Current status- led addresses are correct
- CreateTask address should be correct
- all other addresses if found should be correct
- Compiled against current trunk 462
- port is based on Canon IXUS 850IS / SD800 source from current trunk (VxWorks 5.5)
also changed:
todo:
- capt_seq.c
- movie_rec.c
- a lot more...
loader\ixus900_sd900\resetcode\main.ccamera restarts, used "generic" digic reset code.
platform\ixus900_sd900\sub\100c\boot.cboot()
OKh_usrInit()
OKh_usrKernelInit()
STOPSixus900_sd900 source v2 *BETA*makefile.inc#0x3115
PLATFORMID=12565
PLATFORMOS=vxworks
MEMBASEADDR=0x1900
#MEMENDADDR=0xFFB7A63F # end of ROM
RESTARTSTART=0x50000
MEMISOSTART=0xA4D10 # ROM:FF8117A8 function h_usrKernelInit
MEMISOSIZE=0x40000 # space reserved for chdk, current default 0x40000 could be too small for some community builds... , try 0x4D000 or 0x50000
ROMBASEADDR=0xFF810000
should be correct.
camera.h#elif defined (CAMERA_ixus900_sd900)
#define CAM_PROPSET 1
#define CAM_RAW_ROWPIX 3736 // for 10 MP, 3648px + 88px = 3736 RAW, differents in RAW ?
#define CAM_RAW_ROWS 2772 // for 10 MP, 2736px + 36px = 2772 RAW, differents in RAW ?
//#undef CAM_USE_ZOOM_FOR_MF
//#undef CAM_HAS_ERASE_BUTTON
//#undef CAM_HAS_IRIS_DIAPHRAGM
//#define CAM_HAS_ND_FILTER 1
//#undef CAM_HAS_MANUAL_FOCUS
//#undef CAM_HAS_USER_TV_MODES
//#define CAM_SHOW_OSD_IN_SHOOT_MENU 1
//#define CAM_AF_SCAN_DURING_VIDEO_RECORD 1
//#undef CAM_FEATURE_FEATHER // Cameras with "feather" or touch wheel.
//#undef CAM_CONSOLE_LOG_ENABLED // Development: internal camera stdout -> A/stdout.txt
i'm not shure how determ this before camera boots... so disabled for now.
Is there some information other than source about camera.h ?
boot.c...
#define DELAY 10000000 // delay for turn led on / off
#define LED_BLUE 0xC02200C4 // led in print/share button (blue, backside)
...
void boot() {
long *canon_data_src = (void*)0xFFB6DA44; // ROM:FFB6DA44 , address of string "start of data"
long *canon_data_dst = (void*)0x1900; // generic
//long canon_data_len = 0xFFB7A63F - 0xFFB6DA44; // size from string "start of data" ROM:FFB6DA44 to end of Firmware at ROM:FFB7A63F
long canon_data_len = 0xCBFB; // size from string "start of data" ROM:FFB6DA44 to end of Firmware at ROM:FFB7A63F, 0xFFB7A63F - 0xFFB6DA44 = 0xCBFB
long *canon_bss_start = (void*)0xE4FB; // 0xCBFB + 0x1900 = 0xE4FB
long canon_bss_len = 0xA4D10 - 0xE4FB; // kernelInit at ROM:FFB64AAC , R2 before original kernelInit (MEMISOSTART) minus bss_start
long i;
// ROM:FF8100E4 , same as SD800
asm volatile (
"MRC p15, 0, R0,c1,c0\n"
"ORR R0, R0, #0x1000\n"
"ORR R0, R0, #4\n"
"ORR R0, R0, #1\n"
"MCR p15, 0, R0,c1,c0\n"
:::"r0"
);
for(i=0;i<canon_data_len/4;i++)
canon_data_dst[i]=canon_data_src[i];
for(i=0;i<canon_bss_len/4;i++)
canon_bss_start[i]=0;
// ROM:FF81015C , same as SD800
asm volatile (
"MRC p15, 0, R0,c1,c0\n"
"ORR R0, R0, #0x1000\n"
"BIC R0, R0, #4\n"
"ORR R0, R0, #1\n"
"MCR p15, 0, R0,c1,c0\n"
:::"r0"
);
h_usrInit();
}
void h_usrInit() {
// ROM:FF81198C
asm volatile (
"STR LR, [SP,#-4]!\n"
"BL sub_FF811968\n"
"MOV R0, #2\n"
"MOV R1, R0\n"
"BL sub_FFB54584\n"
"BL sub_FFB46DF8\n" // excVecInit
"BL sub_FF8111C4\n" // sysInitStack
"BL sub_FF811728\n"
"LDR LR, [SP],#4\n"
"B h_usrKernelInit\n" // important !
);
}
void h_usrKernelInit() {
int counter;
volatile long *ledBlue = (void*)LED_BLUE;
counter = DELAY; *ledBlue = 0x46; while (counter--) { asm("nop\n nop\n"); };
counter = DELAY; *ledBlue = 0x44; while (counter--) { asm("nop\n nop\n"); };
// ### CAMERA STOPS SOMEWHERE BELOW
// ### all addresses should be correct
// ### also try to change them with different effects like reboot or just loop in h_usrKernelInit()
// ROM:FF811744
asm volatile (
"STMFD SP!, {R4,LR}\n"
"SUB SP, SP, #8\n"
"BL sub_FFB54A84\n" // classLibInit
"BL sub_FFB6786C\n" // taskLibInit
"LDR R3, =0xD520\n"
"LDR R2, =0xA1960\n"
"LDR R1, [R3]\n"
"LDR R0, =0xA46D0\n"
"MOV R3, #0x100\n"
"BL sub_FFB6097C\n" // qInit
"LDR R3, =0xD4E0\n"
"LDR R0, =0xDD28\n"
"LDR R1, [R3]\n"
"BL sub_FFB6097C\n" // qInit
"LDR R3, =0xD59C\n"
"LDR R0, =0xA46A4\n"
"LDR R1, [R3]\n"
"BL sub_FFB6097C\n" // qInit
"BL sub_FFB6BC28\n" // workQInit
"BL sub_FF8112AC\n"
"MOV R4, #0\n"
"MOV R3, R0\n"
"MOV R12, #0x800\n"
"LDR R0, =h_usrRoot\n" // important !!
"MOV R1, #0x4000\n"
//"LDR R2, =0xA4D10\n" // DEBUG: original firmware call to MEMISOSTART, disable below "LDR R2, =new_sa\n"
"LDR R2, =new_sa\n" // skip some memory for later use with CHDK, MEMISOSTART 0xA4D10 + MEMISOSIZE 0x40000 = 0xD4D10
"LDR R2, [R2]\n" // helps "LDR R2, =new_sa\n"
"STR R12, [SP]\n"
"STR R4, [SP,#4]\n"
"BL sub_FFB64AAC\n" // kernelInit
"ADD SP, SP, #8\n"
"LDMFD SP!, {R4,PC}\n"
);
}
static long drv_struct[16];
static long dh_err() {
return -1;
}
static void drv_self_hide() {
long drvnum;
drvnum = _iosDrvInstall(dh_err,dh_err,dh_err,dh_err,dh_err,dh_err,dh_err);
if (drvnum >= 0)
_iosDevAdd(drv_struct, "A/DISKBOOT.BIN", drvnum);
}
void h_usrRoot() {
int counter;
volatile long *ledBlue = (void*)LED_BLUE;
volatile long *ledOra = (void*)LED_ORA;
counter = DELAY; *ledOra = 0x46; while (counter--) { asm("nop\n nop\n"); };
counter = DELAY; *ledBlue = 0x46; while (counter--) { asm("nop\n nop\n"); };
counter = DELAY; *ledBlue = 0x44; while (counter--) { asm("nop\n nop\n"); };
// ROM:FF811A60
asm volatile ( // generic ?
"STMFD SP!, {R4,R5,LR}\n"
"MOV R5, R0\n"
"MOV R4, R1\n"
"BL sub_FF8119D0\n"
"MOV R1, R4\n"
"MOV R0, R5\n"
"BL sub_FFB59718\n" // memInit
"MOV R1, R4\n"
"MOV R0, R5\n"
"BL sub_FFB5A190\n" // memPartLibInit
"BL sub_FF8117E8\n" // nullsub_1 , required ?
"BL sub_FF811704\n"
"BL sub_FF811A0C\n"
"BL sub_FF8119F0\n"
"BL sub_FF811A38\n"
"BL sub_FF8119C4\n"
);
counter = DELAY; *ledBlue = 0x46; while (counter--) { asm("nop\n nop\n"); };
counter = DELAY; *ledBlue = 0x44; while (counter--) { asm("nop\n nop\n"); };
_taskCreateHookAdd(createHook);
_taskDeleteHookAdd(deleteHook);
counter = DELAY; *ledBlue = 0x46; while (counter--) { asm("nop\n nop\n"); };
counter = DELAY; *ledBlue = 0x44; while (counter--) { asm("nop\n nop\n"); };
drv_self_hide();
counter = DELAY; *ledAf = 0x46; while (counter--) { asm("nop\n nop\n"); };
counter = DELAY; *ledAf = 0x44; while (counter--) { asm("nop\n nop\n"); };
counter = DELAY; *ledBlue = 0x46; while (counter--) { asm("nop\n nop\n"); };
counter = DELAY; *ledBlue = 0x44; while (counter--) { asm("nop\n nop\n"); };
// ROM:FF811AA4 , search for "B taskcreate_Startup" , same as SD800
asm volatile (
"LDMFD SP!, {R4,R5,LR}\n"
"B sub_FF81136C\n" // IsEmptyWriteCache_2
);
}
stubs_entry.S// !!! THIS FILE IS GENERATED. DO NOT EDIT. !!!
#include "stubs_asm.h"
NSTUB(AllocateMemory, 0xff811ab0)
NSTUB(AllocateUncacheableMemory, 0xff814ea0)
NSTUB(Close, 0xff87b584)
NSTUB(CreatePhysicalVram, 0xff95a7d0)
NSTUB(CreateTask, 0xff822594)
NSTUB(CreateTaskStrict, 0xff823634)
NSTUB(DisableDispatch, 0xff8223b8)
// Best match: 93%
NSTUB(DisplayImagePhysicalScreen, 0xff959a60)
// ALT: NSTUB(DisplayImagePhysicalScreen, 0xff959a60) // 29/2
NSTUB(EnableDispatch, 0xff822444)
NSTUB(ExecuteEventProcedure, 0xff816d3c)
NSTUB(ExitTask, 0xff822954)
NSTUB(Fclose_Fut, 0xff8745b8)
NSTUB(Fopen_Fut, 0xff874578)
NSTUB(Fread_Fut, 0xff874674)
NSTUB(FreeMemory, 0xff811abc)
NSTUB(FreeUncacheableMemory, 0xff814ed4)
NSTUB(Fseek_Fut, 0xff874768)
NSTUB(Fwrite_Fut, 0xff8746c8)
NSTUB(GetCurrentAvValue, 0xffb0cf4c)
// ALT: NSTUB(GetCurrentAvValue, 0xffb0f210) // 13/0
NSTUB(GetCurrentTargetDistance, 0xffb0f1b8)
// Best match: 96%
NSTUB(GetFocusLensSubjectDistance, 0xffb01594)
// Best match: 57%
NSTUB(GetFocusLensSubjectDistanceFromLens, 0xffb01b48)
NSTUB(GetParameterData, 0xff9ad67c)
// Best match: 92%
NSTUB(GetPropertyCase, 0xff8258c8)
// Best match: 96%
NSTUB(GetSystemTime, 0xff8150d8)
// ALT: NSTUB(GetSystemTime, 0xff8150d8) // 26/1
// Best match: 93%
NSTUB(GetZoomLensCurrentPoint, 0xffaf1c64)
// ALT: NSTUB(GetZoomLensCurrentPoint, 0xffaf1c64) // 27/2
// Best match: 93%
NSTUB(GetZoomLensCurrentPosition, 0xffaf1c78)
// ALT: NSTUB(GetZoomLensCurrentPosition, 0xffaf1c78) // 27/2
NSTUB(IsStrobeChargeCompleted, 0xff93033c)
NSTUB(LockMainPower, 0xff9a8814)
NSTUB(MakeDirectory, 0xff87b898)
// Best match: 90%
NSTUB(Mount_FileSystem, 0xff87a8ac)
// ALT: NSTUB(Mount_FileSystem, 0xff87a8ac) // 27/3
// Best match: 96%
NSTUB(MoveFocusLensToDistance, 0xffb0f458)
NSTUB(MoveZoomLensWithPoint, 0xffaf1b44)
// ALT: NSTUB(MoveZoomLensWithPoint, 0xffaf1b44) // 25/0
NSTUB(Open, 0xff87b55c)
// Best match: 96%
NSTUB(PhySw_testgpio, 0xff8292c4)
NSTUB(ProtectFile, 0xff873b68)
// Best match: 92%
NSTUB(PutInNdFilter, 0xffb0d140)
// ALT: NSTUB(PutInNdFilter, 0xffb0d140) // 25/2
// Best match: 94%
NSTUB(PutOutNdFilter, 0xffb0d188)
// ALT: NSTUB(PutOutNdFilter, 0xffb0d188) // 16/1
NSTUB(Read, 0xff87b618)
NSTUB(RefreshPhysicalScreen, 0xff9be650)
NSTUB(Remove, 0xff87b5a4)
NSTUB(SetAutoShutdownTime, 0xff9a8718)
NSTUB(SetParameterData, 0xff9ad59c)
NSTUB(SetPropertyCase, 0xff825778)
NSTUB(SleepTask, 0xff8224a8)
NSTUB(TakeSemaphore, 0xff821fa4)
NSTUB(UnlockMainPower, 0xff9a88ac)
NSTUB(Unmount_FileSystem, 0xff87a950)
// Best match: 89%
NSTUB(UnsetZoomForMovie, 0xff9e59f8)
NSTUB(UpdateMBROnFlash, 0xff87aaa4)
// Best match: 96%
NSTUB(VbattGet, 0xff82e420)
NSTUB(Write, 0xff87b624)
NSTUB(_log, 0xffb4cfc0)
// ALT: NSTUB(_log, 0xffb4cfc0) // 27/0
NSTUB(_log10, 0xffb49044)
// ALT: NSTUB(_log10, 0xffb49044) // 27/0
NSTUB(_pow, 0xffb491cc)
// ALT: NSTUB(_pow, 0xffb491cc) // 25/0
NSTUB(_sqrt, 0xffb4b3bc)
// ALT: NSTUB(_sqrt, 0xffb4b3bc) // 24/0
NSTUB(chdir, 0xffb5823c)
// ALT: NSTUB(chdir, 0xffb5823c) // 27/0
NSTUB(close, 0xffb57b7c)
NSTUB(closedir, 0xffb55004)
// ERROR: free is not found!
NSTUB(ints_disable, 0xff81e2d0)
NSTUB(ints_enable, 0xff81e2dc)
NSTUB(ioctl, 0xffb57cbc)
NSTUB(iosDevAdd, 0xffb58d9c)
NSTUB(iosDrvInstall, 0xffb59060)
NSTUB(isalpha, 0xffb4ef78)
// ALT: NSTUB(isalpha, 0xffb4ef78) // 4/0
NSTUB(isdigit, 0xffb4efa8)
// ALT: NSTUB(isdigit, 0xffb4efa8) // 4/0
NSTUB(islower, 0xffb4efd8)
// ALT: NSTUB(islower, 0xffb4efd8) // 4/0
NSTUB(isspace, 0xffb4f020)
// ALT: NSTUB(isspace, 0xffb4f020) // 4/0
NSTUB(isupper, 0xffb4f038)
// ALT: NSTUB(isupper, 0xffb4f038) // 4/0
NSTUB(kbd_p1_f, 0xff827f58)
NSTUB(kbd_p1_f_cont, 0xff827f64)
NSTUB(kbd_p2_f, 0xff82833c)
// Best match: 83%
NSTUB(kbd_pwr_off, 0xff829280)
// ALT: NSTUB(kbd_pwr_off, 0xff82929c) // 5/1
// ALT: NSTUB(kbd_pwr_off, 0xff82b484) // 5/1
// ALT: NSTUB(kbd_pwr_off, 0xff82b4a0) // 5/1
// Best match: 55%
NSTUB(kbd_pwr_on, 0xff95b7c4)
// ALT: NSTUB(kbd_pwr_on, 0xff95b7f0) // 5/4
// ERROR: kbd_read_keys_r2 is not found!
// Best match: 93%
NSTUB(localtime, 0xffb537f8)
NSTUB(lseek, 0xffb57cc0)
// Best match: 53%
NSTUB(malloc, 0xffb5abbc)
// ALT: NSTUB(malloc, 0xffb5abbc) // 15/13
NSTUB(memcmp, 0xffb52bd8)
// ALT: NSTUB(memcmp, 0xffb5ed7c) // 9/0
NSTUB(memcpy, 0xffb52c14)
NSTUB(memset, 0xffb52c8c)
NSTUB(mkdir, 0xff87b7dc)
NSTUB(open, 0xffb581c0)
NSTUB(opendir, 0xffb55038)
NSTUB(qsort, 0xffb52438)
NSTUB(rand, 0xffb5245c)
// ALT: NSTUB(rand, 0xffb5245c) // 8/0
NSTUB(read, 0xffb57bdc)
NSTUB(readdir, 0xffb54fd0)
NSTUB(rename, 0xffb581c8)
// ALT: NSTUB(rename, 0xffb581c8) // 26/0
NSTUB(rewinddir, 0xffb54ff8)
NSTUB(srand, 0xffb52480)
// ALT: NSTUB(srand, 0xffb52480) // 4/0
NSTUB(stat, 0xffb550cc)
NSTUB(strcat, 0xffb52cac)
NSTUB(strchr, 0xffb52cd8)
NSTUB(strcmp, 0xffb52cfc)
NSTUB(strcpy, 0xffb52e90)
NSTUB(strlen, 0xffb52ff4)
NSTUB(strncmp, 0xffb53058)
NSTUB(strncpy, 0xffb5309c)
// ALT: NSTUB(strncpy, 0xffb5309c) // 24/0
NSTUB(strpbrk, 0xffb530e4)
NSTUB(strrchr, 0xffb53120)
// ALT: NSTUB(strrchr, 0xffb53120) // 8/0
NSTUB(strtol, 0xffb52874)
NSTUB(taskCreateHookAdd, 0xffb5d81c)
NSTUB(taskDeleteHookAdd, 0xffb5d758)
// Best match: 82%
NSTUB(taskIdListGet, 0xffb677e4)
NSTUB(taskLock, 0xffb67ea0)
NSTUB(taskName, 0xffb676dc)
NSTUB(taskResume, 0xffb67ac0)
NSTUB(taskSuspend, 0xffb678ec)
NSTUB(taskUnlock, 0xffb67f48)
NSTUB(time, 0xffb54544)
// ALT: NSTUB(time, 0xffb54544) // 25/0
NSTUB(utime, 0xffb55160)
// ALT: NSTUB(utime, 0xffb55160) // 26/0
NSTUB(vsprintf, 0xffb56924)
NSTUB(write, 0xffb57c4c)
stubs_entry_2.S#include "stubs_asm.h"
// search your fw dump, look at stubs_entry.S & stubs_entry_ida.S (execute scan-event-procedures.idc in ida to create)
NHSTUB(MFOn, 0xFF993A30) // ###
NHSTUB(MFOff, 0xFF993A28) // ###
//NHSTUB(Close, 0xFF81B118) // note "Close" / "aClose" ###
//NHSTUB(DisplayImagePhysicalScreen, 0xFF95F73C) // note "ImgDDev.c" / aImgddev_c ### ?
//NHSTUB(Mount_FileSystem, 0xFF879010) // note "Mounter.c" / aMounter_c ###
//NHSTUB(Remove, 0xFFAA2FDC) // note "remove" ?
//NHSTUB(Read, 0xFFAA3050) // after Remove ?
//NHSTUB(Write, 0xFFAA305C) // after Read ?
NHSTUB(free, 0xFF92BA0C) // ?
//NSTUB(kbd_p1_f, 0xFF8280BC) // ###
//NSTUB(kbd_p1_f_cont, 0xffa37128) // ?
//NSTUB(kbd_p2_f, 0xffa3754c) // ?
//NHSTUB(kbd_pwr_off, 0xFF828188) // ###
//NHSTUB(kbd_pwr_on, 0xFF828188) // not found
NHSTUB(kbd_read_keys_r2, 0xFF828D40) // search for "MOVL R4, 0x223000"
//NHSTUB(AllocateMemory, 0xff81ac70) // ###=0xFF81B614 ?
//NHSTUB(FreeMemory, 0xFF81B61C) // ### ?
//NHSTUB(SetPropertyCase, 0xFF8255E4) // see "PropertyCase.c" and refs to it ### ?
// null stub (RET):
//NHSTUB(SetZoomActuatorSpeedPercent, 0xFF9B4BA4) // nullsub_100 ?
NHSTUB(SetZoomActuatorSpeedPercent, 0xFFFFFFFF) // dummy, not found yet
NHSTUB(GetDrive_ClusterSize, 0xFF87B430) // note "GetCatFs_ClusterSize" ###
NHSTUB(GetDrive_TotalClusters, 0xFF87B440) // note "GetCatFs_TotalClusters" ###
NHSTUB(GetDrive_FreeClusters, 0xFF87B454) // note "GetCatFs_FreeClusters" ###
//NHSTUB(UnsetZoomForMovie, 0xFF83656C)
// NHSTUB(WriteSDCard, 0xFFAB536C)
NHSTUB(WriteSDCard, 0xFFFFFFFF) // dummy, not found yet
//NHSTUB(ExpCtrlTool_StopContiAE, 0xFF971658)
NHSTUB(ExpCtrlTool_StopContiAE, 0xFFFFFFFF) // dummy, not found yet
//NHSTUB(ExpCtrlTool_StartContiAE, 0xFF971628)
NHSTUB(ExpCtrlTool_StartContiAE, 0xFFFFFFFF) // dummy, not found yet
//NHSTUB(MakeAFScan, 0xFFB0ECB0)
NHSTUB(MakeAFScan, 0xFFFFFFFF) // dummy, not found yet
// --- has ALT in stubs_entry.S
NSTUB(GetCurrentAvValue, 0xffb0f210)
NSTUB(kbd_pwr_on, 0xff95b7f0)
for most addresses i also tested alternate addresses from stubs_entry.S and stubs_entry_ida.S .
Get Source v2 *BETA*
here.
Get Firmware 1.00C dump
here from
paul.luminos.nl.
Please, acould somebody with better asm skills have a look at this? I know it's not easy if you ain't got the camera in your hands... also i'm aware of that most devs are working on DryOs stuff.
Maybe i missed something important or some addresses are wrong. I double checked everything twice, but there must be still some errors !!!
Thank you very much for your afford and time spend on help me out !!!p::d