First of all we have to make sure that M5 is Powershot.
"...Like the M3 the M5 will soon or later run chdk. Just check the menus and you will see for yourself...""...The firmware isn't based upon dslr code so porting to chdk is much easier..."
First of all we have to make sure that M5 is Powershot.There must be somebody, who can make a firmware dump using the universal dumperI don't expect ML on Digic 6 cameras until they find a replacement for cache hacks.
Tryed with no result.
Quote from: Sapporo on 14 / January / 2017, 06:52:56Tryed with no result.That's a great result, actually. The script has actually run (without crashing the camera), and it successfully created the log file.It proves that the firmware is still Powershot based.However, we know nothing about the DIGIC 7. The "not found!" message means that- the firmware signature has changed AND/OR- ROM size has changed or it is mapped to a different addressYou could try the script I posted here, but please uncomment all mydump function calls in it. (uncomment = remove the apostrophe)
Fixed
private sub RegisterProcs() ' Newest cams (Dryos rel 43 and later) only have System.Create() ' on older dryos cams SystemEventInit is an alias for System.Create() ' ExecuteEventProcedure does is not registered by default on vx, ' but calling an unregistered is not fatal if System.Create() = -1 then SystemEventInit() end if if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then ExecuteEventProcedure("UI.CreatePublic") end ifend subprivate sub InitMsg() lcdmsg = ExecuteEventProcedure("LCDMsg_Create") msgstr = AllocateMemory(80)end subprivate sub PutMsg(msg) if lcdmsg >= 0 then LCDMsg_SetStr(lcdmsg,msg) end ifend sub private sub Initialize() RegisterProcs() InitMsg() PutMsg("Dumping RAM") dumpfile = Fopen_Fut("A/0x100.BIN","w") if dumpfile <> 0 then Fwrite_Fut(0x100,0xFFFFF00,1,dumpfile) Fclose_Fut(dumpfile) Wait(500) PutMsg("done") else PutMsg("file error") end if FreeMemory(msgstr)end sub
Quote from: Sapporo on 14 / January / 2017, 08:07:09FixedThe archive size itself says a lot (way too small). The segments seem to contain the same data (lens correction related, not firmware).That means we're experiencing a huge architectural change.Since I have no idea where to find the ROM, a different approach is needed.Following script will try to dump (almost) 256MB of RAM(?) starting at address 0x100. It's unlikely to contain the whole firmware, but it might have pointers.Code: [Select]private sub RegisterProcs() ' Newest cams (Dryos rel 43 and later) only have System.Create() ' on older dryos cams SystemEventInit is an alias for System.Create() ' ExecuteEventProcedure does is not registered by default on vx, ' but calling an unregistered is not fatal if System.Create() = -1 then SystemEventInit() end if if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then ExecuteEventProcedure("UI.CreatePublic") end ifend subprivate sub InitMsg() lcdmsg = ExecuteEventProcedure("LCDMsg_Create") msgstr = AllocateMemory(80)end subprivate sub PutMsg(msg) if lcdmsg >= 0 then LCDMsg_SetStr(lcdmsg,msg) end ifend sub private sub Initialize() RegisterProcs() InitMsg() PutMsg("Dumping RAM") dumpfile = Fopen_Fut("A/0x100.BIN","w") if dumpfile <> 0 then Fwrite_Fut(0x100,0xFFFFF00,1,dumpfile) Fclose_Fut(dumpfile) Wait(500) PutMsg("done") else PutMsg("file error") end if FreeMemory(msgstr)end subIt's untested, hopefully usable.If the CPU has an MMU, the result is probably unpredictable. If this isn't working either, we'll have to find event procedures that give hints about memory mapping.
Started by _MAG_ « 1 2 ... 10 11 » DSLR Hack development
Started by whitehats Firmware Dumping
Started by inlikeflint DSLR Hack development
Started by G3x.User DSLR Hack development
Started by acseven Feature Requests