Magic Lantern Forum

Developing Magic Lantern => Reverse Engineering => Topic started by: a1ex on March 15, 2015, 07:13:36 PM

Title: Display access from bootloader / Portable binary test
Post by: a1ex on March 15, 2015, 07:13:36 PM
About one month ago, g3gg0 found a way (https://bitbucket.org/hudson/magic-lantern/commits/4deada519a0c) to access the LCD display from bootloader context, without calling anything from the main firmware. This makes a very powerful tool for diagnosing bricked cameras, and also a playground for low-level reverse engineering.

The only camera-specific bits for printing stuff on the LCD are:
- we have to call a Canon routine that initializes the display (which is in bootloader, not in main firmware): we named it "fromutil_disp_init".
- for the YUV layer, newer cameras use YUV422, while older cameras (only checked 5D2) use YUV411. This difference is not essential (you can print on the BMP layer only).

Today I wrote an autodetection routine (https://bitbucket.org/hudson/magic-lantern/commits/82e167853198) that finds the display init routine from ROM strings, and the result is a portable "hello world" binary. That means, it should print something on any ML-enabled camera (and maybe even on cameras without ML). Same binary for all cameras, of course.

I've tested the code on 5D3 and 60D, and I'm looking for confirmation on the other models.

If you are already running ML, just download this autoexec.bin (http://a1ex.magiclantern.fm/debug/portable-hello-world/autoexec.bin), run it, take a picture of your camera screen (sorry, no screenshots yet) and upload it here.

If you have a Canon DSLR without a ML port available, we need to sign this binary (create a FIR). Just mention your camera model and I'll create one for you. Don't expect this to speed up the porting process for your camera. But I hope this proof of concept will convince you to start tinkering with your new little computer :)
Title: Re: Display access from bootloader
Post by: Walter Schulz on March 15, 2015, 07:38:31 PM
650D: Inserted card, closed door and this showed up without turning power switch to ON.
(http://picload.org/image/cwirdar/comp_img_1281.jpg)

7D: Not working. Black screen.
Title: Re: Display access from bootloader
Post by: Indy on March 15, 2015, 07:58:29 PM
Hi,

550D 1.0.8 = sub_FFFF5ECC (in bootcode)
6D = sub_FFFE5018 (in rcbind.bin)

with 550D I was also able to autodetect and call FIO_CreateFile, FIO_Write and FIO_Close to dump the memory, but it did not work on all models.

Indy
Title: Re: Display access from bootloader
Post by: a1ex on March 15, 2015, 09:10:03 PM
@Walter: can you download it again and retry the test?

@Indy: yeah, file writing from bootloader behaves the same here (works on some cameras, but not all); g3gg0 also tried direct SD access, which works on 5D3 and 600D only for now.
Title: Re: Display access from bootloader
Post by: Walter Schulz on March 15, 2015, 09:31:53 PM
650D: Downloaded AUTOEXEC.BIN again
(http://picload.org/image/cwirpcl/comp_img_1282.jpg)

7D: Still the same
Title: Re: Display access from bootloader
Post by: dhilung on March 15, 2015, 09:33:11 PM
Works in 5D2!

(http://dhilung.com/vault/ml/ml_rescue.jpg)

Title: Re: Display access from bootloader
Post by: Katabatic on March 15, 2015, 10:15:38 PM
50D

(http://www.katabatic.co.nz/files/stuffs/IMG_5651.jpg)
Title: Re: Display access from bootloader
Post by: vroem on March 15, 2015, 10:16:55 PM
Katabatic, you beat me to it  ;) (http://file.brow.sr/50D.jpg)
Title: Re: Display access from bootloader
Post by: Greg on March 15, 2015, 10:45:15 PM
500D:
(http://s13.postimg.org/4nf30vznb/500d.jpg)
Title: Re: Display access from bootloader
Post by: g3gg0 on March 15, 2015, 10:56:37 PM
600D:
(http://i.imgur.com/G7B5XgAm.jpg?1) (http://imgur.com/G7B5XgA)
Title: Re: Display access from bootloader
Post by: nikfreak on March 15, 2015, 11:06:35 PM
EOS 70D:

(http://i59.tinypic.com/magffa.jpg)

Cool way to simply identify FW revisions
Title: Re: Display access from bootloader
Post by: g3gg0 on March 15, 2015, 11:38:46 PM
@nikfreak:

image does not load here
Title: Re: Display access from bootloader / Portable binary test
Post by: dmilligan on March 16, 2015, 01:36:38 AM
1100D gets weird flashing horizontal bars:

(http://bitbucket.org/dmilligan/magic-lantern/downloads/1100D_Rescue.png)

here's a 240fps video of it: https://dl.dropboxusercontent.com/u/74060/Video%20Mar%2015%2C%208%2025%2041%20PM.mov
Title: Re: Display access from bootloader / Portable binary test
Post by: Katabatic on March 16, 2015, 02:19:45 AM
Haha but at what cost, vroem? I can't seem to boot ML on it anymore...
Title: Re: Display access from bootloader / Portable binary test
Post by: Audionut on March 16, 2015, 04:36:11 AM
(https://dl.dropboxusercontent.com/u/34113196/ML/IMG_20150316_132455.png)

No more running code on top of Canons firmware!  :P
Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on March 16, 2015, 05:34:21 AM
Quote from: Katabatic on March 16, 2015, 02:19:45 AMHaha but at what cost, vroem? I can't seem to boot ML on it anymore...

Removing battery won't work?
Put card in cardreader. Backup ML directory. Delete ML directory and Autoexec.bin from card. Copy extracted nightly content to card.
(In fact: The only thing you really need to do is to replace Autoexec.bin with the one used before).
Title: Re: Display access from bootloader / Portable binary test
Post by: nikfreak on March 16, 2015, 07:42:40 AM
Quote from: g3gg0 on March 15, 2015, 11:38:46 PM
@nikfreak:

image does not load here

fixed
Title: Re: Display access from bootloader / Portable binary test
Post by: jpaana on March 16, 2015, 01:22:30 PM
EOS M

(https://www.dropbox.com/s/965mlou40t7665q/2015-03-16-14.14.37.jpg?dl=1)
Title: Re: Display access from bootloader / Portable binary test
Post by: boszmann on March 16, 2015, 01:51:31 PM
700D

(http://picload.org/image/cwiogoi/700d_x23.jpg)

NOTE: it is possible to execute with the card door open.
Title: Re: Display access from bootloader / Portable binary test
Post by: blade on March 16, 2015, 11:37:57 PM
EOS 650D, got some more info than walter

(not sure how to post the picture from dropbox, but here is the link.

Cool that it works without turning the camera on!

https://www.dropbox.com/s/uawd0finhm9kl28/Foto%2016-03-15%2023%2030%2005.jpg?dl=0 (https://www.dropbox.com/s/uawd0finhm9kl28/Foto%2016-03-15%2023%2030%2005.jpg?dl=0)

Title: Re: Display access from bootloader / Portable binary test
Post by: Pelican on March 17, 2015, 09:12:54 AM
blade's 650D:
(http://pel.hu/down/Foto%2016-03-15%2023%2030%2005.jpg)

Edit: It worked for me yesterday. I moved it to my page.
Title: Re: Display access from bootloader / Portable binary test
Post by: blade on March 17, 2015, 11:24:18 AM
Thanks for the effort Pelican. Sill not working do, should not matter as the link works!
Title: Re: Display access from bootloader / Portable binary test
Post by: dmilligan on March 17, 2015, 11:40:58 AM
the problem is the 's' in https://
Title: Re: Display access from bootloader / Portable binary test
Post by: rbrune on March 18, 2015, 06:12:06 PM
EOS-M:
(http://www.rbrune.de/img_ml.jpg)
I compiled the autoexec.bin myself from the recovery branch using the portable platform.

Interestingly when one compares the output for my EOS-M with the one from jpaana - the second IMG-naming property looks correctly resolved on mine but not on his? I have the feeling something with the property parsing is not going correctly.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on March 18, 2015, 06:21:54 PM
It's this change: https://bitbucket.org/hudson/magic-lantern/commits/0456d1c173b8

Can you also check if the DUAL prefix option from Dual ISO works on EOS-M? I guess it doesn't.
Title: Re: Display access from bootloader / Portable binary test
Post by: rbrune on March 18, 2015, 06:41:40 PM
Well, dual iso managed to save 'DUAL2086.CR2' successfully... so that worked.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on March 18, 2015, 08:05:11 PM
Thanks everybody for the tests.

Here's a follow-up of this experiment: a nice error page if you load ML on a different camera or firmware version.

https://bitbucket.org/hudson/magic-lantern/pull-request/616/portable-error-messages-if-ml-is-loaded-on
Title: Re: Display access from bootloader / Portable binary test
Post by: g3gg0 on March 18, 2015, 09:05:22 PM
(http://i.imgur.com/VYbxDaL.jpg?1) (http://imgur.com/VYbxDaL)
Title: Re: Display access from bootloader / Portable binary test
Post by: Pelican on March 19, 2015, 10:45:44 PM
g3gg0:
Where can I get that autoexec.bin?
Title: Re: Display access from bootloader / Portable binary test
Post by: g3gg0 on March 19, 2015, 11:08:13 PM
here (http://upload.g3gg0.de/pub_files/de966def704941c0e04d4c5e98509b3a/AUTOEXEC.BIN) or build it from the repository
Title: Re: Display access from bootloader / Portable binary test
Post by: DeafEyeJedi on March 20, 2015, 01:22:21 AM
EOS-M:

(https://farm9.staticflickr.com/8706/16680407498_531049674a_n.jpg) (https://flic.kr/p/rpZs1J)
Title: Re: Display access from bootloader / Portable binary test
Post by: g3gg0 on March 20, 2015, 12:35:49 PM
@DeafEyeJedi:
can you try the one from my last post too?
Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on March 20, 2015, 12:45:15 PM
@g3gg0:
Tested your Autoexec.bin with 650D

- Camera: '650D'
- Camera model: ???
- Firmware version: 1.0.4 / 5.6.4 87(28)
- IMG naming: 100?????/IMG_5255.JPG
- User PS: Marvels Advanced 3.4
- Boot flags: FIR=0 BOOT=-1 RAM=-1 UPD=-1
- ROMBASEADDR: 0xFF0C0000
- DONE!
Title: Re: Display access from bootloader / Portable binary test
Post by: DeafEyeJedi on March 20, 2015, 01:00:35 PM
@g3gg0:

I'm currently at the airport boarding flight to Puerto Rico and won't be back until March 27th.

Until then.
Title: Re: Display access from bootloader / Portable binary test
Post by: arrinkiiii on March 20, 2015, 01:24:27 PM

@DeafEyeJedi

That the ML force be with you. Happy rec's  8)
Title: Re: Display access from bootloader / Portable binary test
Post by: kitor on March 20, 2015, 03:22:20 PM
(http://i.imgur.com/dDvDMui.jpg)

550d. Later I'll try on my ERR50 50D (I must find cf card)
Title: Re: Display access from bootloader / Portable binary test
Post by: g3gg0 on March 20, 2015, 04:50:56 PM
thanks for all the tests :)

and it is totally encouraging to see so many models succeed this test!
someone who can try my posted on on a EOS M ?

Title: Re: Display access from bootloader / Portable binary test
Post by: Licaon_Kter on March 20, 2015, 04:52:49 PM

Quote from: g3gg0 on March 19, 2015, 11:08:13 PM
here (http://upload.g3gg0.de/pub_files/de966def704941c0e04d4c5e98509b3a/AUTOEXEC.BIN) or build it from the repository
M1 here:
(https://i.imgur.com/7h2HptD.jpg)
Title: Re: Display access from bootloader / Portable binary test
Post by: DeafEyeJedi on March 20, 2015, 07:30:54 PM
Thanks @Licaon_Kter for giving us a hand regarding M1.
Title: Re: Display access from bootloader / Portable binary test
Post by: Pelican on March 20, 2015, 08:55:55 PM
Is there a solution for the background on 50D, 5D2 and 7D?
Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on March 20, 2015, 09:05:02 PM
Pelican, a solution requires a problem to be solved. IMO there is no problem. It looks different and I don't care.
There are other priorities, I hope!
Title: Re: Display access from bootloader / Portable binary test
Post by: g3gg0 on March 20, 2015, 10:31:33 PM
@Licaon_Kter:

thanks!
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on March 22, 2015, 11:11:49 PM
Does this test binary work on external monitors?
Title: Re: Display access from bootloader / Portable binary test
Post by: Indy on March 23, 2015, 11:26:18 PM
The bootcode can also receive input chars, but how ? using a serial connector through the battery connector or USB ?
On 550D at least, the grip (connected through by battery port) can be upgraded via the camera body.
Canon must have a dedicated device to do low level debugging/finetuning through bootcode.

Indy
Title: Re: Display access from bootloader / Portable binary test
Post by: bootrom on March 24, 2015, 01:55:38 AM
I would expect USB or HDMI dongle.

Olympus uses a special HDMI dongle. If you connect it to Olympus EMx and power one camera, then it switches into debug mode. This dongle acts as input/output for debug commands (but "output" also changeable to camera display). And private person can't buy HDMI encoder ?
Title: Re: Display access from bootloader / Portable binary test
Post by: ilex on April 02, 2015, 07:32:46 PM
@A1ex: Can You create a FIR for 40D? Thanks in advance.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on April 02, 2015, 08:39:18 PM
Sure. VxWorks binaries, not tested:

For 400D/5Dc: autoexec.bin (http://a1ex.magiclantern.fm/debug/portable-hello-world/VxWorks/autoexec.bin) (you can try it if you are already running 400plus on 400D or ML on 5Dc)
For 40D: 40d.fir (http://a1ex.magiclantern.fm/debug/portable-hello-world/VxWorks/40d.fir)
For 30D: 30d.fir (http://a1ex.magiclantern.fm/debug/portable-hello-world/VxWorks/30d.fir) (not sure I've signed it properly)

Autodetection code is based on the strings from 400D and 5D classic bootloaders (hopefully 40D is similar).
Title: Re: Display access from bootloader / Portable binary test
Post by: Ottoga on April 03, 2015, 01:31:18 AM
Loaded this onto my cf card (7D). When I turned on the camera, the led flashed a couple of times and nothing.

That is:
- no image appeared on the screen
- ML didn't load
- canon menu operational

The autoexe.bin used was downloaded from the link in Alex's 1st post.

Should I be doing anything else to "run' it?
Title: Re: Display access from bootloader / Portable binary test
Post by: kitor on April 03, 2015, 10:06:57 AM
Yep, the card must be prepeared for "normal" MagicLantern boot, you just replace autoexec on working card.
@alex - I'll try on 30D tomorrow.
Title: Re: Display access from bootloader / Portable binary test
Post by: Ottoga on April 03, 2015, 01:18:47 PM
Thanks for the reply. That's what I did,  Just replaced the autoexec.bin on one of my ML CF cards.
Title: Re: Display access from bootloader / Portable binary test
Post by: kitor on April 04, 2015, 12:10:34 AM
30D no luck (so I guesss signature is bad)
(http://i.imgur.com/WWkNTHS.png)
Title: Re: Display access from bootloader / Portable binary test
Post by: rpt on April 04, 2015, 07:01:36 PM
I have a 5D3 and a 7D2. This I first tried it on the 5D3. I dont know what I am doing wrong but I get this screen when I put the card in and close the card slot door:
(https://farm8.staticflickr.com/7644/16845628939_bf7f9d8f67_c.jpg) (https://flic.kr/p/rEAfAg)
20150404_215330 (https://flic.kr/p/rEAfAg) by Rustom (https://www.flickr.com/people/64926965@N00/), on Flickr

The procedure I followed on the 5D3 was:
1.  So I copied my ML card over to a test card and verified that it worked right (could un-install ML and reinstall ML).
2.  Replaced the autoexec.bin from the link in the first post onto this test card.
3.  Placed the card in the slot and closed the door.
4.  I got the above screen.
5.  Removed the battery.
6.  Replaced the original ML card.
7.  Camera booted with ML and it worked.

So I thought that may be the other ML files were not needed So I removed the ML folder and the .FIR file but got the same result.

What am I doing wrong?

Do you want me to try something on the 7D2?


Title: Re: Display access from bootloader / Portable binary test
Post by: Pelican on April 04, 2015, 09:14:03 PM
Quote from: Ottoga on April 03, 2015, 01:31:18 AM
Loaded this onto my cf card (7D). When I turned on the camera, the led flashed a couple of times and nothing.

That is:
- no image appeared on the screen
- ML didn't load
- canon menu operational

The autoexe.bin used was downloaded from the link in Alex's 1st post.

Should I be doing anything else to "run' it?


Use the autoexec from g3gg0's link.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on April 04, 2015, 09:52:22 PM
@rpt: my fault, I probably uploaded the VxWorks experiment by mistake (solved, download again).

The binary from first post should now work on 7D as well.
Title: Re: Display access from bootloader / Portable binary test
Post by: rpt on April 04, 2015, 10:55:04 PM
A1ex, Thanks, that sorted out the 5D3 issue. Here is the image from the 5D3:
(https://farm8.staticflickr.com/7643/17032534442_c468c0e745_c.jpg) (https://flic.kr/p/rX7c5W)
20150405_015915 (https://flic.kr/p/rX7c5W) by Rustom (https://www.flickr.com/people/64926965@N00/), on Flickr

However, it did not install on the 7D2. Please note I have a 7D2 and not the 7D. I tried to load it using the firmware update but got the following message. Attached are the two images - one before starting the firmware update and the other when it tried to do the firmware update.
Before selecting firmware update on the 7D2:
(https://farm8.staticflickr.com/7646/17007970396_fe744494c1_c.jpg) (https://flic.kr/p/rUWi3U)
20150405_020525 (https://flic.kr/p/rUWi3U) by Rustom (https://www.flickr.com/people/64926965@N00/), on Flickr

After doing the firmware update on the 7D2:
(https://farm9.staticflickr.com/8735/17007993186_51b338f71f_c.jpg) (https://flic.kr/p/rUWpPQ)
20150405_020557 (https://flic.kr/p/rUWpPQ) by Rustom (https://www.flickr.com/people/64926965@N00/), on Flickr

Is there something else I need to do? Do you want me to do any other test?
Title: Re: Display access from bootloader / Portable binary test
Post by: Licaon_Kter on April 04, 2015, 11:10:19 PM
7D2 is not (yet) supported: http://builds.magiclantern.fm/#/features
Title: Re: Display access from bootloader / Portable binary test
Post by: rpt on April 04, 2015, 11:15:25 PM
Thanks. I kind of knew that but was hoping for a miracle. You guys are great at miracles :)
Title: Re: Display access from bootloader / Portable binary test
Post by: Ottoga on April 05, 2015, 06:33:51 AM
Done.

https://www.dropbox.com/s/lrcyydx5re98ysq/7D_Magic_Rescue_screenshot.jpg?dl=0 (https://www.dropbox.com/s/lrcyydx5re98ysq/7D_Magic_Rescue_screenshot.jpg?dl=0)

My original attempt failed due to the CF card having had its bootflag reset (probably something that I did the last time I used it)

For the above screenshot, the image was displayed without my needing to power on the camera. (is this how it should work?). I had to remove and reinsert the battery in order to get the camera working again.

Cheers
Title: Re: Display access from bootloader / Portable binary test
Post by: kitor on April 24, 2015, 12:21:42 AM
(http://i.imgur.com/3Dx2JGy.jpg)
My broken ERR50 50D
Title: Re: Display access from bootloader / Portable binary test
Post by: dukeonee on November 09, 2015, 04:29:34 PM
Hello,

I am at a time where my 5D2 is bricked. The LCD screen and top right screen is blank/black; when turning it on the red light flashes erratically. One thing is that when I press the shutter it will take a photo.. (sounds like a half attempt of a shuttler and doesn't save a photo). When I press the liveview the mechanism inside turns on but the screen is blank.

My cards were reformatted. I don't remember what build I was using. How do I create a FIR to use for autoexec.bin file.

I hope people can help me here or lead me to reviving my camera. very much appreciate it.
Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on November 09, 2015, 04:33:47 PM
You don't have to use FIR to enable cards. Run EOScard or MacBoot to make card bootable. Wipe Autoexec.bin and ML directory and replace it with latest nightly build or put diagnostic Autoexec.bin to card for "Screen test".
Title: Re: Display access from bootloader / Portable binary test
Post by: justenS on January 14, 2016, 04:09:32 PM
(http://i68.tinypic.com/2hf4f2d.jpg)
So this is what I get.
What can I do now, my camera won't start up.
There is only a red light flickering when I insert the battery.
Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on January 14, 2016, 04:21:13 PM
First: Rescale pic.
Second: It works exactly this way.

Format the card in cardreader now. -> ML deleted from card
Or delete autoexec.bin and copy extracted nightly build contents to card. If you want to use ML ...
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on January 25, 2016, 08:55:39 AM
I did a small update to display initialization routine (noticed Canon actually calls those from RAM, not from ROM).

Do you mind checking if it still works? No need to upload new screenshots, just a confirmation (works or not).

Link is the same (first post).
Title: Re: Display access from bootloader / Portable binary test
Post by: Oswald on January 25, 2016, 09:36:20 AM
(http://uploads.tapatalk-cdn.com/20160125/6b8ce6a26ae18bc3a155890cf15419b8.jpg)

100d b version.
Title: Re: Display access from bootloader / Portable binary test
Post by: nikfreak on January 25, 2016, 06:40:50 PM
I can confirm the new autoexec.bin is working for 100D.100B & 70D.111A:

100D.100B isn't able to print the "Camera Model" text [? ? ?] as seen in pic before my post.
Title: Re: Display access from bootloader / Portable binary test
Post by: Licaon_Kter on February 02, 2016, 10:27:57 PM
EOS M


what's that 9.9.8 somethingsomething ?


(https://i.imgur.com/AOs2Y2B.jpg)
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on February 03, 2016, 12:49:38 PM
Some internal sub-version number. For example, what we call 70D 111A/111B have the main version number 1.1.1 and the other numbers differ.

Nikfreak used these extra numbers to identify the firmware sub-version from modules, for example.
Title: Re: Display access from bootloader / Portable binary test
Post by: veeman on March 04, 2016, 03:53:27 AM
I've run the diagnostic tool and have attached a pic of the screen. The tool runs fine, but when the regular autoexec.bin is replaced, the screen is blank when turned on. The red led on the bottom right blinks once every time I open card door or insert battery.
(http://i.imgur.com/IupUgPx.jpg?1)
Thanks for your help.
Title: Re: Display access from bootloader / Portable binary test
Post by: Licaon_Kter on March 04, 2016, 09:59:42 AM
You've just replaced AUTOEXEC.BIN and not deleted ML-SETUP.FIR (or whatever the FIR is named), right?
Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on March 04, 2016, 10:03:45 AM
It doesn't matter if a FIR is located there or not in this situation. FIR is used only during installation (Firmware Update in Canon menu).

Make sure to have all other ML files there, too. Autoexec.bin + ML directory (with contents there, of course).
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on March 04, 2016, 10:21:43 AM
Hint: check other posts from the same user before replying ;)
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on July 15, 2016, 11:54:08 PM
Portable display test updated for DIGIC 6 cameras - FIR files available on request.

(http://a1ex.magiclantern.fm/debug/portable-hello-world/80D/PALE180D.jpg)
Title: Re: Display access from bootloader / Portable binary test
Post by: Licaon_Kter on July 16, 2016, 01:19:18 AM
So 750D, 760D, 80D, EOS M3, 7D Mark II, 5DS and 5DS R ?  8) :o
Title: Re: Display access from bootloader / Portable binary test
Post by: ddelreal on July 16, 2016, 03:07:36 AM
Quote from: Licaon_Kter on July 16, 2016, 01:19:18 AM
So 750D, 760D, 80D, EOS M3, 7D Mark II, 5DS and 5DS R ?  8) :o

7D Mark II would be incredible. Good news that there is progress on the DIGIC 6.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on July 16, 2016, 10:38:25 AM
(http://a1ex.magiclantern.fm/bleeding-edge/7D2/DISP-7D2.JPG)

(thanks atonal)
Title: Re: Display access from bootloader / Portable binary test
Post by: DeafEyeJedi on July 26, 2016, 11:41:30 AM

Quote from: g3gg0
@DeafEyeJedi:
can you try the one from my last post too?

Sorry didn't realize I missed out on this one. My bad!

(https://c5.staticflickr.com/9/8870/28452856452_9d6ef9d428_n.jpg) (https://flic.kr/p/KmhjWy)

Thanks @a1ex for the reminder.
Title: Re: Display access from bootloader / Portable binary test
Post by: Bens8806 on July 29, 2016, 10:30:41 PM
Not sure if this thread is still active but my 70D recently stopped working on me. The top screen works with all button functionality but the rear LCD does not come on, and the shutter button doesn't work. The SD card is also not recognized when one is inserted, with magic lantern or not. So when I heard about this, I tried it and got it to pop up. Here is my screenshot. PLEASE HELP! I do not want to send my camera to canon only for them to backdoor into it and reset the firmware or something easy and charge hundreds of dollars for that to happen.
(http://i284.photobucket.com/albums/ll25/Bigfoot14788/IMG_0983_zpsqe7twuuv.jpg)
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on July 30, 2016, 04:00:28 AM
Try this ROM dumper (http://www.magiclantern.fm/forum/index.php?topic=16534.0) and send me the resulting files. Also please send me your old ROM files, which you should have saved during ML installation (or any older copy you can find on your card, under ML/LOGS).

Do you have access to a second camera that runs ML, or to a phototransistor that you can connect to your soundcard input like this (http://chdk.wikia.com/wiki/Obtaining_a_firmware_dump#Using_soundcard_input)? We may need it to see Canon's debug messages during startup.

(I'll move your post to the emergency section)
Title: Re: Display access from bootloader / Portable binary test
Post by: rpt on July 30, 2016, 08:40:53 AM
Here is my image for the 5D3 firmware 123


(https://c3.staticflickr.com/9/8866/28538153282_a4f55d2db2_c.jpg)
20160730_115241 (https://flic.kr/p/KtPuHy) by Rustom Taraporevala (https://www.flickr.com/photos/rustom/), on Flickr


Is there a test for the 7D2 that I can do?
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on September 29, 2016, 12:13:52 AM
Managed to emulate the 1000D and the old 5D in QEMU, so I could debug the VxWorks display test as well. There were many mistakes, regarding load address, caching bit, FIR signing... probably impossible to figure out blindly.

Portable autoexec: autoexec.bin (http://a1ex.magiclantern.fm/debug/portable-hello-world/autoexec.bin) (works on any EOS camera with the bootflag enabled, from DIGIC 2 to DIGIC 6)
For 1000D: DISP1000.FIR (http://a1ex.magiclantern.fm/debug/portable-hello-world/DISP1000.FIR) (tested in QEMU)
For 450D: DISP450D.FIR (http://a1ex.magiclantern.fm/debug/portable-hello-world/DISP450D.FIR) (tested in QEMU)
For 40D: DISP_40D.FIR (http://a1ex.magiclantern.fm/debug/portable-hello-world/DISP_40D.FIR) (tested in QEMU)
For 30D: DISP_30D.FIR (http://a1ex.magiclantern.fm/debug/portable-hello-world/DISP_30D.FIR) (not tested)
For 5D: DISP__5D.FIR (http://a1ex.magiclantern.fm/debug/portable-hello-world/DISP__5D.FIR) (tested in QEMU)

FIR files for other models (any DIGIC) available on request.
Title: Re: Display access from bootloader / Portable binary test
Post by: DeafEyeJedi on September 29, 2016, 06:16:17 PM
Excellent progress @a1ex!
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on September 30, 2016, 09:56:44 AM
Hi Alex, I'm interested in the 1000d file, but the links to the fir files seems dead ?

Are these FIR files to be used to enable the bootflag on these camera models ? Seems like a yes
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on September 30, 2016, 10:11:15 AM
Fixed the links (and also added the 450D).

The portable autoexec was confirmed to work on 400D by eduperez:

(http://a1ex.magiclantern.fm/debug/portable-hello-world/VxWorks/400D.jpg)
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on September 30, 2016, 12:54:05 PM
I can't update the firmware with the FIR on the 1000d with current firmware version 1.0.7.

I put the FIR file on a SD card.
Run firmware update from Canon menu.
It asks me if I want to update, I press OK.
After that A screen appears,
----------------------------------
Firmware update program

          Loading...

----------------------------------
After a second or so, the color of the letters and the background color changes.
After another second, the background starts flickering/flashing and this goes on forever...waited for more then 5 minutes...
The camera doesn't react to the on/off switch.
So I pulled the battery out and restart the cam, still works like before  :D

Is there something wrong with the FIR file ?




Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on September 30, 2016, 01:18:32 PM
Yes, forgot to include this fix (https://bitbucket.org/hudson/magic-lantern/commits/9f59a1a4dc46), should be fine now.

These FIRs contain only the display test; they won't modify anything in the camera.




BTW, the 40D, the 450D and the 1000D can do:

- in-camera MJPEG ( 40D PoC (http://www.magiclantern.fm/forum/index.php?topic=1452.msg10770#msg10770) )
- RAW video ( lv_save_raw )
- full-res silent pictures ( FA_CaptureTestImage )
- most other ML stuff ( 40D only needs minor tweaks apparently (http://www.magiclantern.fm/forum/index.php?topic=1452.msg172529#msg172529) )

If there is interest, I can help with the boot process (the hard part) and let you figure out the rest.
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on September 30, 2016, 03:26:53 PM
Yeah, LIVEVIEW can give the good ML features  :D

Downloaded the updated FIR file for 1000d, still got the flickering display.
Only this time the colors are different, and the text below disappears (in the other FIR file, the text was visible during flickering)
----------------------------------
Firmware update program

          Loading...

----------------------------------
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on September 30, 2016, 03:59:40 PM
I'm interested in a 1000d Port.
Full-res silent pictures would make it a great time-lapse camera  8)

I've got time, so if I can be guided trough the so called easy part  :P I can give it a try.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on September 30, 2016, 04:16:08 PM

Quote from: Levas on September 30, 2016, 03:59:40 PM
I've got time, so if I can be guided trough the so called easy part  :P I can give it a try.

Cool, the first - very easy - task is to blink the LED. You only need some google-fu skills (hint: use coutts' 1000d_dev repostitory).

I'll ask Edu to run a 400D FIR tonight. Not sure what's wrong - maybe the 1000D has only 64MB RAM, but the bootloader configures it as 128MB?!

(I'm placing the image buffer at 0x4000000 = 64MB, so this may explain the issue)
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on September 30, 2016, 04:35:46 PM
'(I'm placing the image buffer at 0x4000000 = 64MB, so this may explain the issue)'
Does this mean you updated the FIR file and can I give a new try ?
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on September 30, 2016, 04:45:36 PM
I've found coutts' 1000d_dev repostitory

Did run the 1000d.FIR that comes with it, and now I have a 1000d with blinking blue led.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on September 30, 2016, 09:06:55 PM
Alright, now make both LEDs blink, in alternating sequence.

Updated the 1000D FIR too.
Title: Re: Display access from bootloader / Portable binary test
Post by: Ant123 on October 01, 2016, 12:17:31 AM
(http://thumbnails115.imagebam.com/50716/17c67d507155976.jpg) (http://www.imagebam.com/image/17c67d507155976)
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on October 01, 2016, 04:29:14 PM
1000d works too now!

https://drive.google.com/drive/folders/0B1BxGc3dfMDaYjV5eTlyNWdjcVU?usp=sharing

Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on October 01, 2016, 04:53:46 PM
Hm, so it most likely has only 64MB...

In this case, you can replace raw video with a handful of LiveView silent pictures :P
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on October 01, 2016, 04:56:39 PM
I can live with that  ;)
My interest is in the full res silent picture function of ML in combination with the timer options  :D
Title: Re: Display access from bootloader / Portable binary test
Post by: mir66 on November 03, 2016, 08:44:53 PM
For 5D: DISP__5D.FIR (tested in QEMU)
Is there something wrong with the FIR file ?
1. Firmware Ver. 1.1.1
2. Current version is 1.1.1 Update?
3. OK
4.Firmware update program
Update file cannot be found.
Please check the memory card and reload the battery and try again.
5.After reset:
Firmware update program Loading... and black screen.

regards
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on November 03, 2016, 09:04:15 PM
Probably. Can you send me a ROM dump so I can try to debug it?
Title: Re: Display access from bootloader / Portable binary test
Post by: mir66 on November 03, 2016, 10:35:43 PM
1.http://www.magiclantern.fm/forum/index.php?topic=16534.0
This metod not working. Only black screen.
2.http://www.magiclantern.fm/forum/index.php?topic=14732.0
This metod:
(http://www.rema.com.pl/okladki_tmp/testEOS5D.jpg)
What can I do it?

3.http://www.magiclantern.fm/forum/index.php?topic=1010.0
Working ok!
regards
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on November 04, 2016, 09:33:12 AM
Alright, so the problem is only with the FIR; the autoexec method works fine.

The portable ROM dumper doesn't work on very old models (5D2/500D generation and earlier) because their bootloaders don't have file writing functions (or at least I wasn't able to find them).

You can get the ROM dump from ML (Debug menu).
Title: Re: Display access from bootloader / Portable binary test
Post by: mir66 on November 04, 2016, 10:08:07 PM
I'm confused. What must I doing?
Thank you for your help
Soft ML for 5Dc - Beta 4
Debug
1. Don't click me
2. Stability tests
3.Show tasks
4. Image Buffers: 540x426, 540X426
5. Free memory 2525K
6. CMOS Temprat: 141 (raw)
7. Snap Simulation: Take real pic
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on November 07, 2016, 02:25:00 PM
My bad, didn't notice it wasn't enabled back then; will send you a test binary by PM.
Title: Re: Display access from bootloader / Portable binary test
Post by: mir66 on November 07, 2016, 10:12:09 PM
Thank You.
Now, dump ROM is enabled in menu ML.
After pressing SET only black screen. Screen on top camera normal working. It is possible now take the picture. Nothing written to the card.
What now. Any idea?
Regards
Title: Re: Display access from bootloader / Portable binary test
Post by: chakawa on November 26, 2016, 03:26:08 AM
Hello,

My 5dmkII who had been long running with ML without probs, just froze suddenly.
I have placed the autoexec file (portable display test) on the card ; and got a long log. Don;t understand any of it and does not look like I can attach it to my post (can I ?)
Basically there was an almost non visible dark screen with dark small grey lines horizontal. And when I turn the camera off and on again, it did not repeat the display.
Then I placed the second autoexec file (LED blink test) ; and there was no blink happening.

Assuming I needed to remove the original ML Autoexec manually from the card : is that right ?

Any advice would be greatly greatly appreciated

Thanks in advance
Chakawa
Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on November 26, 2016, 11:07:42 PM
Did you remove/insert battery before/after running tests?
Title: Re: Display access from bootloader / Portable binary test
Post by: chakawa on November 28, 2016, 12:34:59 AM
Thanks for your reply.
Yes I did.

Also, I just replaced the battery with a new one and all what's happening is it is blinking red (kind of same as it does normally) but nothing showing up on LCD and camera does not boot.

Also pls note that the camera does not do anything (not even blinking) without any CF card inserted (with new battery).

What next step should I take ? Should I re-install ML completely ?

Thanks in advance
Chakawa
Title: Re: Display access from bootloader / Portable binary test
Post by: Brian Blagowsky on February 25, 2017, 12:17:06 AM
After having my camera lock up yesterday when I tried to insert a new CF card after receiving a prompt that the one I was using was full, I have been trying everything to get my 5DII to recognize my CF cards. I have tried erasing them using my Mac since I can't get the camera to format them or even recognize them.
After hours of messing with it, I finally got a card that I had reformatted as MS-DOS FAT, and then loaded the auto exec.bin file and the latest ML folder from the nightly builds, along with the DCIM and MISC folders, to do something other than lock up. I got a Magic Lantern Rescue screen upon startup.  I have tried to drag and drop, or upload the photo I took, but can't get either to work, so I will type out what was on the screen:

Magic Lantern Rescue
------------------------------------
- Model ID: 0x218 5D2
- Camera model: Canon EOS 5D Mark II
- Firmware version: 2.1.2 / 6.9.8 A1(00)
- IMG naming: 100EOS5D/IMG_0000.JPG
- User PS:      Cinestyle
- Boot flag: FIR=0 BOOT=-1 RAM=-1
- ROMBASEADDR: 0xFF010000
- ROMBASEADDR: 0xFF810000
- DONE!

You may now remove the battery.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on April 27, 2018, 04:17:12 PM
Here's a small experiment that applies to all EOS cameras from DIGIC 2 to 6, as long as they have the boot flag enabled. I'm trying to autodetect the ROM layout (https://bitbucket.org/hudson/magic-lantern/commits/9c405ce1c8eca1acc057fff38ac309ee672b119a), as - at least on DIGIC 6 - there seem to be another memory region, unknown to us at the time of writing.

autoexec.bin (http://a1ex.magiclantern.fm/debug/portable-rom-layout/autoexec.bin)

In particular, I'm interested in test results on the following models:
- 5D, 400D (DIGIC 2)
- 1000D (DIGIC 3, 64MB RAM - applied the fix discussed earlier in this thread)
- 7D
- any small DIGIC 5
- 6D, 70D
- all DIGIC 6 models with boot flag already enabled
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on April 27, 2018, 05:09:45 PM
Tried it on my 1000d, with bootflag enabled, but nothing happens  ???

I've put the autoexec.bin on a bootable SD card and put in the 1000d, turn it on and nothing special seemed to happen ?
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on April 27, 2018, 05:19:39 PM
What exactly do you mean by "nothing happens" ?

- camera loads Canon firmware? (if yes: either card is not bootable, or camera doesn't have the boot flag enabled)
- black screen? (if yes: that's a bug in the display init routine)
- something else?
Title: Re: Display access from bootloader / Portable binary test
Post by: dfort on April 27, 2018, 05:24:51 PM
Looks like it worked on the EOSM2

(https://farm1.staticflickr.com/911/41739455691_3f7aeb8cab.jpg) (https://flic.kr/p/26AnBZM)

The test didn't save anything to the card--assume that it only prints to the LCD?
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on April 27, 2018, 05:34:20 PM
On 1000d it loads canon firmware...
The same card in my 6d works, so it isn't the card...
On 6d:
(https://farm1.staticflickr.com/973/26871313237_cd5c022084.jpg)

Hmm, I had boot flag on 1000d enabled in the past, not sure if I kept it that way  ???
Title: Re: Display access from bootloader / Portable binary test
Post by: Levas on April 27, 2018, 05:36:24 PM
Wait, I'm not sure that I enabled boot flag on the 1000d, the testing from years ago was with FIR files, not with autoexec.bin files...
How do I enable bootflag on the 1000d, is there a FIR file for that ?
Title: Re: Display access from bootloader / Portable binary test
Post by: dfort on April 27, 2018, 06:33:00 PM
More cameras

EOSM
(https://farm1.staticflickr.com/948/41022850194_3d3c5470a4.jpg) (https://flic.kr/p/25v3Q9A)

500D
(https://farm1.staticflickr.com/975/41022849914_997e39728d.jpg) (https://flic.kr/p/25v3Q4L)

700D
(https://farm1.staticflickr.com/828/41740674551_fb093f94f9.jpg) (https://flic.kr/p/26AtSjB)

7D
(https://farm1.staticflickr.com/904/41740674751_d63ac47cbb.jpg) (https://flic.kr/p/26AtSo4)

Wondering if the 7D is showing the address for the Master processor?
Title: Re: Display access from bootloader / Portable binary test
Post by: Ant123 on April 27, 2018, 07:19:47 PM
EOS 450D

(https://preview.ibb.co/eu8Qmx/450D.jpg) (https://ibb.co/gTTfKH)

The background is black.
Title: Re: Display access from bootloader / Portable binary test
Post by: a1ex on April 27, 2018, 07:53:00 PM
Looks like it worked :D

It identifies unused areas (1 byte repeated many times) and actual ROM size (unique size x number of repetitions).

Not touching master on 7D yet. The memory map configured at startup app references 0xE0000000, so I thought it must be something there. 80D references 0xEE000000, but locked up on both 0xEE000000 and 0xE0000000.


7D:
FFFF2374: MCR p15,0,Rd,cr6,cr2,0:  946_PRBS2 <- 0xE0000039 (E0000000 - FFFFFFFF, 0x20000000)

80D:
[CPU0] FE0258E4: MCR p15,0,Rd,cr6,cr2,0:       RGNR <- 0x5       
[CPU0] FE0258EC: MCR p15,0,Rd,cr6,cr1,0:      DRBAR <- 0xEE000000
[CPU0] FE0258F4: MCR p15,0,Rd,cr6,cr1,4:      DRACR <- 0x329      (P:RW U:RW; Inner Write-back, write-allocate; Outer Write-back, write-allocate; Non-shared)
[CPU0] FE0258FC: MCR p15,0,Rd,cr6,cr1,2:       DRSR <- 0x31       (0x2000000)
Title: Re: Display access from bootloader / Portable binary test
Post by: ArcziPL on April 27, 2018, 08:00:17 PM
70D:
(https://s25.postimg.cc/kasslfuwv/rescue_autodetect_70d.jpg)


700D (slightly different output than posted by dfort):
(https://s25.postimg.cc/x26yrycen/rescue_autodetect_700d.jpg)
Title: Re: Display access from bootloader / Portable binary test
Post by: aprofiti on April 27, 2018, 09:53:57 PM
50D if needed:
(https://s14.postimg.cc/d6bkebod9/20180427_213021.jpg) (https://postimg.cc/image/d6bkebod9/)
Title: Re: Display access from bootloader / Portable binary test
Post by: sombree on April 28, 2018, 07:11:40 AM
760D:
(https://i.imgur.com/4YcmBq7.png)

80D:
https://www.magiclantern.fm/forum/index.php?topic=17360.msg200716#msg200716
Title: Re: Display access from bootloader / Portable binary test
Post by: toms on May 11, 2018, 11:20:49 PM
750D:

Magic Lantern Rescue
----------------------------
- Model ID: 0x393 750D
- Camera model: Canon EOS K393
- Firmware version: 1.0.0 / 8.5.1 B4(52)
- IMG naming: 100CANON/IMG_2722.JPG
- Boot flag: FIR=0 BOOT=-1 RAM=-1 UPD=-1
- ROMBASEADDR: 0xFE0A0000
- F0000000-F7FFFFFF: byte 0x0 x 0x8000000
- F8000000-FBFFFFFF: byte 0x0 x 0x4000000
- FCE00000-FCFFFFFF: byte 0xFF x 0x200000
- FD400000-FD4FFFFF: byte 0xFF x 0x100000
- FCA00000-FDBFFFFF: byte 0xFF x 0x200000
- FDF00000-FDFFFFFF: byte 0xFF x 0x100000
- FC000000-FFFFFFFF: uniq 0x2000000 x 0x2
- DONE!

You may now remove the battery.
Title: Re: Display access from bootloader / Portable binary test
Post by: critix on May 26, 2018, 05:51:34 PM
For Canon 1300D can you give me FIR file?
Thanks a lot.
Title: Re: Display access from bootloader / Portable binary test
Post by: JagoUK on August 27, 2018, 02:59:09 AM
7D mk2

(https://thumb.ibb.co/eM2Zq9/romlayout_sd.png) (https://ibb.co/eM2Zq9)


(https://thumb.ibb.co/d2Z5DU/Display_Tester_SD.png) (https://ibb.co/d2Z5DU)
Title: Re: Display access from bootloader / Portable binary test
Post by: OneCameraDude on August 17, 2020, 04:15:56 AM
 @a1ex i recently got a 5dmkii from a friend and it's bricked. i was wondering if i can just run the autoexec.bin file or do i have to do something? idk im new to this lol
Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on August 31, 2020, 04:44:10 PM
If it is bricked you can't run standard installation procedure.
Portable Display Test autoexec.bin is able to run on a cam that has been enabled for ML (part of the installation process) with a bootable card (enabled by installation process or using PC and some software).
So: Is cam just dead in the water?
Title: Re: Display access from bootloader / Portable binary test
Post by: tor on February 15, 2021, 10:55:14 PM
Hello,

Just ran this test, here's the picture :

I've an issue with my 5D2, It doesn't read any CF card. I don't know how to fix it. I already open a topic (https://www.magiclantern.fm/forum/index.php?topic=25633.0) a few weeks ago but didn't get any answer, and tried to investigate a little further.

How can i make it work again ? I just need to make it boot on the right ML again !

Title: Re: Display access from bootloader / Portable binary test
Post by: Walter Schulz on February 17, 2021, 09:25:59 AM
There is no pic and you got an answer.