Magic Lantern Forum

Magic Lantern Releases => Camera-specific discussion => Topic started by: Goonism101 on July 27, 2016, 04:44:28 AM

Title: Canon 750D
Post by: Goonism101 on July 27, 2016, 04:44:28 AM
@Alex I've been lurking these forums a while now. I've been waiting for some 7d Mark ii love and you guys are making progress with that (so thank you). However I also own a 750d. I wouldn't mind helping if it isn't too complicated. So let me know if you still need a volunteer for that. Thanks to all of you that put in this work for so many others.
Title: Re: Canon 750D
Post by: a1ex on July 28, 2016, 11:08:08 PM
(http://a1ex.magiclantern.fm/bleeding-edge/750D/6dflLnVM.jpg%3Alarge.jpeg)

Thanks Goonism101 and Austin Tsai.
Title: Re: Canon 750D
Post by: jacoblukas on July 29, 2016, 06:53:17 PM
I just stumbled upon this post, while browsing for some software tricks for my 750D. Having ML in my dslr would be a great thing, so I wonder how's the progress of implementing it in this model.
I could also help with testing and 'no-coding' related problems. Cheers. (:
Title: Re: Canon 750D
Post by: Walter Schulz on August 11, 2016, 10:22:21 AM
Just a reminder to whom it may concern: If you want to make things work you have to do something.

For 760D/750D [...] I have no feedback (I sent a few copies of the firmware dumper, but there was no response from the testers).

Sorry for double post!
Title: Re: Canon 750D
Post by: Roknix on August 16, 2016, 01:07:59 PM
Hello,

I'm also new here. I have a 750D and I can help maybe?

I have some skills in C#/C++ programming. But I never made a firmware like that. So I'm not sure where you need help and how I can help.

I also can test the Firmware if there are versions which are ready for testing. The only thing I need to know is, what I have to test ;)

Greez

Rok
Title: Re: Canon 750D
Post by: Walter Schulz on August 16, 2016, 04:09:42 PM
At the moment a1ex is looking for feedback from testers using his fimware dumper. If you want to take part contact a1ex.
Title: Re: Canon 750D
Post by: Roknix on August 16, 2016, 09:52:49 PM
Hello,

okey I've wrote him a PM. Thank you :)
Title: Re: Canon 750D
Post by: a1ex on August 20, 2016, 12:28:56 PM
Please find a ROM dumper for 750D that does not require additional hardware:

DMPD750D.FIR (http://a1ex.magiclantern.fm/bleeding-edge/750D/DMPD750D.FIR)

The dumper built from the same source code was confirmed to work on 80D, so be sure to read these details (http://www.magiclantern.fm/forum/index.php?topic=17360.msg171019#msg171019) before trying it. If you manage to get it working, please send me a PM.
Title: Re: Canon 750D
Post by: Roknix on August 20, 2016, 08:19:08 PM
Hello

I got this:

https://www.dropbox.com/s/ioumocc1foep3my/20160820_200801.jpg?dl=0

Nothing changing after minutes.

I think my SD-Card is to big. I will try a smaller one.

greez
Title: Re: Canon 750D
Post by: danielmcarmelo on August 21, 2016, 10:04:22 AM
Hello

I got this:

https://www.dropbox.com/s/ioumocc1foep3my/20160820_200801.jpg?dl=0

Nothing changing after minutes.

I think my SD-Card is to big. I will try a smaller one.

greez
I have the same problem and I have a micro sd of 64GB. Have you resolved? Thanks
Title: Re: Canon 750D
Post by: Walter Schulz on August 21, 2016, 12:45:54 PM
Try a smaller card. 64 GB might cause troubles.
Title: Re: Canon 750D
Post by: Roknix on August 22, 2016, 06:54:10 PM
Hello I can confirm it is working. I've used a 16 GB SD-Card.

Please find the following picture:

https://www.dropbox.com/s/tuoo947hde67942/20160822_184151.jpg?dl=0

Just let me know if you need more help.

Greez Rok
Title: Re: Canon 750D
Post by: joopdehoop on August 23, 2016, 11:54:53 AM
Have been using ML on my own 600d for a while now. Bought a 750d for work (I work at a university magazine) and was expecting ML to work on that too since the models are so similar. I see now that it's not as easy as I thought, so I'd like to help out to make it happen. Bit of an amateur programmer and comfortable , so maybe I can help out if somebody points me in the right direction. Testing for example.
Title: Re: Canon 750D
Post by: julienpierb on August 24, 2016, 02:08:13 AM
Hi!
I would like to help but I have about zero programming knowledge, but I know I can somehow be useful!
Please, point me in the right direction and I'll do my best.
Title: Re: Canon 750D
Post by: Randyc714 on October 19, 2016, 02:00:25 AM
Like others I stumbled into this when I upgraded from a T3i to the t6i and found out ML wasn't available. 

I did the load referenced in an earlier message and was able to get the same screen about removing the battery.  Of course, it didn't mean much to me other than to whet the appetite. 

How can I help? I'm perfectly willing to run tests whenever needed.
Title: Re: Canon 750D
Post by: thiagolobo on November 14, 2016, 07:46:29 PM
I am also willing to help. I am pretty familiar with embedded programming and own a 750D.
Title: Re: Canon 750D
Post by: Walter Schulz on November 15, 2016, 10:02:57 AM
Start reading dmilligan's reply in this thread: http://www.magiclantern.fm/forum/index.php?topic=18222
Title: Re: Canon 750D
Post by: Haldi on December 04, 2016, 03:48:03 PM
I've Upgraded from my 500D to 750D on Black Friday.
I'm looking Forward to the development done here.
If some Testing is needed i Can help out.
Title: Re: Canon 750D
Post by: Vandaalite on December 09, 2016, 09:39:20 PM
Okay guys,
I tried to put ML on my 750D, and the first step is working (launch the .FIR on an SD Card and see it working on the screen) but then, a1ex told me to run it in QEMU and to reverse engineer the ROM.
I absolutely don't know anything about Linux, so I give it to one of my friends which tried to launch the script (the one of a1ex on this topic : http://www.magiclantern.fm/forum/index.php?topic=2864.0) but he didn't managed it :/
So, if anyone could help ^^'

Thanks  :)

PS : Sorry if there's some English mistakes, I'm French :s
Title: Re: Canon 750D
Post by: Tchello on December 22, 2016, 02:50:28 PM
So...
I bought the T6i about 2 months ago, and i'm looking for ML.
I wanna know in which stage are you guys on, and if I could help even though I don't know anything about programming.
If there's any update/progress/super-early version, can you send me with the instructions about how to install?
Thanks to you all, and sorry for the bad english(I'm Brazilian)
Title: Re: Canon 750D
Post by: DanielDeclap on December 30, 2016, 09:32:06 AM
I have recently upgraded to a 750d and am interested in participating in testing.
Title: Re: Canon 750D
Post by: pablumm on January 09, 2017, 10:08:01 PM
Hello ML community. I got a brand new T6i for Christmas. You can count on my help for testing and minor debugging.
I had the chance to play with ML on an older camera model, it was awesome. Thanks for the tremendous work.
Title: Re: Canon 750D
Post by: transporter on January 18, 2017, 05:18:25 PM
Hi all, I would like to help with getting ml to run on the 750d.
I ran the rom dumper on my camera, and this is the result.
six files were written to the sd card, but i've no idea what to do with them.
A guide for old folk would be handy.

(https://dl.dropboxusercontent.com/u/16703480/eos750d.jpg)

Title: Re: Canon 750D
Post by: agilb01 on February 03, 2017, 07:13:50 PM
I would be willing to help test.  Please let me know what in particular you would like help testing. Or is this just general bug finding at the moment?
Title: Re: Canon 750D
Post by: a1ex on February 10, 2017, 09:57:54 PM
A generous user just offered to give a T6i (750D) to the ML community. The camera is currently in US, but can be sent to Europe as well.

If you are interested, please prove your skills by showing the firmware running in QEMU (loading autoexec.bin and starting your own task alongside Canon's). This step was already done for 80D. All the files required to complete this task are public, assuming you can borrow this camera from a friend to get a ROM dump.

There's no need to show the GUI, but you'll get massive credits if you manage to do that.
Title: Re: Canon 750D
Post by: Lenodroid on February 12, 2017, 01:23:01 PM
So im getting a bit far...

I managed to decompile (Dissambly) the Rom dumps now i quite need someone's help to get more far.... Because I am basically a Designer not more :/

Anyways i will publish the stubs in 10 Minutes :D

Thanks
Title: Re: Canon 750D
Post by: Lenodroid on February 13, 2017, 09:39:19 AM
So Quick Update:

I need someone who is ready to work with me. The .dis file is 410MB big the firmware dump.......

If someone is ready to bring ML to 750D please PM me...
Title: Re: Canon 750D
Post by: matteopd on February 27, 2017, 11:33:54 PM
Hi, how may I help? I'm ready to test!
Title: Re: Canon 750D
Post by: anh.102w on March 28, 2017, 07:09:47 AM
I have a 750D. I ready for testing if anyone need
Title: Re: Canon 750D
Post by: Krakl on March 29, 2017, 01:48:18 AM
hey guys is the ML already running on the T6i?
Title: Re: Canon 750D
Post by: Walter Schulz on March 29, 2017, 07:16:53 AM
No
Title: Re: Canon 750D
Post by: Vandaalite on March 29, 2017, 10:41:20 PM
Hi,
I still have my 750D, and I'm ready to run any build of ML on it, so if you need, send a message ;)
Title: Re: Canon 750D
Post by: felipemazieri on April 03, 2017, 04:07:08 AM
Hi, I have a T6i (750D) and tested the file DMPD750D.FIR, after I start the file on the camera, (which I had to do on an 8GB card that I had lost here, my 64GB 2 did not want to accept, it was locked on the first attempt) the camera generated these files:
(https://drive.google.com/file/d/0B6ZLuNNAGb0ZaWZLQTQtaW5iOU0/view?usp=sharing)

https://mega.nz/#F!cpph3TQB!sA5bKeagRAMkdipH6ygeHw
Title: Re: Canon 750D
Post by: spichtig on April 04, 2017, 12:32:50 PM
hey i'm also interested in ml for the 750d. i'm also willing to help.
i do have basic programming knowledge in java an c++, but i haven't even installed ml on another camera.
let me know if i can help, or if anyone already got ml running on an 750d.
Title: Re: Canon 750D
Post by: mkroshana on May 11, 2017, 12:53:19 PM
Any progress ?
Even it is buggy, I would like to test it.
Title: Re: Canon 750D
Post by: Greg on May 11, 2017, 05:15:46 PM
qemu job rom      - Firmware version: 1.0.0 / 8.5.1 B4 (52)
felipemazieri rom - Firmware version: 1.0.0 / 8.7.1 B5 (53)

(https://s30.postimg.org/lfwvvk3r5/750_D.png)

So 750D has several firmware versions something like 70D?
Title: Re: Canon 750D
Post by: nikfreak on May 11, 2017, 06:34:55 PM
Yes, 70D had two revisions and 100D even three revisions to deal with.
Around ~2.5 years after anouncing the cams Canon decided to release the first firmware.

Wish ya good luck and even less waiting time!

Edit: Still got the old branches active in my repo if you are interested to see how we dealt with the fw revisions:

https://bitbucket.org/nikfreak/magic-lantern/branch/70D-merge
Title: Re: Canon 750D
Post by: Greg on May 11, 2017, 08:09:29 PM
No worries, I prefer to buy the D3300 (it's cheaper than 1300D) than get a free 750D.
Title: Re: Canon 750D
Post by: OlliDeluxe85 on May 21, 2017, 11:50:12 PM
Hey Guys,

is there still anybody working on ML for the 750d?

I bought my cam yesterday without the knowledge, that ML doesn't work. If I had known that, I had bought the 700d.

Hope anybody get ML working  8)
Title: Re: Canon 750D
Post by: matteopd on June 30, 2017, 12:02:48 AM
I'm still here willing to help if someone more skilled tells me what to do or with what to start with.
Thank you
Title: Re: Canon 750D
Post by: rejathcr on July 04, 2017, 07:46:10 AM
(http://a1ex.magiclantern.fm/bleeding-edge/750D/6dflLnVM.jpg%3Alarge.jpeg)

Thanks Goonism101 and Austin Tsai.



Do u have the firmware file? If so plzzz send me it
Title: Re: Canon 750D
Post by: rejathcr on July 04, 2017, 07:48:06 AM
So Quick Update:

I need someone who is ready to work with me. The .dis file is 410MB big the firmware dump......

If someone is ready to bring ML to 750D please PM me...



I'm ready,I have a 750D,so let me check it out
Title: Re: Canon 750D
Post by: rejathcr on July 04, 2017, 07:55:24 AM
Hello I can confirm it is working. I've used a 16 GB SD-Card.

Please find the following picture:

https://www.dropbox.com/s/tuoo947hde67942/20160822_184151.jpg?dl=0

Just let me know if you need more help.

Greez Rok
I too installed the DMPRD759D.FIR and it took 14gb out 16gb and how to use ML in 750D
Title: Re: Canon 750D
Post by: snewpers on July 10, 2017, 10:57:02 AM
This was all so simple on my 550D  :-\

I'm confused to be honest, is there a working version for the 750D now or is this a bit of a dead end for the 750? If there's anything I can do to 'help' it would be no problem.

Thanks!
Title: Re: Canon 750D
Post by: Walter Schulz on July 12, 2017, 03:05:18 PM
Again: If there is no ML for your cam (and there isn't for 750D) act like there will be no ML port for this cam ever.

You can buildup your skills in programming ARM architecture in C and assembler.
Title: Re: Canon 750D
Post by: Ant123 on July 12, 2017, 06:33:45 PM
Walter Schulz

Are not you tired of answering stupid questions from new members?
Maybe it's need to oblige them to read the FAQ before they can leave comments?
Title: Re: Canon 750D
Post by: matteopd on August 09, 2017, 11:43:43 PM
Again: If there is no ML for your cam (and there isn't for 750D) act like there will be no ML port for this cam ever.

You can buildup your skills in programming ARM architecture in C and assembler.

Is there a guide to follow step by step to help?
Title: Re: Canon 750D
Post by: matteopd on August 09, 2017, 11:47:17 PM
So Quick Update:

I need someone who is ready to work with me. The .dis file is 410MB big the firmware dump.......

If someone is ready to bring ML to 750D please PM me...

Are you still here? I've tried to PM you several times.
Title: Re: Canon 750D
Post by: a1ex on August 10, 2017, 04:12:58 PM
Is there a guide to follow step by step to help?

To quote from another firmware project (https://www.snbforums.com/threads/asuswrt-merlin-on-rt-n18u.19305/page-2#post-180983):
Quote
It's not as simple as "copy these two or three files, then compile and it will work". I won't know what it specifically takes until I go through the trouble of doing it myself [...]

However, you can take a look at the recent ports (EOS M2, 1300D, 1200D, 100D, 70D) or the other D6 threads (80D, 7D2, 760D, 5D4, don't forget CHDK) or the sticky threads from development or reverse engineering areas. You'll find this question already answered.

This is a good overview for pre-D6 models: https://www.magiclantern.fm/forum/index.php?topic=19417.0
This is an easy coding task for D6: http://www.magiclantern.fm/forum/index.php?topic=17360.msg184533#msg184533
This is another one (to be done with QEMU): http://www.magiclantern.fm/forum/index.php?topic=17360.msg187372#msg187372
This is yet another one: http://www.magiclantern.fm/forum/index.php?topic=17627.msg179772#msg179772
Title: Re: Canon 750D
Post by: a1ex on September 03, 2017, 10:01:44 PM
Ready to enable the boot flag: http://www.magiclantern.fm/forum/index.php?topic=17360.msg189584#msg189584

BOOTU750.FIR (http://a1ex.magiclantern.fm/bleeding-edge/750D/BOOTU750.FIR)
Title: Re: Canon 750D
Post by: Vandaalite on September 18, 2017, 02:40:17 PM
Try to run it on my 750D, with the Firmware 1.0.0
It works :)
Title: Re: Canon 750D
Post by: matteopd on September 22, 2017, 02:12:22 PM
Ready to enable the boot flag: http://www.magiclantern.fm/forum/index.php?topic=17360.msg189584#msg189584

BOOTU750.FIR (http://a1ex.magiclantern.fm/bleeding-edge/750D/BOOTU750.FIR)

What's a boot flag?
Title: Re: Canon 750D
Post by: Walter Schulz on September 22, 2017, 02:20:00 PM
http://www.magiclantern.fm/forum/index.php?topic=7569.msg65360#msg65360
Title: Re: Canon 750D
Post by: matteopd on September 22, 2017, 02:33:19 PM
http://www.magiclantern.fm/forum/index.php?topic=7569.msg65360#msg65360

I thank you very much.

So what a1ex said in his last message is to use his file to enable the camera boots from the SD? But then, what to do if we do not have a proper ML file to upload on the SD cause it's on development?

Thank you
Title: Re: Canon 750D
Post by: Walter Schulz on September 22, 2017, 02:42:32 PM
That's the point.  We have a method to set bootflag on Digic 6 cams but we don't have much else. Portable Display Test file may work, though.
But still looking for something like "Hello, World!" running along with Canon's firmware loaded.

Tons and tons of work and unchartered waters ahead.
Title: Re: Canon 750D
Post by: matteopd on September 22, 2017, 10:06:59 PM
Ready to enable the boot flag: http://www.magiclantern.fm/forum/index.php?topic=17360.msg189584#msg189584

BOOTU750.FIR (http://a1ex.magiclantern.fm/bleeding-edge/750D/BOOTU750.FIR)

It's working.
(http://thumb.ibb.co/d5TOpQ/ML.jpg) (http://ibb.co/d5TOpQ)
Title: Re: Canon 750D
Post by: a1ex on September 22, 2017, 10:16:21 PM
Alright then - here's the FIR to enable the boot flag (on any firmware version):

BOOTF750.FIR (http://a1ex.magiclantern.fm/bleeding-edge/750D/BOOTF750.FIR).

This will modify your camera.

After enabling the boot flag in the camera, you may run:

- the portable display test (http://www.magiclantern.fm/forum/index.php?topic=14732.0) (copy autoexec.bin and make your card bootable)
- the portable ROM dumper (http://www.magiclantern.fm/forum/index.php?topic=16534.0) (you may have to format the card to a very small size, or dd this 256MB image (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/sd.img.xz) - howto (https://thepihut.com/blogs/raspberry-pi-tutorials/17789160-backing-up-and-restoring-your-raspberry-pis-sd-card))
- anything compiled from the recovery (https://bitbucket.org/hudson/magic-lantern/branch/recovery) branch (it runs from bootloader context); check Makefile.user.default for options
- the digic6-dumper (https://bitbucket.org/hudson/magic-lantern/branch/digic6-dumper) branch (start by adapting the 80D boot code, and aim for launching a user task alongside Canon firmware)

Good luck!
Title: Re: Canon 750D
Post by: Flance on September 24, 2017, 06:15:44 PM
Hey Alex, can’t I help out by being one your 750D testers if you need because I have my 750D whenever you need me :) look at message under
Title: Re: Canon 750D
Post by: Flance on September 24, 2017, 11:24:18 PM

(http://thumb.ibb.co/fzW5ok/image.jpg) (http://ibb.co/fzW5ok)

works perfectly fine.
Title: Re: Canon 750D
Post by: Chris71 on October 04, 2017, 08:11:22 PM
Hi Alex,

I haven't been on this forum since the ML development for the 550D.  :)

Recently I purchased a 750D. Since I enjoyed ML on the 550D, I hope that it will be possible to make it run on the 750D too.

Technically, I'm wondering if the 750D could be able to record 1080p videos at 50 or even 60 fps with ML. I guess that the Digic 6 processor would be able to handle this, because the 80D also has a Digic 6 and is able to record [email protected]
Title: Re: Canon 750D
Post by: a1ex on October 05, 2017, 09:02:49 PM
Hey - yeah, I remember the good old days :)

Here, it all depends on other 750D owners to jump in - you have ROM dumper, bootflag enabler, emulator, guides, docs, notes... even a free 750D (still) available for whoever decides to port ML on this camera (and proves their abilities).

I don't currently have a DIGIC 6 model, and unfortunately I no longer have the time and patience to do another ML port from scratch. Now it's your (DIGIC 6 and 7 owners') turn to drive the project forward.

I'll keep analyzing the DIGIC 6 models (look at 80D thread), maybe - hopefully - providing some GUI emulation for these models (that alone might take a couple of months or years), maybe a Hello World, and - of course - helping out whoever has the time, skills and motivation to complete and maintain the port (whether it's a DIGIC 2 or a DIGIC 7 or 8 or anything in-between).

This still applies: http://www.magiclantern.fm/forum/index.php?topic=17695.msg178750#msg178750

Good luck!
Title: Re: Canon 750D
Post by: t3r4n on October 21, 2017, 05:35:29 PM
Hi,
thanks to a1ex for his work.
So OK I'm willing to step in and help. My skillset includes programming micro controllers in assembler (back in the days it was the only "free" option to program atmel AVR chips before we got gcc and for the tiny ones still the best way). I can do a fair bit in C even though I'm not using it on a daily basis. Atlassian is not git but seems to be quite similar (no war regarding this statement please ;-) ).
   
So far I've been able to:
a) dump my ROM using the DMDP750.FIR
b) set the BOOT FLAG with BOOT750F.FIR

Questions
a) I've been reading here and in the CHDK wikis and found several Versions of the disassemble.pl script anyone with an idea which one to use best?  Does anyone use the CAPDIS and finish2 tools from CHDK? Is ARM-Console still usable with the digic6 and thumb2 processor?

b) with the bootflag enabled I've not been able to run any of the tools from a1ex post from 22nd of September. The card I'm using is a very old 256 MB card and according to fdisk on my Mac the partition is marked bootable. If I understand it right put the autoexec.bin on the card, put the camera dial on M and insert battery and turn on.
 
Title: Re: Canon 750D
Post by: a1ex on October 21, 2017, 09:18:38 PM
a) The one for ARMv7. For some reason I'm unable to load their wiki right now, so can't tell the exact link. Capdis works, ARM-console doesn't. There are many RE tools I didn't look into yet, and I expect many of them to work (look for Thumb2 or ARMv7 support).

b) The card must be bootable, see http://wiki.magiclantern.fm/install. The size restriction is only for the bootloader-based ROM dumper; other tools should work from any card (FAT12/16/32/EXFAT).

Knowing the AVR assembler will help a lot (the differences are small).

There are some half-successful experiments on the 80D thread, and some others with 5DS (recovery branch) so I recommend looking into these. You may try them in QEMU first (I'm looking for some help with proof-reading its README (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/) anyway).
Title: Re: Canon 750D
Post by: t3r4n on October 22, 2017, 09:24:46 AM
Hi a1ex,
thanks for the reply regarding booting I was able to solve that. On my way to the qemu directory I saw the the makeboot script and inside there I saw my fault of not giving the right name to the card ...  :-\

CPU Info from here http://www.magiclantern.fm/forum/index.php?topic=17714.25 (http://www.magiclantern.fm/forum/index.php?topic=17714.25) works as FIR not the autexec.bin Version (stalls after the second line). I will try to post some good images in the relevant thread later (during blanking the phone focusses out and when it has gained focus again the data already scrolled away  >:( and the camera with manual focus is not able to shoot its own back  ;)
The display Test http://www.magiclantern.fm/forum/index.php?topic=14732.0 (http://www.magiclantern.fm/forum/index.php?topic=14732.0) works but will show only one solid colour as background.
Model ID: 0x393 750D, Camera Model: EOS K393, Firmware 1.0.0 / 8.7

Regarding qemu after some trouble with python pip not working with the compiler I had enabled in my environment I was able to compile qemu and boot it with the default ML and my ROM in the end I got the same result as above.
 
Title: Re: Canon 750D
Post by: matteopd on November 11, 2017, 10:02:05 AM
Hi a1ex,
thanks for the reply regarding booting I was able to solve that. On my way to the qemu directory I saw the the makeboot script and inside there I saw my fault of not giving the right name to the card ...  :-\

CPU Info from here http://www.magiclantern.fm/forum/index.php?topic=17714.25 (http://www.magiclantern.fm/forum/index.php?topic=17714.25) works as FIR not the autexec.bin Version (stalls after the second line). I will try to post some good images in the relevant thread later (during blanking the phone focusses out and when it has gained focus again the data already scrolled away  >:( and the camera with manual focus is not able to shoot its own back  ;)
The display Test http://www.magiclantern.fm/forum/index.php?topic=14732.0 (http://www.magiclantern.fm/forum/index.php?topic=14732.0) works but will show only one solid colour as background.
Model ID: 0x393 750D, Camera Model: EOS K393, Firmware 1.0.0 / 8.7

Regarding qemu after some trouble with python pip not working with the compiler I had enabled in my environment I was able to compile qemu and boot it with the default ML and my ROM in the end I got the same result as above.

Hi t3r4n, where are you from?
Title: Re: Canon 750D
Post by: t3r4n on November 13, 2017, 10:10:24 PM
Hi,
@matteopd : is europe precise enough

@all :
I would like to summarise  the information I researched from various sources and garnish them with some questions:
- so my 750D has a processor called digic6 which is in fact 2(3?) processors in one chip the main one being an arm7 cortex
- being an arm7 cortex it understands two dialects of opcodes: arm and thumb2. To switch between the two a ldx or blx instruction is used. Our disassemblers have a problem in deciding when to use which dialect (still true or old information?)
- there is a co processor handling much of the io stuff the main processor talks to it via e.g. cdp mcr
- there is a tool enabling the boot flag on the camera. is there a source for that (could be that I'm missing the obvious)?
- qemu enters the firmware at 0x7c000008 why this odd (even though it is even :) ) address and not 0x7e02000 which is the firmware start? The first eight bytes at 0x7c000000 are no legal opcodes I understand.
- in the qemu code it says under digic6 .rom0 not yet dumped. is that something we are missing? haven't found anything in the forum on the topic
- I have been casually stepping through the startup code and noticed several loop doing nothing else but counting down r0 from e.g.. 0x20a or 0xf there are other loop copying stuff (e.g. from rom at 0xfe020000..40 to 0x0 in tcm.code) I assume these are to sync stuff and wait for some things to settle or is there any "magic" arm stuff I'm missing out?

At the moment I'm experimenting with radare2 as a replacement for gdb. It has some nice analysis features (if I had the money for IDA I would have bought a different camera instead ;) ) it is even possible to dry simulate an arm system without qemu attached.
The camera itself seems to have an interface in the battery compartment (JTAG? serial? ) Does anyone have information on that? I could 3D print a battery dummy an put connectors as they're used on testbeds for PCBs on it to get an interface but I'm a  bit reluctant to do this to my camera.

Well so far, more questions as they arise.
 




 

Title: Re: Canon 750D
Post by: a1ex on November 13, 2017, 11:07:05 PM
Cortex R4.

Start address: 0xFC000008 = *(uint32_t*)0xFC000000. Cross-check with EOS M3/M10 (dumps available on CHDK forum) - these have a really odd start address. Earlier models (before D6) start at FFFF0000.

Portable dumper source (works on all models): recovery branch, CONFIG_BOOT_DUMPER=y .

No idea what's in ROM0 - M3 has one at 0xFB800000, size 0x800000. I remember trying to dump from 0xF0000000 (where ROM0 is on earlier models) unsuccessfully, a long time ago. Can you try poking around?

There are a bunch of things copied from ROM to RAM before execution (-d romcpy to identify them from qemu). If some piece of code is copied to RAM, it's meant to run from there; otherwise, it's meant to run directly from the ROM.

Battery pins info: https://www.magiclantern.fm/forum/index.php?topic=7531

Most of the I/O (with hardware devices) is MMIO (C0000000 - DFFFFFFF) and there's also a custom interrupt controller. Coprocessors handle stuff like cache configuration, memory attributes, system registers etc - they can be found in ARM docs (ARM ARM v7 and Cortex R4 TRM). There are secondary processors as well - in particular, the MPU (http://www.magiclantern.fm/forum/index.php?topic=17596.0) handles buttons, shutter mechanism, lens communication, stores a few settings and maybe other stuff. Zico is likely the display controller, Xtensa (look it up on CHDK).
Title: Re: Canon 750D
Post by: t3r4n on November 14, 2017, 08:18:18 PM
Hey a1ex,
thanks for the quick reply.
Got the portable dumper working (on cam and qemu), someone posted two updates on the recovery branch yesterday  ;D.
About the rom0 I read about it in the qemu/hw/eos/mode_list.c under default digic6.
I will do some poking.

With the hardware in the battery compartment hmm looks doable. I'm missing the information on Voltage levels but other than that, by looking at the strings output of the rom, the factory menu behind akashimorino seems to offer some more "poking" options.
Title: Re: Canon 750D
Post by: a1ex on November 14, 2017, 11:34:47 PM
Yes, the dry-shell console is definitely useful; unfortunately it only works in QEMU on DIGIC 4 and 5. On D6, it only recognizes the first character, then it locks up...

To debug this: -d io,uart,int

I'm also interested in checking MPU serial console logs from older cameras (in particular, DIGIC 4, where the MPU architecture is known and documented, unlike newer models where it's just a black box), but it's a low-priority task for me (more like a curiosity).
Title: Re: Canon 750D
Post by: t3r4n on November 20, 2017, 07:10:02 PM
Is this picture https://www.aliexpress.com/item-img/The-original-mother-board-big-board-PCB-for-Canon-EOS-750D-Rebel-T6i-DS126571SLR-camera/32693901124.html (https://www.aliexpress.com/item-img/The-original-mother-board-big-board-PCB-for-Canon-EOS-750D-Rebel-T6i-DS126571SLR-camera/32693901124.html) all that is available? I'm not really willing to open mine. Someone must have dropped one so we can do an autopsy.
Title: Re: Canon 750D
Post by: spankyhiney on November 26, 2017, 06:21:27 PM
I also have a T6i 750D, I am a willing to help in anyway to forward progress on this ML project. 
Title: Re: Canon 750D
Post by: totka on November 29, 2017, 10:48:37 PM
Hey folks, I also happen to have a 750D and I would be glad to help you out. Unfortunately I have no programming skills.
Thank you all for all your work on this project !
Title: Re: Canon 750D
Post by: A8M on December 06, 2017, 04:19:39 AM
Well my T7i had a issue and wound up coming home with a new but older T6i.  Exactly where is everybody at on the development.  Just in the few minutes I've played with this thing the firmware is glitchy. 
Title: Re: Canon 750D
Post by: t3r4n on December 06, 2017, 07:35:19 PM
Development is a high word. Let's call it discovery.
When time permits I'm stepping through with qemu and start reading the arm docs with every new discovery. Understanding the minimal.c in the recovery branch and changing bits and pieces (@a1ex haven't found a ROM0 either all dumps in the 0xFxxxxxxx below 0xfc000000 returned nothing)

Question: does anybody know why the interrupt vector table gets build in the boot loader and then again once the "Bootloader END" is on stderr?
 
Title: Re: Canon 750D
Post by: a1ex on December 06, 2017, 07:46:12 PM
One is meant to be used in the bootloader (maybe some parts of the code require interrupts), the other is for main firmware. The two are separate pieces of code - you can't call bootloader functions from main firmware, or the other way.

If you look at M5 firmware, they went even further - there is a tiny bootloader, then a secondary bootloader that uses a DryOS core (!), and then it jumps to a second DryOS core which is probably the main firmware.