New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

waterwingz

12138

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #50 on: 04 / August / 2012, 18:42:47 »

Advertisements

Quote from: srsa_4c on 04 / August / 2012, 17:46:20

Quote from: waterwingz on 04 / August / 2012, 17:38:26
Isn't KEY_POWER used in boot.c to let the user go straight to shooting mode if its held down during startup ?
I meant its usage in the keymap.
Quote
Regardless, having the playback key helps a lot.
Your post gave me the idea to look for new keys
Ixus300/SD4000 1.00d
// { 0, KEY_PLAYBACK ,0x00004000 }, // Found @0xffb5f6f4, levent 0x601
I'd suggest to try it on your cameras to see the reliability.

Thanks ! (although its not going to work on any of my cameras )

Logged

Ported : A1200 SD940 G10 Powershot N G16

philmoz

3449

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #51 on: 05 / August / 2012, 06:48:08 »

Quote from: srsa_4c on 04 / August / 2012, 17:27:22

A patch which enables to find two additional buttons (KEY_POWER is not used anywhere, but may be of interest for some). Bad news: the event IDs for KEY_PLAYBACK and KEY_POWER seem to have been changed starting with r49. Buttons with inverted logic are marked with "inv". I have tested this on several DryOS dumps and it seems to have caught the known abnormalities (i.e. the inverted buttons of A490/495/800).
Needs work on r49+ (is inverted state still marked the same way, what are the new events for the playback (and power) buttons).

Added to trunk in revision 2055.
Also included detection for R49 and R50.

Phil.

Logged

CHDK ports:
sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
g12 (1.00c, 1.00e, 1.00f & 1.00g)
sx130is (1.01d & 1.01f)
ixus310hs (1.00a & 1.01a)
sx40hs (1.00d, 1.00g & 1.00i)
g1x (1.00e, 1.00f & 1.00g)
g5x (1.00c, 1.01a, 1.01b)
g7x2 (1.01a, 1.01b, 1.10b)

nafraf

1308

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #52 on: 05 / August / 2012, 11:49:39 »

It is possible to add the KEY_VIDEO and KEY_HELP to auto detection?
For A810 100b and 2300 b101 (R50) this is the keymap
a810 100b

Code: [Select]

    { 1, KEY_POWER           ,0x40000000 }, // Found @0xffb10060, levent 0x100
    { 1, KEY_PLAYBACK        ,0x80000000 }, // Found @0xffb10068, levent 0x101
    { 1, KEY_HELP            ,0x20000000 }, // Key Help
    { 1, KEY_VIDEO           ,0x10000000 }, // Key Video

a2300 b101

Code: [Select]

    { 1, KEY_PLAYBACK        ,0x80000000 }, // Found @0xffb0fa74, levent 0x101    
    { 1, KEY_POWER           ,0x40000000 }, // Found @0xffb0fa6c, levent 0x100
    { 1, KEY_HELP            ,0x20000000 }, // Key Help
    { 1, KEY_VIDEO           ,0x10000000 }, // Key Video

« Last Edit: 05 / August / 2012, 12:03:25 by nafraf »

Logged

srsa_4c

4451

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #53 on: 05 / August / 2012, 12:56:51 »

Quote from: nafraf on 05 / August / 2012, 11:49:39

It is possible to add the KEY_VIDEO and KEY_HELP to auto detection?

Here's the logic (used the A2300 dump as example)
ffb0fa0c: 0101020c ffb0fa10: 00000003 -> event 3 ffb0fa14: 0101020d ffb0fa18: 00000002 -> event 2 ... ffb0fa5c: 0101023c ffb0fa60: 0000001a -> event 0x1a ffb0fa64: 0101023d = 00000001000000010000001000111101 ffb0fa68: 00000014 -> event 0x14 orange: inverted logic, if 0 green: which physw_status word blue: which bit in the word ( 2 on the Nth power where the blue value is N ) other bits: unknown ffb0fa6c: 0101023e ffb0fa70: 00000100 -> event 0x100 ffb0fa74: 0101023f ffb0fa78: 00000101 -> event 0x101 ... ffb0fa84: 01000251 ffb0fa88: 0000020a -> event 0x20a ffb0fa8c: 01000252 ffb0fa90: 00000202 -> event 0x202 ...
So, the buttons you are looking for will be the ones with events 0x1a and 0x14. Note, that some of this might change, philmoz's preview version had code for more buttons (attached in this thread earlier).
Change find_key_vals() in tools/finsig_dryos.c.

« Last Edit: 05 / August / 2012, 13:00:39 by srsa_4c »

Logged

nafraf

1308

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #54 on: 05 / August / 2012, 20:12:06 »

Thanks, bits are clearer now.

For KEY_HELP, the same event 0x14 works for A810 and A2300. Both using R50.

For KEY_VIDEO, I searched for the event and checked the keymap existing in already ported cameras. The event seems to depends of Release version.

Following code reflects the events corresponding for each release and the list of tested cameras:

Code: [Select]

        if(fw->dryos_ver <= 47)
            add_kmval(fw,tadr,tsiz,tlen,0x12,"KEY_VIDEO",0); //R47:ixus115/ixus220
        else
            if(fw->dryos_ver==49)
            {
                add_kmval(fw,tadr,tsiz,tlen,0x19,"KEY_VIDEO",0); //R49:sx150/ixus230
            }
            else if(fw->dryos_ver==50)
            {
                add_kmval(fw,tadr,tsiz,tlen,0x1A,"KEY_VIDEO",0); //R50:a810/a2300/sx260/s100
                add_kmval(fw,tadr,tsiz,tlen,0x14,"KEY_HELP",0);  //R50:a810/a2300/sx260
            }

But I think that more cameras should be tested...

Logged

nafraf

1308

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #55 on: 06 / August / 2012, 23:02:57 »

A patch to add detection of KEY_HELP and KEY_VIDEO to finsig_dryos.c is in attachment.

To test it, stubs_entry.S was generated for every camera where KEY_VIDEO was found in kbd.c After that, a script extracts KEY_VIDEO line in stubs_entry.S and kbd.c, to compare their values. Output is in attachment, values match.

The patch was tested with some cameras without KEY_VIDEO too (a3300, ixus200), no key was detected.

KEY_HELP was validated in a2300 and a810.

Do you think that this could be useful? If yes, do you suggest any other test? a full test?

keyvideo_keyhelp.patch (1.23 kB - downloaded 59 times.)

out.txt (2.17 kB - downloaded 74 times.)

Logged

srsa_4c

4451

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #56 on: 21 / September / 2012, 17:04:41 »

A patch to allow finsig_dryos to work with DryOS r51 images. As you see, this is only a basic fix, does not bring full support for r51.

Code: (diff) [Select]

Index: tools/finsig_dryos.c
===================================================================
--- tools/finsig_dryos.c	(revision 2160)
+++ tools/finsig_dryos.c	(working copy)
@@ -534,7 +534,7 @@
 {
     if ((i >= 0) && (i < fw->size))
         return fw->buf[i];
-    if (fw->dryos_ver == 50)
+    if (fw->dryos_ver >= 50)
     {
         i = ((i * 4) + (fw->base - fw->base2)) / 4;
         if ((i >= 0) && (i < fw->size2))
@@ -874,6 +874,7 @@
         break;
 	case 49: 
 	case 50: 
+	case 51:
         cam_idx = (((fw->base==0xFF000000)?0xFFF40190:0xFFFE0170) - fw->base) / 4; 
         pid_idx = (((fw->base==0xFF000000)?0xFFF40040:0xFFFE0040) - fw->base) / 4; 
         if ((cam_idx < fw->size) && (strncmp((char*)&fw->buf[cam_idx],"Canon ",6) != 0))
@@ -988,7 +989,7 @@
     // DryOS R50 copies a block of ROM to RAM and then uses that copy
     // Need to allow for this in finding addresses
     // Seen on SX260HS
-    if (fw->dryos_ver == 50)
+    if (fw->dryos_ver >= 50)
     {
         fw->buf2 = 0;
         fw->base2 = 0;

Logged

philmoz

3449

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #57 on: 06 / October / 2012, 03:11:07 »

I'm back from my trip.

I've added the KEY_HELP/KEY_VIDEO changes and support for DryOS R51 to revision 2199 (trunk). This also includes new dancing bits values for R51.

I'll merge back to release-1.1 shortly.

Phil.

P.S. Some images from my trip to Africa are at http://www.pbase.com/phil_a_mitchell/africa

Logged

CHDK ports:
sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
g12 (1.00c, 1.00e, 1.00f & 1.00g)
sx130is (1.01d & 1.01f)
ixus310hs (1.00a & 1.01a)
sx40hs (1.00d, 1.00g & 1.00i)
g1x (1.00e, 1.00f & 1.00g)
g5x (1.00c, 1.01a, 1.01b)
g7x2 (1.01a, 1.01b, 1.10b)

Microfunguy

4037

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #58 on: 06 / October / 2012, 06:20:29 »

Nice quality images Phil, taken with a proper camera (apart from a couple of snapshots)

I did not know they had penguins there, is this South Africa ?

David

Logged

srsa_4c

4451

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #59 on: 26 / May / 2013, 14:19:37 »

I'd like to suggest adding a few functions which could be useful in the future.

EngDrv* (EngDrvIn, EngDrvOut, EngDrvRead, EngDrvBits). I have a possible use for EngDrvRead at the moment.

exmem_free (its real name is probably ExMem.FreeCacheable), it could be useful sometimes to allocate a bigger chunk of memory, and be able to free it. To be able to actually use these, the list of exmem categories is also needed.

realloc (hint here: http://chdk.wikia.com/wiki/User:Srsa_4c/Additional_firmware_routines), some routines depend on it.

Of course the same would be needed for VxWorks, but I'm a bit concerned about that sigfinder. For example the EngDrv event procedures have known names, but their implementation differs somewhat - it would probably be better to find these by name.

Logged