Canon EOS M5 - Firmware Dumping - CHDK Forum
« previous next »
Pages: [1] 2 3 4 5   Go Down

Canon EOS M5

  • 40 Replies
  • 81692 Views
*

Offline zsolex

  • *
  • 1
Canon EOS M5
« on: 11 / December / 2016, 03:55:24 »
Advertisements
Are you planning to support M5?

From Magic lantern: "Please note: some Canon EOS M cameras (M3, M5, M10) are based on PowerShot firmware. It's much easier to port CHDK on these cameras."
« Last Edit: 18 / January / 2017, 07:06:43 by acseven »
Logged
*

Offline Ant

  • *****
  • 509
Re: Canon EOS M5
« Reply #1 on: 11 / December / 2016, 04:50:19 »
First of all we have to make sure that M5 is Powershot.
There must be somebody, who can make a firmware dump using the universal dumper

I don't expect ML on Digic 6 cameras until they find a replacement for cache hacks.
« Last Edit: 11 / December / 2016, 04:57:20 by Ant »
Logged
*

Offline Hardware_Hacker

  • ****
  • 322
Re: Canon EOS M5
« Reply #2 on: 12 / December / 2016, 03:22:28 »
Quote from: Ant on 11 / December / 2016, 04:50:19
First of all we have to make sure that M5 is Powershot.
ML Topic: EOS M5 - 80D in your "pocket"  (Read 2302 times)
http://www.magiclantern.fm/forum/index.php?PHPSESSID=8ovfrgoep9mcola6lij27bqai7&topic=17889.msg172178#msg172178

"...Like the M3 the M5 will soon or later run chdk. Just check the menus and you will see for yourself..."
"...The firmware isn't based upon dslr code so porting to chdk is much easier..."

H-H

Logged
*

Offline reyalp

  • ******
  • 14034
Re: Canon EOS M5
« Reply #3 on: 12 / December / 2016, 16:54:18 »
Quote from: Hardware_Hacker on 12 / December / 2016, 03:22:28
"...Like the M3 the M5 will soon or later run chdk. Just check the menus and you will see for yourself..."
"...The firmware isn't based upon dslr code so porting to chdk is much easier..."
Without a dump, it's impossible to say if CHDK can support it or how much effort will be required, so these statements should be taken as speculation.
Logged
Don't forget what the H stands for.
*

Offline Ant

  • *****
  • 509
Re: Canon EOS M5
« Reply #4 on: 13 / December / 2016, 01:15:52 »
At least we need to know the extension of the firmware update file (*.FI2 for CHDK, *.FIR for ML)
It uses *.FI2
« Last Edit: 13 / December / 2016, 05:59:18 by Ant »
Logged
*

Offline Sapporo

  • *
  • 10
Re: Canon EOS M5
« Reply #5 on: 14 / January / 2017, 06:52:56 »
Quote from: Ant on 11 / December / 2016, 04:50:19
First of all we have to make sure that M5 is Powershot.
There must be somebody, who can make a firmware dump using the universal dumper

I don't expect ML on Digic 6 cameras until they find a replacement for cache hacks.

Tried with no result.

I used a 512 MB SD card, I low level formatted it in my M5, used EOScard and marked SCRIPT. After that I put script.req and extend.m at the root of the card. I started the camera in play mode and pressed SET.
« Last Edit: 14 / January / 2017, 08:25:26 by Sapporo »
Logged
*

Offline srsa_4c

  • ******
  • 4451
Re: Canon EOS M5
« Reply #6 on: 14 / January / 2017, 07:08:26 »
Quote from: Sapporo on 14 / January / 2017, 06:52:56
Tryed with no result.
That's a great result, actually. The script has actually run (without crashing the camera), and it successfully created the log file.
It proves that the firmware is still Powershot based.

However, we know nothing about the DIGIC 7. The "not found!" message means that
- the firmware signature has changed AND/OR
- ROM size has changed or it is mapped to a different address


You could try the script I posted here, but please uncomment all mydump function calls in it. (uncomment = remove the apostrophe)
Logged
*

Offline Sapporo

  • *
  • 10
Re: Canon EOS M5
« Reply #7 on: 14 / January / 2017, 08:07:09 »
Quote from: srsa_4c on 14 / January / 2017, 07:08:26
Quote from: Sapporo on 14 / January / 2017, 06:52:56
Tryed with no result.
That's a great result, actually. The script has actually run (without crashing the camera), and it successfully created the log file.
It proves that the firmware is still Powershot based.

However, we know nothing about the DIGIC 7. The "not found!" message means that
- the firmware signature has changed AND/OR
- ROM size has changed or it is mapped to a different address


You could try the script I posted here, but please uncomment all mydump function calls in it. (uncomment = remove the apostrophe)
Fixed
« Last Edit: 14 / January / 2017, 08:13:29 by Sapporo »
Logged
*

Offline srsa_4c

  • ******
  • 4451
Re: Canon EOS M5
« Reply #8 on: 14 / January / 2017, 08:26:18 »
Quote from: Sapporo on 14 / January / 2017, 08:07:09
Fixed
The archive size itself says a lot (way too small). The segments seem to contain the same data (lens correction related, not firmware).
That means we're experiencing a huge architectural change.
Since I have no idea where to find the ROM, a different approach is needed.

Following script will try to dump (almost) 256MB of RAM(?) starting at address 0x100. It's unlikely to contain the whole firmware, but it might have pointers.
Code: [Select]
private sub RegisterProcs()
' Newest cams (Dryos rel 43 and later) only have System.Create()
' on older dryos cams SystemEventInit is an alias for System.Create()
' ExecuteEventProcedure does is not registered by default on vx,
' but calling an unregistered is not fatal
if System.Create() = -1 then
SystemEventInit()
end if
if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
ExecuteEventProcedure("UI.CreatePublic")
end if
end sub

private sub InitMsg()
lcdmsg = ExecuteEventProcedure("LCDMsg_Create")
msgstr = AllocateMemory(80)
end sub

private sub PutMsg(msg)
if lcdmsg >= 0 then
LCDMsg_SetStr(lcdmsg,msg)
end if
end sub
 
private sub Initialize()
RegisterProcs()
InitMsg()
PutMsg("Dumping RAM")

dumpfile = Fopen_Fut("A/0x100.BIN","w")
if dumpfile <> 0 then
Fwrite_Fut(0x100,0xFFFFF00,1,dumpfile)
Fclose_Fut(dumpfile)
Wait(500)
PutMsg("done")
else
PutMsg("file error")
end if
FreeMemory(msgstr)
end sub
It's untested, hopefully usable.
If the CPU has an MMU, the result is probably unpredictable. If this isn't working either, we'll have to find event procedures that give hints about memory mapping.
Logged
*

Offline Sapporo

  • *
  • 10
Re: Canon EOS M5
« Reply #9 on: 14 / January / 2017, 08:38:33 »
Quote from: srsa_4c on 14 / January / 2017, 08:26:18
Quote from: Sapporo on 14 / January / 2017, 08:07:09
Fixed
The archive size itself says a lot (way too small). The segments seem to contain the same data (lens correction related, not firmware).
That means we're experiencing a huge architectural change.
Since I have no idea where to find the ROM, a different approach is needed.

Following script will try to dump (almost) 256MB of RAM(?) starting at address 0x100. It's unlikely to contain the whole firmware, but it might have pointers.
Code: [Select]
private sub RegisterProcs()
' Newest cams (Dryos rel 43 and later) only have System.Create()
' on older dryos cams SystemEventInit is an alias for System.Create()
' ExecuteEventProcedure does is not registered by default on vx,
' but calling an unregistered is not fatal
if System.Create() = -1 then
SystemEventInit()
end if
if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
ExecuteEventProcedure("UI.CreatePublic")
end if
end sub

private sub InitMsg()
lcdmsg = ExecuteEventProcedure("LCDMsg_Create")
msgstr = AllocateMemory(80)
end sub

private sub PutMsg(msg)
if lcdmsg >= 0 then
LCDMsg_SetStr(lcdmsg,msg)
end if
end sub
 
private sub Initialize()
RegisterProcs()
InitMsg()
PutMsg("Dumping RAM")

dumpfile = Fopen_Fut("A/0x100.BIN","w")
if dumpfile <> 0 then
Fwrite_Fut(0x100,0xFFFFF00,1,dumpfile)
Fclose_Fut(dumpfile)
Wait(500)
PutMsg("done")
else
PutMsg("file error")
end if
FreeMemory(msgstr)
end sub
It's untested, hopefully usable.
If the CPU has an MMU, the result is probably unpredictable. If this isn't working either, we'll have to find event procedures that give hints about memory mapping.
Screen turned black after 1 second and nothing more happend. I will try again with a bigger card when I get home. 512 MB may be too small.
Logged
Pages: [1] 2 3 4 5   Go Up
« previous next »
 

Related Topics