Bricked IXUS 110 IS - page 3 - General Help and Assistance on using CHDK stable releases - CHDK Forum
« previous next »
Pages: 1 2 [3]   Go Down

Bricked IXUS 110 IS

  • 22 Replies
  • 13018 Views
*

Offline Poldy

  • *
  • 7
Re: Bricked IXUS 110 IS
« Reply #20 on: 07 / January / 2015, 11:18:48 »
Advertisements
One more thing. I don't know what happened, but maybe because of different SD card or simply because camera was without battery for long time...

If I insert bootable card and press power button, CHDK image shows and I can go actually inside CHDK menus, for about 3-4 seconds before camera shuts down due to lens error.

Someone mentioned that script can disable lens error, but I don't know how to set up everything correctly...
Logged
*

Offline srsa_4c

  • ******
  • 4451
Re: Bricked IXUS 110 IS
« Reply #21 on: 07 / January / 2015, 19:41:06 »
Thanks for getting back on this issue.
Quote from: Poldy on 07 / January / 2015, 11:18:48
Someone mentioned that script can disable lens error, but I don't know how to set up everything correctly...
Newer cameras have a special function added to their firmware that prevents camera shutdown on (most?) e32 errors. Unfortunately this camera is slightly older generation and has no such function.

Now, for the ROM dump.
Your dump shows difference in 4 consecutive bytes (address is 0xFFDF4AA4) when compared to the 101f dump in our collection. That section of the firmware is some kind of data.
There are no asserts/exceptions recorded in the ROM. However, I see logged data that, I think, shows E32 (subtype 1) errors. This is "ISStartupError", which would also explain why you're getting an instant shutdown (cameras with e32 usually have ~60 seconds runtime before the shutdown).

It could be possible that those 4 damaged bytes are the cause of the IS initialization failure.
Logged
*

Offline reyalp

  • ******
  • 14138
Re: Bricked IXUS 110 IS
« Reply #22 on: 07 / January / 2015, 21:45:53 »
Quote
It could be possible that those 4 damaged bytes are the cause of the IS initialization failure.
Or an unrelated calibration difference, or flag recording the error ... (I have no preference for any of these theories)

From comparison with D10, which is similar generation and same ROM size, it looks like the normal "adjustment data" is at 0xFFFE0000 (EraseAdjustmentArea refers to a variable that has the address when running)

FFDF0000 seems to be the start of some block of data, before that it's all 0xFFFFFFFF (i.e. never used flash). I expect this address holds the same data for all firmware versions of the cam, and likely many other cams with the same ROM size.

FFDF0000 is referenced from ISCommunication.c in the firmware. Near the string "SIO_Int"

Our ixus110 100b, 101d and 101f dumps all have the same value (01 BC A9 02)  at FFDF4AA4... which might lower the odds of it being a calibration value.

My d10 has a different value.

The next difference in poldy's dump is at FFFC0000, the there is only this one difference in the FFDF0000 block.

The ML cache lockdown hacks might offer a way to try "patching" this to the value found in other firmwares without modifying ROM.
Logged
Don't forget what the H stands for.
Pages: 1 2 [3]   Go Up
« previous next »
 

Related Topics


SimplePortal © 2008-2014, SimplePortal