40D Disk Dumping. More Trials - page 3 - DSLR Hack development - CHDK Forum

40D Disk Dumping. More Trials

  • 50 Replies
  • 40726 Views
*

Offline mx3

  • ****
  • 372
Re: 40D Disk Dumping. More Trials
« Reply #20 on: 11 / June / 2008, 06:00:45 »
Advertisements
int (*ft_creat)(char *nm,int flg);
ft_create create= (ft_create) 0x00989A44;
skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler

*

ASalina

Re: 40D Disk Dumping. More Trials
« Reply #21 on: 11 / June / 2008, 06:02:46 »
Ok, open() is returning a negative number.

create empty file
also it is possible to add function create

Ok.

Same result. LED came on.

*

ASalina

Re: 40D Disk Dumping. More Trials
« Reply #22 on: 11 / June / 2008, 06:08:25 »
int (*ft_creat)(char *nm,int flg);
ft_create create= (ft_create) 0x00989A44;


fd still no good...

Should I remove empty dump.dmp and try again?

Update: removed dump.dmp. Same result. fd < 0.
« Last Edit: 11 / June / 2008, 06:13:40 by ASalina »

*

ASalina

Re: 40D Disk Dumping. More Trials
« Reply #23 on: 11 / June / 2008, 06:18:27 »
BTW: The CF Drive LED flashes (disk access) in every one of these tests. I don't know what that means. Could the CF card be write protected in software during an upgrade?

Update:
I just tried to open a file O_RDONLY. I put another empty dump.dmp on the card.
Still getting fd < 0.
« Last Edit: 11 / June / 2008, 06:35:58 by ASalina »


*

Offline mx3

  • ****
  • 372
Re: 40D Disk Dumping. More Trials
« Reply #24 on: 11 / June / 2008, 06:56:12 »
try
A/DUMP.BIN

maybe cf card mounted as B or C?
B/DUMP.BIN
B:/DUMP.BIN

C/DUMP.BIN
C:/DUMP.BIN

and maybe add Sleep(1000) before open ( no sense in it but why not to try?)

typedef void (*ft_SleepTask)(long msec);
ft_SleepTask SleepTask=(ft_SleepTask) 0x0095BB84;
SleepTask(1000);

skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler

*

Offline DataGhost

  • ****
  • 314
  • EOS 40D, S5IS
    • DataGhost.com
Re: 40D Disk Dumping. More Trials
« Reply #25 on: 11 / June / 2008, 07:05:13 »
Write protected? That's possible, yes. I did some quick digging and though I can't guarantee anything, I think I found a piece of pretty independent code which will tell you if the card is write protected or not. sub_91C774(long *wp) (called on ROM:91BCFC) should return 1 (protected) or 0 (not protected) in wp.

I found this by backtracking from the string [CF]         WriteProtect=%d, RotatingDevice=%d, which is not identified by itself (IDA identified WriteProtect........ and not the preceding [CF] with lots of spaces and tabs). That string is referenced at ROM:918B08 and then sent to some (probably) kind of printing/logging routine, which seems to have all it's arguments on the stack. Strings without values get five null values written on the stack anyway, and this one as R10 written as the first stack variable. R10 is assigned from R2 (ROM:918AD0) which is assigned from the calling routine (ROM:91C008 and further back) by "LDR R2, [SP,#0x20]". Right before calling sub_91C774 I was talking about, "ADD R0, SP, #0x20" happens and inside sub_91C774 a value is written into (effective) [R0].

Just in case anyone wants to backtrack/verify my findings before blindly executing something which I'm not 100% sure of it does only what it suggests and actually works.

mx3: I'm pretty sure the A:/ (with colon) syntax is correct, I saw this string in the firmware, prepended to some 'input filename, please' result and then fed into open(). Maybe the drive number is different indeed. I also saw some references to B:.

*

ASalina

Re: 40D Disk Dumping. More Trials
« Reply #26 on: 11 / June / 2008, 07:25:15 »
@Dataghost

Ok, I just tried opening O_RDONLY the existing file DUMP.DMP with the path "A:/DUMP.DMP" and the LED did not light!
This means that the retruned fd > 0!

We're making progress!

Next, I'll try the full dumper program.

*

Offline mx3

  • ****
  • 372
Re: 40D Disk Dumping. More Trials
« Reply #27 on: 11 / June / 2008, 07:33:49 »
try permisions 0644 instead 0777
skype: max_dtc. ICQ: 125985663, email: win.drivers(at)gmail, eVB decompiler


*

ASalina

Re: 40D Disk Dumping. More Trials
« Reply #28 on: 11 / June / 2008, 07:34:58 »
I GOT THE DUMP!!!

ls -l /mnt/cfcard

-rwxr-xr-x    1 as as 8388608 1999-12-31 23:00 dump.dmp*

I'll find a place to share it ASAP!

*

Offline DataGhost

  • ****
  • 314
  • EOS 40D, S5IS
    • DataGhost.com
Re: 40D Disk Dumping. More Trials
« Reply #29 on: 11 / June / 2008, 07:39:18 »
Nice work, how did you do it?
You can host the dump on zshare, for example.

 

Related Topics