supplierdeeply

40D 1.0.8 Dump Available

  • 34 Replies
  • 11537 Views
*

ASalina

  • Publish
    Re: 40D 1.0.8 Dump Available
    « Reply #30 on: 18 / June / 2008, 13:16:24 »
    Advertisements
    40D 1.0.8 function name list #2.

    This file includes the function names from 40D108_FLIST_P1.TXT and so it replaces that file. I've done my best to avoid making up my own names, but in a few cases I had to to minimize my own confusion.

    489 functions names so far. Only ~1500 to go :-)




  • Publish
    Re: 40D 1.0.8 Dump Available
    « Reply #31 on: 19 / June / 2008, 04:16:53 »
    Hi,

    Here are my function names. I focussed mainly on the menu structures and loading and storing of camera properties.
    Some interesting addresses are

    FF9A34E4 Create_DialogBox; as it already explains this is where all Dialog boxes are created.

    FF931B08 Start_submenu. This function is called when a submenu has to be displayed an executed. The switch statement inside will accept 46 values.

    0   Quality
    1   Red Eye
    2   Beep
    3   NoCF = Shoot without card
    4   Review Time
    5   ---------------------------------- what happens here ?? ----------------------
    6   AEB
    7   WB
    8   Custom WB
    9   WB BKT
    A   Colorspace
    B   Picture Style
    C   Dust Removal data
    D   Protect
    E   Rotate
    F   Erase All
    10   Print Order
    11   Transfer Order
    12   External Media Backup
    13   Highlight Alert
    14   AF Points Display
    15   Histogram
    16   Autoplay
    17   Auto PowerOff
    18   File Numbering
    19   Auto Rotate
    1A   Info Button
    1B   Format
    1C   LAN / WFT settings
    1D   Card Extension ?? Recording function + Media Select ??
    1E   Press SET button ?? / LCD brightness
    1F   Date /Time
    20   Language
    21   Video
    22   Sensor Cleaning
    23   Live View
    24   Flash Control
    25   CamSetupSave
    26   Clear Settings
    27   FirmVersion
    28   ---------------------------------- what happens here ?? ----------------------
    29   C.Fn 1 menu
    2A   C.Fn 2 menu
    2B   C.Fn 3 menu
    2C   C.Fn 4 menu
    2D   Clear Custom Functions

    The menu's are build and destroyed at
    FF930BEC Build_all_menu_tabs

    When the menu's are build I also found memory location where camera properties where stored.
    One interesting location 0x3F48. This is where the mode of the camera is stored (P, TV, AV, Landscape etc).
    This is used in the sub FF866DBC GetModeZoneData_FF866DBC_0_Adv_1_Basic.
    The result of this function
    0=Basic Zone (landscape, sports etc)
    1=Creative Zone (P. TV, AV etc)

    So I made some Get_xxx and Set Setxxx subs where camera properties are retrieved/stored. The list is by far not complete.
    So far I found the following memory locations

    0x2944   Mirror down Status
    0x37FC   JpegSize Compression
    0x3DF8   Quick review
    0x3F48   Camera Mode
    0x3FBC   (JPEG) Compresson L
    0x3FC1   (JPEG) Compresson M1
    0x3FC4   (JPEG) Compresson M2
    0x3FC8   JPEG Size Compression
    0x3FCC   Red-Eye reduction
    0x3FD0   Beep
    0x3FD4   No Card Release
    0x3FE0   AEB value
    0x3FE4   COMP
    0x3FE8   something with WB
    0x3FEC   something with WB Gui WB PC Valid ?
    0x3FF0   WBS GM
    0x3FF4   WBS BA
    0x3FF8   WBB GM
    0x3FFC   WBB BA
    0x4000   Color Space
    0x4004   WB Mode
    0x4008   Flavor Mode
    0x4108   Display AF Points
    0x410C   Histogram
    0x4110   Highlight Alert
    0x4114   Auto Power Off
    0x4118   Language
    0x411C   Auto Rotate
    0x4120   File Numbering Mode
    0x4124   Video System
    0x4128   PTP
    0x412C   LCD brightness
    0x4130   DateStyle
    0x4194   Custom WB number
    0x4198   Set PC WB number
    0x419C   Active Sweep mode
    0x41A4   Active Sweep status
    0x41A8   Electric Shutter
    0x41B4   LiveView
    0x41B8   LiveView Grid
    0x41BC   LiveView Timer
    0x41C4   LiveView Output device State
    0x41D4   Studio ISO COMP
    0x13218   AsDoneRecord
    0x13220   InfoButtonShoot
    0x13278   Param Cfn-1 menu
    0x13280   Param Cfn-2 menu
    0x13288   Param Cfn-3 menu
    0x13290   Param Cfn-4 menu


    I am now trying to find out how the strings are loaded into the dialog boxes so I can determine whet the AF Micro adjustment is located. At the end if the BIN File there are reference to many lenses (FFF60164 "EF14mm f/2.8L USM",0)
    I located some strings with a substrings "afshift" which might be related.

    I think that the location "FF86F6DC DPU_DirectPrinting_FF86F6DC" is executed when the useless direct print button is pressed. Maybe we can reprogram that and make it useful.

    so far so good  :)
    « Last Edit: 19 / June / 2008, 04:19:34 by emklap »

  • Publish
    Re: 40D 1.0.8 Dump Available
    « Reply #32 on: 19 / June / 2008, 08:18:33 »

    489 functions names so far. Only ~1500 to go :-)





    What happens then? :)

    *

    Offline _MAG_

    • *
    • 47
  • Publish
    Re: 40D 1.0.8 Dump Available
    « Reply #33 on: 19 / June / 2008, 09:22:32 »
    i sink need know all functions to work with CHDK.


  • Publish
    Re: 40D 1.0.8 Dump Available
    « Reply #34 on: 19 / October / 2010, 15:32:22 »
    Dear emklap,

    I have learned a lot from your 40D analysis, and work now on the 550D here:
    http://magiclantern.wikia.com/wiki/GUI_menus
    http://magiclantern.wikia.com/wiki/550d_108_StateObjects
    with other people (AJ, Alex, etc...).

    I noticed thanks to the cited post that the 40D and the 400D already have similar functions for the GUI: 'CreateDialogBox' and 'CreateBinarySemaphore', etc...

    do you have a complete understanding of how the GUI is working ? I mean 'WinSys', 'Items', etc ?
    I would like to add menus using Canon functions...
    and how Strings are mapped to StringIDs for example
    See a first work here:
    http://magiclantern.wikia.com/wiki/GUI_StringIDs

    thanks for any clue that can save time in understanding and documenting DryOS and the GUI.

    Identified symbols in 550D (several thousand) are available also on Magic Lantern mailing-list.

    the camera settings are mostly stored in the struct at 0x14c48, see
    http://magiclantern.wikia.com/wiki/Properties
    like a "studio mode" switch ;-)

    thanks again to all people here to share your knowledge.

    Kind regards
     
    Indy


    Hi,

    Here are my function names. I focussed mainly on the menu structures and loading and storing of camera properties.
    Some interesting addresses are

    FF9A34E4 Create_DialogBox; as it already explains this is where all Dialog boxes are created.

    FF931B08 Start_submenu. This function is called when a submenu has to be displayed an executed. The switch statement inside will accept 46 values.

    0   Quality
    1   Red Eye
    2   Beep
    3   NoCF = Shoot without card
    4   Review Time
    5   -- -------------------------------- what happens here ?? ----------------------
    6   AEB
    7   WB
    8   Custom WB
    9   WB BKT
    A   Colorspace
    B   Picture Style
    C   Dust Removal data
    D   Protect
    E   Rotate
    F   Erase All
    10   Print Order
    11   Transfer Order
    12   External Media Backup
    13   Highlight Alert
    14   AF Points Display
    15   Histogram
    16   Autoplay
    17   Auto PowerOff
    18   File Numbering
    19   Auto Rotate
    1A   Info Button
    1B   Format
    1C   LAN / WFT settings
    1D   Card Extension ?? Recording function + Media Select ??
    1E   Press SET button ?? / LCD brightness
    1F   Date /Time
    20   Language
    21   Video
    22   Sensor Cleaning
    23   Live View
    24   Flash Control
    25   CamSetupSave
    26   Clear Settings
    27   FirmVersion
    28   ---------------------------------- what happens here ?? ----------------------
    29   C.Fn 1 menu
    2A   C.Fn 2 menu
    2B   C.Fn 3 menu
    2C   C.Fn 4 menu
    2D   Clear Custom Functions

    The menu's are build and destroyed at
    FF930BEC Build_all_menu_tabs

    When the menu's are build I also found memory location where camera properties where stored.
    One interesting location 0x3F48. This is where the mode of the camera is stored (P, TV, AV, Landscape etc).
    This is used in the sub FF866DBC GetModeZoneData_FF866DBC_0_Adv_1_Basic.
    The result of this function
    0=Basic Zone (landscape, sports etc)
    1=Creative Zone (P. TV, AV etc)

    So I made some Get_xxx and Set Setxxx subs where camera properties are retrieved/stored. The list is by far not complete.
    So far I found the following memory locations

    0x2944   Mirror down Status
    0x37FC   JpegSize Compression
    0x3DF8   Quick review
    0x3F48   Camera Mode
    0x3FBC   (JPEG) Compresson L
    0x3FC1   (JPEG) Compresson M1
    0x3FC4   (JPEG) Compresson M2
    0x3FC8   JPEG Size Compression
    0x3FCC   Red-Eye reduction
    0x3FD0   Beep
    0x3FD4   No Card Release
    0x3FE0   AEB value
    0x3FE4   COMP
    0x3FE8   something with WB
    0x3FEC   something with WB Gui WB PC Valid ?
    0x3FF0   WBS GM
    0x3FF4   WBS BA
    0x3FF8   WBB GM
    0x3FFC   WBB BA
    0x4000   Color Space
    0x4004   WB Mode
    0x4008   Flavor Mode
    0x4108   Display AF Points
    0x410C   Histogram
    0x4110   Highlight Alert
    0x4114   Auto Power Off
    0x4118   Language
    0x411C   Auto Rotate
    0x4120   File Numbering Mode
    0x4124   Video System
    0x4128   PTP
    0x412C   LCD brightness
    0x4130   DateStyle
    0x4194   Custom WB number
    0x4198   Set PC WB number
    0x419C   Active Sweep mode
    0x41A4   Active Sweep status
    0x41A8   Electric Shutter
    0x41B4   LiveView
    0x41B8   LiveView Grid
    0x41BC   LiveView Timer
    0x41C4   LiveView Output device State
    0x41D4   Studio ISO COMP
    0x13218   AsDoneRecord
    0x13220   InfoButtonShoot
    0x13278   Param Cfn-1 menu
    0x13280   Param Cfn-2 menu
    0x13288   Param Cfn-3 menu
    0x13290   Param Cfn-4 menu


    I am now trying to find out how the strings are loaded into the dialog boxes so I can determine whet the AF Micro adjustment is located. At the end if the BIN File there are reference to many lenses (FFF60164 "EF14mm f/2.8L USM",0)
    I located some strings with a substrings "afshift" which might be related.

    I think that the location "FF86F6DC DPU_DirectPrinting_FF86F6DC" is executed when the useless direct print button is pressed. Maybe we can reprogram that and make it useful.

    so far so good  :)

     

    Related Topics