It's funny, but I got my camera bricked after experimenting with language menu.
Now camera is in cyclic reboot:
<0>#<0>
NotInit
StartDiskboot
<0>
Start Program on RAM
<0>
DRYOS version 2.3, release #0055+p6
Copyright (C) 1997-2013 by CANON Inc.
NotInit
Assert: File CdsTable.c Line 144
!!!WatchDog expired!!!
[_imageSensorTask] -> [WdtPrint (LR:0xbfe13575 , PC:0xfc2699a4)]
[WdtPrint] -> [_imageSensorTask (LR:0xbfe11453 , PC:0x010e1014)]
[_imageSensorTask] -> [WdtPrint (LR:0xbfe118ad , PC:0xfc2699a4)]
<0>#<0>
NotInit
StartDiskboot
<0>
Start Program on RAM
<0>
DRYOS version 2.3, release #0055+p6
Copyright (C) 1997-2013 by CANON Inc.
NotInit
Assert: File CdsTable.c Line 144
!!!WatchDog expired!!!
[_imageSensorTask] -> [WdtPrint (LR:0xbfe13575 , PC:0xfc2699a4)]
[WdtPrint] -> [_imageSensorTask (LR:0xbfe11453 , PC:0x010e1014)]
[_imageSensorTask] -> [WdtPrint (LR:0xbfe118ad , PC:0xfc2699a4)]
<0>#<0>
NotInit
StartDiskboot
<0>
Start Program on RAM
<0>
DRYOS version 2.3, release #0055+p6
Copyright (C) 1997-2013 by CANON Inc.
NotInit
Assert: File CdsTable.c Line 144
With help of a1ex I turned on TIO debug UART. Its pinout is the same as on another cameras, and levels are 1.8 volt.
But it's need to be very lucky to get into debug shell. There I found that adjustment data(including model number and serial number) are erased.
Now I am looking the way to restore it from ROM dump...
Does anybody had experience with flash programming on camera?
Which functions I should use for file reading from SD?
P.S. I was surprised finding second flash chip on board(MX29GL640ETXEI). Maybe it used by Zico?