Canon PTZ (CR-N500 / 300 / 100 / 700) Firmware Modding? - General Discussion and Assistance - CHDK Forum

Canon PTZ (CR-N500 / 300 / 100 / 700) Firmware Modding?

  • 2 Replies
  • 2031 Views
Canon PTZ (CR-N500 / 300 / 100 / 700) Firmware Modding?
« on: 03 / November / 2023, 15:59:56 »
Advertisements
Hi there!

So I'm looking to do something a bit different, but CHDK seems like the closest community to what it is I'm trying to do... so I thought I'd reach out here first?

I'm working in a studio that has CR-N500 cameras – Canon PTZs that can stream over network via NDI|HX, RTMP, etc.

These cameras *have* microSD slots – but they are literally non-functional

Canon's tech-specs say, "Media Slot – microSD card slot x 1 (future expansion, recording unavailable)"

They have released a few firmware updates since the devices came out last year, but none add the recording feature

Part of me wonders whether there might be a simple flag in the firmware, to turn this feature on...

... and I figured that if *anyone* had a good place to begin figuring out how to mod the Canon firmware images, it would be the CHDK community

The firmware in question can be downloaded from the CR-N500 Support Page (or directly here)

So, any thoughts...?

*

Offline reyalp

  • ******
  • 14119
Re: Canon PTZ (CR-N500 / 300 / 100 / 700) Firmware Modding?
« Reply #1 on: 03 / November / 2023, 20:10:22 »
Hi there!

So I'm looking to do something a bit different, but CHDK seems like the closest community to what it is I'm trying to do... so I thought I'd reach out here first?
You're welcome here, folks involved with Magic Lantern (https://www.magiclantern.fm/) might also have ideas.

Quote
I'm working in a studio that has CR-N500 cameras – Canon PTZs that can stream over network via NDI|HX, RTMP, etc.

These cameras *have* microSD slots – but they are literally non-functional

Canon's tech-specs say, "Media Slot – microSD card slot x 1 (future expansion, recording unavailable)"

They have released a few firmware updates since the devices came out last year, but none add the recording feature

Part of me wonders whether there might be a simple flag in the firmware, to turn this feature on...

... and I figured that if *anyone* had a good place to begin figuring out how to mod the Canon firmware images, it would be the CHDK community

The firmware in question can be downloaded from the CR-N500 Support Page (or directly here)

So, any thoughts...?
A first obvious question is whether it appears related to any of the other Canon camera families (PowerShot P&S, EOS, Digic DV).

The "Digic DV 6" branding suggests the latter.

The fact the firmware update file has a .BIN extension rather than .FIM, .FIR or .FI2 suggests it's not in one of the known formats, though of course they could easily stick a different extension on the same formats.

xf705 is Digic DV 6 and used the FIM format (understood by http://github.com/protyposis/CanonCamcorderFirmwareTools), which IMO the bin file definitely is not.

The fact CR-N500 is quite recent (announced in 2021?) suggests it could be in the unified firmware family that started with Digic 8 still cams and includes recent Digic DV cams like xf605.

The only ASCII strings in the file seem to be in a header ("2023-07-10", "1.3.0", "0447") from a quick skim the rest looks pretty random, likely compressed and/or encrypted. By eye, it doesn't obviously look like the known formats to me, but I didn't do any real analysis. Neither 'file' nor binwalk identify it as any standard format

Some options for further investigation would be to try to reverse the .bin file format, or investigate the exposed network services, or it up to look for a UART. (hmm, is the "service" terminal on https://www.usa.canon.com/content/dam/canon-assets-(no-crop-applied)/newsroom/2021/20210317-product/cr-n500-rear-white-copy.jpg a UART?)

There's also a USB port listed "Type-A (USB 2.0) x 1 (future expansion)" which you could try connecting and see what sort of device it shows up as. Some Canon DV cams expose some service related features over PTP.

Personally, I'd probably hit the network first since it should give you general information about the device even if there's nothing immediately exploitable.
Don't forget what the H stands for.

Re: Canon PTZ (CR-N500 / 300 / 100 / 700) Firmware Modding?
« Reply #2 on: 06 / November / 2023, 09:27:41 »
As reyalp stated: File naming is odd. And version numbering doesn't follow movie camera/DV product line (x.x.x.x) but EOS and PS (x.x.x).

Are you familiar with UART and how to access it? Service port looks interesting indeed and worth a try.
If you want to contact ML devs follow our discord invite: https://discord.gg/uaY8akC
Reyalp is a frequent visitor and contributor.
But our main devs haven't hacked any DV device yet. There is a guy trying to port ML to XF605 but project has just started.

 

Related Topics


SimplePortal 2.3.6 © 2008-2014, SimplePortal