SD1200 IS - Firmware Dumping - CHDK Forum
« previous next »
Pages: [1] 2   Go Down

SD1200 IS

  • 16 Replies
  • 20609 Views
*

Offline chdkinfo

  • *
  • 2
SD1200 IS
« on: 28 / April / 2009, 20:15:15 »
Advertisements
Here is my start with a SD1200IS.

To display the Firmware version:

Without a memory card in the camera press the
[ PLAY ] button. Camera will power up and report
"No Memory Card". Now press and hold the
[ FUNC. SET ] button and press [ TRASH/TIMER ]
icons. Firmware version will be displayed.

Next, I used a 512 MB SD card. Formatted it in the camera.
Then put it in a card reader (am using Ubuntu) and created
and empty file named vers.req in the root directory.
Put card back in camera. (Write protect button position did
not seem to make any difference in the results).
Press [ PLAY ] button.  Camera powers up in play mode.

Now, press [ FUNC. SET ] and while holding it down
press the [ TRASH/TIMER ] button.

Each time you press this combination of buttons,
you should get data similar to this format:

PRESS 1 shows:

P-ID:31C4 NT D

Firmware Ver GM1.00C
NoError
Jan 9 2009 14:57:24

PRESS 2 shows:

P-ID:31C4 NT D

Adj Ver. 006.008

PRESS 3 shows:

P-ID:31C4 NT D

Adj Ver .006.008
Total Shots: 13
Zoom Retry Count: 0
Mecha Condition: 0x00000000

PRESS 4 shows:

P-ID:31C4 NT D

Driver info: 0x00000000

NOTE: The [ PLAY ] button is the one with the blue triangle
inside a blue square. The [ TRASH/TIMER ] is the bottom
button on the ring buttons just above and between the
[ DISP. ]  and [ MENU ] buttons.
Logged
*

Offline trickv

  • *
  • 1
Re: SD1200 IS
« Reply #1 on: 09 / June / 2009, 00:57:01 »
I purchased a SD1200IS, and I'm trying to make some progress on getting a firmware dump.

There is a related thread at: http://chdk.setepontos.com/index.php/topic,3366.0.html

I didn't know at first the difference between DryOS and NewDryOS, and the camera didn't respond to the DryOS attempts I made on Linux.  I plopped into a Windows machine and ran CardTricks to learn what NewDryOS is -- now I get it.  NewDryOS is the way to go with this camera; it responds to this.

I've managed to get the device to attempt to load code using the NewDryOS.  The device does not return any visual feedback, indicating an attempt to load this code.  The dump file is always empty.  Tried both the PLAY and POWER buttons; neither produce anything other than an empty dump file.

My next task is to try to get the camera to give /some/ sign that our code is being run.  I want to get it to light up an LED so that I know the code is being loaded, and hopefully to know when the writing of the firmware dump has finished.

I've set up an arm-elf build environment (on Linux).  I've managed to compile the udumper source (from http://www.badongo.com/file/8588786) and it produces the same result as I achieved with the DISKBOOT.BIN created by CardTricks.

I've read around quite a bit, and it seems that most LEDs are located between 0xC0220000 - 0xC0220100.  I've used the following (incredibly simple) program in an attempt to get any of the LEDs to turn on:
Code: [Select]
int main(){
    int i;
    long* led=(long*)0xC0220000;
    while (led <     0xC0220200) {
        *led = 0x46;
        led++;
    }
    while(1) {};
    return 0;
}
No luck.  LEDs don't turn on.  I (possibly dangerously?) have also tried extending the max led value too 0xC022FFFF -- no luck either.  I let it run for a good 20 minutes hoping /any/ of the LEDs might come on but nothing.

On a side note: the camera does seem to notice when I place a file called PS.FI2 on the card by giving me a Firmware Update menu option.  Maybe this can be a way in?  I see this referenced in quite a few places but I don't know what to put in the PS.FI2 file.

I've tried quite a few other bits of LED blinking code from across the forums, with no success.

Can any CHDK experts recommend some next steps?
Logged
*

Offline reyalp

  • ******
  • 14128
Re: SD1200 IS
« Reply #2 on: 09 / June / 2009, 01:09:44 »
Many recent cameras have trouble with udumper. There appears to be issues both with DISKBOOT.BIN loading and the WriteSDCard function that udumper uses. You may find something useful in this thread http://chdk.setepontos.com/index.php/topic,3347.30.html

To create an FI2 file, it needs to be encoded with the the correct keys and platformid. The thread linked above talks about this.
Logged
Don't forget what the H stands for.
*

Offline chdkinfo

  • *
  • 2
Re: SD1200 IS
« Reply #3 on: 16 / June / 2009, 20:29:17 »
I am still looking forward to extra features on this camera.
However, since I bought two of these for stereo, I could not
wait.

I opened the cameras (big gamble) and soldered wires(bigger
gamble) to them so that one shutter fires both cameras at
the same time. Since they are hard wired together, I can
even get good flash shots.

I love the results. Great 3D stereo.

I use Gimp on Ubuntu to edit them so that I can print on
4" X 6" at a one hour print machine.
Logged
*

Offline syrius

  • *
  • 11
Re: SD1200 IS
« Reply #4 on: 09 / August / 2009, 17:29:21 »
The SD1200 IS has the same DIGIC 4 as the SD780 IS. Here is a thread discussing how to dump the firmware from the SD780 IS:
http://chdk.setepontos.com/index.php/topic,3995.msg37547.html#msg37547
Logged
*

Offline handyandy55

  • *
  • 11
Re: SD1200 IS
« Reply #5 on: 13 / August / 2009, 13:24:53 »
any chance of posting photos of how you opened up the sx200is and what wires did you connect were?

Like you i have been waiting to purchase two of these to do some 3D photos.

How good is the syn between the two cameras?

I want to photograph model helicopters which have a head speed of between 1500-2200 RPM.

I use a shutter speed of around 1/320 to get a lot of blade movement so sync is important.

Any info would be most welcome.

Logged
*

Offline syrius

  • *
  • 11
Re: SD1200 IS
« Reply #6 on: 13 / August / 2009, 16:44:37 »
At http://chdk.setepontos.com/index.php/topic,2995.0.html i have found an easy tool to encode a DISKBOOT.BIN file to a ps.fi2 file.

I did the following steps:
Code: [Select]
HDR 0x31C4 0x02230000 0x01000000 0x00000000 0x00000001
  • Change the file pack.bat to
Code: [Select]
fi2encdec.exe -e -sys G10 my.map ps.fi2
  • Start pack.bat
  • Copy the new file ps.fi2 to the sd-card, turn the camera on, press menu-button, selected the new menu-item "firmware-update". Then there is no encoding error, but it shows and do nothing.

The encoding-process seams to work, because there were no encoding error shown (with an empty ps.fi2 file there were shown encoding errors). Still i am searching for a DISKBOOT.BIN file, finding the address to turn on the LEDs.
« Last Edit: 13 / August / 2009, 17:01:00 by syrius »
Logged
*

Offline syrius

  • *
  • 11
Re: SD1200 IS
« Reply #7 on: 20 / August / 2009, 16:12:33 »
I used code like the following
Code: [Select]
void port_on(int port) {
volatile long *p = (void*)port;
*p = 0x46;
}
int main() {
int led = 0xC0220100;
for (;led<0xC0220200; led = led+4) {
port_on(led);
}
}
and have found some LED-address:
Code: [Select]
#define LED_IO_R 0xC0220130    // IO indicator LED (red state)
#define LED_IO_G 0xC0220134    // IO indicator LED (green state)
#define LED_AF   0xC0223030    // Auto-focus LED (very bright...)
My steps:
  • I use the blinker source http://drop.io/chdkdev/asset/by-grand-blinker-rar and http://chdk.wikia.com/wiki/CHDK-Shell
  • Modify the code (see example above)
  • Compile with the fw\make.bat (don't forget to add the folder \CHDK-Shell\gcc\bin to your PATH-Variable of CHDK-Shell )
  • Converte the created file main to ps.fi2 with fi2encdec.exe shown in my previous post.
  • Copy the file ps.fi2 to the root-folder of your camera-SD-card and start the firmware-update process (see my previous post)
In the attachment you will find a ps.fi2 file which shows orange, red and green LED at the back and the little flash in the front of the camera.
« Last Edit: 20 / August / 2009, 16:46:34 by syrius »
Logged
*

Offline syrius

  • *
  • 11
Re: SD1200 IS
« Reply #8 on: 06 / September / 2009, 14:44:09 »
With my Lego NXT light sensor I have managed to find a way blinking the firmware out - but it will take a lot of time (about 14 days). In the attachment is a file containing 1024 bytes starting at address 0xFFC00000. A comparison with the SD780IS shows only some differences (about 18 bytes in the first 1024 bytes block).
« Last Edit: 06 / September / 2009, 14:52:14 by syrius »
Logged
*

Offline whim

  • ******
  • 2046
  • A495/590/620/630 ixus70/115/220/230/300/870 S95
Re: SD1200 IS
« Reply #9 on: 06 / September / 2009, 15:03:58 »
Quote
starting at address 0xFFC00000

are you sure about that ? AFAIK all ixus/SD series have firmware start at 0xFF810000
in view of the time/hassle involved in blinking thought i should let you know ...

from http://chdk.wikia.com/wiki/Porting_the_CHDK
Quote
ROM start adresses

A-series                       0xFFC00000
S-, SD-, and G- series   0xFF810000

hope that helps,

wim
Logged
Pages: [1] 2   Go Up
« previous next »
 

Related Topics


SimplePortal © 2008-2014, SimplePortal