Dumping PowerShot D10?

  • 5 Replies
  • Publish
    Dumping PowerShot D10?
    « on: 28 / April / 2009, 18:34:57 »

    I have a brand new D10. I tried to dump firmware using udumper, but it doesn't work (the camera won't do anything... as it should) but when I power off the device, I find that the empty.dum remains... empty :-(

    Any ideas?

  • Publish
    Re: Dumping PowerShot D10?
    « Reply #1 on: 05 / May / 2009, 23:13:59 »
    Have you tried cardtricks with the "NewDryOS" button option?

    Also can you post the three screens output from using the ver.req file

  • Publish
    Re: Dumping PowerShot D10?
    « Reply #2 on: 06 / May / 2009, 02:57:34 »
    I tried NewDryOS and DryOS... [manually, because I don't have Windows... I've read the source, and unzipped the files] also tried some other files found on this forum, without success.

    I'll be glad to try to blink the leds [I have some knowledge in electronics and programming], but I cannot find the source of the blinker.

    By the way, I find it difficult to find any ressource for this project... why not add all the published sources to the svn?

    Ver.req output:

    Code: [Select]
    Canon PowerShot D10
    P-ID:31BC PAL D

    Firmware Ver GM1.00A
    Feb 25 2009   18:42:06

    Code: [Select]
    Canon PowerShot D10
    P-ID:31BC PAL D

    Adj. Ver.004.010

    Code: [Select]
    Canon PowerShot D10
    P-ID:31BC PAL D

    Total Shoot: 14
    Zoom Retry Condition: 0
    Mecha Condition: 0x00000000

    Code: [Select]
    Canon PowerShot D10
    P-ID:31BC PAL D

    Driver Info: 0x00000000

  • Publish
    Re: Dumping PowerShot D10?
    « Reply #3 on: 24 / June / 2009, 01:34:12 »
    Hi Guys
    In the SX200is we are having the same kind of problems.  More people there and I suspect the OS is the same...  Come join us in the SX200is discussions, as I think we are working towards the same NEW release of Canon's DIXIG4 OS...


  • Publish
    Re: Dumping PowerShot D10?
    « Reply #4 on: 14 / October / 2009, 20:09:57 »
    I managed to blink the D10 firmware out starting at 0xFF810000. I used the blinker java version provided by syrius for the SD1200 IS:,3547.msg39712.html#msg39712

    Followed the instructions in README.TXT and also i made the following changes:

    changed to the P-ID of the D10:

    Code: [Select]
    header change your key here (31BC is for D10)
    HDR 0x000031BC 0x02230000 0x01000000 0x00000000 0x00000001

    only made two changes:

    Code: [Select]
    #define DELAY_COUNT  1265
    couldn't blink it any faster than 1200bps. Maybe it's the diode i got from an old mouse. you can try faster speeds. this took about 12hours to blink.
    Change the start of rom addess to the on of the D10:

    Code: [Select]
    unsigned int startOfRom  = 0xFF810000;
    Use this one instead:

    Code: [Select]
    @rem you have to edit the line that says @copy ps.fi2 g:\.
    @rem change g:\. to the drive letter of your SD-Card
    @rem you also have to edit the setvariables.bat
    @rem also, you need to edit in fi2envdec folder
    @call setvariables.bat
    @del *.o
    @del main
    @arm-elf-gcc -fno-builtin -O2 -Ilib -nostdinc -c entry.s
    @arm-elf-gcc -fno-builtin -O2 -Ilib -c lib/crc16.c
    @arm-elf-gcc -fno-builtin -O1 -Ilib -c main.c
    @arm-elf-gcc -fno-builtin -O2 -Ilib -nostdlib -Wl,-N,-Ttext,1900,-Map, -o main.exec entry.o main.o crc16.o -lc -lgcc
    @arm-elf-objcopy -O binary main.exec main
    @arm-elf-objdump -d main.exec > main.dump
    @zero | dd bs=1k count=100 >>main
    @copy main fi2envdec\diskboot.bin
    @cd fi2envdec
    @call pack.bat
    @rem copy firmware upload file to SD-Card (change g: to your drive letter!!!)
    @copy ps.fi2 g:\.
    @cd ..

    also edit fw/SetVariables.bat to your own scenario.

    I did it using an old diode i got from an antique mouse which i taped directly to the AF LED; i also covered it with a piece of tin foil, which seemed to help better the poor reception. I used a 10kohm resistor; all mounted to a serial port (schematic included in the sirius' package). As i said, i couldn't blink any faster than 1200bps. The java program works well and the first minute of blinking is very good to check the acuracy of the capture: all the lines that appear should be exactly alike.
    I hope anyone will pick this up and start the port, as i'm not a great programmer.

    Download the firmware here:

    « Last Edit: 14 / October / 2009, 20:31:30 by elxarro »


    Offline fe50

    • ******
    • 3069
    • IXUS50 & 860, SX10 Star WARs-Star RAWs
      • fe50
  • Publish
    Re: Dumping PowerShot D10?
    « Reply #5 on: 15 / October / 2009, 01:43:13 »
    Hello & welcome, elxarro !

    I managed to blink the D10 firmware out...
    Great !

    I added your dump to the CHDKdumps2 repository...,288.msg41607.html#msg41607


    Related Topics