SX120 IS - Firmware Dumping - CHDK Forum

SX120 IS

  • 4 Replies
SX120 IS
« on: 22 / September / 2009, 11:54:09 »

I would like to inform you that I managed to dump firmware from SX120IS. Current udumper does not work on this camera so I had to modify it a bit.

Few facts:
* executing DISKBOOT.BIN is possible after encoding it with `dancingbits' and specifying option '3'
* contrary to what wiki says about SX line, ROM starts at 0xFFC00000 [1]
* led addresses:
Code: [Select]
0xC0220008 FLASH_LAMP
0xC022000C LED_AF
0xC0220010 LED_ORANGE
0xC0220014 LED_GREEN
* link to firmware:

At first I found LED addresses using self-created PS.FI2 file. Few days later dancingbits program was updated with a new encoding method. Executing DISKBOOT.BIN became possible - hurray!

With a thought that blinking would be inevitable, I started playing around with IDA and analyzing CanonIxus95IS_SD1200IS firmware. (I was to lazy to go to shop to buy a photodiode ;P ).

It took me a bit of time to find a real WriteSDCard function... Instead of serching for 'write' string in the binary I should have looked for ',#0x38]' near STR instruction first. These two post gave me a really good hint how to get the bastard.,3347.msg31914.html#msg31914,3347.msg35952.html#msg35952

Here's the code:
Code: (asm) [Select]
ROM:FFC3EE28 uSetPointers                            ; CODE XREF: sub_FFC3F454+34p
ROM:FFC3EE28                                         ; sub_FFC3F5B4+2CFp
ROM:FFC3EE28                 STMFD   SP!, {R4-R6,LR}
ROM:FFC3EE2C                 MOV     R6, R0
ROM:FFC3EE30                 LDR     R0, =0xE2FC ;Somewhere near pointers are stored
ROM:FFC3EE34                 MOV     R5, R1
ROM:FFC3EE38                 ADD     R4, R0, R6,LSL#7


ROM:FFC3EE64                 ADRNE   R0, aMounter_c  ; "Mounter.c"
ROM:FFC3EE68                 BNE     DebugAssert
ROM:FFC3EE6C                 LDR     R0, [R4,#0x70]
ROM:FFC3EE70                 TST     R0, #1
ROM:FFC3EE74                 LDMNEFD SP!, {R4-R6,PC}
ROM:FFC3EE78                 MOV     R0, #3
ROM:FFC3EE7C                 LDR     R1, =sub_FFCE4118
ROM:FFC3EE80                 STR     R0, [R4,#0x3C]
ROM:FFC3EE84                 STR     R1, [R4,#0x4C]
ROM:FFC3EE88                 LDR     R1, =ThisIsIT
ROM:FFC3EE8C                 MOV     R0, #0
ROM:FFC3EE90                 STR     R1, [R4,#0x50]
ROM:FFC3EE94                 LDR     R1, =sub_FFCE4064
ROM:FFC3EE98                 STR     R0, [R4,#0x38]
ROM:FFC3EE9C                 STR     R1, [R4,#0x5C]
ROM:FFC3EEA0                 STR     R0, [R4,#0x60]
ROM:FFC3EEA4                 LDR     R0, =sub_FFCE46D4
ROM:FFC3EEA8                 STR     R0, [R4,#0x64]
ROM:FFC3EEAC                 LDR     R0, =sub_FFCE4744
ROM:FFC3EEB0                 STR     R0, [R4,#0x68]
ROM:FFC3EEB4                 LDMFD   SP!, {R4-R6,PC}
ROM:FFC3EEB4 ; End of function uSetPointers

Unfortunately, changed udumper code did not work - address could not be found:
Code: (c) [Select]
for (i=0x1900;i<0xF0000;i+=4)
if ((*(unsigned int*)(i+0x60)==0) &&
(*(unsigned int*)(i+0x38)==0) &&
(*(unsigned int*)(i+0x3C)==3) &&
(*(unsigned int*)(i+0x4C)>MIN_ADDRESS) &&
(*(unsigned int*)(i+0x50)>MIN_ADDRESS) ) {

                        wr=(f_w)*(unsigned int*)(i+0x50);


if you look a bit harder into the firmware code you will find:

Code: (asm) [Select]
ROM:FFC3EEDC dword_FFC3EEDC  DCD 0x53A               ; DATA XREF: uSetPointers+34r
ROM:FFC3EEE0 aMounter_c      DCB "Mounter.c",0       ; DATA XREF: uSetPointers+3Co
ROM:FFC3EEE0                                         ; sub_FFC3EF84+154oo ...
ROM:FFC3EEEA                 DCB    0
ROM:FFC3EEEB                 DCB    0
ROM:FFC3EEEC off_FFC3EEEC    DCD sub_FFCE4118        ; DATA XREF: uSetPointers+54r
ROM:FFC3EEF0 off_FFC3EEF0    DCD ThisIsIT            ; DATA XREF: uSetPointers+60r

Code: [Select]
[gajownik@zuzia tmp]$ grep Mounter CanonIxus95IS_SD1200IS.bin.strings
ffc3eee0 Mounter.c
[gajownik@zuzia tmp]$

Mounter.c is uniq and 0x10 bytes later we have a pointer to our function! :)

I compiled attached code at 1 AM, inserted SD card into camera with a trembling hands and a minute later there was a big smile on my face :]

If someone would like to test it on his/her camera, binary can be found in the attachment (dumps from 0xFFC00000 though).

And now for something completely different. On systems with /bin/sh set to ksh ./chdk/tools/ does not work:
Code: [Select]
gajownik@hydra:~/chdk/chdk/tools$ make
pakwif.c -> pakwif.o
pakwif.o -> pakwif
gensig.c -> gensig.o
gensig.o -> gensig
-> signatures_vxworks.h
./[9]: syntax error: `(' unexpected
make: *** [signatures_vxworks.h] B??d 1

Here's a fix:

Code: [Select]
gajownik@hydra:~/chdk/chdk/tools$ LC_ALL=C svn diff
---  (revision 803)
+++  (working copy)
@@ -1,4 +1,4 @@



Hope that helps.

Oh, BTW is processor really little endian?

[1] I discovered it by blinking out first 3 bytes of "gaonisoyP" string with a fantastic speed of 1bit per 5 seconds ;)
"Trying is the first step towards failure." (Homer Simpson)


Offline fe50

  • ******
  • 3147
  • IXUS50 & 860, SX10 Star WARs-Star RAWs
    • fe50
Re: SX120 IS
« Reply #1 on: 22 / September / 2009, 15:20:52 »
Hello & welcome, gajownik !
Congratulations, a really good start into the CHDK universe :D !
Good luck for porting this camera...

I've added your dump to the CHDK dump repository...[1]

Re: SX120 IS
« Reply #2 on: 04 / December / 2009, 03:03:42 »
I can program a bit, but I know nothing about assembly. I wish I could help.

I just bought a SX120 IS in hopes of there being firmware for it one day. Is all the work done in linux? I'd like to help but how? Anyone have any advice? If anyone was working on this but lost interest I just want you to know there is definite interest in this topic.

I hate to sound like some fledgling flopping around on the internet, but could someone point me in the right direction? Thanks.  :)


Offline reyalp

  • ******
  • 14086
Re: SX120 IS
« Reply #3 on: 04 / December / 2009, 03:32:18 »
Don't forget what the H stands for.

Re: SX120 IS
« Reply #4 on: 08 / August / 2010, 11:25:12 »

sorry for the probably naive question: Do you think that your modifications would also help to dump the IXUS 110 IS - SD960 firmware, where the standard udumper fails, see ? Or is this completely unrelated?

I have a IXUS 110IS and could try it, if you think that there is some hope ;)


Related Topics

SimplePortal 2.3.6 © 2008-2014, SimplePortal