Dumping PowerShot D10?

BlueWhisper

6

« on: 28 / April / 2009, 18:34:57 »

Advertisements

Hello!

I have a brand new D10. I tried to dump firmware using udumper, but it doesn't work (the camera won't do anything... as it should) but when I power off the device, I find that the empty.dum remains... empty :-(

Any ideas?

Logged

LukeSkaff

30

Re: Dumping PowerShot D10?

« Reply #1 on: 05 / May / 2009, 23:13:59 »

Have you tried cardtricks with the "NewDryOS" button option?

Also can you post the three screens output from using the ver.req file
http://chdk.wikia.com/wiki/Ver.req#Q._How_can_I_get_the_original_firmware_version_number_of_my_camera.3F

Logged

BlueWhisper

6

Re: Dumping PowerShot D10?

« Reply #2 on: 06 / May / 2009, 02:57:34 »

I tried NewDryOS and DryOS... [manually, because I don't have Windows... I've read the source, and unzipped the files] also tried some other files found on this forum, without success.

I'll be glad to try to blink the leds [I have some knowledge in electronics and programming], but I cannot find the source of the blinker.

By the way, I find it difficult to find any ressource for this project... why not add all the published sources to the svn?

Ver.req output:

Code: [Select]

Canon PowerShot D10
P-ID:31BC PAL D

Firmware Ver GM1.00A
NoError
Feb 25 2009   18:42:06

Code: [Select]

Canon PowerShot D10
P-ID:31BC PAL D

Adj. Ver.004.010

Code: [Select]

Canon PowerShot D10
P-ID:31BC PAL D


Total Shoot: 14
Zoom Retry Condition: 0
Mecha Condition: 0x00000000

Code: [Select]

Canon PowerShot D10
P-ID:31BC PAL D

Driver Info: 0x00000000

Logged

cyber7

6

Re: Dumping PowerShot D10?

« Reply #3 on: 24 / June / 2009, 01:34:12 »

Hi Guys
In the SX200is we are having the same kind of problems. More people there and I suspect the OS is the same... Come join us in the SX200is discussions, as I think we are working towards the same NEW release of Canon's DIXIG4 OS...

Cheers
cyber7

Logged

elxarro

2

Re: Dumping PowerShot D10?

« Reply #4 on: 14 / October / 2009, 20:09:57 »

I managed to blink the D10 firmware out starting at 0xFF810000. I used the blinker java version provided by syrius for the SD1200 IS: http://chdk.setepontos.com/index.php/topic,3547.msg39712.html#msg39712

Followed the instructions in README.TXT and also i made the following changes:

fw/fi2envdec/my.map
changed to the P-ID of the D10:

Code: [Select]

header change your key here (31BC is for D10)
HDR 0x000031BC 0x02230000 0x01000000 0x00000000 0x00000001

fw/main.c
only made two changes:

Code: [Select]

#define DELAY_COUNT 1265
couldn't blink it any faster than 1200bps. Maybe it's the diode i got from an old mouse. you can try faster speeds. this took about 12hours to blink.
Change the start of rom addess to the on of the D10:

Code: [Select]

unsigned int startOfRom = 0xFF810000;
fw/Make.bat
Use this one instead:

Code: [Select]

@rem you have to edit the line that says @copy ps.fi2 g:\.
@rem change g:\. to the drive letter of your SD-Card
@rem you also have to edit the setvariables.bat
@rem also, you need to edit my.map in fi2envdec folder
@rem
@call setvariables.bat
@del *.o
@del main
@arm-elf-gcc -fno-builtin -O2 -Ilib -nostdinc -c entry.s
@arm-elf-gcc -fno-builtin -O2 -Ilib -c lib/crc16.c
@arm-elf-gcc -fno-builtin -O1 -Ilib -c main.c
@arm-elf-gcc -fno-builtin -O2 -Ilib -nostdlib -Wl,-N,-Ttext,1900,-Map,main.map -o main.exec entry.o main.o crc16.o -lc -lgcc
@arm-elf-objcopy -O binary main.exec main
@arm-elf-objdump -d main.exec > main.dump
@zero | dd bs=1k count=100 >>main
@copy main fi2envdec\diskboot.bin
@cd fi2envdec
@call pack.bat
@rem copy firmware upload file to SD-Card (change g: to your drive letter!!!)
@copy ps.fi2 g:\.
@cd ..
@pause

also edit fw/SetVariables.bat to your own scenario.

I did it using an old diode i got from an antique mouse which i taped directly to the AF LED; i also covered it with a piece of tin foil, which seemed to help better the poor reception. I used a 10kohm resistor; all mounted to a serial port (schematic included in the sirius' package). As i said, i couldn't blink any faster than 1200bps. The java program works well and the first minute of blinking is very good to check the acuracy of the capture: all the lines that appear should be exactly alike.
I hope anyone will pick this up and start the port, as i'm not a great programmer.

Download the firmware here:
http://bigupload.com/d=M28Y2G8U9V

Cheers!

« Last Edit: 14 / October / 2009, 20:31:30 by elxarro »

Logged