FF93C5D8\n"
103         "TST     R0, #1\n"
104         "MOVNE   R2, R4\n"
105         "LDMNEFD SP!, {R4-R6,LR}\n"
106         "MOVNE   R1, #1\n"
107         "BNE     sub_FF85C98C\n"
108         "BL      sub_FF95DAFC\n"
109         "BL      sub_FF86D3EC\n"
110         "STR     R0, [R4,#0x14]\n"
111         "MOV     R0, R4\n"
112         "BL      sub_FF93D738\n"
113         "BL      sub_FF93E214\n"
114         "MOV     R0, R4\n"
115         //"BL      sub_FF93D820\n"
116         "BL      sub_FF93D820_my\n"
117         "BL      capt_seq_hook_raw_here\n" // +
118         "MOV     R5, R0\n"
119         "B       loc_FF85E6C4\n"
120
121
122 "loc_FF85E6B4:\n" //                               ; CODE XREF: sub_FF85E634+38j
123         "LDR     R0, =0x54E0\n"
124         "LDR     R0, [R0,#4]\n"
125         "CMP     R0, #0\n"
126         "MOVNE   R5, #0x1D\n"
127
128 "loc_FF85E6C4:\n" //                               ; CODE XREF: sub_FF85E634+7Cj
129         "BL      sub_FF93F268\n"
130         "BL      sub_FF93F2A4\n"
131         "MOV     R2, R4\n"
132         "MOV     R1, #1\n"
133         "MOV     R0, R5\n"
134         "BL      sub_FF85C98C\n"
135         "BL      sub_FF93DC28\n"
136         "CMP     R0, #0\n"
137         "LDRNE   R0, [R4,#8]\n"
138         "ORRNE   R0, R0, #0x2000\n"
139         "STRNE   R0, [R4,#8]\n"
140         "LDMFD   SP!, {R4-R6,PC}\n"
141  );
142 }


[edit] 12-bit RAW for both the win and loss. Higher depth, but no converter :(
« Last Edit: 05 / October / 2008, 12:05:22 by brake »

Re: ixus90/sd790 IS porting
« Reply #9 on: 27 / September / 2008, 12:45:54 »
I just wanted to check how it is going! I've been wanting CHDK for my 90IS for many months now and just noticed today that you were working on a version for it!

Please feel encouraged! ;-)

 

Related Topics