40D 1.0.8 Dump Available

  • 34 Replies
  • 11727 Views
*

ASalina

Re: 40D 1.0.8 Dump Available
« Reply #30 on: 18 / June / 2008, 13:16:24 »
Advertisements
40D 1.0.8 function name list #2.

This file includes the function names from 40D108_FLIST_P1.TXT and so it replaces that file. I've done my best to avoid making up my own names, but in a few cases I had to to minimize my own confusion.

489 functions names so far. Only ~1500 to go :-)




Re: 40D 1.0.8 Dump Available
« Reply #31 on: 19 / June / 2008, 04:16:53 »
Hi,

Here are my function names. I focussed mainly on the menu structures and loading and storing of camera properties.
Some interesting addresses are

FF9A34E4 Create_DialogBox; as it already explains this is where all Dialog boxes are created.

FF931B08 Start_submenu. This function is called when a submenu has to be displayed an executed. The switch statement inside will accept 46 values.

0   Quality
1   Red Eye
2   Beep
3   NoCF = Shoot without card
4   Review Time
5   ---------------------------------- what happens here ?? ----------------------
6   AEB
7   WB
8   Custom WB
9   WB BKT
A   Colorspace
B   Picture Style
C   Dust Removal data
D   Protect
E   Rotate
F   Erase All
10   Print Order
11   Transfer Order
12   External Media Backup
13   Highlight Alert
14   AF Points Display
15   Histogram
16   Autoplay
17   Auto PowerOff
18   File Numbering
19   Auto Rotate
1A   Info Button
1B   Format
1C   LAN / WFT settings
1D   Card Extension ?? Recording function + Media Select ??
1E   Press SET button ?? / LCD brightness
1F   Date /Time
20   Language
21   Video
22   Sensor Cleaning
23   Live View
24   Flash Control
25   CamSetupSave
26   Clear Settings
27   FirmVersion
28   ---------------------------------- what happens here ?? ----------------------
29   C.Fn 1 menu
2A   C.Fn 2 menu
2B   C.Fn 3 menu
2C   C.Fn 4 menu
2D   Clear Custom Functions

The menu's are build and destroyed at
FF930BEC Build_all_menu_tabs

When the menu's are build I also found memory location where camera properties where stored.
One interesting location 0x3F48. This is where the mode of the camera is stored (P, TV, AV, Landscape etc).
This is used in the sub FF866DBC GetModeZoneData_FF866DBC_0_Adv_1_Basic.
The result of this function
0=Basic Zone (landscape, sports etc)
1=Creative Zone (P. TV, AV etc)

So I made some Get_xxx and Set Setxxx subs where camera properties are retrieved/stored. The list is by far not complete.
So far I found the following memory locations

0x2944   Mirror down Status
0x37FC   JpegSize Compression
0x3DF8   Quick review
0x3F48   Camera Mode
0x3FBC   (JPEG) Compresson L
0x3FC1   (JPEG) Compresson M1
0x3FC4   (JPEG) Compresson M2
0x3FC8   JPEG Size Compression
0x3FCC   Red-Eye reduction
0x3FD0   Beep
0x3FD4   No Card Release
0x3FE0   AEB value
0x3FE4   COMP
0x3FE8   something with WB
0x3FEC   something with WB Gui WB PC Valid ?
0x3FF0   WBS GM
0x3FF4   WBS BA
0x3FF8   WBB GM
0x3FFC   WBB BA
0x4000   Color Space
0x4004   WB Mode
0x4008   Flavor Mode
0x4108   Display AF Points
0x410C   Histogram
0x4110   Highlight Alert
0x4114   Auto Power Off
0x4118   Language
0x411C   Auto Rotate
0x4120   File Numbering Mode
0x4124   Video System
0x4128   PTP
0x412C   LCD brightness
0x4130   DateStyle
0x4194   Custom WB number
0x4198   Set PC WB number
0x419C   Active Sweep mode
0x41A4   Active Sweep status
0x41A8   Electric Shutter
0x41B4   LiveView
0x41B8   LiveView Grid
0x41BC   LiveView Timer
0x41C4   LiveView Output device State
0x41D4   Studio ISO COMP
0x13218   AsDoneRecord
0x13220   InfoButtonShoot
0x13278   Param Cfn-1 menu
0x13280   Param Cfn-2 menu
0x13288   Param Cfn-3 menu
0x13290   Param Cfn-4 menu


I am now trying to find out how the strings are loaded into the dialog boxes so I can determine whet the AF Micro adjustment is located. At the end if the BIN File there are reference to many lenses (FFF60164 "EF14mm f/2.8L USM",0)
I located some strings with a substrings "afshift" which might be related.

I think that the location "FF86F6DC DPU_DirectPrinting_FF86F6DC" is executed when the useless direct print button is pressed. Maybe we can reprogram that and make it useful.

so far so good  :)
« Last Edit: 19 / June / 2008, 04:19:34 by emklap »

Re: 40D 1.0.8 Dump Available
« Reply #32 on: 19 / June / 2008, 08:18:33 »

489 functions names so far. Only ~1500 to go :-)





What happens then? :)

*

Offline _MAG_

  • *
  • 47
Re: 40D 1.0.8 Dump Available
« Reply #33 on: 19 / June / 2008, 09:22:32 »
i sink need know all functions to work with CHDK.


Re: 40D 1.0.8 Dump Available
« Reply #34 on: 19 / October / 2010, 15:32:22 »
Dear emklap,

I have learned a lot from your 40D analysis, and work now on the 550D here:
http://magiclantern.wikia.com/wiki/GUI_menus
http://magiclantern.wikia.com/wiki/550d_108_StateObjects
with other people (AJ, Alex, etc...).

I noticed thanks to the cited post that the 40D and the 400D already have similar functions for the GUI: 'CreateDialogBox' and 'CreateBinarySemaphore', etc...

do you have a complete understanding of how the GUI is working ? I mean 'WinSys', 'Items', etc ?
I would like to add menus using Canon functions...
and how Strings are mapped to StringIDs for example
See a first work here:
http://magiclantern.wikia.com/wiki/GUI_StringIDs

thanks for any clue that can save time in understanding and documenting DryOS and the GUI.

Identified symbols in 550D (several thousand) are available also on Magic Lantern mailing-list.

the camera settings are mostly stored in the struct at 0x14c48, see
http://magiclantern.wikia.com/wiki/Properties
like a "studio mode" switch ;-)

thanks again to all people here to share your knowledge.

Kind regards
 
Indy


Hi,

Here are my function names. I focussed mainly on the menu structures and loading and storing of camera properties.
Some interesting addresses are

FF9A34E4 Create_DialogBox; as it already explains this is where all Dialog boxes are created.

FF931B08 Start_submenu. This function is called when a submenu has to be displayed an executed. The switch statement inside will accept 46 values.

0   Quality
1   Red Eye
2   Beep
3   NoCF = Shoot without card
4   Review Time
5   -- -------------------------------- what happens here ?? ----------------------
6   AEB
7   WB
8   Custom WB
9   WB BKT
A   Colorspace
B   Picture Style
C   Dust Removal data
D   Protect
E   Rotate
F   Erase All
10   Print Order
11   Transfer Order
12   External Media Backup
13   Highlight Alert
14   AF Points Display
15   Histogram
16   Autoplay
17   Auto PowerOff
18   File Numbering
19   Auto Rotate
1A   Info Button
1B   Format
1C   LAN / WFT settings
1D   Card Extension ?? Recording function + Media Select ??
1E   Press SET button ?? / LCD brightness
1F   Date /Time
20   Language
21   Video
22   Sensor Cleaning
23   Live View
24   Flash Control
25   CamSetupSave
26   Clear Settings
27   FirmVersion
28   ---------------------------------- what happens here ?? ----------------------
29   C.Fn 1 menu
2A   C.Fn 2 menu
2B   C.Fn 3 menu
2C   C.Fn 4 menu
2D   Clear Custom Functions

The menu's are build and destroyed at
FF930BEC Build_all_menu_tabs

When the menu's are build I also found memory location where camera properties where stored.
One interesting location 0x3F48. This is where the mode of the camera is stored (P, TV, AV, Landscape etc).
This is used in the sub FF866DBC GetModeZoneData_FF866DBC_0_Adv_1_Basic.
The result of this function
0=Basic Zone (landscape, sports etc)
1=Creative Zone (P. TV, AV etc)

So I made some Get_xxx and Set Setxxx subs where camera properties are retrieved/stored. The list is by far not complete.
So far I found the following memory locations

0x2944   Mirror down Status
0x37FC   JpegSize Compression
0x3DF8   Quick review
0x3F48   Camera Mode
0x3FBC   (JPEG) Compresson L
0x3FC1   (JPEG) Compresson M1
0x3FC4   (JPEG) Compresson M2
0x3FC8   JPEG Size Compression
0x3FCC   Red-Eye reduction
0x3FD0   Beep
0x3FD4   No Card Release
0x3FE0   AEB value
0x3FE4   COMP
0x3FE8   something with WB
0x3FEC   something with WB Gui WB PC Valid ?
0x3FF0   WBS GM
0x3FF4   WBS BA
0x3FF8   WBB GM
0x3FFC   WBB BA
0x4000   Color Space
0x4004   WB Mode
0x4008   Flavor Mode
0x4108   Display AF Points
0x410C   Histogram
0x4110   Highlight Alert
0x4114   Auto Power Off
0x4118   Language
0x411C   Auto Rotate
0x4120   File Numbering Mode
0x4124   Video System
0x4128   PTP
0x412C   LCD brightness
0x4130   DateStyle
0x4194   Custom WB number
0x4198   Set PC WB number
0x419C   Active Sweep mode
0x41A4   Active Sweep status
0x41A8   Electric Shutter
0x41B4   LiveView
0x41B8   LiveView Grid
0x41BC   LiveView Timer
0x41C4   LiveView Output device State
0x41D4   Studio ISO COMP
0x13218   AsDoneRecord
0x13220   InfoButtonShoot
0x13278   Param Cfn-1 menu
0x13280   Param Cfn-2 menu
0x13288   Param Cfn-3 menu
0x13290   Param Cfn-4 menu


I am now trying to find out how the strings are loaded into the dialog boxes so I can determine whet the AF Micro adjustment is located. At the end if the BIN File there are reference to many lenses (FFF60164 "EF14mm f/2.8L USM",0)
I located some strings with a substrings "afshift" which might be related.

I think that the location "FF86F6DC DPU_DirectPrinting_FF86F6DC" is executed when the useless direct print button is pressed. Maybe we can reprogram that and make it useful.

so far so good  :)

 

Related Topics