Canon 7D Mark II

Started by Pelican, November 02, 2014, 09:55:18 AM

Previous topic - Next topic

0 Members and 2 Guests are viewing this topic.

a1ex

Please find a test I'd like you to run on DIGIC 6 cameras: http://www.magiclantern.fm/forum/index.php?topic=17714

@JagoUK: normally, we enable the boot flag after being able to run user code on top of main firmware. I could try to enable it on the master processor from the bootloader (we did that on the old 5D), but the bricking risk is pretty high, because I have no idea what to do about the slave processor.

If any of you have a 7D2 body you don't mind tossing out, I can give it a try. It may be best to try on a cheaper DIGIC 6 body first.

JagoUK

Hi A1ex

Responded to your other post, as did atonal.

As for bootflag firmware.
I was under the impression the bootflag is a simple switch using a known command ENABLEBOOTFLAG and not sending random commands?
As long as there is not a bootable card in containing an Autoexec.bin the camera should boot properly no?

I appreciate running an Autoexec.bin with bad code could be a big problem though.

I am happy to give it a try if my interpretation is correct.

Would like to get on with being able to dump firmware as I have a photodiode connected via a raspberry pi but the recordings appear very noisy (Might be due to the pi)

Anyway let me know and i'll do what I can to help. I have already managed to compile your autoexec.bin so customising the code should be ok this end.

Cheers

ddelreal

Thanks @JagoUK for all your help. You, a1ex, atonal and others working on 7D2 are greatly appreciated!

JagoUK

No need to thank me, i've not done anything.

Any luck with this bootflag Alex?
I see you have a dumper for 80d, any chance of one for 7D2? Would really like to get a look at the FW. Obviously bootflag is more important as I could craft my own dumper if bootflag was enabled.

Cheers

a1ex

I've compiled the 80D dumper for 7D2 (DMPD-7D2.FIR), but given the previous tests on this camera, I don't have high hopes. But you are welcome to give it a try.

If it works, that would make the bootflag enabling process a lot easier.

JagoUK

Thanks for trying. Afraid it does not work. Camera locked up and wouldn't respond to power button or card flap. Had to take battery out.

https://www.dropbox.com/s/2vc6s05oi7tp0iz/7d2.png

There was an image embedded, but for some reason this forum does not like dropbox links in its own IMG tags? Untagged it now.

JagoUK

I tried to use the blinker last night to get the firmware out
I seem to be having the same issue as Fraggy where every byte seems the same.



QuoteSo i tested LCD Firmware... And it worked...
So next step is testing the extractor...
Got no sync...
Looks like every blink contains the same bit...

https://www.dropbox.com/s/2f91dqj1xd43t5b/7d2%20dump.png

a1ex

The blinker linked above is just a simple LED test.

I've compiled a dumper for 7D2 bootloader, using the CHDK soundcard method, here: BDMP-7D2.FIR. The decoder is under contrib/led_blink_dumper in the digic6-dumper branch.

DeafEyeJedi

Finally got the 7D2 in my hands from a co-worker. Downloaded and installed BDMP-7D2.FIR. Ran firmware update and now I get a constant led blink (no flashing) just stays on. I plan on taking the battery out. Am I expecting anything to be written on the card?

Also let me know if you still need me to run CPUI-7D2.FIR from CHDK cpuinfo thread?
5D3.113 | 5D3.123 | EOSM.203 | 7D.203 | 70D.112 | 100D.101 | EOSM2.* | 50D.109

Walter Schulz

Quote from: a1ex on August 22, 2016, 02:46:25 PM
I've compiled a dumper for 7D2 bootloader, using the CHDK soundcard method

DeafEyeJedi

Definitely needed coffee. Thanks for the reminder, Walter and now I gotta ask the guys around here at work to see if they have a soundcard device for me to use.
5D3.113 | 5D3.123 | EOSM.203 | 7D.203 | 70D.112 | 100D.101 | EOSM2.* | 50D.109

Walter Schulz

Your PC has no mic input jack?

DeafEyeJedi

My MBP does have an input jack ... if I were to find a 3.5mm jack and plug one end into the 7DII whilst the other end into the MBP -- which software can I use to read the LED blinker (if any)?
5D3.113 | 5D3.123 | EOSM.203 | 7D.203 | 70D.112 | 100D.101 | EOSM2.* | 50D.109

JagoUK

Quote from: a1ex on August 22, 2016, 02:46:25 PM
The blinker linked above is just a simple LED test.

I've compiled a dumper for 7D2 bootloader, using the CHDK soundcard method, here: BDMP-7D2.FIR. The decoder is under contrib/led_blink_dumper in the digic6-dumper branch.

Hi Alex.

Thanks for that, unfortunately I have had to order a new diode so will have to wait till tomorrow.

One thing I have noticed is that the flashing appears to stop after 5mins. Isn't this too quick for a 30MB dump?

Shame the dump to card does not work.

a1ex

Bootloader is 640K, so I guess it should be fine. This is the dumper that worked on 80D, but there we had to dump the entire thing. On 7D2, I need the two bootloaders, but I only know how to dump one of them.

JagoUK

Ah ok, BDMP-7D2.FIR is to dump the 1st Bootloader only (should have read closer!).

Wouldn't a dump of all the whole ROM capture both bootloaders?

ddelreal

You need a diode for the sound card method?

JagoUK

Quote from: ddelreal on August 22, 2016, 10:48:57 PM
You need a diode for the sound card method?

Yes, you capture the Blinks of the LED from the Card Port.

http://chdk.wikia.com/wiki/Obtaining_a_firmware_dump#Using_soundcard_input

I had it working with a Raspberry Pi on the GPIO port pin 18 too but this seems easier. I just cut off a 3.5mm jack off a set of old Apple headphone (4pole to match my laptop dual mic/headphone port.)

I was using an IRled that I shaved the IR coating off but it ended upbreaking after too much abuse so I just ordered a set of 20 photodiodes for £2

JagoUK

Quote from: a1ex on August 22, 2016, 10:26:31 PM
Bootloader is 640K, so I guess it should be fine. This is the dumper that worked on 80D, but there we had to dump the entire thing. On 7D2, I need the two bootloaders, but I only know how to dump one of them.

Hi Alex.

New photodiodes arrived.
Almost there, having some sync errors in the decoding, but interesting stuff coming out.

https://www.dropbox.com/s/qsopaubye3c5fd5/bootflag.png
https://www.dropbox.com/s/ky82acqbnnidkko/master-slaveRAM-ROM.png
https://www.dropbox.com/s/gworqqeu2zrbrem/SD-CF-SLAVE.png


JagoUK

Think I may have found the problem! AGC on my mic port. Now to find out if I can turn it off!

ddelreal

Yes, while in movie mode, you can go to the audio menu and switch to Manual.

Pelican

EOS 7D Mark II, EOS 7D, EOS 5, EOS 100 + lenses (10mm to 300mm), 600EX, 550EX, YN600EX x 3
EOScard, EOS DSLR firmwares, ARMu, NiControl, etc.: http://pel.hu/down

JagoUK

Quote from: ddelreal on August 23, 2016, 09:29:23 PM
Yes, while in movie mode, you can go to the audio menu and switch to Manual.

I was referring to the Mic input on Laptop.

Quote from: Pelican on August 24, 2016, 12:44:49 AM
http://superuser.com/questions/362343/how-do-i-disable-microphone-volume-auto-adjusting
Problem is it does it in Windows and Linux.

I have managed to get a 217K dump so far

ddelreal

Quote from: JagoUKI was referring to the Mic input on Laptop.

Ah, sorry.

Pelican

Quote from: JagoUK on August 24, 2016, 01:21:56 AM
I have managed to get a 217K dump so far
Haven't you used the dumper which dumps the 0xffff000-ffffffff area? That is only 64 kB.
EOS 7D Mark II, EOS 7D, EOS 5, EOS 100 + lenses (10mm to 300mm), 600EX, 550EX, YN600EX x 3
EOScard, EOS DSLR firmwares, ARMu, NiControl, etc.: http://pel.hu/down