SX40HS porting thread

Yeah, just received my SX40HS camera, and the first thing what i have done after unboxing was to dump the Firmware...

Here is the dump of the 1.00f firmware. http://chdk.setepontos.com/index.php?topic=6955.0
Romstart is @0xFF000000
DRYOS version 2.3, release #0049

Vers.req info:
Canon PowerShot SX40HS
P-ID: 3238 PAL D
Firmware Ver GM1.00F (1.0.0.0)
Adj Ver.010.008

So lets see if this digic5 camera is also so "easy"  to port as the digic4 ones.
My disassembler is just heating up.

Okay, initial boot of signed  PS2.FI (with d4c key) works. Also starting a non encoded diskboot.bin via Canonbasic works. But until now i was not able to get the automatic diskboot.bin working, camera does not startup up.

I think canon has again changed the dancingbit. I found this code sequence at the usual position in the romdump: { 7,1,5,3,0,6,4,2 } But also with this dancingbits coding, it does not startup. Maybe someone else can verify if i extracted here the correct dancing bits code.

Nice

Added the

• SX40 1.00F

full 16MB dump (dumped with cBasic udumper) provided by ERR99 from this forum post to the box.net/chdk repository.

Okay, initial boot of signed  PS2.FI (with d4c key) works. Also starting a non encoded diskboot.bin via Canonbasic works. But until now i was not able to get the automatic diskboot.bin working, camera does not startup up.

I think canon has again changed the dancingbit. I found this code sequence at the usual position in the romdump: { 7,1,5,3,0,6,4,2 } But also with this dancingbits coding, it does not startup. Maybe someone else can verify if i extracted here the correct dancing bits code.

Took a quick look and your dancing bits values look OK (I assume you updated dancingbits.c and changed your NEED_ENCODED_DISKBOOT value).

Looking at the startup code it looks like the camera has 256MB of RAM (up from 128MB on the previous models). Not surprising since the camera can to 8 frames at 10fps - may mean the capture task will be quite different though, and there may be a lot more RAW buffers.

What format is your SD card - the R47 cameras can boot from exFat FAT32 formatted cards up to 32GB in size; but you have to put the 'BOOTDISK' string at offset 0x1E0 instead of 0x40 in the boot sector. The R49 code looks to be the same.

Good luck

Phil.

Okay, initial boot of signed  PS2.FI (with d4c key) works. Also starting a non encoded diskboot.bin via Canonbasic works. But until now i was not able to get the automatic diskboot.bin working, camera does not startup up.

I think canon has again changed the dancingbit. I found this code sequence at the usual position in the romdump: { 7,1,5,3,0,6,4,2 } But also with this dancingbits coding, it does not startup. Maybe someone else can verify if i extracted here the correct dancing bits code.

Yor're right, they're located @0xFF5B5344.

The fi2 keys are d4c, @FF61A4FC and @FFFF3B48

Took a quick look and your dancing bits values look OK (I assume you updated dancingbits.c and changed your NEED_ENCODED_DISKBOOT value).

Yes, i updated dancingbits.c an the diskboot value for this. But its still not booting up this way.

What format is your SD card - the R47 cameras can boot from exFat FAT32 formatted cards up to 32GB in size; but you have to put the 'BOOTDISK' string at offset 0x1E0 instead of 0x40 in the boot sector. The R49 code looks to be the same.

For development i use a 2GB FAT16 formated card. This card is starting-up fine diskboot.bin files on my other chdk capable cameras. I also tried to format the card to FAT32 and set the BOOTDISK string @0x1E0, but its still not booting up correctly.

Currently i modified the SW to startup to the boot() funktion in platform\sx40hs\sub\100f\boot.c.
I modified this boot function to jump and the end back to the original canon firmware.
If i create a PS2.FIR file, exactly this expected bahaviour happens. The camera accepts the Firmwareupdate file, the camera reboots and is up and running again. If i add a endless loop at the end of the boot function, the camera "freezes" during the "firmware update" procedure and i have to remove the battery (as expected). So i am sure that my code is executed if i start my build via PS2.FIR file.

But if i use the dancingbits encoded diskboot.bin output of the same bild, the camera keeps of (or it starts a directly shutsdown , i cant tell, no display or led goes on).  If i start a unencoded diskboot.bin manually via canon basic script, it works&boots also as expected.

So the build cant be so wrong, but i dont understand currently why the encoded diskboot.bin is not starting up from a 2GB,FAT16 (made bootable with SDM) automatically.

Quote from: ERR99 on 19 / October / 2011, 19:01:09

Okay, initial boot of signed  PS2.FI (with d4c key) works. Also starting a non encoded diskboot.bin via Canonbasic works. But until now i was not able to get the automatic diskboot.bin working, camera does not startup up.

I think canon has again changed the dancingbit. I found this code sequence at the usual position in the romdump: { 7,1,5,3,0,6,4,2 } But also with this dancingbits coding, it does not startup. Maybe someone else can verify if i extracted here the correct dancing bits code.

Yor're right, they're located @0xFF5B5344.

The fi2 keys are d4c, @FF61A4FC and @FFFF3B48

Fine. d4c signed ps2.fir booting is working, but the diskboot.bin way is not working (even if the encoding used found at 0xFF5B5344).

Good news, diskboot.bin is executed! I checked this with led blinking testcode at the end of the boot() function. But anyway, if i jump here back to the original firmware, the camera freezes or shutsdown.
If i start the same build via PS2.FIR, jump to original firmware works fine, camera is starting up.

Currently i dont know what could be the different between this two boot/startup-process, and how i have to modify that the diskboot.bin, so that this build does not crash.

Good news, diskboot.bin is executed! I checked this with led blinking testcode at the end of the boot() function. But anyway, if i jump here back to the original firmware, the camera freezes or shutsdown.
If i start the same build via PS2.FIR, jump to original firmware works fine, camera is starting up.

Currently i dont know what could be the different between this two boot/startup-process, and how i have to modify that the diskboot.bin, so that this build does not crash.

Maybe post the boot code you have so far - another set of eyes might spot something.

Phil.

Don't worry about it until you finish porting. I had the same issue on sx220 and had to comment out two lines in boot.c for diskboot.bin to work, but this screwed the firmware update method. At the end of the port both boot methods will work just fine.