CHDK Topic:- DIGIC 7 'PowerShot' Development

  • 3 Replies
CHDK Topic:- DIGIC 7 'PowerShot' Development
« on: 16 / January / 2019, 22:55:36 »
Some recent (1/2019) ML Forum Changes, Just for your 'Reference'.

The, D7, Current ML Topic:- DIGIC 7 Development

IS Now 'RE-LOCATED' Here:-

The, D8, 'Current ML' Topic:- DIGIC 8 'PowerShot' Development


ML Topic: Canon EOS R

IS 'Located' Here:-


Continued in post #1

Re: CHDK Topic:- DIGIC 7 'PowerShot' Development
« Reply #1 on: 16 / January / 2019, 22:56:16 »
===Some 'Selected' DIGIC 7 related History stuff - Pt1====

(ML) Re: DIGIC 7 development (....)
« Reply #63 on: August 09, 2018, by a1ex

".. For DIGIC 7 models, the next step is porting the 80D startup code (i.e. running user code alongside Canon firmware).
I expect this step to be straightforward, so it's left as an exercise to the owners of these cameras.
You can debug the startup code in the emulator; once you get it working, just ask me to enable the boot flag so you
can test it on the camera. .."

(ML) Re: DIGIC 7 Development (.....)
« Reply #64 on: August 10, 2018 by morgan20
".. Although, I've read that DIGIC 7 are quite the same as DIGIC 6, just dual core, and this kinda makes me wonder why
we can't run the DIGIC 6 code on a single DIGIC 7 core? .."

(ML) Re: DIGIC 7 Development (.....)
Reply #65 on: August 10, 2018, by a1ex

A/ ".. Short answer: because nobody tried yet. .."

B/ ".. Long answer: generally it won't work out of the box. ......."

C/ ".. The similarity I've mentioned was at hardware level, i.e. many peripherals (things other than CPU and RAM)
    identified on DIGIC 6 could be used to emulate DIGIC 7 firmware either out of the box or with minor adjustments
    (such as different register addresses). ........"

D/ ".. The DIGIC 7 cameras appear to be very similar; that is, I'd expect most of the knowledge gained by analyzing one model
    to apply to all others in this group. ........"

(ML) Re: How to run Magic Lantern into QEMU?!...
« Reply #381 on: September 13, 2018, by a1ex»

".. I didn't look into M6 yet, as PowerShots are not exactly my primary focus. .."

".. Porting to ... (& M5-xxxx + M6-xxxx) should now be just a matter of (Code) pattern matching (in theory). .."

(ML) Edit #1a:- see also ML Reply #105 January 16, 2019 x

(ML) by a1ex,  For DIGIC 7/8:-
- There's very little reason for ML to run on both cores, on these models.
  They both can access nearly the entire memory space (except for a small private page).
- This does not apply to earlier dual core models.
  On 7D, ML running only on a single core means reduced functionality (or much harder to implement certain features).
- Emulation-wise, it's important, but one has to understand the low-level interfaces between the two cores.
  Likely doable with io_trace (after updating it to run on the newer CPUs)..."

(ML) Edit #2:- EOS firmware in QEMU - development and reverse engineering guide
PowerShot firmware startup sequence

(ML, by a1ex)    TODO   (see CHDK).   Startup code is generally simpler and single-threaded, but less verbose.

« Last Edit: 03 / February / 2019, 19:46:58 by Hardware_Hacker »

Re: CHDK Topic:- DIGIC 7 'PowerShot' Development
« Reply #2 on: 16 / January / 2019, 22:57:27 »
Continued from post #1

CHDK Topic:- DIGIC 7 'PowerShot' Development 'Code Pattern Matching' (in theory)

Important Note #0:-  'Code Pattern Matching' (theory ONLY) The CHDK reference camera used is the M3-101a (edited), also see Note #2.
Important Note #1:-  'Code Pattern Matching' (theory ONLY) i.e. THIS IS NOT A DIGIC 7, M5 & M6, "PORTING ATTEMPT" post.
Important Note #2:-  'Code Pattern Matching' (theory ONLY) was originaly done in 2017 & 2018, so in 2019, it will not be up-to-date.
Important Note #3:-  This, complex, stuff starts with a post "Canon EOS M5" « on: 11/December/2016
So, just due to Reply #3,  " much effort will be required ... by reyalp" it will contain many typos,
and other errors, so please post any DIGIC 7 related comments and corrections ... etc.

IDA 7 & CHDK_Ref:- IDA 7 - ARM Dissassembler Demo & Qemu on: 28/September/2017 by H-H
Reply #1 and Edit's on: 21/September/2017 by H-H

See some of the attached 'Code Pattern Matching' (Using Win-10_x64 & IDA-Pro 7.0 Disassembler) files for:-
(based on "IDA Demo HowTo" by srsa_4c)

====M3 [Reference Camera]====
Eos-M3-101a (edited)

Eos_M5-100a, Eos_M5-101e

Eos_M6-100b, Eos_M6-100f

Important Note #4:-  CHDK D7 Boot.c,  'Startup Code' " left as an exercise to the owners of these cameras. .."

Also see ML Topic:- DIGIC 7 Development Posts, an example below
(ML) Re: DIGIC 7 Development (200D/SL2, 800D/T7i, 77D, 6D2)
« Reply #1 on: June 12, 2017, by a1ex»

What we know about D7 can be found on the (CHDK) EOS M5 thread, but that model runs PowerShot firmware.
It's very likely a dual-core Cortex A9, with MMU, and runs Thumb-2 code
(therefore, we might have some luck matching code patterns from some D6 models).

Caching issues (not yet solved on D6) are probably similar (that is, once it's solved for one model,
it will very likely apply to all others).

CHDK Ref:- ====EOS M5 Thread====


See the attached D7 files:-

Edit #1:- Also See ML Topic: Firmware Dumping and Loading into IDA  (Read 20776 times)

« Last Edit: 03 / February / 2019, 19:54:28 by Hardware_Hacker »


Offline reyalp

  • ******
  • 11706
Re: CHDK Topic:- DIGIC 7 'PowerShot' Development
« Reply #3 on: 04 / February / 2019, 17:25:43 »
What is the purpose of this thread?
Don't forget what the H stands for.


Related Topics