CHDK for new Canon PowerShot SX200 IS? - page 4 - Feature Requests - CHDK Forum  

CHDK for new Canon PowerShot SX200 IS?

  • 141 Replies
  • 63295 Views
Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #30 on: 09 / April / 2009, 15:01:21 »
Advertisements
"Firmware Update" give me an empty dump file. I've tried to open it with an hexeditor : nothing !

Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #31 on: 09 / April / 2009, 18:40:34 »
"Firmware Update" give me an empty dump file. I've tried to open it with an hexeditor : nothing !
I checked the dumps properly as well. I always use the Strings function in Cardtricks with the proper card selected, then sometimes I'll just open them up in notepad to double check, and they've always been empty. Great find on the ver.req button combination! Here's what I get with it on my camera:

First press:
Canon PowerShot SX200 IS
P-ID:31C0  NT D

Firmware Ver GM1.00C
NoError
Jan 28 2009  14:08:40

Second press:
Canon PowerShot SX200 IS
P-ID:31C0  NT D

Adj Ver.004.013

Third press:
Canon PowerShot SX200 IS
P-ID:31C0  NT D

Adj Ver.004.013
IS Firm Ver.  2.09
IS Param Ver.  2.07

Fourth Press:
Canon PowerShot SX200 IS
P-ID:31C0  NT D

Driver Info: 0x00000000

I also tried vers.req, and got the following on the third press:

Canon PowerShot SX200 IS
P-ID:31C0  NT D

Adj Ver.004.013
Total Shoot: 156
Zoom Retry Count: 0
Mecha Condition: 0x00000000

All the other presses were the same as the ver.req file. Strangely enough, I've taken far more than 156 shots. There were more shots then that just on the card I was using. I'm open to try other dumping techniques or files or such. I'm pretty busy over the weekend, though, so I might not be able to get to them until Monday if I don't try them tonight.
Cameras: SX200 IS 100c US, S3 IS US

Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #32 on: 10 / April / 2009, 04:18:48 »
ok, i've read some post to understand mean of dumping this firmware.

If i've understand, the current method consist of finding the entry point in ROM of the function used to access to file system on SD card to realise a dump of firmware located at FF810000 or 0xFFC00000 to a file present on SDCard.

The way used by udumper is to consider that there is a unique signature represented by some ARM instructions always present in the WriteSDCard function (on all canon model). So it find this signature in memory to had the entry point of WriteSDCard. And use WriteSDCard with the correct parameters.

If it is not ok, why ?

- the signature seems to be bad ?
- implementation of WriteSDCard function has change ?
- there is an initialisation sequence to use API functions ?

I think way to dump this firmware can be done by creating a new dumper :

- Dumping firmware by using low level function (storing dump directly sequentially in SD sectors).
OR Change the actual heuristic used by the udumper to find entry point of WriteSDCard function.
- There is another problem, debugging ! We actually don't know if the code is really executed normally. So finding LED adress can be usefull to ensure that all is ok.

I'm going to download the ARM development kit.

What do you think about this ???

*

Offline mx3

  • ****
  • 372
Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #33 on: 10 / April / 2009, 06:24:59 »
....
 We actually don't know if the code is really executed normally. So finding LED adress can be usefull to ensure that all is ok.

I'm going to download the ARM development kit.

What do you think about this ???
welcome to party :-)

BTW before udumper was made ROM dumps had been blinked out using LED and photodiode :-)
skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler


*

Offline ewavr

  • ****
  • 1057
  • A710IS
Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #34 on: 10 / April / 2009, 06:39:50 »
udumper is not looking for WriteSDCard's signature in ROM.


Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #35 on: 10 / April / 2009, 08:36:47 »
Searching a pointer to WriteSDCard's Signature in RAM, it's a strange method ! Seem to be ok for the moment on Dryos Camera but for the SX200IS ??

*

Offline ewavr

  • ****
  • 1057
  • A710IS
Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #36 on: 10 / April / 2009, 08:48:39 »
Searching a pointer to WriteSDCard's Signature in RAM, it's a strange method !

Using WriteSDCard() when OS is killed is more strange  :D.

Well, maybe first result of search is wrong, but second (third etc.) result is correct?

edit: udumper code:
Code: (c) [Select]
  for (i=0x1900;i<0xF0000;i+=4)
   if ((*(unsigned int*)(i+0x34)==0) &&
       (*(unsigned int*)(i+0x38)==0) &&
       (*(unsigned int*)(i+0x3C)==3) &&
       (*(unsigned int*)(i+0x4C)>MIN_ADDRESS) &&
       (*(unsigned int*)(i+0x50)>MIN_ADDRESS) ) {

wr=(f_w)*(unsigned int*)(i+0x50);

is based on DRYOS/VxWorks code (example for SX10):

Code: [Select]
ROM:FF85A5DC                MOV     R1, #0 
ROM:FF85A5E0                 LDR     R0, =0x1A784
ROM:FF85A5E4                 STR     R1, [R0,#0x34]
ROM:FF85A5E8                 STR     R1, [R0,#0x38]
ROM:FF85A5EC                 MOV     R1, #3         
ROM:FF85A5F0                 STR     R1, [R0,#0x3C]
ROM:FF85A5F4                 LDR     R1, =ReadSDCard
ROM:FF85A5F8                 STR     R1, [R0,#0x4C] 
ROM:FF85A5FC                 LDR     R1, =WriteSDCard
ROM:FF85A600                 STR     R1, [R0,#0x50]
« Last Edit: 10 / April / 2009, 08:54:46 by ewavr »

Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #37 on: 10 / April / 2009, 09:38:39 »
I wanna make a prog to scan Led addresses from 0xC0220000 to 0xC02200FF.

Is there a risk to dammage camera ?

I only need to compile source with GCC and load it to sdcard as diskboot.bin ?


*

Offline ewavr

  • ****
  • 1057
  • A710IS
Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #38 on: 10 / April / 2009, 09:42:10 »
I wanna make a prog to scan Led addresses from 0xC0220000 to 0xC02200FF.
Is there a risk to dammage camera ?

It is very low.

Quote
I only need to compile source with GCC and load it to sdcard as diskboot.bin ?

Don't forget encode diskboot.bin.

Re: CHDK for new Canon PowerShot SX200 IS?
« Reply #39 on: 17 / May / 2009, 01:07:55 »
Just got a SX200IS myself. Not not much of a low level developer/hacker but willing to try things and no problem with involved directions.

Verified:
Using the 2G card included with camera and following directions for newdryos udumper via cardtricks 1.44,
camera _appears_ not to power up, no lights or anything after inserting battery and hitting play or power.

Using dryos or vxworks udumper (via cardtricks 1.44 & letting it format the card each time), the camera starts up and functions normally for a locked & otherwise empty card.

This tells me the camera ignores DISKBOOT.BIN when it is dryos or vxworks udumper but does at least try to execute it when it is a newdryos udumper.

However, with the newdryos udumper, insert card, insert battery, hit play, wait over a full minute, remove battery, remove card.  Then examine empty.dum with HxD , the file is still all 00's.

I'm still reading the chdk wiki to see what the next options are. ie: do the old AF led blinker directions even apply to a newdryos/digic iv camera?
« Last Edit: 19 / May / 2009, 00:21:32 by KEYofR »

 

Related Topics