TX1 Firmware dumping - Firmware Dumping - CHDK Forum
« previous next »
Pages: [1] 2 3   Go Down

TX1 Firmware dumping

  • 27 Replies
  • 21516 Views
*

Offline Microfunguy

  • ****
  • 4037
    • StereoData Maker
TX1 Firmware dumping
« on: 09 / March / 2008, 12:55:12 »
Advertisements
A quick check of memory-mapped I/O locations 0xC0220000 to 0xC0220100 fails to find any LED locations.

If I do a wider search, is there any danger of causing damage to other hardware components  in the camera ?

A similar test on the A620 confirmed the code basically works (and the LED's are at the locations we already know) but it also produced a strange sound from some device.



David
Logged
*

Offline ewavr

  • ****
  • 1057
  • A710IS
Re: TX1 Firmware dumping
« Reply #1 on: 09 / March / 2008, 13:58:38 »
Quote from: Microfunguy on 09 / March / 2008, 12:55:12
A quick check of memory-mapped I/O locations 0xC0220000 to 0xC0220100 fails to find any LED locations.
If I do a wider search, is there any danger of causing damage to other hardware components  in the camera ?
David

I cannot give advice.
In my A710 I make search from 0xC0220000 to 0xC022FFFF  - without camera damage. But there is always a risk :(

If LED location search fails, remains two methods: universal dumper (described somewhere in this forum) and "power consumption" method (VERY slow, it was used for G7 LED location search).
Logged
*

Offline Microfunguy

  • ****
  • 4037
    • StereoData Maker
Re: TX1 Firmware dumping
« Reply #2 on: 09 / March / 2008, 14:34:30 »
Quote from: ewavr on 09 / March / 2008, 13:58:38
two methods: universal dumper (described somewhere in this forum) and "power consumption" method (VERY slow, it was used for G7 LED location search).

Thanks.

I will try to find details about those two methods.

To turn possible LED locations on/off we use *led=0x46;   and  *led=0x44;


Why ?

How were those values found ?


David
Logged
*

Offline ewavr

  • ****
  • 1057
  • A710IS
Re: TX1 Firmware dumping
« Reply #3 on: 09 / March / 2008, 15:12:35 »
Quote from: Microfunguy on 09 / March / 2008, 14:34:30
To turn possible LED locations on/off we use *led=0x46;   and  *led=0x44;
Why ?

It is secret of DIGIC  ;) But TX1 can use "inverse" schematic - try 0x44 instead of 0x46 (and vice versa).

Quote from: Microfunguy on 09 / March / 2008, 14:34:30
How were those values found ?

From firmware analysis (first firmware was decrypted from "firmware update").
Logged
*

Offline Microfunguy

  • ****
  • 4037
    • StereoData Maker
Re: TX1 Firmware dumping
« Reply #4 on: 10 / March / 2008, 07:23:55 »
Quote from: ewavr on 09 / March / 2008, 13:58:38
I make search from 0xC0220000 to 0xC022FFFF  - without camera damage. But there is always a risk

No. nothing there.

Quote
TX1 can use "inverse" schematic - try 0x44 instead of 0x46 (and vice versa).

No, that did not work either (over that address range).

Quote
remains two methods: universal dumper (described somewhere in this forum) and "power consumption" method (VERY slow, it was used for G7 LED location search).


Well, it may be slow but it did work.

Was that published in this forum or DPReview ?



David
Logged
*

Offline DataGhost

  • ****
  • 314
  • EOS 40D, S5IS
    • DataGhost.com
Re: TX1 Firmware dumping
« Reply #5 on: 10 / March / 2008, 08:33:10 »
I suggest searching in reverse as well (0xC022xxxx -> 0xC0220000) and from several different starting addresses (device will shut down if you enter non-existing memory). I have found out that, on my S5 at least, the camera could shut down when setting the wrong addresses. I encountered it when doing this manually with the keypad, before the LED addresses (although I did "*led |= 0x2" instead of "*led = 0x46", I believe). It could be that the camera already shuts down before you find the actual addresses.

Edit because of new information below:
Hm, I guess it's still VxWorks then? I'm used to DryOS and have never used the firmware update feature before, else I'd have known the power led stays lit.
« Last Edit: 10 / March / 2008, 11:53:44 by DataGhost »
Logged
*

Offline cybercom

  • ****
  • 268
    • William Meredith's Photography Site - enjoy!!
Re: TX1 Firmware dumping
« Reply #6 on: 10 / March / 2008, 10:42:57 »
Hi all,

What's happening so far is that the TX-1 sees the ps.fir file on the card saying, update 1.0.1.0 -> 1.0.1.0?

When I tell it OK, the screen blanks after about a 1/10th of a second. The Power LED stays lit. All keyboard functions are inoperative for 13.8 secs at which point the camera turns off.

Nothing blinks, makes noises, rattles or hums.

If I then turn the camera on again and go into Record mode it functions normally.

vers.req returns:


Canon Powershot TX-1
P-ID:3100   NT   V  (Looking at another listing I saw, I'm wondering if that's 310 letter O ??)


Firmware Ver   GM 1.01b
No Error
Mar 23 2007   11:29:53

Adj Ver.027.001

SubCPU Ver 1.02

Total Shoot xxx (number depends on the camera - I have four)


I have two AC supplies, so can try any method, however slow to obtain a dump and could actually do two at a time for verification.

Any and all assistance gratefully accepted!


TIA,

~~~~~~~~~~~~~~~~~~~~~~~~~~~

<")%%%><<


Logged
~~~~~~~~~~~~~~~~~~~~~

<")%%%><<
*

Offline ewavr

  • ****
  • 1057
  • A710IS
Re: TX1 Firmware dumping
« Reply #7 on: 10 / March / 2008, 14:05:29 »
Quote from: Microfunguy on 10 / March / 2008, 07:23:55
Was that published in this forum or DPReview ?

Source of "universal dumper" was here - http://chdk.setepontos.com/index.php/topic,221.msg2740.html#msg2740 (and read all in this thread).
Some comment: if camera is VxWorks based, filling  memory with zeroes is not necessary.
About "power consumption" method: sources never have been published, only some speculations and results in russian forum. If it is interesting, I can publish them tomorrow.
Logged
*

Offline Microfunguy

  • ****
  • 4037
    • StereoData Maker
Re: TX1 Firmware dumping
« Reply #8 on: 10 / March / 2008, 14:16:57 »
Quote from: ewavr on 10 / March / 2008, 14:05:29

Source of "universal dumper" was here
Thanks, I had already researched that, I meant the 'power-consumption' method.-

Quote
If it is interesting, I can publish them tomorrow.


That would be very useful, we do not have many options  ;)



David
Logged
*

Offline Microfunguy

  • ****
  • 4037
    • StereoData Maker
Re: TX1 Firmware dumping
« Reply #9 on: 10 / March / 2008, 14:24:54 »
Quote from: cybercom on 10 / March / 2008, 10:42:57
All keyboard functions are inoperative for 13.8 secs at which point the camera turns off.

Aaahh .. that is slightly different to 'Must wait for timeout to shut off camera.' (private email)

I took that as meaning that after time-out you could then shut-off camera.

If you mean the camera switched itself off , Data Ghosts' comments are relevant.




David
Logged
Pages: [1] 2 3   Go Up
« previous next »
 

Related Topics


SimplePortal © 2008-2014, SimplePortal