A495 porting thread

  • 346 Replies
  • 47712 Views
Re: A495 porting thread
« Reply #210 on: 03 / June / 2011, 06:13:43 »
Advertisements
« Last Edit: 03 / June / 2011, 06:20:18 by HankeyPoo »

*

Offline whim

  • ******
  • 2013
  • A495/590/620/630 ixus70/115/220/230/300/870 S95
Re: A495 porting thread
« Reply #211 on: 03 / June / 2011, 06:33:23 »

Re: A495 porting thread
« Reply #212 on: 03 / June / 2011, 06:56:27 »
thx for the help !

but i have formatet the card with cardtricks :(

Re: A495 porting thread
« Reply #213 on: 03 / June / 2011, 10:49:18 »
please someone with 100F firmware: does the video work for you? if so, which chdk version should i use. thank you, jose


Re: A495 porting thread
« Reply #214 on: 03 / June / 2011, 21:58:20 »
Okay - final beta release for all reported A495 cameras.   Please let me know if they boot and run and I will submit for inclusion in the autobuild server.

CHDK A495 firmware 1.00d Beta 2 : A495 1.00d
CHDK A495 firmware 1.00e Beta 2 : A495 1.00e
CHDK A495 firmware 1.00f Beta 2  : A495 1.00f


 8)
« Last Edit: 03 / June / 2011, 22:26:11 by waterwingz »

Re: A495 porting thread
« Reply #215 on: 03 / June / 2011, 22:00:11 »
please someone with 100F firmware: does the video work for you? if so, which chdk version should i use. thank you, jose
I'd suggest the one posted right above.

*

Offline philmoz

  • *****
  • 2936
    • Photos
Re: A495 porting thread
« Reply #216 on: 03 / June / 2011, 22:25:48 »
Follow-up - I think I've got it down to six stubs entries that may not be correct.  That's a lot more managable - I'll pick away at them over the next couple of days when I have a few minutes.  For what its worth,  the questionable stubs are :
Code: [Select]
kbd_read_keys_r2()  <- 1st instruction is a Branch to somewhere else
leddrive()                 <- different code that my reference port
qsort()                     <- not a proper subroutine - will crash if called
readfastdir()             <- different code that my reference port
time()                      <- different code that my reference port
writesdcard()            <- nulsub in the A495 ports

If you're still looking for these here are the values my new signature finder has found:
Code: [Select]
                     1.00d       1.00e       1.00f
kbd_read_keys_r2    0xffc42fb0  0xffc42fb0  0xffc42fb0
LEDDrive            0xffc42bc4  0xffc42bc4  0xffc42bc4
qsort               0xffe3c190  0xffe3c240  0xffe3c194
ReadFastDir         0xffdebbf4  0xffdebca4  0xffdebbf8
time                0xffc633e4  0xffc63434  0xffc63434
WriteSDCard         0xffcfcb1c  0xffcfcbcc  0xffcfcbcc

Phil.

CHDK ports:
  sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
  g12 (1.00c, 1.00e, 1.00f & 1.00g)
  sx130is (1.01d & 1.01f)
  ixus310hs (1.00a & 1.01a)
  sx40hs (1.00d, 1.00g & 1.00i)
  g1x (1.00e, 1.00f & 1.00g)

Re: A495 porting thread
« Reply #217 on: 03 / June / 2011, 22:28:07 »
If you're still looking for these here are the values my new signature finder has found:
Phil.
Thanks Phil.  I'll take a look - silly me to think I just posted the "final" beta version.

Any chance you can fish for :

NHSTUB(PutInNdFilter, 0xFFC00B20)
NHSTUB(PutOutNdFilter, 0xFFC00B20)   

EDIT 1  :  4 of 6 match what I had right away - off to look at the other two.
EDIT 2  :  5th stub is the same - the A495F version is a Branch instruction that jumps right away to the address you found
                  6th stub is the same except for using 2 different registers to do the same thing (see below)



« Last Edit: 03 / June / 2011, 22:58:47 by waterwingz »


Re: A495 porting thread
« Reply #218 on: 03 / June / 2011, 22:52:27 »
@philmoz :   I think we need a new thread for your tool.  Or paste it on the end of the CHDK-PT thread ?

So,  here's an interesting challenge.   The address you posted for WriteSDCard versus the one I found.  Different addresses - identical code except for how it uses two registers - R5 vs R6 and R6 vs R7.

Code: [Select]
void __attribute__((naked,noinline)) sub_FFCFCBCC_my(  ) {
asm volatile (
" STMFD SP!, {R0-R11,LR} \n"              
" LDR R0, =0x5118 \n"                      
" SUB SP, SP, #0xC \n"                    
" MOV R11, R2 \n"                          
" LDR R2, [SP, #0xC] \n"                  
" LDR R0, [R0, #8] \n"                    
" MOV R9, #0 \n"                          
" CMP R2, R0 \n"                          
" MOV R5, #2 \n"                          
" BEQ loc_FFCFCC24 \n"                    
" MOV R0, #0x80 \n"                        
" BL sub_FFC06084 \n"                      
" LDR R0, [SP, #0xC] \n"                  
" BL sub_FFCFC31C \n"                      
" MOV R4, R0 \n"                          
" MOV R0, #0x80 \n"                        
" BL sub_FFC0602C \n"                      
" CMP R4, #0 \n"                          
" BEQ loc_FFCFCC5C \n"                    
" LDR R0, =0x5118 \n"                      
" LDR R2, [SP, #0xC] \n"                  
" STR R2, [R0, #8] \n"                    
"loc_FFCFCC24:\n"
" LDR R1, =0x6CE80 \n"                    
" LDR R2, [SP, #0xC] \n"                  
" LDR R6, [SP, #0x10] \n"                  
" ADD R10, R1, R2, LSL #5 \n"              
" LDR R1, [R10, #0x14] \n"                
" ADD R0, R6, R11 \n"                      
" CMP R0, R1 \n"                          
" BHI loc_FFCFCC5C \n"                    
" LDR R1, [R10, #0x10] \n"                
" CMP R1, #1 \n"                          
" LDREQ R6, [SP, #0x10] \n"                
" BEQ sub_FFCFCC70 \n"                    
" CMP R0, #0x800000 \n"                    
" BLS loc_FFCFCC68 \n"                    
"loc_FFCFCC5C:\n"
" MOV R0, #1 \n"                          
" ADD SP, SP, #0x1C \n"                    
" LDMFD SP!, {R4-R11,PC} \n"              
);
}

Code: [Select]
void __attribute__((naked,noinline)) sub_FFCFC9E8_my(  ) {
asm volatile (
" STMFD SP!, {R0-R11,LR} \n"              
" LDR R0, =0x5118 \n"                      
" SUB SP, SP, #0xC \n"                    
" MOV R11, R2 \n"                          
" LDR R2, [SP, #0xC] \n"                  
" LDR R0, [R0, #8] \n"                    
" MOV R9, #0 \n"                          
" CMP R2, R0 \n"                          
" MOV R6, #2 \n"                          
" BEQ loc_FFCFCA40 \n"                    
" MOV R0, #0x80 \n"                        
" BL sub_FFC06084 \n"                      
" LDR R0, [SP, #0xC] \n"                  
" BL sub_FFCFC31C \n"                      
" MOV R4, R0 \n"                          
" MOV R0, #0x80 \n"                        
" BL sub_FFC0602C \n"                      
" CMP R4, #0 \n"                          
" BEQ loc_FFCFCA78 \n"                    
" LDR R0, =0x5118 \n"                      
" LDR R2, [SP, #0xC] \n"                  
" STR R2, [R0, #8] \n"                    
"loc_FFCFCA40:\n"
" LDR R1, =0x6CE80 \n"                    
" LDR R2, [SP, #0xC] \n"                  
" LDR R7, [SP, #0x10] \n"                  
" ADD R10, R1, R2, LSL #5 \n"              
" LDR R1, [R10, #0x14] \n"                
" ADD R0, R7, R11 \n"                      
" CMP R0, R1 \n"                          
" BHI loc_FFCFCA78 \n"                    
" LDR R1, [R10, #0x10] \n"                
" CMP R1, #1 \n"                          
" LDREQ R7, [SP, #0x10] \n"                
" BEQ sub_FFCFCA8C \n"                    
" CMP R0, #0x800000 \n"                    
" BLS loc_FFCFCA84 \n"                    
"loc_FFCFCA78:\n"
" MOV R0, #1 \n"                          
" ADD SP, SP, #0x1C \n"                    
" LDMFD SP!, {R4-R11,PC} \n"              
);
}

EDIT :  Never mind - it gets more interesting if you blow the routines out for more than 400 words.

« Last Edit: 03 / June / 2011, 23:18:21 by waterwingz »

*

Offline KPOT

  • *
  • 10
Re: A495 porting thread
« Reply #219 on: 04 / June / 2011, 00:18:18 »
100d video crashed after ~ 10-12 seconds, the camera freezes with black screen, video does not save on SD
zoom on video, when optical zoom for a maximum, start digital zoom and i can't zoom out optical zoom, when digital zoom dont started, optical works fine,   pardon for my English

Badpixel bin......ok
RAW.......ok
DNG.......ok

 

Related Topics