supplierdeeply

Canon 5d Classic Development ***BOOTDISK NOW ENABLED***

  • 65 Replies
  • 37935 Views
*

Offline Coutts

  • *****
  • 538
  • www.flickr.com/couttsphotog
    • Flickr
  • Publish
    Canon 5d Classic Development ***BOOTDISK NOW ENABLED***
    « on: 01 / March / 2012, 11:20:43 »
    Advertisements
    UPDATE:
    The build thread for 5dc has moved here: http://www.magiclantern.fm/forum/index.php?topic=1010.0



    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Hi, haven't been on here in a while :P

    I recently sold my 500d and upgraded to a 5dc. Since then I have been itching to see what can be done with it, so with the help of Alex and Indy, the initial step to porting some kind of ML hybrid to the 5dc is done :)

    The 5dc runs VxWorks and uses an older version of the FIR file format (v2). Alex provided a simple project for the 5dc to blink the LED without starting the main firmware. Yesterday I finally successfully got the camera to take the firmware update and run the code.

    Basic workflow:
    - use decrypt_fw2 on the 5dc FIR file to decode it.
    - use dissect_fw2_5d to split the header/flasher from the decrypted FIR. note the header size of 0x30 for the 5dc (different from other cameras).
    - compile bin file with a main method (Alex provided this)
    - Modify assemble_fw to use 0x30 for the offset.
    - run assemble_fw to get your new FIR with your code as the payload.
    - run this fir through decrypt_fw2 again to re- encode it.

    Here is a video of the LED test working:
    Canon 5d Hacking | LED Test


    I will post the code later today for anyone interested in helping out. I will not be able to work on this like I did the 500d as I have classes, but I will work on it when I get free time.

    Alex believes the 5dc is similar enough to port into the unified tree, but I am still not sure if this will be worth the hassle. The next step is to start the main firmware, either using ML's method or 400plus.


    Depending on if this ends up in the unified tree or not, my backup name for the project will be 5dplus :)

    Anybody out there have a 5dc?


    edit:
    repo available here: https://bitbucket.org/coutts/5dplus
    « Last Edit: 15 / June / 2012, 17:13:03 by Coutts »
    Canon 5d
    Canon 50mm f/1.8
    Sigma 24mm f/1.8

    Flickr

  • Publish
    Re: Canon 5d Classic Development
    « Reply #1 on: 01 / March / 2012, 13:25:03 »
     I do not have a 5d, but this is relevant to my interests...

    *

    Offline 0xAF

    • ***
    • 219
      • 0xAF
  • Publish
    Re: Canon 5d Classic Development
    « Reply #2 on: 01 / March / 2012, 14:39:03 »
    Count me too ;)
    // AF

  • Publish
    Re: Canon 5d Classic Development
    « Reply #3 on: 01 / March / 2012, 16:15:24 »
    Good work Coutts!


    *

    Offline Coutts

    • *****
    • 538
    • www.flickr.com/couttsphotog
      • Flickr
  • Publish
    Re: Canon 5d Classic Development
    « Reply #4 on: 02 / March / 2012, 17:25:09 »
    some progress:
    Today I learned how the ML boot process works. I can boot the firmware by just directly jumping into the ROM, but of course I need to start my own task before I let the camera take control. The problem is I don't understand the 5dc boot process enough yet to know how to do this.

    Here is the ML boot process (my interpretation[omitted some stuff]) outlined. Refer to copy_and_restart() in boot-hack.c:
    - bootloader copies our code to 0x800000
    - we copy a portion of the firmware from ROM into RAM. All we need to copy is from the start of the ROM up until the BL jump to cstart. For example, in the 500d, this bl call is at 0xFF012AE8. Subtract the start of the rom (0xFF010000) from this and we get 0x12AE8. This is all that we need to copy, so a safe number (used in ML) for RELOCSIZE is 0x3000. As long as the RELOCSIZE is at least as big as ([cstart bl call location] - [rom start address]), we are good.
    Quote
    blob_memcpy( new_image, firmware_start, firmware_start + firmware_len );
    - in the RAM copy of the firmware, the jump to cstart is replaced with a return instruction so that it doesn't try to run cstart until we call it ourselves later.
    Quote
    INSTR( HIJACK_INSTR_BL_CSTART ) = RET_INSTR;
    - next, we fix some branch instructions in cstart so that they point to the ROM locations of the functions and not the RAM ones (we want to eventually be executing from ROM and not our RAM copy of the firmware). This is done on bzero32 and create_init_task. Also, we replace DryOS's init_task (passed as an arg to create_init_task) to point to our init task (which starts ML). Our init task will call dryos' init task so everything works out in the end.
    Quote
    FIXUP_BRANCH( HIJACK_FIXBR_BZERO32, bzero32 );
    FIXUP_BRANCH( HIJACK_FIXBR_CREATE_ITASK, create_init_task );
    INSTR( HIJACK_INSTR_MY_ITASK ) = (uint32_t) my_init_task;
    - next we execute the RAM copy of the firmware. Remember we patched the call to cstart to just return, so once execution reaches that point it will stop and return (it returns to nobody). Think of RELOCADDR as the location of the RAM copy of the firmware, so if we call that, then the firmware starts executing (up until cstart like I said above) :)
    Quote
    thunk reloc_entry = (thunk)( RELOCADDR + 0xC );
    reloc_entry();
    - Now we execute the RAM version of cstart. Remember we modified it to call the ROM functions for bzero32 and create_init_task, so after create_init_task is called, execution is now running from the ROM and no longer from the RAM copy.
    Quote
        void (*ram_cstart)(void) = (void*) &INSTR( cstart );
    ram_cstart();

    This is my understanding, if anyone has anything to contribute please do :)
    « Last Edit: 02 / March / 2012, 17:38:13 by Coutts »
    Canon 5d
    Canon 50mm f/1.8
    Sigma 24mm f/1.8

    Flickr

    *

    Offline Coutts

    • *****
    • 538
    • www.flickr.com/couttsphotog
      • Flickr
  • Publish
    Re: Canon 5d Classic Development
    « Reply #5 on: 03 / March / 2012, 16:56:32 »
    Canon 5d
    Canon 50mm f/1.8
    Sigma 24mm f/1.8

    Flickr

    *

    Offline Coutts

    • *****
    • 538
    • www.flickr.com/couttsphotog
      • Flickr
  • Publish
    Re: Canon 5d Classic Development
    « Reply #6 on: 04 / March / 2012, 01:33:13 »
    Going to attempt to blink the firmware and bootloader through the LED like chdk people :)

    Canon 5d
    Canon 50mm f/1.8
    Sigma 24mm f/1.8

    Flickr

  • Publish
    Re: Canon 5d Classic Development
    « Reply #7 on: 04 / March / 2012, 06:52:49 »
    Looks like even an oldie like the 5Dc is receiving some attention and care by you guys.
    Another few months and i can probably run ML on my toaster :P


    *

    Offline Coutts

    • *****
    • 538
    • www.flickr.com/couttsphotog
      • Flickr
  • Publish
    Re: Canon 5d Classic Development
    « Reply #8 on: 05 / March / 2012, 13:06:35 »
    Well unfortunately this project had a short life.. I'm at a wall and it looks like it's going nowhere unless somebody else can take a look at this.

    I couldn't adapt any LED blinking code to work on the 5d, it's acting strange when I run code from the FIR. I need to have a while loop, and it has to be in C code. I can't make it loop from ASM, nor can I turn the led off from ASM (only works in C for some reason).

    Additionally, I can't get the firmware to start. I have tried branching right into the ROM at a few locations (including 0xFF810000 to start the firmware.. no luck). I've tried re-writing some of the asm code of the boot process and then branching into the next ROM function, no luck. I've even tried re-writing the boot procsess in C and then passing control back to the ROM but no luck again.

    It seems the 5dc doesn't want to be worked on :/
    Canon 5d
    Canon 50mm f/1.8
    Sigma 24mm f/1.8

    Flickr

    *

    Offline srsa_4c

    • ******
    • 3104
  • Publish
    Re: Canon 5d Classic Development
    « Reply #9 on: 05 / March / 2012, 13:58:51 »
    Hi!

    It won't help much, but you should remember: you're doing a "firmware upgrade". VxWorks is up and running, you can't just jump back into the ROM.
    There is some code in the 350d thread (bootflg2) which runs with the firmware update method. It can maybe give some ideas (I wouldn't touch the bootflag at this point).

    edit:

    had to correct myself (after seeing some P&S bootloaders), the OS is probably absent when the upgrade program is started
    « Last Edit: 15 / May / 2012, 11:28:04 by srsa_4c »

     

    Related Topics