Canon EOS M5 - page 2 - Firmware Dumping - CHDK Forum
« previous next »
Pages: 1 [2] 3 4 5   Go Down

Canon EOS M5

  • 40 Replies
  • 64308 Views
*

Offline Ant

  • ****
  • 444
Re: Canon EOS M5
« Reply #10 on: 14 / January / 2017, 08:43:15 »
Advertisements
Try to start at address 0x100000
Logged
*

Offline Sapporo

  • *
  • 10
Re: Canon EOS M5
« Reply #11 on: 14 / January / 2017, 08:47:45 »
I will be back home in maybe 6 hours.
Logged
*

Offline srsa_4c

  • ******
  • 4338
Re: Canon EOS M5
« Reply #12 on: 14 / January / 2017, 08:48:36 »
Quote from: Sapporo on 14 / January / 2017, 08:38:33
Screen turned black after 1 second and nothing more happend.
That's a crash. You could try getting the romlog.
Quote
I will try again with a bigger card when I get home. 512 MB may be too small.
It's unlikely related to card size.
I have a feeling that the days of dumping arbitrary memory are over...

Anyway, please watch this thread, I (or someone else) will likely post something new to try.
Logged
*

Offline c_joerg

  • *****
  • 1015
Re: Canon EOS M5
« Reply #13 on: 14 / January / 2017, 15:11:47 »
Quote from: srsa_4c on 14 / January / 2017, 08:48:36
I have a feeling that the days of dumping arbitrary memory are over...

A friend has a G7x mark II. Do you would expect the same problems with a dump on the G7x mark II?
Logged
M100 100a, M3 101a, G9x II (1.00c), 2*G1x (101a,100e), S110 (103a), SX50 (100c), SX230 (101a), S45,
Flickr https://www.flickr.com/photos/136329431@N06/albums
YouTube https://www.youtube.com/channel/UCrTH0tHy9OYTVDzWIvXEMlw/videos?shelf_id=0&view=0&sort=dd
*

Offline reyalp

  • ******
  • 12943
Re: Canon EOS M5
« Reply #14 on: 14 / January / 2017, 15:12:31 »
Quote from: c_joerg on 14 / January / 2017, 15:11:47
A friend has a G7x mark II. Do you would expect the same problems with a dump on the G7x mark II?
We don't know what to expect, but it would be interesting to find out. (edit: Past experience would suggest D7 cameras would behave similarly, but it's realy just a guess)
« Last Edit: 14 / January / 2017, 15:14:54 by reyalp »
Logged
Don't forget what the H stands for.
*

Offline Sapporo

  • *
  • 10
Re: Canon EOS M5
« Reply #15 on: 14 / January / 2017, 18:34:52 »
Quote from: Ant on 14 / January / 2017, 08:43:15
Try to start at address 0x100000
Same thing. The screen became black.
Logged
*

Offline Sapporo

  • *
  • 10
Re: Canon EOS M5
« Reply #16 on: 14 / January / 2017, 18:51:43 »
Quote from: srsa_4c on 14 / January / 2017, 08:48:36
Quote from: Sapporo on 14 / January / 2017, 08:38:33
Screen turned black after 1 second and nothing more happend.
That's a crash. You could try getting the romlog.
Quote
I will try again with a bigger card when I get home. 512 MB may be too small.
It's unlikely related to card size.
I have a feeling that the days of dumping arbitrary memory are over...

Anyway, please watch this thread, I (or someone else) will likely post something new to try.
I replaced the code in extend.m with the romlog code. Correct?
Logged
*

Offline srsa_4c

  • ******
  • 4338
Re: Canon EOS M5
« Reply #17 on: 14 / January / 2017, 19:41:23 »
Quote from: Sapporo on 14 / January / 2017, 18:51:43
I replaced the code in extend.m with the romlog code. Correct?
Yes, whatever script you intend to run, it must be placed into the extend.m file.
The romlog is OK.
What I see is
- this is still 32 bit ARM
- exception vector 0x10, data abort (can this be caused by permission problems?)
- one of the registers holds 0x100, the start address in the script
- SP is at 0x5E3558 which looks like a regular RAM address
- R0 is 0x4044F6E0, looks like an uncached RAM address
- PC is 0xDFFD41C8, could be a TCM
- LR is 0xE00278A1, thumb address, there are more 0xexxxxxxx addresses on stack

I think the ROM is located above 0xe0000000.

Modified the blind dumper to dump four 16MB segments, starting at 0xe0000000.
Code: [Select]
dim f,a,startadr=0,romsize=0x1000000,msgstr=0

private sub mydump(c)
        startadr = c * 0x1000000
        startadr = startadr + 0xe0000000
        sprintf(msgstr,"A/DUMP%0X.BIN",c)
        LCDMsg_SetStr(a,msgstr)
        f=Fopen_Fut(msgstr,"w")
        Fwrite_Fut(startadr,romsize,1,f)
        Fclose_Fut(f)
        Wait(500)
end sub

private sub Initialize()
UI.CreatePublic()
a=LCDMsg_Create()
LCDMsg_SetStr(a,"Running")
System.Create()
msgstr = AllocateMemory(80)

        mydump(0)
        mydump(1)
        mydump(2)
        mydump(3)

        LCDMsg_SetStr(a,"Done")
FreeMemory(msgstr)
end sub
Logged
*

Offline Ant

  • ****
  • 444
Re: Canon EOS M5
« Reply #18 on: 15 / January / 2017, 02:26:41 »
Quote from: srsa_4c on 14 / January / 2017, 19:41:23
Modified the blind dumper to dump four 16MB segments, starting at 0xe0000000.

According GK.LOG, there should be 32MB at least:

Code: [Select]
JediDraw
02,  579,0,0x23aa220,0x23cd360,e1812a58,0
03,  846,0x23aa220,0x23cd360,2,0,0xbff0056c
Logged
*

Offline Sapporo

  • *
  • 10
Re: Canon EOS M5
« Reply #19 on: 15 / January / 2017, 04:23:41 »
Quote from: srsa_4c on 14 / January / 2017, 19:41:23
Quote from: Sapporo on 14 / January / 2017, 18:51:43
I replaced the code in extend.m with the romlog code. Correct?
Yes, whatever script you intend to run, it must be placed into the extend.m file.
The romlog is OK.
What I see is
- this is still 32 bit ARM
- exception vector 0x10, data abort (can this be caused by permission problems?)
- one of the registers holds 0x100, the start address in the script
- SP is at 0x5E3558 which looks like a regular RAM address
- R0 is 0x4044F6E0, looks like an uncached RAM address
- PC is 0xDFFD41C8, could be a TCM
- LR is 0xE00278A1, thumb address, there are more 0xexxxxxxx addresses on stack

I think the ROM is located above 0xe0000000.

Modified the blind dumper to dump four 16MB segments, starting at 0xe0000000.
Code: [Select]
dim f,a,startadr=0,romsize=0x1000000,msgstr=0

private sub mydump(c)
        startadr = c * 0x1000000
        startadr = startadr + 0xe0000000
        sprintf(msgstr,"A/DUMP%0X.BIN",c)
        LCDMsg_SetStr(a,msgstr)
        f=Fopen_Fut(msgstr,"w")
        Fwrite_Fut(startadr,romsize,1,f)
        Fclose_Fut(f)
        Wait(500)
end sub

private sub Initialize()
UI.CreatePublic()
a=LCDMsg_Create()
LCDMsg_SetStr(a,"Running")
System.Create()
msgstr = AllocateMemory(80)

        mydump(0)
        mydump(1)
        mydump(2)
        mydump(3)

        LCDMsg_SetStr(a,"Done")
FreeMemory(msgstr)
end sub
Done. File too big for CHDK and uploaded at http://www.filedropper.com/eosdigital
Logged
Pages: 1 [2] 3 4 5   Go Up
« previous next »
 

Related Topics