What I have wondered with the HF10 FW as well, how do you find out the exact processor model?
Thats the easiest thing. Both FW have strings with list of registers - using them the processor line could be easily googled. Then, at most any compiler includes processor specific libraries which contain strings with IDs. For HV30 thats a FR71 and mainboard id MB8AA101.
BTW, both of them are not listed in official fujitsu docs, this means they could be designed specially for canon (or even by canon).
Btw, I was just searching for file names and stuff and came over some devices and paths, strangely some are unix style, and some are dos style. Could that maybe mean that DryOS is based on a unix/linux kernel and those dos style paths are to access the FAT storage devices? (A text file with the paths is attached)
Yes, thats strange. However, from my CHDK experience, embedded systems often offer a simplified model for file IO, and it could be easily mixed with dos/unix styles.
edit: what I forgot earlier... what if there's no USB backdoor?
Good question. We have to find it.
The best option we may wish is to have something similar to autoload feature we have in powershot CHDK now. To find it out we need a way to extract and understand ram layout and bootloader area.
So, IDA f/w analysis is the main point we can do now, imho.
