SD870IS Firmware dumping - page 4 - Firmware Dumping - CHDK Forum
« previous next »
Pages: 1 2 3 [4] 5 6 7   Go Down

SD870IS Firmware dumping

  • 60 Replies
  • 30107 Views
*

Offline mlaprise

  • *
  • 23
Re: SD870IS Firmware dumping
« Reply #30 on: 22 / January / 2008, 00:20:44 »
Advertisements
Good work RyeBrye !

About the scroll wheel ... I suspect this scroll wheel to be just a software feature (in fact ...I'm almost sure). When the software detect a successive press of the four-way button in clockwise order or counterclockwise order it simulates a scroll. So .. I don't think the keyboard itself is very different from the other.

And for the OS ... I'm pretty sure this cam have a DryOS firmware.
« Last Edit: 22 / January / 2008, 00:24:53 by mlaprise »
Logged
*

Offline RyeBrye

  • **
  • 73
  • SD-870
Re: SD870IS Firmware dumping
« Reply #31 on: 22 / January / 2008, 01:18:12 »
Yeah, I'd be surprised if this camera didn't have DryOS - well... at least when we get the firmware dumped we can provide yet another dump to help in the DryOS port...

I've got it dumping now via audio - the AF LED works beautifully...

Any chance anyone has the decoder program that you pump the audio file into to get the .bin file? The download link on the wiki seems to point to a broken link.

Yeah - the scroll wheel is software... (and quite annoying, imho)

I'm 33 minutes into my dump now...

It still baffles me how FAR away this AF LED was from the rest... oh well - when this dump comes out it should be fun to pick through :)

Once I get this thing dumped - and assuming someone can supply me with the download for the thing to decode the audio and get the firmware file... I'll post the MD5 of the firmware so that someone else can dump and make sure that they are the same.

Update: Audio dump finished... but I can't do anything with it since the link to the adc.exe is broken :( - Dump took 1 hour and 8 minutes... The waveforms look fantastic - should be an easy thing to process...
« Last Edit: 22 / January / 2008, 01:55:06 by RyeBrye »
Logged
*

Offline Barney Fife

  • *****
  • 1157
    • Gay Outdoorsmen
Re: SD870IS Firmware dumping
« Reply #32 on: 22 / January / 2008, 02:09:37 »
Deleted
« Last Edit: 22 / April / 2008, 09:43:42 by Barney Fife »
Logged
[acseven/admin commented out: please refrain from more direct offensive language to any user. FW complaints to me] I felt it imperative to withdraw my TOTAL participation. Nobody has my permission, nor the right, to reinstate MY posts. Make-do with my quoted text in others' replies only. Bye
*

Offline GrAnd

  • ****
  • 916
  • [A610, S3IS]
    • CHDK
Re: SD870IS Firmware dumping
« Reply #33 on: 22 / January / 2008, 03:05:15 »
Quote from: Barney Fife on 22 / January / 2008, 02:09:37
adc.exe and source is round in the blinker.rar file(s?) at http://grandag.nm.ru/hdk/blinker/
Yeah. The 'blinker.rar'.
Logged
CHDK Developer.
*

Offline Barney Fife

  • *****
  • 1157
    • Gay Outdoorsmen
Re: SD870IS Firmware dumping
« Reply #34 on: 22 / January / 2008, 03:13:38 »
Deleted
« Last Edit: 22 / April / 2008, 09:44:03 by Barney Fife »
Logged
[acseven/admin commented out: please refrain from more direct offensive language to any user. FW complaints to me] I felt it imperative to withdraw my TOTAL participation. Nobody has my permission, nor the right, to reinstate MY posts. Make-do with my quoted text in others' replies only. Bye
*

Offline RyeBrye

  • **
  • 73
  • SD-870
Re: SD870IS Firmware dumping
« Reply #35 on: 22 / January / 2008, 11:04:42 »
Ok... Got the adc.c and I'll compile it and run it today and post the .bin file somewhere. I'm not going to be able to do a second dump until this evening - so if someone else wants to run one we can compare our md5's and make sure our dumps are the same before posting them.
Logged
*

Offline RyeBrye

  • **
  • 73
  • SD-870
Re: SD870IS Firmware dumping
« Reply #36 on: 22 / January / 2008, 13:29:02 »
Ok... I've got the dump file, and I'm running it through ADC... but I'm getting 0 byte dump files...

Here's what I used for my blinker settings:

#define DELAY_SYNC   45
#define DELAY_SPACE  50
#define DELAY0       1
#define DELAY1       25

Here's what I'm trying to use for my ADC settings:

#define ST_SYNC         0
#define ST_BIT          1
#define ST_SPACE        2

#define LEVEL_UNK       0
#define LEVEL_HI        1
#define LEVEL_LO        2

#define LEVEL_THRES_HI  0xA0
#define LEVEL_THRES_LO  0x80

#define LEN_SYNC        5
#define LEN_SPACE       1
#define LEN_0           1
#define LEN_1           6



When I try to run ADC on it, I get this:

000000 [0x0001DBCE]: SYNC ERROR!
000000 [0x0001DBCF]: SYNC ERROR!
000000 [0x0001DBD0]: SYNC ERROR!
... (etc)


If I set the low threshold lower, I get none of the sync errors - but I get a 0-byte dump file coming out.


I think my problem is that my sound card only recorded at 44.1 KHz and the thing obviously requires 96 Khz for capturing it - so it only captured half of the information...

On the wiki, it has capture settings listed off for 9230 baud and 2500 baud and 1600 baud - the 9600 baud and the 2500 baud are both labeled as "96Khz"  - what settings should I use to capture as fast as possible on a 44.1 KHz capture card?

How is the math figured out on those things...? I'll re-run the dump tonight, but would like to know what settings I can use to get the dump done as quickly as is reasonable given a good signal from the AF beam and a 44.1KHz capture card.

Logged
*

Offline GrAnd

  • ****
  • 916
  • [A610, S3IS]
    • CHDK
Re: SD870IS Firmware dumping
« Reply #37 on: 22 / January / 2008, 16:09:55 »
You have to adjust these values:
Code: [Select]
#define LEVEL_THRES_HI  0xA0
#define LEVEL_THRES_LO  0x80

#define LEN_SYNC        5
#define LEN_SPACE       1
#define LEN_0           1
#define LEN_1           6

Look at this picture:


Firstly, set thresholds to cut middle part of signal. The center is usual in 0x80.
For example, if the high signal is about 0xC0 you can try setting LEVEL_THRES_HI to 0xB0.
The same is for lowest value. If the low signal is about 0x40 you can try setting LEVEL_THRES_LO to 0x50.
Also, you can uncomment the following lines in the adc.c:
Code: [Select]
#if 0
            fwrite((lv == LEVEL_HI)?"^":"_",1,1,fo);
            continue;
#endif
After that adc.exe will output the recognized levels like the
"^^^^^^______^^__^^______^__^^______^^_^^...".
This output (you do not need to convert the whole file, a couple kilobytes will enough) could help in adjusting of the rest values.
1) LEN_SYNC  = 5 // Should be larger than the widest SPACE (2) signal, but a little bit smaller than the actual SYNC (1) width.
2) LEN_SPACE = 1 // Can be left as small as possible.
3) LEN_1     = 6 // Should be larger than the widest LEN_0 (4) signal, but a little bit smaller than the actual LEN_1 (3) width.
4) LEN_0     = 1 // The same as for SPACE/SYNC pair. Can be left as small as possible.
Logged
CHDK Developer.
*

Offline Lobo

  • *
  • 4
Re: SD870IS Firmware dumping
« Reply #38 on: 22 / January / 2008, 23:26:39 »
'grats Rye!  If there is anything I can do to help out, divide and conquer or whatever, let me know!
Logged
*

Offline RyeBrye

  • **
  • 73
  • SD-870
Re: SD870IS Firmware dumping
« Reply #39 on: 22 / January / 2008, 23:42:12 »
Thanks GrAnd for the help!

I'm going to try re-dumping it tonight on another machine and see if I can get a better-quality dump to process. I already re-did one dump, but I accidently forgot to modify the dump settings to set the starting address for the IXUS - or change the values from the ones that were already in there (woops)...

This dumping process is harder than I thought it would be :)

When my battery recharges, I'll uncomment the line in the blinker and dump out a ton of 0xAA with the same settings I use for the dump - because I think that the 0xAA will make calibrating the adc file a lot easier...

Given that I can only work on it in the evenings, that I only have 1 battery, and that it takes a few hours to run each dump... It might be a few days before I get the dump out :)

(I might try using a different photo transistor too... the one I am using right now is very angle sensitive and if it moves slightly, the signal amplitude changes wildly)

UPDATE: Ok... The battery obviously wasn't fully discharged because it fully charged in about 15 minutes. I'm redoing another dump with the 2500 baud settings and I can visually see the difference between the 0's and the 1's (I put in some 0xAA's at the beginning of the dump instead of just the other character data there...)  - So, I'll let this run overnight and will definitely get something that will be easy to process...
 
« Last Edit: 23 / January / 2008, 00:09:49 by RyeBrye »
Logged
Pages: 1 2 3 [4] 5 6 7   Go Up
« previous next »
 

Related Topics


SimplePortal © 2008-2014, SimplePortal