Two Qs sparked by sorting several hands full of SD890 and SD990

koshy

1096

« on: 11 / April / 2022, 18:52:38 »

Advertisements

Long time no post :-)

I finally got to go through some SD890 and SD990 cameras I had picked up for little money over time (years it seems), I don't even recall whether some were bought defunct for like a fiver in case I need an LCD, flash, jogdial or whatever.

Something odd happened though and that leads me to my first question to you folks. Three out of like 15 extended the lens made some audible choke and failed with a lens error. I was curious if I could get a FW dump in spite of that but could not.
I get up to the CHDK splash screen can even invoke the CHDK scripting screen, I think but then the cam shuts down. Can that shutdown be thwarted?
Universal dumper using Canon basic fails as I obviously can't start up in Play mode (the lens error is detected in it, too) and hence can't press the func button at the required time, the cam is already off by then. A lot of things come to mind that I can / could try, like disconnecting the optical unit, seeing what happens when powering on the camera, I never tried that. I have faulty (even) older models I'd rather explore this with. If I really wanted to I could of course swap optical units giving error and not between two cameras, or maybe connect one in a different housing depending on cable lengths. Where that second camera would come from brings me to thought no 2...

Something else I saw to a degree that bothers me is dust inside the optical unit which shows up on pictures. To horrible amounts in some cameras, to noticeable amounts if you look for it in more. Unacceptable to me in either case.
Every second camera had this out of 20. More SD990s than SD890s although I don't know if that is a pattern. At first I thought the sensor gets hold of the dust in some way and the prospect of having to remove the sensor with marking screw positions and counting unscrew rotations made me throw up my hands in despair, that is the one thing besides lens disassembly that I always shied away from, everything else is pretty much in components not less serviceable than a PC only tinier :-) When thinking about it though I realized that the dust is altered by zooming towards some flat surface like the ceiling, so it must rather be inside the lens, probably on one of the rear elements (otherwise it would stay a spot no matter what's projected onto it), maybe that's less impossible to disassemble and blow out with like canned air.

Hence the question: Has anybody successfully done this on some Ixus / SD? I mean I have seen repair places offer this for below a hundred bucks years back so it must be doable with reasonable effort but these days I could get three to five used cameras for that if I can find some. I just dislike the idea of getting rid of that lot and would much rather acquire the skill to fix this - then probably do it twice and settle for knowing that I can but we'll see ;-)

Logged

Koshy had a little ELPH which wasn't white as snow but everywhere that Koshy went the ELPH was sure to go. (actually an SD, but that detail ruins the rhyme...)

reyalp

14080

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #1 on: 11 / April / 2022, 19:29:32 »

Quote from: koshy on 11 / April / 2022, 18:52:38

Something odd happened though and that leads me to my first question to you folks. Three out of like 15 extended the lens made some audible choke and failed with a lens error. I was curious if I could get a FW dump in spite of that but could not.
I get up to the CHDK splash screen can even invoke the CHDK scripting screen, I think but then the cam shuts down. Can that shutdown be thwarted?

Maybe https://chdk.fandom.com/wiki/User:Srsa_4c/Working_with_a_broken_camera#Missing.2C_broken_or_malfunctioning_lens_hardware

Quote

Universal dumper using Canon basic fails as I obviously can't start up in Play mode (the lens error is detected in it, too) and hence can't press the func button at the required time, the cam is already off by then.

There's probably not much need for a firmware dump from these cams, but given the splash screen shows, you could potentially get one with a special CHDK build that does an fwrite as soon as the SD card is available, for example immediately before core_spytask_can_start in the platform/sub boot.c

You could also try doing it with an autostart Lua script. To get the autostart setting set, you could configure it on another camera. You'd need to use native calls like the attached. Note the start address and size may need to be adjusted.

No comment on the dust issue, except it sound like you have enough examples on hand to learn. You could always start with some lens error victims.

Logged

Don't forget what the H stands for.

koshy

1096

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #2 on: 11 / April / 2022, 19:36:40 »

Quote from: reyalp on 11 / April / 2022, 19:29:32

There's probably not much need for a firmware dump from these cams, but given the splash screen shows, you could potentially get one with a special CHDK build that does an fwrite as soon as the SD card is available, for example immediately before core_spytask_can_start in the platform/sub boot.c

Since they went onto the shelf with lens folded in I was just pondering wether some flipped bit could do this, with the pattern emerging that became extremely unlikely as in why on earth should it happen in the same place so basically the universe ruled out the thought already :-) But still there it was.

Logged

Koshy had a little ELPH which wasn't white as snow but everywhere that Koshy went the ELPH was sure to go. (actually an SD, but that detail ruins the rhyme...)

koshy

1096

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #3 on: 11 / April / 2022, 19:37:42 »

Quote from: reyalp on 11 / April / 2022, 19:29:32

You'd need to use native calls like the attached.

Nothing there :-)

Logged

Koshy had a little ELPH which wasn't white as snow but everywhere that Koshy went the ELPH was sure to go. (actually an SD, but that detail ruins the rhyme...)

koshy

1096

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #4 on: 11 / April / 2022, 19:40:57 »

Quote from: reyalp on 11 / April / 2022, 19:29:32

No comment on the dust issue, except it sound like you have enough examples on hand to learn.

Quote from: reyalp on 11 / April / 2022, 19:29:32

You could always start with some lens error victims.

Exactly my thought yes, I'll see. I filed 'em away neatly enough and just thought I'd check for past crowd experience first.

« Last Edit: 11 / April / 2022, 20:44:45 by koshy »

Logged

Koshy had a little ELPH which wasn't white as snow but everywhere that Koshy went the ELPH was sure to go. (actually an SD, but that detail ruins the rhyme...)

reyalp

14080

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #5 on: 11 / April / 2022, 19:56:38 »

Quote from: koshy on 11 / April / 2022, 19:37:42

Quote from: reyalp on 11 / April / 2022, 19:29:32
You'd need to use native calls like the attached.
Nothing there :-)

Might help if I remembered to attach the file

romdump.lua (0.69 kB - downloaded 5 times.)

Logged

Don't forget what the H stands for.

koshy

1096

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #6 on: 11 / April / 2022, 20:02:13 »

Quote from: reyalp on 11 / April / 2022, 19:29:32

Maybe https://chdk.fandom.com/wiki/User:Srsa_4c/Working_with_a_broken_camera#Missing.2C_broken_or_malfunctioning_lens_hardware

Thank you.

So from that

Quote

Cameras released in 2011 or later have special event procedures named EnableLensError, DisableLensError. It is assumed that using DisableLensError could prevent camera shutdown in presence of certain (but not all!) lens related error conditions.

But out of luck, any camera I am really interested in personally was released before 2010 and won't have those procedures. Too bad they were never designed to last...

Logged

Koshy had a little ELPH which wasn't white as snow but everywhere that Koshy went the ELPH was sure to go. (actually an SD, but that detail ruins the rhyme...)

koshy

1096

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #7 on: 11 / April / 2022, 20:19:31 »

Quote from: reyalp on 11 / April / 2022, 19:56:38

Might help if I remembered to attach the file

Wonderful thank you, for the non-broken camera from my pocket that worked just fine. Now I'll get the others...

Logged

Koshy had a little ELPH which wasn't white as snow but everywhere that Koshy went the ELPH was sure to go. (actually an SD, but that detail ruins the rhyme...)

koshy

1096

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #8 on: 11 / April / 2022, 20:39:42 »

That worked like a charm, it does execute the script before the camera shuts down. That is good to know. I take it there is a way to do the canon basic non safe write to some bit address (no need to illustrate) using lua native calls so that a flipped bit could be rectified in the hypothetical case.

More practically, how would I compare the FW dumps in a meaningful way, I know we talked about this before but I think when I encountered the actual flipped but srsa identified the position, that may be wrong it was pre-pandemic and pre-war and all that by a long shot and seems, well, distant.

four_SD990.7z (1794.5 kB - downloaded 5 times.)

Logged

Koshy had a little ELPH which wasn't white as snow but everywhere that Koshy went the ELPH was sure to go. (actually an SD, but that detail ruins the rhyme...)

reyalp

14080

Re: Two Qs sparked by sorting several hands full of SD890 and SD990

« Reply #9 on: 11 / April / 2022, 22:09:12 »

Quote from: koshy on 11 / April / 2022, 20:39:42

I take it there is a way to do the canon basic non safe write to some bit address (no need to illustrate) using lua native calls so that a flipped bit could be rectified in the hypothetical case.

I would probably try to do it from C somewhere early, but if there's a enough time to dump the whole firmware you'd expect it to be possible to do it with a Lua script too.

Quote

More practically, how would I compare the FW dumps in a meaningful way, I know we talked about this before but I think when I encountered the actual flipped but srsa identified the position, that may be wrong it was pre-pandemic and pre-war and all that by a long shot and seems, well, distant.

Use any binary compare to find the offset of the first difference, and then inspect to see if it looks like normal log/adjustment variation or not.

I usually use HxD to compare, but only because I downloaded it a long time ago and it lets you compare and jump to the first difference.

I don't have a specific recipe for the "inspect" part, but generally, normal variation will be near the end of the file, and likely preceded by a large chunk of 0xFF values, and likely aligned to some fairly large value.

For example, your INTACT.BIN and PRIMARY_1.BIN vary at 0x7B0000
I don't immediately recognize that as a log or adjustment block, but it's close enough to the end of the file I'd assume it's OK. The fact that _2 and _3 vary at exactly the same address provides additional confirmation.

The CHDK CRC check should also catch corruption in a large fraction of the ROM.

Logged

Don't forget what the H stands for.