G3 X 1.00C FW Dump - page 2 - Firmware Dumping - CHDK Forum

G3 X 1.00C FW Dump

  • 11 Replies

Offline reyalp

  • ******
  • 12427
Re: G3 X 1.00C FW Dump
« Reply #10 on: 04 / February / 2016, 15:42:46 »
How do I use and dereference pointers in Canon Basic?
We don't know all details of this language. I'd probably use the peek event procedures that are registered by System.Create: Peek8, Peek16, Peek32 - for addresses, you obviously need Peek32.
You can actually use *foo syntax. Spacing determines whether it's multiplication or pointer de-ref  :-[

Some notes in http://chdk.wikia.com/wiki/Canon_Basic#Language_documentation

FWIW, I have been including the g3x dump in my finsig_thumb2 tests. I expect that most of the found values are good.
« Last Edit: 04 / February / 2016, 15:44:25 by reyalp »
Don't forget what the H stands for.

Re: G3 X 1.00C FW Dump
« Reply #11 on: 07 / February / 2016, 08:07:07 »
Hi srsa,

I'm really impressed how fast you can work through the assembler.

The function I'd call LEDtable_init is sub_fc075dc4. The suspicious values there are 0x21 and 4.

I was so close.. I also found these values but was irritated because this function seemed to write random values into the members [0,1,5,6,7] of the array I identified.
Yes, I also found 0xd20b0000 + 0x800 as well as the On/Off values 0x4d0002 and 0x4c0003.

I'm assuming you do follow reyalp's work on the D6 sigfinder - it's progressing pretty well.

Haha unfortunately no. I basically tried to work *offline* through the assembly since my last post in december.
I printed out the objdump disassembly of "task_LEDCon" and "taskcreate_LEDCon" and all referenced functions.
Then I took the ARM assembler documentation and tried to find breadcrumbs in this mess of instructions:D

I just read through reyalp's thread... Cool
So I guess I could use his software to confirm the findings I already made? This sounds really good.
I'll try it out when I find the time as I am curious if it can identify the missing handful of functions I didn't find yet.

How do I use and dereference pointers in Canon Basic?

I just got it!  :-X
There was a syntax error in my script.

Code: [Select]
'Based on the Dumper Script
startaddr = 0x9BAC
startptr = *startaddr
romsize = 504

sprintf(msgstr,"Adr %0X",startaddr)
sprintf(msgstr,"Ptr %0X",startptr)
dumpfile = Fopen_Fut("A/PRIMARY.BIN","w")

I got the following output as well as a dump of the memory:
Adr 9BAC
Ptr 36AE10

Unfortunately, the dump didn't contain anything useful.

(Hmm, I found a lot of instructions that jump into some weird memory range "0xBFE158A8" or so.
Maybe I can dump that too.....)

So I continued with your addresses and it worked!! Thanks!!

Code: [Select]
  led1addr = 0xd20b0884
  led2addr = 0xd20b0810
  Poke32(led2addr, 0x4d0002)  'It is ON now!!
  *led2addr = 0x4d0002        'Works, too!
  Poke32(led1addr, 0x4c0003)  'It is OFF now!!
Interestingly, each time I try to read the value of the addresses (using dereferencing or Peek32), I just get "5C" as value.
So, Poke32, Peek32 is equal to pointer-usage in Canon Basic.

Code: [Select]
0xd20b0884 'Status light - Back facing green LED
0xd20b0810 'Focus helper - Front facing white LED

There is a lot of knowledge hidden here.
Each time I crawl through the forum, the wiki pages or the Repository, I find something new.
If I knew a way to glue this all together, I'd try to help. :')

Next step is to collect more information about running self-compiled programs.
And try the same thing in C.

Thank you all for your patience!


Related Topics