supplierdeeply

SX120 IS

  • 4 Replies
  • 8429 Views
  • Publish
    SX120 IS
    « on: 22 / September / 2009, 11:54:09 »
    Advertisements
    Ave,

    I would like to inform you that I managed to dump firmware from SX120IS. Current udumper does not work on this camera so I had to modify it a bit.

    Few facts:
    * executing DISKBOOT.BIN is possible after encoding it with `dancingbits' and specifying option '3'
    * contrary to what wiki says about SX line, ROM starts at 0xFFC00000 [1]
    * led addresses:
    Code: [Select]
    0xC0220008 FLASH_LAMP
    0xC022000C LED_AF
    0xC0220010 LED_ORANGE
    0xC0220014 LED_GREEN
    * link to firmware: http://w472.wrzuta.pl/plik/3BjnPIMyelk/sx120is.100b

    At first I found LED addresses using self-created PS.FI2 file. Few days later dancingbits program was updated with a new encoding method. Executing DISKBOOT.BIN became possible - hurray!

    With a thought that blinking would be inevitable, I started playing around with IDA and analyzing CanonIxus95IS_SD1200IS firmware. (I was to lazy to go to shop to buy a photodiode ;P ).

    It took me a bit of time to find a real WriteSDCard function... Instead of serching for 'write' string in the binary I should have looked for ',#0x38]' near STR instruction first. These two post gave me a really good hint how to get the bastard.

    http://chdk.setepontos.com/index.php/topic,3347.msg31914.html#msg31914
    http://chdk.setepontos.com/index.php/topic,3347.msg35952.html#msg35952

    Here's the code:
    Code: (asm) [Select]
    ROM:FFC3EE28 uSetPointers                            ; CODE XREF: sub_FFC3F454+34p
    ROM:FFC3EE28                                         ; sub_FFC3F5B4+2CFp
    ROM:FFC3EE28                 STMFD   SP!, {R4-R6,LR}
    ROM:FFC3EE2C                 MOV     R6, R0
    ROM:FFC3EE30                 LDR     R0, =0xE2FC ;Somewhere near pointers are stored
    ROM:FFC3EE34                 MOV     R5, R1
    ROM:FFC3EE38                 ADD     R4, R0, R6,LSL#7

    [snip]

    ROM:FFC3EE64                 ADRNE   R0, aMounter_c  ; "Mounter.c"
    ROM:FFC3EE68                 BNE     DebugAssert
    ROM:FFC3EE6C                 LDR     R0, [R4,#0x70]
    ROM:FFC3EE70                 TST     R0, #1
    ROM:FFC3EE74                 LDMNEFD SP!, {R4-R6,PC}
    ROM:FFC3EE78                 MOV     R0, #3
    ROM:FFC3EE7C                 LDR     R1, =sub_FFCE4118
    ROM:FFC3EE80                 STR     R0, [R4,#0x3C]
    ROM:FFC3EE84                 STR     R1, [R4,#0x4C]
    ROM:FFC3EE88                 LDR     R1, =ThisIsIT
    ROM:FFC3EE8C                 MOV     R0, #0
    ROM:FFC3EE90                 STR     R1, [R4,#0x50]
    ROM:FFC3EE94                 LDR     R1, =sub_FFCE4064
    ROM:FFC3EE98                 STR     R0, [R4,#0x38]
    ROM:FFC3EE9C                 STR     R1, [R4,#0x5C]
    ROM:FFC3EEA0                 STR     R0, [R4,#0x60]
    ROM:FFC3EEA4                 LDR     R0, =sub_FFCE46D4
    ROM:FFC3EEA8                 STR     R0, [R4,#0x64]
    ROM:FFC3EEAC                 LDR     R0, =sub_FFCE4744
    ROM:FFC3EEB0                 STR     R0, [R4,#0x68]
    ROM:FFC3EEB4                 LDMFD   SP!, {R4-R6,PC}
    ROM:FFC3EEB4 ; End of function uSetPointers

    Unfortunately, changed udumper code did not work - address could not be found:
    Code: (c) [Select]
    for (i=0x1900;i<0xF0000;i+=4)
    if ((*(unsigned int*)(i+0x60)==0) &&
    (*(unsigned int*)(i+0x38)==0) &&
    (*(unsigned int*)(i+0x3C)==3) &&
    (*(unsigned int*)(i+0x4C)>MIN_ADDRESS) &&
    (*(unsigned int*)(i+0x50)>MIN_ADDRESS) ) {

                            wr=(f_w)*(unsigned int*)(i+0x50);

    But...



    if you look a bit harder into the firmware code you will find:

    Code: (asm) [Select]
    ROM:FFC3EEDC dword_FFC3EEDC  DCD 0x53A               ; DATA XREF: uSetPointers+34r
    ROM:FFC3EEE0 aMounter_c      DCB "Mounter.c",0       ; DATA XREF: uSetPointers+3Co
    ROM:FFC3EEE0                                         ; sub_FFC3EF84+154oo ...
    ROM:FFC3EEEA                 DCB    0
    ROM:FFC3EEEB                 DCB    0
    ROM:FFC3EEEC off_FFC3EEEC    DCD sub_FFCE4118        ; DATA XREF: uSetPointers+54r
    ROM:FFC3EEF0 off_FFC3EEF0    DCD ThisIsIT            ; DATA XREF: uSetPointers+60r

    Code: [Select]
    [[email protected] tmp]$ grep Mounter CanonIxus95IS_SD1200IS.bin.strings
    ffc3eee0 Mounter.c
    [[email protected] tmp]$

    Mounter.c is uniq and 0x10 bytes later we have a pointer to our function! :)

    I compiled attached code at 1 AM, inserted SD card into camera with a trembling hands and a minute later there was a big smile on my face :]

    If someone would like to test it on his/her camera, binary can be found in the attachment (dumps from 0xFFC00000 though).

    And now for something completely different. On systems with /bin/sh set to ksh ./chdk/tools/gensigs.sh does not work:
    Code: [Select]
    [email protected]:~/chdk/chdk/tools$ make
    pakwif.c -> pakwif.o
    pakwif.o -> pakwif
    gensig.c -> gensig.o
    gensig.o -> gensig
    -> signatures_vxworks.h
    ./gensigs.sh[9]: syntax error: `(' unexpected
    make: *** [signatures_vxworks.h] B??d 1
    [email protected]:~/chdk/chdk/tools$

    Here's a fix:

    Code: [Select]
    [email protected]:~/chdk/chdk/tools$ LC_ALL=C svn diff gensigs.sh
    Index: gensigs.sh
    ===================================================================
    --- gensigs.sh  (revision 803)
    +++ gensigs.sh  (working copy)
    @@ -1,4 +1,4 @@
    -#!/bin/sh
    +#!/bin/bash

     VERSIONS=$3

    [email protected]:~/chdk/chdk/tools$

    Hope that helps.

    Oh, BTW is processor really little endian?

    [1] I discovered it by blinking out first 3 bytes of "gaonisoyP" string with a fantastic speed of 1bit per 5 seconds ;)
    "Trying is the first step towards failure." (Homer Simpson)

    *

    Offline fe50

    • ******
    • 3034
    • IXUS50 & 860, SX10 Star WARs-Star RAWs
      • fe50
  • Publish
    Re: SX120 IS
    « Reply #1 on: 22 / September / 2009, 15:20:52 »
    Hello & welcome, gajownik !
    Congratulations, a really good start into the CHDK universe :D !
    Good luck for porting this camera...

    I've added your dump to the CHDK dump repository...[1]

  • Publish
    Re: SX120 IS
    « Reply #2 on: 04 / December / 2009, 03:03:42 »
    I can program a bit, but I know nothing about assembly. I wish I could help.

    I just bought a SX120 IS in hopes of there being firmware for it one day. Is all the work done in linux? I'd like to help but how? Anyone have any advice? If anyone was working on this but lost interest I just want you to know there is definite interest in this topic.

    I hate to sound like some fledgling flopping around on the internet, but could someone point me in the right direction? Thanks.  :)

    *

    Online reyalp

    • ******
    • 9947
  • Publish
    Re: SX120 IS
    « Reply #3 on: 04 / December / 2009, 03:32:18 »
    Don't forget what the H stands for.


  • Publish
    Re: SX120 IS
    « Reply #4 on: 08 / August / 2010, 11:25:12 »
    Hello,

    sorry for the probably naive question: Do you think that your modifications would also help to dump the IXUS 110 IS - SD960 firmware, where the standard udumper fails, see http://chdk.setepontos.com/index.php?topic=3585.0 ? Or is this completely unrelated?

    I have a IXUS 110IS and could try it, if you think that there is some hope ;)

     

    Related Topics