New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

srsa_4c

4451

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #100 on: 02 / May / 2014, 13:44:41 »

Advertisements

@philmoz

The sigfinder can't deal with the new DIGIC 4+ dumps correctly. The location of the bootloader is now relative to the ROM start address:
8M ROM: 0xff810000 - bootloader, 0xff820000 - main firmware 16M ROM: 0xff010000 - bootloader, 0xff020000 - main firmware
Dumps which start at 0xff820000 or 0xff020000 give usable results, but there's no chance for finding the dancing bits and one of the keys due to the missing bootloader segment. Dumps which start with the bootloader make the sigfinder fail very early.
Which approach do you think would be better:
- load the bootloader separately for these dumps (based on the location of 'gaonisoy')
- load the whole dump in one piece, and fix everything that fails due to the unexpected layout
- ...?
Thanks.
edit:
I'll try to come up with something based on the location of the Canon fw signature.

« Last Edit: 02 / May / 2014, 18:03:47 by srsa_4c »

Logged

srsa_4c

4451

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #101 on: 03 / May / 2014, 09:18:24 »

Finsig support for DIGIC 4+ dumps that include the bootloader, drops support for short dumps that only have the main firmware (shouldn't be a problem as no 4+ ports exist yet).
The only issue (not sure how large) is that the meaning of ROMBASEADDR will change for 4+ cams, it used to mean the start of the main firmware previously.
No fancy name for the new DB encoding, it will be the duty of the first porter.

finsig_digic4plus_bootloader_support.diff (4.89 kB - downloaded 21 times.)

Logged

philmoz

3450

Re: New stubs/signature finder (gensig2/finsig2) for DryOS cameras.

« Reply #102 on: 03 / May / 2014, 22:21:23 »

Quote from: srsa_4c on 03 / May / 2014, 09:18:24

Finsig support for DIGIC 4+ dumps that include the bootloader, drops support for short dumps that only have the main firmware (shouldn't be a problem as no 4+ ports exist yet).
The only issue (not sure how large) is that the meaning of ROMBASEADDR will change for 4+ cams, it used to mean the start of the main firmware previously.
No fancy name for the new DB encoding, it will be the duty of the first porter.

Looks ok.

I don't think the ROMBASEADDR meaning is an issue - I've always just assumed it meant the start of the firmware dump.

Phil.

Logged

CHDK ports:
sx30is (1.00c, 1.00h, 1.00l, 1.00n & 1.00p)
g12 (1.00c, 1.00e, 1.00f & 1.00g)
sx130is (1.01d & 1.01f)
ixus310hs (1.00a & 1.01a)
sx40hs (1.00d, 1.00g & 1.00i)
g1x (1.00e, 1.00f & 1.00g)
g5x (1.00c, 1.01a, 1.01b)
g7x2 (1.01a, 1.01b, 1.10b)