Any developers interested in working on CHDK firmware for DSLRs ? - page 8 - DSLR Hack development - CHDK Forum
« previous next »
Pages: 1 ... 3 4 5 6 7 [8] 9 10 11 12 13 ... 21   Go Down

Any developers interested in working on CHDK firmware for DSLRs ?

  • 202 Replies
  • 148895 Views
*

Offline mx3

  • ****
  • 372
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #70 on: 12 / February / 2008, 22:56:19 »
Advertisements
Quote from: RayeR on 12 / February / 2008, 21:16:32
Aha, there's some difference in 350D and 400D FW - As I can see original FIR is 4907626B but decrypted is 4907594 - 32B missing!
Then 400D have 16B more of garbage at the beginning thand 350D

400D:
00000000: 59 C0 55 E3 30 00 00 00 90 7C 12 00 00 00 00 00
00000010: 02 00 A0 E3 12 00 00 EA 43 6F 70 79 72 69 67 68

350D:
00000000: 02 00 A0 E3 12 00 00 EA 43 6F 70 79 72 69 67 68

Quote
The 1st 8 bytes at 0 seems to be some common header for all DigicII DSLRs
for 400D - 1st 16 bytes -maybe
for 350D - it is code

Code: [Select]
400D

RAM:00800020                 DCD 0xE355C059
RAM:00800024                 DCD 0x30
RAM:00800028                 DCD 0x127C90
RAM:0080002C                 DCD 0
RAM:00800030 ; ---------------------------------------------------------------------------
RAM:00800030
RAM:00800030 loc_800030                              ; DATA XREF: sub_80053C+14o
RAM:00800030                                         ; sub_80053C:loc_8005A4o
RAM:00800030                 MOV     R0, #2
RAM:00800034
RAM:00800034 loc_800034                              ; DATA XREF: sub_80053C+58o
RAM:00800034                 B       loc_800084
RAM:00800034 ; ---------------------------------------------------------------------------
RAM:00800038                 DCB 0x43 ; C
RAM:00800039                 DCB 0x6F ; o
RAM:0080003A                 DCB 0x70 ; p
RAM:0080003B                 DCB 0x79 ; y
RAM:0080003C                 DCB 0x72 ; r

RAM:00800084 loc_800084                              ; CODE XREF: ROM:loc_800034j
RAM:00800084                 LDR     R0, =0xC0100000
RAM:00800088                 LDR     R1, =0x4D3
RAM:0080008C                 STR     R1, [R0]
RAM:00800090                 LDR     R0, =0xC0400000
RAM:00800094                 LDR     R1, =0x410005
RAM:00800098                 STR     R1, [R0,#8]
RAM:0080009C                 MOV     R0, #0xC0000000
RAM:008000A0                 LDR     R1, =0xD9C50000
RAM:008000A4                 STR     R1, [R0,#0x10]
RAM:008000A8                 LDR     SP, =0x1900
RAM:008000AC                 MOV     R11, #0
RAM:008000B0                 LDR     PC, =loc_8000D0
RAM:008000B0 ; ---------------------------------------------------------------------------
RAM:008000B4 off_8000B4      DCD loc_8000D0          ; DATA XREF: RAM:008000B0r
RAM:008000B8 dword_8000B8    DCD 0x1900              ; DATA XREF: RAM:008000A8r
RAM:008000BC dword_8000BC    DCD 0xC0100000          ; DATA XREF: ROM:loc_800084r
RAM:008000C0 dword_8000C0    DCD 0x4D3               ; DATA XREF: RAM:00800088r
RAM:008000C4 dword_8000C4    DCD 0xC0400000          ; DATA XREF: RAM:00800090r
RAM:008000C8 dword_8000C8    DCD 0x410005            ; DATA XREF: RAM:00800094r
RAM:008000CC dword_8000CC    DCD 0xD9C50000          ; DATA XREF: RAM:008000A0r
RAM:008000D0 ; ---------------------------------------------------------------------------
RAM:008000D0
RAM:008000D0 loc_8000D0                              ; CODE XREF: RAM:008000B0j
RAM:008000D0                                         ; DATA XREF: ROM:off_8000B4o
RAM:008000D0                 MOV     R12, SP


for 350D code at offset 0. load at 800000
« Last Edit: 12 / February / 2008, 22:58:13 by mx3 »
Logged
skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler
*

Offline RayeR

  • *
  • 18
    • RayeR's homepage
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #71 on: 13 / February / 2008, 05:38:06 »
BTW I found that leading code and copyright message is not protected by checksum on 350D so I wonder how napalm did repaired it by bytes 32-34 (which belongs to copyright on 350D). Checksum must me fixed by some further bytes. I will try to find the range of protected bytes.

>mx3
And how about mismatch size of original and decrypted FIR od 400D?

Are there some knowledges about VxWorks? Do we have some working complette image? I thought it's a kind of linux-like os, I searched for some classic locations like /bin /etc/ /dev but there are very few strings with paths. It seems like this firmware don't use ROM filesystem with multiple files like powershots. Also the FW update maybe only a small part of huge firmware inside i don't know how big is the flash size. Can I get some complette dump from digicII powershot somewhere?
« Last Edit: 13 / February / 2008, 05:53:42 by RayeR »
Logged
Canon EOS 350D, PowerShot A95
*

Offline mx3

  • ****
  • 372
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #72 on: 13 / February / 2008, 05:47:43 »
Quote from: RayeR on 13 / February / 2008, 05:38:06
And how about mismatch size of original and decrypted FIR od 400D?

because decryptor skips them
  fseek(in, 32, SEEK_SET);   //Skip the first 32 bytes for 30D they are not encrypted
I think these bytes better to transfer to output without decryption
I could possibly help with analysis

same for 40D


Logged
skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler
*

Offline RayeR

  • *
  • 18
    • RayeR's homepage
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #73 on: 13 / February / 2008, 06:00:04 »
Quote from: mx3 on 13 / February / 2008, 05:47:43
because decryptor skips them
  fseek(in, 32, SEEK_SET);   //Skip the first 32 bytes for 30D they are not encrypted
I think these bytes better to transfer to output without decryption
I could possibly help with analysis

Aha, so when you encrypt it back, you have to add original 32Bytes or can be ommited? Napalm meand bytes 32-34 from decrypted file? then it's effectively 64-66 in original FIR.
Logged
Canon EOS 350D, PowerShot A95
*

Offline mx3

  • ****
  • 372
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #74 on: 13 / February / 2008, 06:02:25 »
Quote from: RayeR on 13 / February / 2008, 06:00:04
Aha, so when you encrypt it back, you have to add original 32Bytes or can be ommited? Napalm meand bytes 32-34 from decrypted file? then it's effectively 64-66 in original FIR.
see attached file Any developers interested in working on CHDK firmware for DSLRs ?
Logged
skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler
*

Offline naplam

  • *
  • 25
  • EOS 400D
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #75 on: 13 / February / 2008, 06:14:12 »
Quote from: RayeR on 13 / February / 2008, 06:00:04
Aha, so when you encrypt it back, you have to add original 32Bytes or can be ommited? Napalm meand bytes 32-34 from decrypted file? then it's effectively 64-66 in original FIR.
I always keep the first 32 bytes and I mean 32-34 not 64-66:
Code: [Select]
ROM:00800020                 DCB 0x59 ; Y
ROM:00800021                 DCB 0xC0 ; +
ROM:00800022                 DCB 0x55 ; U
That's the checksum ^

Quote from: mx3 on 13 / February / 2008, 05:47:43
I think these bytes better to transfer to output without decryption
Yep, if you do that the file fits exactly at 0x800000 for the loader.

Quote from: RayeR on 13 / February / 2008, 05:38:06
BTW I found that leading code and copyright message is not protected by checksum on 350D so I wonder how napalm did repaired it by bytes 32-34 (which belongs to copyright on 350D). Checksum must me fixed by some further bytes. I will try to find the range of protected bytes.
I guess I'm calculating the checksum on more bytes than I should, because it only works for v1.1.1, for other versions I'd have to adjust adding or substracting the difference from the correct checksum but I don't care for the time being- but I think the copyright is included, as the code near it should in theory be included as well. If you can find out the exact range great :)

Quote
Are there some knowledges about VxWorks? Do we have some working complette image? I thought it's a kind of linux-like os, I searched for some classic locations like /bin /etc/ /dev but there are very few strings with paths. It seems like this firmware don't use ROM filesystem with multiple files like powershots. Also the FW update maybe only a small part of huge firmware inside i don't know how big is the flash size. Can I get some complette dump from digicII powershot somewhere?
It's not linux-like at all. And you're not going to find any useful files/scripts either because it's not using any. It's a real-time OS for embedded systems, not a sort of dirty hack of consumer pc os like the os in 300D. The best thing we can do to find out how the camera is using the OS is looking for calls to os functions, isr, message queues,
Logged
*

Offline RayeR

  • *
  • 18
    • RayeR's homepage
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #76 on: 13 / February / 2008, 07:51:56 »
Quote
It's not linux-like at all. And you're not going to find any useful files/scripts either because it's not using any. It's a real-time OS for embedded systems, not a sort of dirty hack of consumer pc os like the os in 300D. The best thing we can do to find out how the camera is using the OS is looking for calls to os functions, isr, message queues,

Aha... So it's comlpetly new for me... And why did Canon left it and started to use DRYoS? Or it's new canon's proprietary system?
Logged
Canon EOS 350D, PowerShot A95
*

Offline naplam

  • *
  • 25
  • EOS 400D
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #77 on: 13 / February / 2008, 08:05:22 »
Quote from: RayeR on 13 / February / 2008, 07:51:56
Aha... So it's comlpetly new for me... And why did Canon left it and started to use DRYoS? Or it's new canon's proprietary system?
DryOS is Canon propietary so now they don't depend on anyone else. But it's similar to vxworks.

http://www.canon.com/technology/canon_tech/explanation/dryos.html
Quote
By developing platform software in-house, Canon can more effectively promote reuse and sharing of software modules while raising product functionality and quickly addressing the trend toward highperformance devices
« Last Edit: 13 / February / 2008, 08:07:28 by naplam »
Logged
*

Offline nns

  • *
  • 4
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #78 on: 25 / February / 2008, 20:43:45 »
Just wondering if any more headway has been made on identifying the checksum calculation region.  I'm working with 20D firmware, and it is lacking the header that the 350D and 400D apparently have.  I've identified the checksum routine, and I could patch it the same way naplam did, but I'd rather figure out where the checksum is, and how it is calculated.
« Last Edit: 26 / February / 2008, 07:49:11 by nns »
Logged
*

Offline rchoi999

  • *
  • 17
  • A650is
Re: Any developers interested in working on CHDK firmware for DSLRs ?
« Reply #79 on: 26 / February / 2008, 00:27:34 »
RayeR, do you have any patch for A40 firmware coz I still have a working one on hand and would like to try your patch, thanks.

Also, I don't understand CZ in your web, sorry.
Logged
Pages: 1 ... 3 4 5 6 7 [8] 9 10 11 12 13 ... 21   Go Up
« previous next »
 

Related Topics


SimplePortal © 2008-2014, SimplePortal