I'm able to run (simple) binaries on the camera. I'm using the AdditionAgentRAM eventproc to load my plain, unencoded binary and run it as a task.
This has allowed me to dump the RAM in rec mode, and do some experiments on some of the found overlay buffers. I haven't been able to blink an LED by using MMIO though, my above "guess" is somehow not right.
About the overlays: the main one has a 16 bit/pixel format (probably some kind of YUV), the other is 8 bit/pixel. The latter may be used as transparency layer or something, I don't have a better idea. Both kind of overlays have 640x480 pixel resolution, and both are double buffered.
The attached image shows the effect of 64kB random data copied over the main overlay (noise at the top), the same data is copied to the 8bpp overlay (luma noise below).
The Canon Basic script is this:
private sub Initialize()
System.Create()
AdditionAgentRAM("A/MY.BIN","WHAT")
end subThe source for the binary is
@ compile with:
@ arm-elf-gcc -Wl,-N,-Ttext,0x5ce000 -nostdlib -march=armv7 -mthumb try2.s -o try2.bin
@ and extract the needed bytes from the binary :/
@ 0x5ce000 is the start of AdditionAgent RAM
.globl _start
.org 0
_start:
.text
@ first byte has to be non-zero (otherwise blob might be treated as encoded)
push {r4,lr}
ldr r0, =10000 @ 10sec
ldr r3, =0xfc251cb4 @ SleepTask, arm
blx r3
mov r0, #0
mov r1, #4
mov r2, #0x80
ldr r3, =0xfc1a73d9 @ LEDDrive, thumb
blx r3
ldr r2, =0x1b6
ldr r1, =0x101 @ O_TRUNC, O_WRONLY
adr r0, fname
ldr r3, =0xfc2a50fb @ Open, thumb
blx r3
mov r4, r0
mov r1, #0
ldr r2, =0x10000000 @ 256 MB
ldr r3, =0xfc2a51a3 @ Write, thumb
blx r3
mov r0, r4
ldr r3, =0xfc2a50fd @ Close, thumb
blx r3
mov r0, #0
mov r1, #1
mov r2, #0x80
ldr r3, =0xfc1a73d9 @ LEDDrive, thumb
blx r3
ldr r3, =0xfc2512b1 @ ExitTask, thumb
blx r3
pop {r4,pc}
fname:
.asciz "A/RAM.BIN"
@ sx280 102b
@ DebugAssert, 0xfc251d14
@ ReceiveMessageQueue, 0xfc251bfc
@ GetNumberOfPostedMessages 0xfc251bf4
@ Close 0xfc2a50fc
@ GiveSemaphore 0xfc251c3c
@ Open 0xfc2a50fa
@ Write 0xfc2a51a2
@ SleepTask 0xfc251cb4
@ ExitTask 0xfc2512b0
@ LEDDrive 0xfc1a73d8
The first byte of the binary has to be non-zero.
Uncached addresses are OR'd with 0x40000000.
