IXUS 130 (SD1400 IS) Porting Thread

emlyn

« on: 12 / April / 2010, 08:57:47 »

Advertisements

I recently bought an IXUS130 (I believe its called SD1400 IS in the USA) to complement my DSLR, as I wanted something portable that I could keep with me at all times. I was originally planning on getting either an S90, but that was slightly above my budget, or something with CHDK already available. However everything I could find with CHDK already ported was both more expensive, and with fewer features than the newer models, so in the end I decided on the IXUS130 as it is very compact and also does HD video, so it can replace my camcorder.

I would really like to get CHDK working on it, but I have no experience porting (or even using) it. I think the first step is to dump the firmware, so I first tried with udumper:
I formatted a 128 MB SD card in the camera, made it bootable using the instructions from:
http://scruss.com/blog/2010/01/10/perhaps-a-slightly-easier-way-to-make-sd-cards-bootable-for-chdk-under-os-x/
then I copied the diskboot.bin and empty.dum files from udumper to the SD card.
With both diskboot.bin files (for VxWorks and DryOS) the camera would just boot normally then display "Memory card locked".
Then I found CardTricks - I couldn't get my SD card to mount in a Windows VM, but I found a newdryos.bin file which I renamed to diskboot.bin and copied to the SD card. With this one the camera crashes when I switch it on, which I understand is expected behaviour, but nothing is changed on the SD card, the empty.dum file is still entirely zeroes.

I'm not sure what else I can try with udumper, so I think I'll have to start looking into blinking. If I understand correctly, I'll have to get a compiler toolchain set up (presumably the same that is used to compile CHDK?), and find the addresses of the LEDs.

If anyone is able to offer any help, it would be very much appreciated, but in any case I'll try to keep this thread updated with any progress I make. Just don't expect things to go very fast, as I don't have a lot of time to spend on this.

Logged

ERR99

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #1 on: 12 / April / 2010, 10:12:47 »

For dumping the firmware, you can try the modified G11 udumper on your camera, maybe it works, maybe not. But its worth a try.

http://chdk.setepontos.com/index.php/topic,4647.msg46175.html#msg46175

Logged

emlyn

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #2 on: 12 / April / 2010, 10:46:53 »

Thanks for the help. I tried copying the linked diskboot.bin file to my SD card, and the camera tries to load it (i.e. it doesn't boot up normally), but no LEDs flash (in the thread it says they should), and nothing is written to the SD card.
It looks like blinking is the way to go...

Logged

emlyn

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #3 on: 27 / April / 2010, 04:43:29 »

Logged

ERR99

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #4 on: 27 / April / 2010, 04:55:44 »

Quote from: emlyn on 12 / April / 2010, 10:46:53

Thanks for the help. I tried copying the linked diskboot.bin file to my SD card, and the camera tries to load it (i.e. it doesn't boot up normally), but no LEDs flash (in the thread it says they should), and nothing is written to the SD card.
It looks like blinking is the way to go...

Could you please try the attached file instead of the G11 udumper?
It is the same code (but with removed led code) and it is encoded with dancingbits option 2 (instead 3).
Maybe this on is working on your camera. So please create again a newdryos udumper disk with cardtricks and then replace the diskboot.bin on the sd-card with the attached file. Then start the camera with it, wait 1-2 Minutes and then check the empty.dum file on the sd-card for any strings with cardtricks.

Logged

emlyn

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #5 on: 27 / April / 2010, 07:27:15 »

I tried the attached DISKBOOT.BIN, but I get the same result as always (camera hangs, but nothing is changed on the card).

From other threads I got the impression that the newer cameras use a different encoding, which is why I thought FI2 might be the way to go.

I have been powering on the camera in play mode (as I read in the instructions), but it seems that some cameras need to be powered on with the power button, not the play button, so I will try all the dumpers again that way, maybe I'll get lucky...

Thanks again for your help,
Emlyn

Logged

emlyn

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #6 on: 21 / May / 2010, 03:31:54 »

Just a quick update - unfortunately not very good news.
I've tried the 3 different dancing bits encodings, but none of them give any response, and I've tried creating a .FI2 file with the G10 key/iv but it isn't accepted either.
It seems a number of new cameras are in the same situation (http://chdk.setepontos.com/index.php?topic=5045.0) - they use a different dancing bits encoding and a new FI2 key.
So if I understand correctly, the only avenues now are either to wait for a firmware update from Canon, which may be quite some time, or find an exploitable bug in the firmware by looking at the firmware from similar cameras, which I don't have the time or the experience to do myself...

Logged

emlyn

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #7 on: 18 / August / 2010, 05:25:43 »

We have a firmware dump! (see http://chdk.setepontos.com/index.php/topic,5045.msg53846.html#msg53846)
Reyalp has also added a 4th dancing bits encoding for new cameras, and it works on the Ixus 130!
I've found the address of the front AF LED (0xC0223030), but have so far been unable to find the address of the rear LED (although I can switch it on with the CBasic LEDDrive function).

So now I guess it's time to look into IDA...

Logged

emlyn

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #8 on: 19 / August / 2010, 10:39:05 »

Neither the free version, nor the demo version of IDA Pro are any good for this, and I'm not about to spend more than 400 Euros for the full version...
I played around with ARMu, and using the DryOS Porting wiki page, was able to find lots of functions, but it gets a bit tedious after 100 or so, when what I am doing manually is probably all automated in the IDA scripts...

But at least it helped me find the rear LED at address 0xC0220130, MEMBASEADDR=0x1900 and MEMISOSTART=0x14FE20.

Logged

reyalp

11336

Re: IXUS 130 (SD1400 IS) Porting Thread

« Reply #9 on: 19 / August / 2010, 12:23:47 »

You don't need to find all the functions in the disassembler. Start using the finsig/gensig in the CHDK build process. See http://chdk.wikia.com/wiki/Signature_finder

See also http://chdk.wikia.com/wiki/GPL_Tools This (among other things) explains how to turn your dump into an ELF that you can feed to the demo version of IDA.

The dryos porting page is quite old, it dates from when dryos cameras were first being ported. http://chdk.wikia.com/wiki/Adding_support_for_a_new_camera is probably the best place to start.

Logged

Don't forget what the H stands for.