EOS Lens protocol analyse - anybody intresting? - page 5 - DSLR Hack development

fsnfs

9

Re: EOS Lens protocol analyse - anybody intresting?

« Reply #40 on: 15 / July / 2010, 22:10:00 »

Advertisements

Quote from: _MAG_ on 12 / May / 2008, 13:32:25

they not release protocol. they sell only a device. I think we need undersand protocol to add no-af lens af confirmation in firmware. Of course maybe in firmware this been simple (disable check) or maybe needed transfer "virtual data" from "original lense"

HI _MAG_
I have the same idea of this
I also hope to enable no-af lens af confirmation by using non-AF old lens.

Is the firmware of 400D cracked?
Can it add a funtion to enable af confirmation by software now?

Logged

arm.indiana

105

Re: EOS Lens protocol analyse - anybody intresting?

« Reply #41 on: 09 / August / 2010, 06:22:59 »

Hi,

here is another reference: http://wapedia.mobi/en/Canon_EF_lens_mount?t=5.
why not also analysis firmware code ?

Arm.Indy

Logged

arm.indiana

105

Re: EOS Lens protocol analyse - anybody intresting?

« Reply #42 on: 28 / August / 2010, 04:31:58 »

Hi,

"LCOM_" string in the firmware means Lens Communication.

100eb8 (Reached->LCOM_AF_FINISHED FOCUS_OK ) 101590 SetReqForNear Go on LCOM_FAR_SEARCH (NEnd=%d) 1015c0 SetReqForNear LCOM_FAR_SEARCH -> LCOM_NEAR_SEARCH 101840 SetReqForFar Go on LCOM_NEAR_SEARCH (FEnd=%d) 101870 SetReqForFar LCOM_NEAR_SEARCH -> LCOM_FAR_SEARCH 1018d0 SetReqForReachedEnd LCOM_FAR_SEARCH -> LCOM_NEAR_SEARCH 101908 SetReqForReachedEnd LCOM_NEAR_SEARCH -> LCOM_FAR_SEARCH 102908 SetReqForInfPint Set LCOM_TMNL_FINAL_FOCUSING 108808 SetSearchCtrl EVALUATING (LCOM_REST) 1088ac EvaluateContrast1 Receive LCOM_TMNL_FINAL_FOCUSING 108c44 EvaluateContrast1 EVALUATING (LCOM_WAIT_TO_AE) 108e58 (Reached->LCOM_FOCUS_MOVING ) 108e78 (Reached->LCOM_WAIT_TO_SEARCH_STOP ) 108ea0 (Reached->LCOM_SEARCH_STOPPED ) 108ec0 -> LensRequest == LCOM_AFTER_SEARCH 109c80 CkLensEnd LCOM_REACHED_END (SEARCH LensEnd) EndCnt(F=%d, N=%d) 109cf8 CkLensEnd LCOM_DELAYED_NG_1 (LEGACY LensEnd READY) 109d2c CkLensEnd LCOM_DELAYED_NG_1 (LEGACY LensEnd) 109ea4 CkLensEnd LCOM_DELAYED_NG_1 (LEGACY LensEnd GoOnLimit) 109edc CkLensEnd LCOM_DELAYED_NG_2 (LEGACY LensEnd FACE_SHORT) 109f14 CkLensEnd LCOM_REACHED_END (LEGACY LensEnd) 109fa4 CkLensEnd LCOM_DELAYED_NG_2 (LEGACY ScanEnd) 109fd4 CkLensEnd LCOM_DELAYED_NG_2 (LEGACY ScanEnd GoOnLimit) 10a00c CkLensEnd LCOM_DELAYED_NG_2 (LEGACY ScanEnd FACE_SHORT) 10a044 CkLensEnd LCOM_GO_ON_SCAN (LEGACY ScanEnd) 10a27c SetSearchStopCtrl LCOM_OCCURED_ERROR 10aef4 CkLensInfo Recognized LCOM_WAIT_TO_AE 4a7a38 SetReqForFUnexp Avoid LCOM_NEAR_UNEXPLORED (RStep=%d > MStep=%d) 4a7ac4 SetReqForNUnexp Avoid LCOM_NEAR_UNEXPLORED (RStep=%d > MStep=%d) 4a8318 CkLensEnd LCOM_DELAYED_NG_1 (LEGACY LensEnd MaxEndCount) EndCnt(F=%d, N=%d) 4a8364 SetSearchStopCtrl LCOM_WAIT_TO_SEARCH_STOP -> LCOM_SEARCH_STOPPED

from 550D/1.0.8 FW

Arm.indy

Logged

_MAG_

47

Re: EOS Lens protocol analyse - anybody intresting?

« Reply #43 on: 13 / September / 2010, 02:01:00 »

CkLensInfo Recognized
wery intresting

i sink be intresting to bypass LensRequest function. replace
108ec0 -> LensRequest == LCOM_AFTER_SEARCH to 10aef4 CkLensInfo Recognized LCOM_WAIT_TO_AE

or something like this.

maybe better if you repost this in http://www.dslr-forum.de/showthread.php?t=649529&page=28
forum.

Logged

arm.indiana

105

Re: EOS Lens protocol analyse - anybody intresting?

« Reply #44 on: 16 / October / 2010, 16:17:09 »

Hi,

in 550D, there is a function called "send_LensBP".

this function use a BIG table (from 0xff487a38 to 0xffaaed4) which record seems to have 11 bytes each.
does this table data make sense to you (see below the beginning and the end) ? is it part of the Lens protocol ?

I can send the complete table if needed.

Indy

Code: (asm) [Select]

ROM:FF01D7DC send_LensBP_data                        ; DATA XREF: create_MainMessQueue+48o
ROM:FF01D7DC
ROM:FF01D7DC var_C           = -0xC
ROM:FF01D7DC
ROM:FF01D7DC                 STMFD   SP!, {R4,LR}
ROM:FF01D7E0                 SUB     SP, SP, #0x30
ROM:FF01D7E4                 MOV     R4, R1
ROM:FF01D7E8                 MOV     R0, R1
ROM:FF01D7EC                 BL      compute_lens_data_offset


ROM:FF07C314 compute_lens_data_offset                ; CODE XREF: send_LensBP_data+10p
ROM:FF07C314                 MOV     R1, #0xB
ROM:FF07C318                 MUL     R0, R1, R0
ROM:FF07C31C                 LDR     R1, =lens_data_maybe
ROM:FF07C320                 ADD     R0, R0, R1
ROM:FF07C324                 BX      LR
ROM:FF07C324 ; End of function compute_lens_data_offset


[code=asm]ROM:FF487A38 lens_data_maybe DCB 0,0,0,0,0,0,0,0,0,0,0
ROM:FF487A38                                         ; DATA XREF: compute_lens_data_offset+8o
ROM:FF487A38                                         ; ROM:off_FF07C328o
ROM:FF487A38                 DCB 0xBC,0xF9,0xCD,0xFE,0xA4,0x9D,0xBD,0x65,0x3A,0xA0,0
ROM:FF487A38                 DCB 0,0,0,0,0,0,0,0,0,0,0
ROM:FF487A38                 DCB 0xB3,0x49,0x47,0x25,0x25,0x6D,0xB8,0x4F,0xBE,0x66,1
ROM:FF487A38                 DCB 0xD7,0xE9,0xBB,0xE2,0x1C,0x66,0xD8,0x85,0xC4,0x5C,4
ROM:FF487A38                 DCB 0xD6,0x8C,0xC8,0xE2,0x21,0x77,0xDE,0xCD,0xC5,0x12,5
ROM:FF487A38                 DCB 0xDB,0xE3,0x3F,0x2B,0xAC,0xD5,0xD4,0xD0,0xC9,0x40,7
ROM:FF487A38                 DCB 0xD9,0xB8,0x44,0x18,0x26,0x60,0xDB,0x8F,0xC8,0x37,0xB
ROM:FF487A38                 DCB 0x50,0x58,0xBD,0xDA,0x31,0x70,0x59,0x98,0xC1,0x6B,0x21
ROM:FF487A38                 DCB 0x55,0x70,0xC8,0x2B,0x9C,0x9D,0x5A,0x8C,0x39,0xED,0x22
ROM:FF487A38                 DCB 0x54,0x63,0x40,0x7B,0xB2,0xE5,0x55,0xA0,0xC0,0x5B,0x27
ROM:FF487A38                 DCB 0x57,0xEE,0x44,0x96,0x1A,0x25,0x58,0x7E,0xC2,4,0x2A
ROM:FF487A38                 DCB 0x53,0xF,0xB9,0x39,0x2C,0x36,0x52,0x11,0xC0,0x6A,0x13
ROM:FF487A38                 DCB 0x58,0xC7,0xC8,0x20,0x1A,0x2C,0x59,0x17,0x48,0x20,0x13
ROM:FF487A38                 DCB 0x54,0xFB,0xA3,0x91,0x9E,0x64,0x50,0x8E,0xC7,0xEF,0x16
ROM:FF487A38                 DCB 0x59,0xD3,0x44,0x95,0xA3,0xA5,0x59,0x41,0x33,0x27,0x18
ROM:FF487A38                 DCB 0x4E,0x40,0xB5,0xF0,0x28,0xE,0x46,0x73,0xC7,1,0xFF
ROM:FF487A38                 DCB 0x4D,0xAC,0xC8,0x33,0x99,0x57,0x46,0x85,0xC7,0x4F,0
ROM:FF487A38                 DCB 0x4F,0x97,0x24,0xB7,0xA7,0xF8,0xC7,0x15,0xBE,0x8B,0
ROM:FF487A38                 DCB 0x4E,0x7C,0x44,0xBD,0xA4,0xF8,0xC6,0x80,0xBC,0xDF,0
...
ROM:FF4AAE5B                 DCB 0xD2,1,0xC8,0x52,0xA1,0xAD,0xD3,0xAC,0xCB,0x2C,4
ROM:FF4AAE5B                 DCB 0xC8,0xC5,0x3B,0x25,0xAA,0x78,0xD6,0x6C,0xC7,0xC6,5
ROM:FF4AAE5B                 DCB 0xC4,0xC5,0x44,0x92,0x28,0x6A,0xD6,0xBA,0xC7,0xD9,5
ROM:FF4AAE5B                 DCB 0xD2,0x24,0xB6,0xE8,0x27,0xFE,0xCE,0x43,0xCB,0x69,3
ROM:FF4AAE5B                 DCB 0xD2,0x76,0xC8,0x55,0xA1,0x54,0xC5,0x5F,0xCB,0x65,3
ROM:FF4AAE5B                 DCB 0xB2,0xC5,0x3B,0xD,0xAA,0x63,0xD6,0xEC,0xC1,0x68,4
ROM:FF4AAE5B                 DCB 0x47,0xF6,0x44,0x93,0x28,0x66,0xD7,0x42,0xC1,0x84,4
ROM:FF4AAE5B                 DCB 0xD2,0x62,0x29,0xBE,0x1E,0x7A,0xC7,0x4C,0xCB,0xA2,3
ROM:FF4AAE5B                 DCB 0xD2,0xBA,0xC8,0x57,0xA1,0x17,0x4A,0x60,0xCB,0x9C,3
ROM:FF4AAE5B                 DCB 0x48,0x8B,0x3A,0xFF,0xAA,0x56,0xD7,0x55,0xC2,0xF2,3
ROM:FF4AAE5B                 DCB 0x4C,0x72,0x44,0x94,0x28,0x63,0xD7,0xB1,0xC3,7,3
ROM:FF4AAED4

[/code]

Logged