PowerShot SX210 IS - Porting Thread

  • 588 Replies
  • 170153 Views
Re: PowerShot SX210 IS - Porting Thread
« Reply #30 on: 25 / May / 2010, 04:39:39 »
Advertisements
There is much simpler way to check that code is running.
You should do the following:
1. Check signature at 0xFF810004 - if equals "gaonisoy", jump to 0xFF810000
2. Check signature at 0xFFC00004 - if equals "gaonisoy", jump to 0xFFC00000
3. No luck, but almost impossible
So if the code is running - camera will start as usual, if no - it will hang.

I think it's possible to bruteforce dancingbits key if someone will generate 4K variations of encoded file and post them somewhere on the forum to allow people try and report result for every file.
4K is not so much if many people will try to check them.

Re: PowerShot SX210 IS - Porting Thread
« Reply #31 on: 25 / May / 2010, 11:24:33 »
Ummmm, won't this just result in a boot loop?

When you jump to 0xff810000/C0 doesn't it then go and check the bootimg file and if the SD is locked run the bootimg file...repeat?

Therefor it will look like a crash just like a crash will?  - Edit here

Harpo
Canon Models - SD300, SD780, & SX210

*

Offline whoever

  • ****
  • 280
  • IXUS950
Re: PowerShot SX210 IS - Porting Thread
« Reply #32 on: 25 / May / 2010, 11:47:23 »
you should be able to test this theory with an already hacked camera. If it works on another digic 4 camera, chances are high it will work on the current ones.
I could, if I had a digic 4 camera. Of course, I can try with my Ixus, but I'm pretty sure somebody (ewavr?) verified it worked back then, -- it's somewhere in the TX1 thread. (They might've used a small series resistor to increase sensitivity.)

Ummmm, won't this just result in a boot loop?
Therefor it will look like a crash just like a crash will?  - Edit here
Yes it will.

Re: PowerShot SX210 IS - Porting Thread
« Reply #33 on: 25 / May / 2010, 13:54:49 »
Edit - Had brain far_t  (did you know this word is banned?).  My idea is invalid.

Harpo
« Last Edit: 25 / May / 2010, 22:20:19 by HarpoMa »
Canon Models - SD300, SD780, & SX210


Re: PowerShot SX210 IS - Porting Thread
« Reply #34 on: 26 / May / 2010, 06:08:26 »
When you jump to 0xff810000/C0 doesn't it then go and check the bootimg file and if the SD is locked run the bootimg file...repeat?
Yes, it will... I've missed this.

Re: PowerShot SX210 IS - Porting Thread
« Reply #35 on: 28 / May / 2010, 14:31:20 »
One more suggestion.
NOTE! This all is untested, because I have VxWorks camera - nowhere to test.
It looks like we can create script disk.
To create script disk - create file called script.req on SD card and write the string "for DC_scriptdisk" without quotes to it.
Then format card using camera and you should have scriptdisk prepared.
Or just write string "SCRIPT" at offset 0x1F0 in the bootsector - this is the same.

By the way - same for bootdisk.
To create bootdisk - create file called boot.req on SD card and write the string "for DC_bootdisk" without quotes to it.
Then format card using camera and you should have bootdisk prepared.

Then create script file A/autotest.m and lock the card to tell the camera to run it at startup (maybe lock is not required, I'm not sure).
It looks like this script file is plaintext and is not encoded, it just should start with zero byte.
I.e. <0> <plaintext script>
From this script you should be able to call any registered eventproc, so you can enter factory mode with SetFactoryMode and leave it using ClearFactoryMode.
In factory mode camera will load and start A/BootFAEXE.bin at startup, so we will be able to perform the dump if we will place the dumper with this name on card.

Or maybe if someone could contact service engineer on personal (non official) basis and get servicing diskboot.bin or upgrader.bin (resque loader) - this certainly will help.
The key could be bruteforced easy enough.

[--- added ---]
Failed here too :(
Digged more deeply and saw that BootFAEXE.bin is encoded with the same key as DiskBoot.bin
Looks like the only way to go is to make hardware ROM dump or try to contact service in unofficial basis...
« Last Edit: 28 / May / 2010, 15:19:01 by cppasm »

*

Offline reyalp

  • ******
  • 11496
Re: PowerShot SX210 IS - Porting Thread
« Reply #36 on: 28 / May / 2010, 21:44:46 »
If you can actually run a canon script, you should good to go. In a worst case, there's peek and poke functions (you probably have to call some eventproc registration functions to get them.)

However, I'm pretty sure it was previously determined that the scripts need to be encoded somehow too.
Don't forget what the H stands for.

*

Offline whoever

  • ****
  • 280
  • IXUS950
Re: PowerShot SX210 IS - Porting Thread
« Reply #37 on: 30 / May / 2010, 02:11:04 »
NOTE! This all is untested, because I have VxWorks camera - nowhere to test.
It looks like we can create script disk.
To create script disk - create file called script.req on SD card and write the string "for DC_scriptdisk" without quotes to it.
Then format card using camera and you should have scriptdisk prepared.
Or just write string "SCRIPT" at offset 0x1F0 in the bootsector - this is the same.

Then create script file A/autotest.m and lock the card to tell the camera to run it at startup (maybe lock is not required, I'm not sure).
It looks like this script file is plaintext and is not encoded, it just should start with zero byte.
I.e. <0> <plaintext script>
Can you confirm it works like that on your VxWorks camera? It doesn't work on mine.

This, on the other hand, does work as advertised. The script apparently gets loaded and parsed: if I put there some gibberish, the cam shuts down, and if valid code (I tried "exit"), it doesn't.

Maybe it is indeed encoded in later cameras, though I don't recall anybody experimenting with it.

In any event, there's a long way between being able to load a script with unknown syntax, and being able to execute useful code.


*

Offline reyalp

  • ******
  • 11496
Re: PowerShot SX210 IS - Porting Thread
« Reply #38 on: 30 / May / 2010, 03:50:40 »
Quote
In any event, there's a long way between being able to load a script with unknown syntax, and being able to execute useful code.
Capturing the camera console and/or romlog may provide some hints on script errors.
Don't forget what the H stands for.

Re: PowerShot SX210 IS - Porting Thread
« Reply #39 on: 30 / May / 2010, 12:49:06 »
Scripts was one entry point I tried but didn't know about the <0> byte at the start.
Canon Models - SD300, SD780, & SX210

 

Related Topics