DryOS - some success - page 14 - DryOS Development - CHDK Forum

DryOS - some success

  • 220 Replies
  • 193727 Views
*

Offline ewavr

  • ****
  • 1057
  • A710IS
Re: DryOS - some success
« Reply #130 on: 18 / January / 2008, 08:28:44 »
Advertisements
From your message it look like that A720IS code is done and it will be available soon. I have seen the code from allbest but it has got a lot of stuff and even i wasnt able to understand every thing in it. I have seen your early post too but didnt get in my mind. so what you suggest from where to start.
You don't need to rewrite the entire code - only in platform/your_camera/ and loader/your_camera/ directories. This code is not much different in different builds.
A720 now included in main (Allbest) build - http://tools.assembla.com/chdk/browser/trunk.

*

Offline Cooky_Monster

  • *
  • 5
  • A720IS
Re: DryOS - some success
« Reply #131 on: 18 / January / 2008, 09:04:24 »
From your message it look like that A720IS code is done and it will be available soon. I have seen the code from allbest but it has got a lot of stuff and even i wasnt able to understand every thing in it. I have seen your early post too but didnt get in my mind. so what you suggest from where to start.
You don't need to rewrite the entire code - only in platform/your_camera/ and loader/your_camera/ directories. This code is not much different in different builds.
A720 now included in main (Allbest) build - http://tools.assembla.com/chdk/browser/trunk.


Dear ewavr

Thank you for your message about the build. ok let me clarify this then I have to compile the code myself. right or wrong. and what about the two files like other camera CHDK firmware have......

??

Re: DryOS - some success
« Reply #132 on: 18 / January / 2008, 09:49:02 »
From your message it look like that A720IS code is done and it will be available soon. I have seen the code from allbest but it has got a lot of stuff and even i wasnt able to understand every thing in it. I have seen your early post too but didnt get in my mind. so what you suggest from where to start.
You don't need to rewrite the entire code - only in platform/your_camera/ and loader/your_camera/ directories. This code is not much different in different builds.
A720 now included in main (Allbest) build - http://tools.assembla.com/chdk/browser/trunk.


Very cool.  Can't wait to see the S5 in there.

*

Offline GrAnd

  • ****
  • 916
  • [A610, S3IS]
    • CHDK
Re: DryOS - some success
« Reply #133 on: 18 / January / 2008, 10:08:44 »
Updated DryOS signatures for IDA.
CHDK Developer.

Re: DryOS - some success
« Reply #134 on: 18 / January / 2008, 10:12:49 »
thanks to everyone for all your hard work.

I've been checking this thread daily for the progress on the A720IS and yesterday I tested the port on my camera.

it works great, I'm a newbie to CHDK (and digital photography for that matter) but learning rapidly what my little and cheap camera can do.

*

Offline lukg

  • ***
  • 162
  • Eos 450D+18-55is+55-250is & Powershot S5is - 1.01a
Re: DryOS - some success
« Reply #135 on: 18 / January / 2008, 11:51:16 »
Any progress with S5?   ::)

*

Offline DataGhost

  • ****
  • 314
  • EOS 40D, S5IS
    • DataGhost.com
Re: DryOS - some success
« Reply #136 on: 18 / January / 2008, 16:00:48 »
No, not really. For those of you who don't know, I'm in the middle of a 3-week exam period, so I don't have a lot of time. Also, I don't always feel like programming, so those two events (spare time + feel like) need to coincide before I start working again.
I don't see anyone else working on it, so I guess it all depends on me, heh. Anyway, when I make progress, I will probably announce it, so there is no need to ask every now and then. While it is flattering to see that people are desparately hoping for me to complete this, it does get old quickly.

I can at least give you a bit of a progress update, though... I completed the keymap, basic keyboard support and redirection is working properly (own PhySw task). I still have some issues to work out in actually mapping them to something useful for chdk (it's pretty crowded, though I don't really require all keys, at least not in one variable). Proper hooking of the camera's actual tasks still need to be done, I don't have that yet, and I still haven't found (looked for*) all useful functions.

Re: DryOS - some success
« Reply #137 on: 18 / January / 2008, 16:54:13 »
Hi.

About FI2 and "Update File Error!!!" message.

I checked your FIR for ProductID -- it looks correct (0x315D).

So we need to investigate new encoding scheme and, maybe, new file format.

Does anyone have official PS.FI2 for any model? Learning its structure may help a lot.

Some ideas about cypher scheme:

1. Models a620, s2is and s3is use the same cypher algorithm and the same encryption key.
It appears to lay at the memory address 0xff803fe1 in all three models (it's sounds good for us).
Notice that, AFAIK, the key exists on that address not all the time, but it's appearing there at some special (unknown) moments, so not every dump containts the key.

So, maybe we must search for new key around address 0xff803fe1.

2. WxW models have the special upgrade log ("A/UpgradeLog.txt"). It is created by camera on each (even unsucceful) try of FW upgrading. Content of that log is encrypted, and (that's nice) it is encrypted using the same method and same key.

I tried to find something similar in a720 FW, but it neither makes upgrade log (at least for unsucceful tries), not contains functions, that looks like ones for upgrade process logging.

Nethertheless, if somebody will found such encrypted log somehow, we can try to use it for key RE (since the content of log is predictable).

3. WxW models have a special ("Factory") mode. Nobody can reach it yet (there are some clues saing that we need a special shaped SD-card for accessing the factory mode). Nethertheless, according of FW-dumps, inside factory mode we can run our scripts (files named like "A/*.m"). Actually, we have no prove of it yet, but probably these scripts are encrypted too, and probably the encrypting scheme and the key are the same as above.

At a720 I found factory mode functions, and they almost indentical to WxW models'.
There are:
0xFFC55570 FactoryMode_m_Execute
0xFFAD05A0 ShowScript
0xFFAD0ADC FactoryMode_m_ParseScript

So, we can try to RE these ones and find the place there script decryption take place.

4. I tried to find and decompile function what used to do firmware upgrading.
I found the following things:

There is an interesting function (I called it "FIRhandler") at 0xFFE2CB20.
It calls from itself another function -- Compander_inner (0xFFD0E410) -- it's inner function of some kind of packer/depacker (Compander, 0xFFD0E4E8). The Compander itself is called from some other places.

Compander_inner function contains interesting string "1.1.3.LZC.1.0.1" -- so, we can thing about LZC compressing method (from UNIX COMPRESS, http://en.wikipedia.org/wiki/Compress ).

FIRhandler neightbour function uses another strange string -- "SLSYS+SDS1SKY;b=P" -- i don't know what is it.
Any ideas?

5. At least, since we can run our code from diskboot, we can install some kind of tracer/debugger and try to investigate what happens then we select "Update Firmware" from menu -- this is the way to found and understand all checks of FW-update integrity.

Am i too late? :)

*

Offline intrinsic

  • *
  • 29
  • S5IS
Re: DryOS - some success
« Reply #138 on: 18 / January / 2008, 16:59:39 »
I don't see anyone else working on it, so I guess it all depends on me, heh. Anyway, when I make progress, I will probably announce it, so there is no need to ask every now and then. While it is flattering to see that people are desparately hoping for me to complete this, it does get old quickly.

I'm still in the process of wading through the sources to try to get a better understanding of how things work on both sides of the fence (S5 and CHDK). But unfortunately it's slow going. With luck I'll find some time to go over ewavr's port and this should hopefully help me in figuring out where to go from here, problem is there's so many facets of the thing it's a bit hard to know where to start.

I can at least give you a bit of a progress update, though... I completed the keymap, basic keyboard support and redirection is working properly (own PhySw task). I still have some issues to work out in actually mapping them to something useful for chdk (it's pretty crowded, though I don't really require all keys, at least not in one variable). Proper hooking of the camera's actual tasks still need to be done, I don't have that yet, and I still haven't found (looked for*) all useful functions.

If you could publish a copy of your sources how they stand now that would assist in understanding of (and hopefully progress on) the port.

*

Offline lukg

  • ***
  • 162
  • Eos 450D+18-55is+55-250is & Powershot S5is - 1.01a
Re: DryOS - some success
« Reply #139 on: 18 / January / 2008, 18:43:03 »
No, not really. For those of you who don't know, I'm in the middle of a 3-week exam period, so I don't have a lot of time.

 :D I'm in the middle of exam period too, I can understand you! Good luck with your exams..  :xmas

 

Related Topics


SimplePortal © 2008-2014, SimplePortal