Quote from: a1ex on April 21, 2018, 12:21:43 PM
Edit: the EOS M50 appears to run EOS firmware (https://bitbucket.org/hudson/magic-lantern/commits/f6e763a002080605887dcc4a5c882b626fe97553) (other recent models, i.e. M3, M5, M6, M10 and M100, are based on PowerShot firmware). Looking for a volunteer to try the LED blinking test on this camera, too :)
+1
Hi! I've got an M50, a second camera, and I went out and bought a couple low-capacity SD cards. I'd love to help out with the blinking led test. Do I just use the standard one from the diagnostic tools thread (http://a1ex.magiclantern.fm/blink/autoexec.bin)? Does anyone have a link to instructions/materials that I might've missed to help me through the process?
Quote from: a1ex on April 24, 2018, 10:28:49 AM
Portable ROM dumpers (https://www.magiclantern.fm/forum/index.php?topic=16534) ready 8)
M50_DUMP.FIR (need a second volunteer who has either another camera to film the display, or a phototransistor connected to soundcard/arduino/whatever)
Emulation coming soon.
Hello a1ex!
Also got a M50 and a 2nd camera, would be happy to help as well.
Since the M50 is running EOS firmware, would that mean its easier to port Magic Lantern to it? :)
Quote from: acarboni on May 22, 2018, 05:40:24 PM
I went out and bought a couple low-capacity SD cards.
Really? You only need a small filesystem; card size doesn't matter. You can run the test on 128GB cards just as easy as on a 2GB card (in other words, both of them will have to be formatted at a smaller capacity anyway).
LED blinking FIR sent via PM.
Quote from: a1ex on June 04, 2018, 04:19:01 PM
LED blinking FIR sent via PM.
Trying to get it working on my M50,
I used dd to write the QEMU image suggested in here https://www.magiclantern.fm/forum/index.php?topic=16534.0 to my SD-Card, this it how it looks now:
root@cubeX:/home/freezer/Canon# fdisk -l /dev/sdd
Disk /dev/sdd: 59,5 GiB, 63864569856 bytes, 124735488 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000
Device Boot Start End Sectors Size Id Type
/dev/sdd1 99 506879 506781 247,5M 6 FAT16
And the file-structure within the FAT16:
root@cubeX:/media/freezer/EOS_DIGITAL# find .
.
./autoexec.bin
./LEDIDM50.FIR
./DCIM
./DCIM/autoexec.bin
./DCIM/LEDIDM50.FIR
./DCIM/100CANON
./DCIM/EOSMISC
./MISC
filesizes:
-rw-r--r-- 1 freezer freezer 604 Jun 4 19:16 LEDIDM50.FIR
-rw-r--r-- 1 freezer freezer 25312 Jun 4 20:07 autoexec.bin
I used the autoexec.bin from the Portable ROM-Dumper thread above and the .FIR provided. Copied them to both / and /DCIM
However nothing really seems to happen when turning it on with the SD-Card inserted. As far as I understand the .FIR file is to enable the boot-flag in the Canon Firmware, is there anything special needed to do to apply it?
Thanks!
Run "firmware update" from the original menu.
Quote from: ArcziPL on June 04, 2018, 11:28:58 PM
Run "firmware update" from the original menu.
Can't find any option to update firmware in the original menu.
EOS Utility seems to have an option for Firmware Update, not sure if that would work? Don't have a Windows installation right now.
You have to be in one of the following modes: M/Av/Tv/P. The camera manual describes it for sure. And don't use EOS Utility for that.
Page 299 of your manual contains a screenshot showing firmware information. Highlight/select this item and open sub-menu to access firmware update option.
@ArcziPL: Nope, Canon don't bother users with this kind of geeky stuff ...
Thanks,
got it now.
However when i confirm "Update firmware" with OK, the LCD screen goes black immediately with no LED blinking or anything else happening.
Have to remove the battery to revive it.
Hi all,
I've got a M50 and another camera (6D). I'm ready to help any developper to port ML on this camera.
I didn't find the FIR file to perform the LED blinking test on the M50.
Quote from: ldevulder on June 10, 2018, 05:23:09 PM
I didn't find the FIR file to perform the LED blinking test on the M50.
You need to get it from a1ex via PM.
Also read over posts from lovefilm because he tried running the M50 LED blinking test.
Canon released firmware update (https://www.usa.canon.com/internet/portal/us/home/support/details/cameras/eos-m-series-digital-cameras/eos-m50-body?subtab=downloads-firmware) for EOS M50.
Looks very much like DIGIC 7. Dual core.
EC412 READY
EC412 ICU Firmware Version 1.0.1 ( 6.8.0 )
ICU Release DateTime May 23 2018 15:50:06
...
[CPU0] [ init:e014499b ] task_create(PowerMgr, prio=20, stack=400, entry=e01448ed, arg=0)
[CPU0] [ init:e0558f51 ] task_create(DbgMgr, prio=1f, stack=0, entry=e0558ecf, arg=c81c78)
[CPU0] [ init:e0097255 ] CreateStateObject(DMState, 0xe09d49c0, inputs=22, states=2)
[CPU0] [ init:e004c24b ] task_create(EEPROM, prio=1f, stack=400, entry=e004bea5, arg=0)
[CPU0] [ init:e0044ea9 ] task_create(ROM0R, prio=11, stack=400, entry=e00448c1, arg=620004)
[CPU0] [ init:e0044ebb ] task_create(ROM1R, prio=11, stack=400, entry=e00448c1, arg=640006)
...
[CPU0] [ init:e0622337 ] register_func('EnableBootDisk', e062228b, 0)
[CPU0] [ init:e0622343 ] register_func('DisableBootDisk', e0622295, 0)
...
[CPU0] [ init:e0050521 ] task_create(Startup, prio=15, stack=2800, entry=e0050415, arg=c826a0)
[CPU0] [ init:e0040905 ] task_create(TaskMain, prio=1d, stack=0, entry=e0040525, arg=0)
[CPU0] [ Startup:e0558f51 ] task_create(PropMgr, prio=14, stack=0, entry=e0558ecf, arg=cc9264)
akashimorino
[CPU0] [ TaskMain:e00461e9 ] register_func('drysh', e07393e9, 0)
[CPU0] [ TaskMain:e00461ff ] register_func('NewTaskShell', e00461ad, 0)
[CPU0] [ TaskMain:e00461c9 ] task_create(EvShel, prio=18, stack=8000, entry=e0046105, arg=0)
[CPU0] [ EvShel:e05773eb ] task_create(LowConsole, prio=19, stack=800, entry=e005153d, arg=0)
[CPU0] [ EvShel:e05773eb ] task_create(ConsoleSvr, prio=18, stack=800, entry=e0051141, arg=0)
Open Console EC412[1]>...
EC412[1]>drysh
Dry[WarpPUX]> ?
[Kern]
extask memmap meminfo mkcfg dminfo exobjinfo stdlibcfg efatcfg
sysvers xd xm prio resume suspend release sem mutex event mq exit
Dry[WarpPUX]> memmap
e008f6c0 : Exception vector
000dc870 : Heap start
0x00114920(1132832)
001f1190 : Heap end
001f1190 : DRYOS system object
0x000094e0(38112)
001fa670 : DRYOS system memory
0x000e2200(926208)
000dc070 : Error exception stack start (PU0)
0x00000400(1024)
000dc470 : Error exception stack end (PU0)
000dc470 : Error exception stack start (PU1)
0x00000400(1024)
000dc870 : Error exception stack end (PU1)
df000000 : IRQ exception stack start (PU0)
0x00001000(4096)
df001000 : IRQ exception stack end (PU0)
df001000 : IRQ exception stack start (PU1)
0x00001000(4096)
df002000 : IRQ exception stack end (PU1)
Dry[WarpPUX]> meminfo -m
Malloc Information (onetime type)
Start Address = 0x000dc878
End Address = 0x001f0ec0
Total Size = 0x00114648 ( 1132104)
Allocated Size = 0x000018c8 ( 6344)
Allocated Peak = 0x000018c8 ( 6344)
Allocated Count = 0x00000008 ( 8)
Free Size = 0x00112d80 ( 1125760)
Free Block Max Size = 0x00112d80 ( 1125760)
Free Block Count = 0x00000001 ( 1)
Dry[WarpPUX]> sysvers
SystemIF 0.97
DRYOS version 2.3, release #0060+p2
MACH 0.50
TODO: figure out LED address(es), bootloader display registers and a way to dump the ROM. Currently running it from a modified 200D bootloader.
Edit: might have found the LEDs (drive values: on = 0xD0002, off = 0xC0003)
- 0: SD card LED 0xD01300E4
- 6: WLAN LED 0xD01300E4 (same LED?!)
- 7, 8, 10, 11: 0xD01300E4 (same LED?!)
- 1, 2, 3, 4, 9: unknown 0xD01301A4
- 5: ?! (no obvious MMIO activity)
Volunteers willing to run untested code are welcome.
Hi all,
Just received my shiny new M50 and then rapidly proceeded to wonder how I can make it do what it 'should' be able to do. ;)
I have read through this forum, and have not seen any definitive working versions of ML(Magic Lantern) for the M50. Can someone significantly more intelligent than myself in regards to firmware code injection, please advise current status of a functioning ML for the Canon M50 on the DIGIC 8?
Please let me know if there is anything I can do to help progress/assist with the project moving forward.
Thanks in advance! :)
Status:
- can run custom code (FIR files for now; I need to prepare those)
- can blink the LEDs
- can flip error screen from bootloader
- can jump to main firmware from FIR (no special tricks required)
- cannot boot main firmware with 200D code (likely easy to debug)
- can not display custom stuff on the screen, not even from bootloader (likely easy after seeing the bootloader)
I can prepare test files for #5, but not right now.
Thank you for the status update a1ex!
Please let me know if there is anything that I can do to help expedite any of the steps.
Thank you again! :)
Quote from: a1ex on April 21, 2018, 12:21:43 PM
Edit: the EOS M50 appears to run EOS firmware (https://bitbucket.org/hudson/magic-lantern/commits/f6e763a002080605887dcc4a5c882b626fe97553) (other recent models, i.e. M3, M5, M6, M10 and M100, are based on PowerShot firmware). Looking for a volunteer to try the LED blinking test on this camera, too :)
Does anyone know if Canon Basic is available on the M50 or EOS R(as with the M3)?
Maybe. The M50 ROM contains the following strings:
B:/script.req
uartr.req
FIO_GetFileInfo (%s) ver.req failed
(%s) ver.req Dir
for DC_scriptdisk
B:/Factory.m
B:/AutoTest.m
B:/Extend.m
I have not tested it, but it's worth trying (http://chdk.wikia.com/wiki/Canon_Basic).
There is some (different) scripting interface in DIGIC 5 DSLRs (https://www.magiclantern.fm/forum/index.php?topic=2864.msg190986#msg190986) as well, but I have not explored it (it's left as a nice exercise for the community). This scripting engine is not present on DIGIC 6 or newer "pure EOS" models, from what I could tell.
I have a Canon EOS M50, If you need me to do anything to help, Please feel free to ask.
Quote from: a1ex on August 09, 2018, 09:02:43 AM
For DIGIC 7 models, the next step is porting the 80D startup code (https://www.magiclantern.fm/forum/index.php?topic=19737.msg200895;topicseen#msg200895) (i.e. running user code alongside Canon firmware). I expect this step to be straightforward, so it's left as an exercise to the owners of these cameras. You can debug the startup code in the emulator; once you get it working, just ask me to enable the boot flag so you can test it on the camera.
The previous post was for M50 ( DIGIC 8 ). On this camera, I don't know yet how the bootloader looks like, and the code written for DIGIC 7 didn't work, so I'll probably attempt to dump the ROM directly from main firmware. The tests you'll run are:
- jumping to Canon firmware (expecting to be identical to DIGIC 7, i.e. jumping to 0xE0040000)
- LED blinking (testing the above addresses)
- LED blinking from main firmware (if I'll get this working in QEMU)
- ROM dumping from main firmware (could not test this one in QEMU yet)
- other tests (CPU model, diagnostic logs etc)
After publishing the ROM dumper, I'll update the emulator, attempt to enable the boot flag and get some diagnostic logs. Further progress will require a developer with a camera in their hands and plenty of spare time for experiments. If that describes you, your contribution will be more than welcome. I'll be here to help if you get stuck, but please be aware I'm not interested in maintaining yet another camera port alone.
If the code damages the camera, I'll try to help, but cannot guarantee success.
Hi a1ex. I'm a software engineering student. I'll be graduating the end of the month. I'm interested in working on my m50 with my spare time. I see the documentation on the site about setting up qemu dev environment. Looks exciting. Any advice you have for me before I jump in? Thanks :)
I'll be jumping in after the semester is over. For now back to writing papers :'(
Quote from: SniperJunkie on December 06, 2018, 10:10:56 PM
I have a Canon EOS M50, If you need me to do anything to help, Please feel free to ask.
Do you have another cam with ML running on it?
If not:
Take a look into http://chdk.wikia.com/wiki/Obtaining_a_firmware_dump#Using_soundcard_input
@kenthinson: Welcome abord! Best luck for the finals!
After exploring the D8 disassembly I have (I was given a reconstructed M50 dump) I decided to publish my findings here.
- The camera does appear to have the scripting language we (@CHDK) refer to as Canon Basic.
- I have the impression that the card setup is the same as described here: http://chdk.wikia.com/wiki/Canon_Basic/Card_Setup
- Event procedures (short: eventproc) do exist, the eventproc handling firmware routines seem to be the same as on PowerShots.
- There seems to be support for extend.m and autotest.m scripts, but their invocation may differ from what's described here: http://chdk.wikia.com/wiki/Canon_Basic#Starting_the_script
- Now, the differences:
- Most event procedures that appear in CHDK related scripts do not exist. That means, CHDK scripts will not work on D8 cams.
- Many event procedures seem to be pre-registered, so registration functions such as System.Create() are not necessarily needed.
- In file names, the card root is B:/
- I have not yet found an eventproc to write binary files from script, or, to write text on screen.
Problem is, I can't say for sure whether using a prepared script card is enough to run scripts. So, everything below is speculation.
Script support seems to be enabled when the cam is in factory mode - the factory mode flag is at 0xE1FF802C.
I think it is also enabled when there's a script named "AutoTest.m" in the root of the card. The code I found loads "AutoTest.m" automatically at the end of the startup procedure.
The following minimal script should make a hex dump of the first 0x40000 bytes of ROM. I'm not certain that my WriteFileString interpretation is correct.
For a first try, name the script "AutoTest.m".
dim startadr=0xe0000000
dim romsize=0x40000
dim fname="B:/ROM.TXT"
private sub Initialize()
p = startadr
f = OpenFileCREAT(fname)
do while p < (startadr+romsize)
WriteFileString(f,"%08X: %08x %08x %08x %08x\n",p,*p,*(p+4),*(p+8),*(p+12))
p = p + 16
loop
CloseFile(f)
end sub
This script is not camera specific, so it can be tried on any D8 cameras (assuming that all D8 cams share the same codebase):
EOS M50, R; PowerShot SX740, SX70
To make sure the card is correctly prepared for scripting, get any older PowerShot (2005...2017) and use the universal dumper script (http://chdk.wikia.com/wiki/Canon_Basic/Scripts/Dumper) to check.
I can't guarantee success, but I think it's worth to try this route.
sorry, but I didnt have success on my M50, I prepared the Card with EOSCard after true formating in the M50
(but with my M50 I also did not have success with the dumper scripts)
EOScard?
Is there a bootflag enabler for the real (not emulated) M50 body?
Wondering if I missed something ...
Quote from: StefanKeller.AC on December 18, 2018, 05:40:54 PM
sorry, but I didnt have success on my M50, I prepared the Card with EOSCard after true formating in the M50
(but with my M50 I also did not have success with the dumper scripts)
Thanks for trying. I guess we'll know more when emulation of the M50 becomes possible.
Quote from: Walter Schulz on December 18, 2018, 06:09:09 PM
EOScard?
Is there a bootflag enabler for the real (not emulated) M50 body?
Wondering if I missed something ...
EOSCard can also set PowerShot-related flags, in this case the SCRIPT signature.
Quote from: srsa on December 18, 2018, 06:13:04 PM
EOSCard can also set PowerShot-related flags, in this case the SCRIPT signature.
Thanks for the explanation! I should get accustomed to those "hybrid cams" (for lack of a better word) terms...
Please find a ROM dumper for the EOS/PowerShot M50. It took an entire week of trial and error to figure it out - thanks @71m363nd3r for testing!
D_M50101.FIR (https://a1ex.magiclantern.fm/bleeding-edge/M50/D_M50101.FIR) (only for M50 firmware 1.0.1)
Source code: commit 568e05a (https://bitbucket.org/hudson/magic-lantern/commits/568e05a).
This is not using the portable codebase, but runs directly from the main firmware, using the regular ML boot process. For this reason, it is only compatible with M50 firmware 1.0.1. On other firmwares, it will just lock up.
There were two mysterious bugs that were preventing ML from booting on the M50 on real hardware, although it was working fine in the emulator, and its early startup code was apparently identical to 200D's:
1) The FIR is running on both CPU cores (unlike DIGIC 7, but I need to double-check). The two cores do not start at the same time; the main one (CPU0) wakes up the secondary one (CPU1) somewhere in cstart. It was easy to fix (https://bitbucket.org/hudson/magic-lantern/commits/0f8fc984f719c52d3b), but figuring it out with LED blinks was very puzzling.
2) The startup code, although nearly identical to 200D's, expected one of the cache maintenance functions to preserve R3 across the call (something not compatible with the C ABI). In our relocated startup code (that makes room for loading ML), I had to use a veneer to make a long call to that function. From all of the available registers, GCC picked exactly R3 to make that long call...
... and the side effect was disabling a loop that was zeroing out some memory. The trick is that, at camera startup, the RAM is not zeroed; you still have some electrical noise or maybe even some data from previous run. In the emulator, the RAM is always zeroed at startup. The result was that my test code was booting just fine in the emulator, but was locking up on real hardware. Good luck figuring out with binary feedback from the camera (i.e. works or locks up). I've solved it comparing the execution traces between the files reported to work (i.e. jumping to unmodified Canon firmware), and the ones reported to lock up (jumping to relocated Canon firmware); if anyone is curious, . I highly doubt I could have figured it out without an emulator. This change (https://bitbucket.org/hudson/magic-lantern/commits/b85a1b13a2fe0b32b52b6f8fe8d16812dcf10698) fixed it.
Once the two quirks were fixed, the startup code previously written for 200D worked out of the box.
When dumping the ROM, there was yet another quirk: initial attempt (calling dump_file with a ROM address) saved a file with correct size, that contained garbage. Oddly enough, it had fragments from the diagnostic log. Best guess: the DMA channel used for file I/O might be simply unable to read from the ROM. Instead, it probably ignores the higher address bits and just saves something from the RAM (matching the lower address bits). I'm not sure whether this step was working on 200D - need to double-check. Anyway, fixing this was straightforward: copying the ROM contents to RAM (https://bitbucket.org/hudson/magic-lantern/commits/568e05a9639874f25eed96f1084182d6e1f2a390) before saving did the trick.
Emulation is not ready yet; still working on it. I am able to emulate the bootloader (including file I/O), but main firmware doesn't initialize the SD card, so I'm unable to test Canon Basic scripts yet.
The same dumper source code works on 200D (I've actually used it to test the M50 dumper in QEMU, as file I/O isn't fully working), and - after finding a few stubs - on all the other DIGIC 7 models. If anyone is looking for some low-hanging fruit to get started with development, the new stubs are relatively easy to find and they can be tested in QEMU. Once you do that, I'll enable the boot flag, so you'll be able to run custom code on real hardware.
Dear Santa, please (https://www.magiclantern.fm/forum/index.php?topic=23084.msg208831#msg208831) give us the time and energy to port ML on these new cameras!
so, apologies for being that guy, but where exactly do I start here?
I'm a skilled developer, but new to photography. I have an M50 with the 1.0.1 firmware, and a decent amount of experience reverse engineering software. I don't need any excessive hand-holding, just links, docs, and maybe a little setup troubleshooting.
Quote from: a1ex on December 24, 2018, 10:39:36 PM
If anyone is looking for some low-hanging fruit to get started with development, the new stubs are relatively easy to find and they can be tested in QEMU
Given the above, I can definitely give this a shot. Sounds fun.
Docs:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst
However, that easy coding task mostly applies to models other than M50 and 200D. The current experiments are working out of the box on these two cameras; it's the other 3 models that could use some help from the community in order to reach the same stage.
I have yet to commit the emulator bits for M50, but I've got most of the stuff working locally (including file I/O after manually calling the initialization routine from the serial console). For now, you may run the ROM dumper and follow the steps from the "Initial firmware analysis" section in the docs. ROM layout and startup code on M50 are pretty much identical to DIGIC 7 (to the point that some stubs are identical with 200D).
Once you are ready to run this code on your camera, I can prepare a tool to enable the boot flag (for any model from this thread).
Quote from: a1ex on December 28, 2018, 09:02:48 AM
Docs:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst
However, that easy coding task mostly applies to models other than M50 and 200D. The current experiments are working out of the box on these two cameras; it's the other 3 models that could use some help from the community in order to reach the same stage.
I have yet to commit the emulator bits for M50, but I've got most of the stuff working locally (including file I/O after manually calling the initialization routine from the serial console). For now, you may run the ROM dumper and follow the steps from the "Initial firmware analysis" section in the docs. ROM layout and startup code on M50 are pretty much identical to DIGIC 7 (to the point that some stubs are identical with 200D).
Once you are ready to run this code on your camera, I can prepare a tool to enable the boot flag (for any model from this thread).
I assume the risk of bricking my camera with these tools is low (but not zero)?
That's right. All of the binaries available in this thread were already confirmed to work on at least one other camera, and they were also tested in QEMU (where I could confirm they are reserving memory properly so our binary won't be overwritten by Canon firmware). They do not (at the time of writing) attempt to make any permanent changes to the camera. Sure, that will no longer apply after enabling the boot flag.
However, Canon firmware is, by design, unsafe (https://bitbucket.org/hudson/magic-lantern/pull-requests/825/prevent-canon-settings-from-being-saved/). Any DryOS task is able to write anywhere in memory, so a programming mistake can - in theory - have devastating effects. Starting from DIGIC 7, we've got a MMU, which currently doesn't do much other than a flat mapping, but can - in theory - be used to implement some sort of protection between ML code and Canon data structures. TLDR: there is a small probability of getting invalid settings written into one of the nonvolatile memories; that's usually recoverable, but I'm unable to guarantee it.
So far, the worst case I've recovered successfully was a Canon firmware update interrupted in the middle (i.e. not caused by ML). Last time I've unbricked a camera was two days ago (an EOS M with invalid video settings; ask Danne for details).
Quote from: a1ex on December 28, 2018, 04:54:59 PM
Last time I've unbricked a camera was two days ago (an EOS M with invalid video settings; ask Danne for details).
Word! My prop value mistake analyzed, narrowed down and fixed to camera original state within the hour...
Quote from: a1ex on December 28, 2018, 04:54:59 PM
So far, the worst case I've recovered successfully was a Canon firmware update interrupted in the middle (i.e. not caused by ML). Last time I've unbricked a camera was two days ago (an EOS M with invalid video settings; ask Danne for details).
that makes me feel a lot better
I'll report back here once I get a chance to read the docs and get set up.
Quote from: a1ex on December 28, 2018, 09:02:48 AM
Docs:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst
However, that easy coding task mostly applies to models other than M50 and 200D. The current experiments are working out of the box on these two cameras; it's the other 3 models that could use some help from the community in order to reach the same stage.
I have yet to commit the emulator bits for M50, but I've got most of the stuff working locally (including file I/O after manually calling the initialization routine from the serial console). For now, you may run the ROM dumper and follow the steps from the "Initial firmware analysis" section in the docs. ROM layout and startup code on M50 are pretty much identical to DIGIC 7 (to the point that some stubs are identical with 200D).
Once you are ready to run this code on your camera, I can prepare a tool to enable the boot flag (for any model from this thread).
I'm having a bit of trouble with `hg` and `brew` at the moment. I still want to help, but I need to get back to LA first where I can clean up my Mac. :)
Ok progress report and questions for you guys!
Progress.
I have been following:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
Step 1, and 2 under installation complete. Got dependencies installed through home-brew.
In addition I dumped my m50 rom files. I got two bin files
540b1d00a2631c6a29a0280d75679440 ROM0.BIN
1e7c58573aa62d016f3b355205d8fed5 ROM1.BIN
Should I continue with step 3? Is qemu ready? or do we need to do some more work first.
Lets get this thing rolling :)
Quote from: leathc on January 02, 2019, 05:15:51 PM
I'm having a bit of trouble with `hg` and `brew` at the moment. I still want to help, but I need to get back to LA first where I can clean up my Mac. :)
A couple of forum topics that will help get your Mac up and running in a hurry:
Setting up a Magic Lantern development environment on a Macintosh (https://www.magiclantern.fm/forum/index.php?topic=16012.0)
Magic Lantern development compiler.app (Mac OS) (https://www.magiclantern.fm/forum/index.php?topic=21882.0)
PM me when you get back to LA if you want to get together. I live nearby in Redondo Beach.
I keep thinking about getting an M50 for my next ML project--once the M2 is up and running.
Quote from: kenthinson on January 03, 2019, 01:55:02 PM
Should I continue with step 3? Is qemu ready? or do we need to do some more work first.
I just checked and it looks like there isn't an EOSM50 directory yet so it might still be a little early. Though if you want to get started you can create that directory and start figuring out what is needed for the debugmsg.gdb file. The EOSM2 port started from scratch so you can see what was done to get that camera working in QEMU starting around this post in the ML on EOS-M2 (https://www.magiclantern.fm/forum/index.php?topic=15895.msg185103#msg185103) topic.
Quote from: dfort on January 03, 2019, 05:00:49 PM
Though if you want to get started you can create that directory and start figuring out what is needed for the debugmsg.gdb file.
Well, that would be quite a bit of duplicated work. Please find here (https://a1ex.magiclantern.fm/bleeding-edge/M50/qemu.patch) the draft QEMU patches for M50 in their current state. Not double-checked yet, but emulation goes far enough to save a log file on the virtual SD card with these commands in the serial console:
akashimorino
mount 2
dumpf
Not sure if that's enough for testing the Canon Basic scripts, but that's all I've got for now.
The M50 also has a serial flash, so one of the next steps is dumping its contents (easy; one way is to adapt this code (https://bitbucket.org/hudson/magic-lantern/src/unified/modules/sf_dump/sf_dump.c) on the minimal codebase, which is not able to load modules yet, and the other is to work from the "recovery" branch, i.e. directly from bootloader). Probably not a very straightforward task for a newcomer, but it's not very hard either.
Quote from: dfort on January 03, 2019, 05:00:49 PM
A couple of forum topics that will help get your Mac up and running in a hurry:
Setting up a Magic Lantern development environment on a Macintosh (https://www.magiclantern.fm/forum/index.php?topic=16012.0)
Magic Lantern development compiler.app (Mac OS) (https://www.magiclantern.fm/forum/index.php?topic=21882.0)
PM me when you get back to LA if you want to get together. I live nearby in Redondo Beach.
I keep thinking about getting an M50 for my next ML project--once the M2 is up and running.
Thanks for the links. I'll check it out.
Also, neat. Maybe we can meet up and you can play with the M50 a bit.
Quote from: a1ex on January 03, 2019, 06:09:06 PM
Please find here (https://a1ex.magiclantern.fm/bleeding-edge/M50/qemu.patch) the draft QEMU patches for M50 in their current state.
I had no idea it was this far along. Feel like we were just given the password to get into a speakeasy and now it is time to get drunk.
Quote from: dfort on January 04, 2019, 04:46:27 PM
I had no idea it was this far along. Feel like we were just given the password to get into a speakeasy and now it is time to get drunk.
I'm buyin' if it means I can get my camera to do all the stuff it should be able to do...
Applied the qemu patch and got the M50 running. No GUI emulation yet and this is what the default qemu autoexec.bin looks like but hey, it is a start.
(https://farm5.staticflickr.com/4851/39668670933_28ffcae26e.jpg) (https://flic.kr/p/23roiQi)
No twitter account: M50?
https://twitter.com/autoexec_bin/status/1082649361484529667
(https://pbs.twimg.com/media/DwZX1SCXQAMtgGo.jpg:small)
Nope, M50 looks like this:
(https://a1ex.magiclantern.fm/bleeding-edge/M50/M50-hello.jpg)
I know what it is, but not spoiling the game.
@a1ex Can it save files yet?
Aspect ratio 4:3! Boy, you got us! And we're totally offtopic. Totally!
Fujifilm?
Nope, it's a Canon. But no DiGiC 7/8 on board!
Those Twitter members will hunt you down, a1ex!
Disclaimer: If I'm right, of course ...
No twitter either over here:
7D Mark II
EOS M3
SX50 HS
SX70HS
Canon PowerShot G1 X Mark III
:D
EOS M5?
Somebody here got it right.
(https://farm5.staticflickr.com/4816/46667116051_124f326d51_n.jpg) (https://flic.kr/p/2e6PaKa)
Yes, it's a Canon. Yes, it has DIGIC 8 on board. Yes, it has a 4:3 screen.
Quote from: Ant123 on January 08, 2019, 06:43:39 PM
SX70HS
... running EOS firmware!
Quote from: srsa on January 08, 2019, 05:45:21 PM
@a1ex Can it save files yet?
Yes, just got a ROM dump.
Dumper (really hackish): SX70DUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/SX70/SX70DUMP.FIR). I'll upload a nicer one later. I've used g3gg0's FullFAT-based dumper from the "recovery" branch; other than that, it was code written for M50 running from bootloader context.
The SX740 probably belongs to the same group, according to CHDK folks; I didn't look into it yet.
Have fun!
P.S. QEMU patches for M50 (linked earlier (https://www.magiclantern.fm/forum/index.php?topic=23296.msg210122#msg210122)) worked out of the box for the SX70 bootloader:
(https://a1ex.magiclantern.fm/bleeding-edge/SX70/SX70-qemu.png)
Where does EOS R fit in? DiGiC 8 but EOS or Powershot codebase or mixed-breed?
I did not see the EOS R firmware yet, but previous experiments (https://www.magiclantern.fm/forum/index.php?topic=22770.msg207211#msg207211) suggest it might be significantly different from the smaller models.
Though I'm tempted to repeat the tests, now that we've got the display working.
Quote from: a1ex on January 03, 2019, 06:09:06 PM
The M50 also has a serial flash, so one of the next steps is dumping its contents (easy; one way is to adapt this code (https://bitbucket.org/hudson/magic-lantern/src/unified/modules/sf_dump/sf_dump.c) on the minimal codebase, which is not able to load modules yet, and the other is to work from the "recovery" branch, i.e. directly from bootloader). Probably not a very straightforward task for a newcomer, but it's not very hard either.
Did this ever get done? I have to say, it's certainly not very straightforward. :) I have the green screen running on QEMU for the M50, but I can't get the screen you posted.
Quote from: a1ex on January 08, 2019, 10:39:27 PM
Quote from: Ant123 on January 08, 2019, 06:43:39 PM
SX70HS
... running EOS firmware!
While kinda off-topic here, i wonder if someone could help us @ darktable / pixls.us with providing a full raw sample set from that "Powershot SX70 HS" camera for https://raw.pixls.us/
RPU is used e.g. by RawSpeed fast raw decoding library (https://github.com/darktable-org/rawspeed) for integration testing.
Total of 8 samples needed: {RAW, CRAW} x {16:9, 4:3, 3:2, 1:1}.
oooh now I have a blinking LED on my M50 qemu, pls advise
Great work, @leathc!
Quote from: DeafEyeJedi on January 11, 2019, 04:45:57 AM
Great work, @leathc!
Thanks! and thanks dfort for helping me! haha
Quote from: LebedevRI on January 09, 2019, 09:32:15 AM
... running EOS firmware!
While kinda off-topic here, i wonder if someone could help us @ darktable / pixls.us with providing a full raw sample set from that "Powershot SX70 HS" camera for https://raw.pixls.us/
RPU is used e.g. by RawSpeed fast raw decoding library (https://github.com/darktable-org/rawspeed) for integration testing.
Total of 8 samples needed: {RAW, CRAW} x {16:9, 4:3, 3:2, 1:1}.
Below you can dl all the raw samples.
https://we.tl/t-X8KcVPjtVX (https://we.tl/t-X8KcVPjtVX)
This (https://www.magiclantern.fm/forum/index.php?topic=17714.msg210501#msg210501) might help the M50 port.
Magic Lantern Rescue
----------------------------
- Model ID: 0x412 M50
- Camera model: Canon EOS M50 / KISS M
- Firmware version: 1.0.1 / 6.8.0 34(00)
- IMG naming: 100CANON/IMG_2868.JPG
- User PS: CineStyle
- Boot flags: FIR=0 BOOT=-1 RAM=-1 UPD=-1
- ROMBASEADDR: 0xE0040000
CHDK CPU info for 0x412 M50
------------------------------
ID 0x414FC091
Revision 0x1 1
Part 0xC09 3081
ARM Arch 0xF 15
Variant 0x4 4
Implementor 0x41 65
Cache type 0x83338003
Icache min words/line 0x3 3 [8]
(zero) 0x0 0
L1 Icache policy 0x2 2
Dcache min words/line 0x3 3 [8]
Exclusives Reservation Granule 0x3 3 [8]
Cache Writeback Granule 0x3 3 [8]
(zero) 0x0 0
(register format) 0x4 4
TCM type 0x00000000
(raw value) 0x0 0
MPU type 0x414FC091
S 0x1 1
- 0x48 72
Num of MPU regions 0xC0 192
Multiprocessor ID 0x80000000
(raw value) 0x80000000 -2147483648
Processor feature 0 0x00001231
ARM inst set 0x1 1
Thumb inst set 0x3 3
Jazelle inst set 0x2 2
ThumbEE inst set 0x1 1
- 0x0 0
Processor feature 1 0x00000011
Programmers' model 0x1 1
Security extensions 0x1 1
Microcontr. prog model 0x0 0
- 0x0 0
Debug feature 0x00010444
(raw value) 0x10444 66628
Aux feature 0x00000000
(raw value) 0x0 0
Mem model feature 0 0x00100103
VMSA support 0x3 3
PMSA support 0x0 0
Cache coherence 0x1 1
Outer shareable 0x0 0
TCM support 0x0 0
Auxiliary registers 0x1 1
FCSE support 0x0 0
- 0x0 0
Mem model feature 1 0x20000000
L1 Harvard cache VA 0x0 0
L1 unified cache VA 0x0 0
L1 Harvard cache s/w 0x0 0
L1 unified cache s/w 0x0 0
L1 Harvard cache 0x0 0
L1 unified cache 0x0 0
L1 cache test & clean 0x0 0
Branch predictor 0x2 2
Mem model feature 2 0x01230000
L1 Harvard fg prefetch 0x0 0
L1 Harvard bg prefetch 0x0 0
L1 Harvard range 0x0 0
Harvard TLB 0x0 0
Unified TLB 0x3 3
Mem barrier 0x2 2
WFI stall 0x1 1
HW access flag 0x0 0
Mem model feature 3 0x00102111
Cache maintain MVA 0x1 1
Cache maintain s/w 0x1 1
BP maintain 0x1 1
- 0x102 258
Supersection support 0x0 0
ISA feature 0 0x00101111
Swap instrs 0x1 1
Bitcount instrs 0x1 1
Bitfield instrs 0x1 1
CmpBranch instrs 0x1 1
Coproc instrs 0x0 0
Debug instrs 0x1 1
Divide instrs 0x0 0
- 0x0 0
ISA feature 1 0x13112111
Endian instrs 0x1 1
Exception instrs 0x1 1
Exception AR instrs 0x1 1
Extend instrs 0x2 2
IfThen instrs 0x1 1
Immediate instrs 0x1 1
Interwork instrs 0x3 3
Jazelle instrs 0x1 1
ISA feature 2 0x21232041
LoadStore instrs 0x1 1
Memhint instrs 0x4 4
MultiAccess Interruptible instructions 0x0 0
Mult instrs 0x2 2
MultS instrs 0x3 3
MultU instrs 0x2 2
PSR AR instrs 0x1 1
Reversal instrs 0x2 2
ISA feature 3 0x11112131
Saturate instrs 0x1 1
SIMD instrs 0x3 3
SVC instrs 0x1 1
SynchPrim instrs 0x2 2
TabBranch instrs 0x1 1
ThumbCopy instrs 0x1 1
TrueNOP instrs 0x1 1
T2 Exec Env instrs 0x1 1
ISA feature 4 0x00011142
Unprivileged instrs 0x2 2
WithShifts instrs 0x4 4
Writeback instrs 0x1 1
SMC instrs 0x1 1
Barrier instrs 0x1 1
SynchPrim_instrs_frac 0x0 0
PSR_M instrs 0x0 0
- 0x0 0
ISA feature 5 0x00000000
- 0x0 0
Cache level ID 0x09200003
Cache type, level1 0x3 3 [Separate Icache, Dcache]
Cache type, level2 0x0 0 [no cache]
Cache type, level3 0x0 0 [no cache]
Cache type, level4 0x0 0 [no cache]
Cache type, level5 0x0 0 [no cache]
Cache type, level6 0x0 0 [no cache]
Cache type, level7 0x0 0 [no cache]
Cache type, level8 0x1 1 [Icache only]
Level of coherency 0x1 1
Level of unification 0x1 1
(zero) 0x0 0
Cache size ID reg (data, level0) 0x700FE019
Line size in words 0x1 1 [8]
Associativity 0x3 3 [4]
Number of sets 0x7F 127 [128]
Write allocation 0x1 1
Read allocation 0x1 1
Write back 0x1 1
Write through 0x0 0
Cache size ID reg (inst, level0) 0x200FE019
Line size in words 0x1 1 [8]
Associativity 0x3 3 [4]
Number of sets 0x7F 127 [128]
Write allocation 0x0 0
Read allocation 0x1 1
Write back 0x0 0
Write through 0x0 0
SCTLR 0x48C5187D
MPU Enable 0x1 1
Strict Align 0x0 0
L1 DCache Enable 0x1 1
- (SBO) 0xF 15
- (SBZ) 0x0 0
Branch Pred Enable 0x1 1
L1 ICache Enable 0x1 1
High Vectors 0x0 0
Round Robin 0x0 0
- (SBZ) 0x0 0
- (SBO) 0x1 1
MPU background reg 0x0 0
- (SBO) 0x1 1
Div0 exception 0x0 0
- (SBZ) 0x0 0
FIQ Enable 0x0 0
- (SBO) 0x3 3
VIC 0x0 0
CPSR E bit 0x0 0
- (SBZ) 0x0 0
NMFI 0x1 1
TRE 0x0 0
AFE 0x0 0
Thumb exceptions 0x1 1
Big endian 0x0 0
ACTLR 0x00000045
(raw value) 0x45 69
ACTLR2 0x00000001
(raw value) 0x1 1
CPACR 0x00000000
(raw value) 0x0 0
DBGDIDR 0x35141000
Revision 0x0 0
Variant 0x0 0
- (RAZ) 0x10 16
Version 0x4 4 [v7 basic]
Context 0x1 1 [2]
BRP 0x5 5 [6]
WRP 0x3 3 [4]
DBGDRAR 0x00000000
Valid 0x0 0
- (UNK) 0x0 0
Address 0x0 0 [0x00000000]
DBGDSAR 0x00000000
Valid 0x0 0
- (UNK) 0x0 0
Address 0x0 0 [0x00000000]
DBGDSCR 0x00000000
HALTED 0x0 0
RESTARTED 0x0 0
MOE 0x0 0
SDABORT_l 0x0 0
ADABORT_l 0x0 0
UND_l 0x0 0
FS 0x0 0
DBGack 0x0 0
INTdis 0x0 0
UDCCdis 0x0 0
ITRen 0x0 0
HDBGen 0x0 0
MDBGen 0x0 0
SPIDdis 0x0 0
SPNIDdis 0x0 0
NS 0x0 0
ADAdiscard 0x0 0
ExtDCCmode 0x0 0
- (SBZ) 0x0 0
InstrCompl_l 0x0 0
PipeAdv 0x0 0
TXfull_l 0x0 0
RXfull_l 0x0 0
- (SBZ) 0x0 0
TXfull 0x0 0
RXfull 0x0 0
- (SBZ) 0x0 0
- DONE!
It's worth noting the above log was not from a real M50, but from the emulator. In other words, it's what I thought it might be, i.e. what I knew from DIGIC 7 (https://www.magiclantern.fm/forum/index.php?topic=19737.msg200715#msg200715) (alongside with a few emulator quirks).
CPU info log from a real M50 / real SX70:
CHDK CPU info for 0x412 M50 / 0x805 SX70
------------------------------
ID 0x414FC091
Revision 0x1 1
Part 0xC09 3081
ARM Arch 0xF 15
Variant 0x4 4
Implementor 0x41 65
Cache type 0x83338003
Icache min words/line 0x3 3 [8]
(zero) 0x0 0
L1 Icache policy 0x2 2
Dcache min words/line 0x3 3 [8]
Exclusives Reservation Granule 0x3 3 [8]
Cache Writeback Granule 0x3 3 [8]
(zero) 0x0 0
(register format) 0x4 4
TCM type 0x00000000
(raw value) 0x0 0
MPU type 0x414FC091
S 0x1 1
- 0x48 72
Num of MPU regions 0xC0 192
Multiprocessor ID 0x80000000
(raw value) 0x80000000 -2147483648
Processor feature 0 0x00001231
ARM inst set 0x1 1
Thumb inst set 0x3 3
Jazelle inst set 0x2 2
ThumbEE inst set 0x1 1
- 0x0 0
Processor feature 1 0x00000011
Programmers' model 0x1 1
Security extensions 0x1 1
Microcontr. prog model 0x0 0
- 0x0 0
Debug feature 0x00010444
(raw value) 0x10444 66628
Aux feature 0x00000000
(raw value) 0x0 0
Mem model feature 0 0x00100103
VMSA support 0x3 3
PMSA support 0x0 0
Cache coherence 0x1 1
Outer shareable 0x0 0
TCM support 0x0 0
Auxiliary registers 0x1 1
FCSE support 0x0 0
- 0x0 0
Mem model feature 1 0x20000000
L1 Harvard cache VA 0x0 0
L1 unified cache VA 0x0 0
L1 Harvard cache s/w 0x0 0
L1 unified cache s/w 0x0 0
L1 Harvard cache 0x0 0
L1 unified cache 0x0 0
L1 cache test & clean 0x0 0
Branch predictor 0x2 2
Mem model feature 2 0x01230000
L1 Harvard fg prefetch 0x0 0
L1 Harvard bg prefetch 0x0 0
L1 Harvard range 0x0 0
Harvard TLB 0x0 0
Unified TLB 0x3 3
Mem barrier 0x2 2
WFI stall 0x1 1
HW access flag 0x0 0
Mem model feature 3 0x00102111
Cache maintain MVA 0x1 1
Cache maintain s/w 0x1 1
BP maintain 0x1 1
- 0x102 258
Supersection support 0x0 0
ISA feature 0 0x00101111
Swap instrs 0x1 1
Bitcount instrs 0x1 1
Bitfield instrs 0x1 1
CmpBranch instrs 0x1 1
Coproc instrs 0x0 0
Debug instrs 0x1 1
Divide instrs 0x0 0
- 0x0 0
ISA feature 1 0x13112111
Endian instrs 0x1 1
Exception instrs 0x1 1
Exception AR instrs 0x1 1
Extend instrs 0x2 2
IfThen instrs 0x1 1
Immediate instrs 0x1 1
Interwork instrs 0x3 3
Jazelle instrs 0x1 1
ISA feature 2 0x21232041
LoadStore instrs 0x1 1
Memhint instrs 0x4 4
MultiAccess Interruptible instructions 0x0 0
Mult instrs 0x2 2
MultS instrs 0x3 3
MultU instrs 0x2 2
PSR AR instrs 0x1 1
Reversal instrs 0x2 2
ISA feature 3 0x11112131
Saturate instrs 0x1 1
SIMD instrs 0x3 3
SVC instrs 0x1 1
SynchPrim instrs 0x2 2
TabBranch instrs 0x1 1
ThumbCopy instrs 0x1 1
TrueNOP instrs 0x1 1
T2 Exec Env instrs 0x1 1
ISA feature 4 0x00011142
Unprivileged instrs 0x2 2
WithShifts instrs 0x4 4
Writeback instrs 0x1 1
SMC instrs 0x1 1
Barrier instrs 0x1 1
SynchPrim_instrs_frac 0x0 0
PSR_M instrs 0x0 0
- 0x0 0
ISA feature 5 0x00000000
- 0x0 0
Cache level ID 0x09200003
Cache type, level1 0x3 3 [Separate Icache, Dcache]
Cache type, level2 0x0 0 [no cache]
Cache type, level3 0x0 0 [no cache]
Cache type, level4 0x0 0 [no cache]
Cache type, level5 0x0 0 [no cache]
Cache type, level6 0x0 0 [no cache]
Cache type, level7 0x0 0 [no cache]
Cache type, level8 0x1 1 [Icache only]
Level of coherency 0x1 1
Level of unification 0x1 1
(zero) 0x0 0
Cache size ID reg (data, level0) 0x700FE019
Line size in words 0x1 1 [8]
Associativity 0x3 3 [4]
Number of sets 0x7F 127 [128]
Write allocation 0x1 1
Read allocation 0x1 1
Write back 0x1 1
Write through 0x0 0
Cache size ID reg (inst, level0) 0x200FE019
Line size in words 0x1 1 [8]
Associativity 0x3 3 [4]
Number of sets 0x7F 127 [128]
Write allocation 0x0 0
Read allocation 0x1 1
Write back 0x0 0
Write through 0x0 0
SCTLR 0x40C5187D
MPU Enable 0x1 1
Strict Align 0x0 0
L1 DCache Enable 0x1 1
- (SBO) 0xF 15
- (SBZ) 0x0 0
Branch Pred Enable 0x1 1
L1 ICache Enable 0x1 1
High Vectors 0x0 0
Round Robin 0x0 0
- (SBZ) 0x0 0
- (SBO) 0x1 1
MPU background reg 0x0 0
- (SBO) 0x1 1
Div0 exception 0x0 0
- (SBZ) 0x0 0
FIQ Enable 0x0 0
- (SBO) 0x3 3
VIC 0x0 0
CPSR E bit 0x0 0
- (SBZ) 0x0 0
NMFI 0x0 0
TRE 0x0 0
AFE 0x0 0
Thumb exceptions 0x1 1
Big endian 0x0 0
ACTLR 0x00000045
(raw value) 0x45 69
ACTLR2 0x00000701
(raw value) 0x701 1793
CPACR 0xC0000000
(raw value) 0xC0000000 -1073741824
DBGDIDR 0x35137041
Revision 0x1 1
Variant 0x4 4
- (RAZ) 0x70 112
Version 0x3 3 [v7 full]
Context 0x1 1 [2]
BRP 0x5 5 [6]
WRP 0x3 3 [4]
DBGDRAR 0x00000000
Valid 0x0 0
- (UNK) 0x0 0
Address 0x0 0 [0x00000000]
DBGDSAR 0x00030000
Valid 0x0 0
- (UNK) 0x0 0
Address 0x30 48 [0x00030000]
DBGDSCR 0x03000002
HALTED 0x0 0
RESTARTED 0x1 1
MOE 0x0 0
SDABORT_l 0x0 0
ADABORT_l 0x0 0
UND_l 0x0 0
FS 0x0 0
DBGack 0x0 0
INTdis 0x0 0
UDCCdis 0x0 0
ITRen 0x0 0
HDBGen 0x0 0
MDBGen 0x0 0
SPIDdis 0x0 0
SPNIDdis 0x0 0
NS 0x0 0
ADAdiscard 0x0 0
ExtDCCmode 0x0 0
- (SBZ) 0x0 0
InstrCompl_l 0x1 1
PipeAdv 0x1 1
TXfull_l 0x0 0
RXfull_l 0x0 0
- (SBZ) 0x0 0
TXfull 0x0 0
RXfull 0x0 0
- (SBZ) 0x0 0
Difference from 200D: CPUINFO-200D-vs-M50.html (https://a1ex.magiclantern.fm/bleeding-edge/M50/CPUINFO-200D-vs-M50.html)
edit: updated ROM dumpers (SX740 untested):
Quote from: a1ex on January 16, 2019, 09:06:18 AM
DIGIC 8: M50 (https://a1ex.magiclantern.fm/debug/portable-rom-dumper/new/DUMP_M50.FIR) SX70 (https://a1ex.magiclantern.fm/debug/portable-rom-dumper/new/DUMPSX70.FIR) SX740 (https://a1ex.magiclantern.fm/debug/portable-rom-dumper/new/DMPSX740.FIR)
and uploaded FIRs for getting the CPU info:
Quote from: a1ex on January 16, 2019, 09:19:19 AM
DIGIC 8: M50 (https://a1ex.magiclantern.fm/debug/portable-cpuinfo/CPUI_M50.FIR) SX70 (https://a1ex.magiclantern.fm/debug/portable-cpuinfo/CPUISX70.FIR) SX740 (https://a1ex.magiclantern.fm/debug/portable-cpuinfo/CPUSX740.FIR)
Quote from: a1ex on January 15, 2019, 01:26:02 PM
edit: updated ROM dumpers (SX740 untested):
and uploaded FIRs for getting the CPU info:
I'll try these out on the real hardware. EDIT: for the M50 that is
those both run great on the M50, but I'm not actually seeing the dumps
it could be because I didn't format the card correctly or something I suppose
Really? DUMP_M50.FIR isn't working for you? Maybe try a smaller SD card though the new dumper should be able to work on the larger cards as long as it is formatted as FAT32.
Quote from: dfort on January 17, 2019, 06:34:02 AM
Really? DUMP_M50.FIR isn't working for you? Maybe try a smaller SD card though the new dumper should be able to work on the larger cards as long as it is formatted as FAT32.
no I'm an idiot, I didn't do low level format
I have the dumps now, and RESCUE.log for the CPU info
I run this dump firmware on my M50
there is the log :)
Magic Lantern Rescue
----------------------------
- Model ID: 0x412 M50
- Camera model: Canon EOS KISS M
- Firmware version: 1.0.1 / 6.8.0 34(00)
- IMG naming: 100CANON/0127.JPG
- User PS: ??? ??? ???
- Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
- ROMBASEADDR: 0xE0040000
CHDK CPU info for 0x412 M50
------------------------------
ID 0x414FC091
Revision 0x1 1
Part 0xC09 3081
ARM Arch 0xF 15
Variant 0x4 4
Implementor 0x41 65
Cache type 0x83338003
Icache min words/line 0x3 3 [8]
(zero) 0x0 0
L1 Icache policy 0x2 2
Dcache min words/line 0x3 3 [8]
Exclusives Reservation Granule 0x3 3 [8]
Cache Writeback Granule 0x3 3 [8]
(zero) 0x0 0
(register format) 0x4 4
TCM type 0x00000000
(raw value) 0x0 0
MPU type 0x414FC091
S 0x1 1
- 0x48 72
Num of MPU regions 0xC0 192
Multiprocessor ID 0x80000000
(raw value) 0x80000000 -2147483648
Processor feature 0 0x00001231
ARM inst set 0x1 1
Thumb inst set 0x3 3
Jazelle inst set 0x2 2
ThumbEE inst set 0x1 1
- 0x0 0
Processor feature 1 0x00000011
Programmers' model 0x1 1
Security extensions 0x1 1
Microcontr. prog model 0x0 0
- 0x0 0
Debug feature 0x00010444
(raw value) 0x10444 66628
Aux feature 0x00000000
(raw value) 0x0 0
Mem model feature 0 0x00100103
VMSA support 0x3 3
PMSA support 0x0 0
Cache coherence 0x1 1
Outer shareable 0x0 0
TCM support 0x0 0
Auxiliary registers 0x1 1
FCSE support 0x0 0
- 0x0 0
Mem model feature 1 0x20000000
L1 Harvard cache VA 0x0 0
L1 unified cache VA 0x0 0
L1 Harvard cache s/w 0x0 0
L1 unified cache s/w 0x0 0
L1 Harvard cache 0x0 0
L1 unified cache 0x0 0
L1 cache test & clean 0x0 0
Branch predictor 0x2 2
Mem model feature 2 0x01230000
L1 Harvard fg prefetch 0x0 0
L1 Harvard bg prefetch 0x0 0
L1 Harvard range 0x0 0
Harvard TLB 0x0 0
Unified TLB 0x3 3
Mem barrier 0x2 2
WFI stall 0x1 1
HW access flag 0x0 0
Mem model feature 3 0x00102111
Cache maintain MVA 0x1 1
Cache maintain s/w 0x1 1
BP maintain 0x1 1
- 0x102 258
Supersection support 0x0 0
ISA feature 0 0x00101111
Swap instrs 0x1 1
Bitcount instrs 0x1 1
Bitfield instrs 0x1 1
CmpBranch instrs 0x1 1
Coproc instrs 0x0 0
Debug instrs 0x1 1
Divide instrs 0x0 0
- 0x0 0
ISA feature 1 0x13112111
Endian instrs 0x1 1
Exception instrs 0x1 1
Exception AR instrs 0x1 1
Extend instrs 0x2 2
IfThen instrs 0x1 1
Immediate instrs 0x1 1
Interwork instrs 0x3 3
Jazelle instrs 0x1 1
ISA feature 2 0x21232041
LoadStore instrs 0x1 1
Memhint instrs 0x4 4
MultiAccess Interruptible instructions 0x0 0
Mult instrs 0x2 2
MultS instrs 0x3 3
MultU instrs 0x2 2
PSR AR instrs 0x1 1
Reversal instrs 0x2 2
ISA feature 3 0x11112131
Saturate instrs 0x1 1
SIMD instrs 0x3 3
SVC instrs 0x1 1
SynchPrim instrs 0x2 2
TabBranch instrs 0x1 1
ThumbCopy instrs 0x1 1
TrueNOP instrs 0x1 1
T2 Exec Env instrs 0x1 1
ISA feature 4 0x00011142
Unprivileged instrs 0x2 2
WithShifts instrs 0x4 4
Writeback instrs 0x1 1
SMC instrs 0x1 1
Barrier instrs 0x1 1
SynchPrim_instrs_frac 0x0 0
PSR_M instrs 0x0 0
- 0x0 0
ISA feature 5 0x00000000
- 0x0 0
Cache level ID 0x09200003
Cache type, level1 0x3 3 [Separate Icache, Dcache]
Cache type, level2 0x0 0 [no cache]
Cache type, level3 0x0 0 [no cache]
Cache type, level4 0x0 0 [no cache]
Cache type, level5 0x0 0 [no cache]
Cache type, level6 0x0 0 [no cache]
Cache type, level7 0x0 0 [no cache]
Cache type, level8 0x1 1 [Icache only]
Level of coherency 0x1 1
Level of unification 0x1 1
(zero) 0x0 0
Cache size ID reg (data, level0) 0x700FE019
Line size in words 0x1 1 [8]
Associativity 0x3 3 [4]
Number of sets 0x7F 127 [128]
Write allocation 0x1 1
Read allocation 0x1 1
Write back 0x1 1
Write through 0x0 0
Cache size ID reg (inst, level0) 0x200FE019
Line size in words 0x1 1 [8]
Associativity 0x3 3 [4]
Number of sets 0x7F 127 [128]
Write allocation 0x0 0
Read allocation 0x1 1
Write back 0x0 0
Write through 0x0 0
SCTLR 0x40C5187D
MPU Enable 0x1 1
Strict Align 0x0 0
L1 DCache Enable 0x1 1
- (SBO) 0xF 15
- (SBZ) 0x0 0
Branch Pred Enable 0x1 1
L1 ICache Enable 0x1 1
High Vectors 0x0 0
Round Robin 0x0 0
- (SBZ) 0x0 0
- (SBO) 0x1 1
MPU background reg 0x0 0
- (SBO) 0x1 1
Div0 exception 0x0 0
- (SBZ) 0x0 0
FIQ Enable 0x0 0
- (SBO) 0x3 3
VIC 0x0 0
CPSR E bit 0x0 0
- (SBZ) 0x0 0
NMFI 0x0 0
TRE 0x0 0
AFE 0x0 0
Thumb exceptions 0x1 1
Big endian 0x0 0
ACTLR 0x00000045
(raw value) 0x45 69
ACTLR2 0x00000701
(raw value) 0x701 1793
CPACR 0xC0000000
(raw value) 0xC0000000 -1073741824
DBGDIDR 0x35137041
Revision 0x1 1
Variant 0x4 4
- (RAZ) 0x70 112
Version 0x3 3 [v7 full]
Context 0x1 1 [2]
BRP 0x5 5 [6]
WRP 0x3 3 [4]
DBGDRAR 0x00000000
Valid 0x0 0
- (UNK) 0x0 0
Address 0x0 0 [0x00000000]
DBGDSAR 0x00030000
Valid 0x0 0
- (UNK) 0x0 0
Address 0x30 48 [0x00030000]
DBGDSCR 0x03000002
HALTED 0x0 0
RESTARTED 0x1 1
MOE 0x0 0
SDABORT_l 0x0 0
ADABORT_l 0x0 0
UND_l 0x0 0
FS 0x0 0
DBGack 0x0 0
INTdis 0x0 0
UDCCdis 0x0 0
ITRen 0x0 0
HDBGen 0x0 0
MDBGen 0x0 0
SPIDdis 0x0 0
SPNIDdis 0x0 0
NS 0x0 0
ADAdiscard 0x0 0
ExtDCCmode 0x0 0
- (SBZ) 0x0 0
InstrCompl_l 0x1 1
PipeAdv 0x1 1
TXfull_l 0x0 0
RXfull_l 0x0 0
- (SBZ) 0x0 0
TXfull 0x0 0
RXfull 0x0 0
- (SBZ) 0x0 0
- boot_read_sector 103604
- boot_write_sector 10361a
- 10362a: BL 104dc4
- 10180B Card init => 2
- Saving RESCUE.LOG ...
Hello,
I have M50. I am Android programmer and my knowledge in embedded systems is small (easy AVR programming)
Are there any simple tasks that I could do?
Since you mentioned AVR, what about this?
Quote from: a1ex on September 08, 2017, 09:47:36 AM
- find some UART (https://www.magiclantern.fm/forum/index.php?topic=7531) or JTAG (https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/) port and attempt to communicate with it
Related: 600D (https://www.magiclantern.fm/forum/index.php?topic=7531.msg208794#msg208794) (successful) and R (https://www.magiclantern.fm/forum/index.php?topic=22770.msg210363#msg210363) (unsuccessful).
However, that would be of secondary importance for models in this thread, since we are already able to execute code alongside Canon's main firmware. It could be useful for interfacing with other peripherals, or - better not get there - for unbricking.
A better idea would be to start reading the thread, and also the threads for other recent models. Are there any tasks you could do? Are you able to run the firmware in QEMU? Are you able to push the emulation even further? Are you able to fix the logging code, which worked out of the box on 80D, 5D4 and 200D, but crashed on M50? (you will need QEMU for this one)
BTW - once you (or anyone else) are ready to run the proof of concept code (digic6-dumper branch) on your camera, I can enable the boot flag.
Quote from: a1ex on February 05, 2019, 03:54:06 PM
BTW - once you (or anyone else) are ready to run the proof of concept code (digic6-dumper branch) on your camera, I can enable the boot flag.
Is that digic6-dumper branch not safe to run on camera or what?
If my camera won't turn into a brick maybe I'll give it a shot
https://mobile.twitter.com/autoexec_bin/status/1086653394142617601?p=p#
See a1ex's answer dated 07:55 - 19. Jan. 2019
Quote from: Walter Schulz on February 08, 2019, 05:16:07 AM
See a1ex's answer dated 07:55 - 19. Jan. 2019
That answer was about ROM dumpers - these carry very little risk on new models. On M50, the ROM dumper was already confirmed to work, so the answer no longer applies.
Quote from: Karim on February 08, 2019, 04:56:36 AM
Is that digic6-dumper branch not safe to run on camera or what?
The digic6-dumper branch works out of the box, but once you attempt to run the 80D experiments, it will fail. The issue is that Canon's DebugMsg is in RAM on DIGIC 6/7 (where we can override it easily), while on DIGIC 8 is in ROM (where we can override it with a little more coding). I didn't attempt to solve it yet, but I've documented the MMU configuration (https://chdk.setepontos.com/index.php?topic=13014.msg131247#msg131247) about 2 years ago.
Safety-wise, it's probably OK (but it's worth noting that Canon firmware reflashes the main ROM at shutdown (https://bitbucket.org/hudson/magic-lantern/pull-requests/825/prevent-canon-settings-from-being-saved/diff), so...)
Quote from: Karim on February 08, 2019, 04:56:36 AM
If my camera won't turn into a brick maybe I'll give it a shot
I cannot guarantee that. Risks were explained for e.g. DIGIC 7 (https://www.magiclantern.fm/forum/index.php?topic=19737.75), 5D4 (https://www.magiclantern.fm/forum/index.php?topic=17695.msg208999#msg208999) etc. Enabling the boot flag
will modify your camera, so there is a tiny chance of things going wrong when running this procedure on a new camera model.
Enabling the boot flag will enable anyone with (basic) programming skills to run the proof of concept code on their camera and experiment with it. You will still need QEMU for debugging and for understanding how your code will run. The logging code does not work yet; debugging will have to be done in QEMU. On hardware, you've only got LED blinks, file I/O (as long as the camera doesn't crash) and... display from bootloader context (but do check the 80D thread).
Still with me? If you are OK with the risks, just drop me a PM.
Not sure where to post this as it's both DIGIC 7 and 8 related.
I've noticed that D7 and D8 ports still have
-march=armv7-r
in platform/(cam)/Makefile.platform.default
"armv7-r" means ARM Cortex R. The Cortex R supports integer divide instructions in Thumb mode, whereas the Cortex A9 does not. To avoid getting undefined instruction exceptions in the future, I'd suggest using
-march=armv7-a
instead.
Thanks, I wasn't aware of this difference.
I am a new comer to magic lantern community. I have successfully dumped the ROM and CPU info from my M50. May I ask what this the next step in the development?
I was trying to use QEMU but do not know how to "clone" it to my computer. Consulting someone with experience could provide me with further steps in development.
Here is the attached CPU info:
Magic Lantern Rescue
----------------------------
- Model ID: 0x412 M50
- Camera model: Canon EOS KISS M
- Firmware version: 1.0.1 / 6.8.0 34(00)
- IMG naming: 100CANON/1900.JPG
- User PS: ??? ??? ???
- Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
- ROMBASEADDR: 0xE0040000
CHDK CPU info for 0x412 M50
------------------------------
ID 0x414FC091
Revision 0x1 1
Part 0xC09 3081
ARM Arch 0xF 15
Variant 0x4 4
Implementor 0x41 65
Cache type 0x83338003
Icache min words/line 0x3 3 [8]
(zero) 0x0 0
L1 Icache policy 0x2 2
Dcache min words/line 0x3 3 [8]
Exclusives Reservation Granule 0x3 3 [8]
Cache Writeback Granule 0x3 3 [8]
(zero) 0x0 0
(register format) 0x4 4
TCM type 0x00000000
(raw value) 0x0 0
MPU type 0x414FC091
S 0x1 1
- 0x48 72
Num of MPU regions 0xC0 192
Multiprocessor ID 0x80000000
(raw value) 0x80000000 -2147483648
Processor feature 0 0x00001231
ARM inst set 0x1 1
Thumb inst set 0x3 3
Jazelle inst set 0x2 2
ThumbEE inst set 0x1 1
- 0x0 0
Processor feature 1 0x00000011
Programmers' model 0x1 1
Security extensions 0x1 1
Microcontr. prog model 0x0 0
- 0x0 0
Debug feature 0x00010444
(raw value) 0x10444 66628
Aux feature 0x00000000
(raw value) 0x0 0
Mem model feature 0 0x00100103
VMSA support 0x3 3
PMSA support 0x0 0
Cache coherence 0x1 1
Outer shareable 0x0 0
TCM support 0x0 0
Auxiliary registers 0x1 1
FCSE support 0x0 0
- 0x0 0
Mem model feature 1 0x20000000
L1 Harvard cache VA 0x0 0
L1 unified cache VA 0x0 0
L1 Harvard cache s/w 0x0 0
L1 unified cache s/w 0x0 0
L1 Harvard cache 0x0 0
L1 unified cache 0x0 0
L1 cache test & clean 0x0 0
Branch predictor 0x2 2
Mem model feature 2 0x01230000
L1 Harvard fg prefetch 0x0 0
L1 Harvard bg prefetch 0x0 0
L1 Harvard range 0x0 0
Harvard TLB 0x0 0
Unified TLB 0x3 3
Mem barrier 0x2 2
WFI stall 0x1 1
HW access flag 0x0 0
Mem model feature 3 0x00102111
Cache maintain MVA 0x1 1
Cache maintain s/w 0x1 1
BP maintain 0x1 1
- 0x102 258
Supersection support 0x0 0
ISA feature 0 0x00101111
Swap instrs 0x1 1
Bitcount instrs 0x1 1
Bitfield instrs 0x1 1
CmpBranch instrs 0x1 1
Coproc instrs 0x0 0
Debug instrs 0x1 1
Divide instrs 0x0 0
- 0x0 0
ISA feature 1 0x13112111
Endian instrs 0x1 1
Exception instrs 0x1 1
Exception AR instrs 0x1 1
Extend instrs 0x2 2
IfThen instrs 0x1 1
Immediate instrs 0x1 1
Interwork instrs 0x3 3
Jazelle instrs 0x1 1
ISA feature 2 0x21232041
LoadStore instrs 0x1 1
Memhint instrs 0x4 4
MultiAccess Interruptible instructions 0x0 0
Mult instrs 0x2 2
MultS instrs 0x3 3
MultU instrs 0x2 2
PSR AR instrs 0x1 1
Reversal instrs 0x2 2
ISA feature 3 0x11112131
Saturate instrs 0x1 1
SIMD instrs 0x3 3
SVC instrs 0x1 1
SynchPrim instrs 0x2 2
TabBranch instrs 0x1 1
ThumbCopy instrs 0x1 1
TrueNOP instrs 0x1 1
T2 Exec Env instrs 0x1 1
ISA feature 4 0x00011142
Unprivileged instrs 0x2 2
WithShifts instrs 0x4 4
Writeback instrs 0x1 1
SMC instrs 0x1 1
Barrier instrs 0x1 1
SynchPrim_instrs_frac 0x0 0
PSR_M instrs 0x0 0
- 0x0 0
ISA feature 5 0x00000000
- 0x0 0
Cache level ID 0x09200003
Cache type, level1 0x3 3 [Separate Icache, Dcache]
Cache type, level2 0x0 0 [no cache]
Cache type, level3 0x0 0 [no cache]
Cache type, level4 0x0 0 [no cache]
Cache type, level5 0x0 0 [no cache]
Cache type, level6 0x0 0 [no cache]
Cache type, level7 0x0 0 [no cache]
Cache type, level8 0x1 1 [Icache only]
Level of coherency 0x1 1
Level of unification 0x1 1
(zero) 0x0 0
Cache size ID reg (data, level0) 0x700FE019
Line size in words 0x1 1 [8]
Associativity 0x3 3 [4]
Number of sets 0x7F 127 [128]
Write allocation 0x1 1
Read allocation 0x1 1
Write back 0x1 1
Write through 0x0 0
Cache size ID reg (inst, level0) 0x200FE019
Line size in words 0x1 1 [8]
Associativity 0x3 3 [4]
Number of sets 0x7F 127 [128]
Write allocation 0x0 0
Read allocation 0x1 1
Write back 0x0 0
Write through 0x0 0
SCTLR 0x40C5187D
MPU Enable 0x1 1
Strict Align 0x0 0
L1 DCache Enable 0x1 1
- (SBO) 0xF 15
- (SBZ) 0x0 0
Branch Pred Enable 0x1 1
L1 ICache Enable 0x1 1
High Vectors 0x0 0
Round Robin 0x0 0
- (SBZ) 0x0 0
- (SBO) 0x1 1
MPU background reg 0x0 0
- (SBO) 0x1 1
Div0 exception 0x0 0
- (SBZ) 0x0 0
FIQ Enable 0x0 0
- (SBO) 0x3 3
VIC 0x0 0
CPSR E bit 0x0 0
- (SBZ) 0x0 0
NMFI 0x0 0
TRE 0x0 0
AFE 0x0 0
Thumb exceptions 0x1 1
Big endian 0x0 0
ACTLR 0x00000045
(raw value) 0x45 69
ACTLR2 0x00000701
(raw value) 0x701 1793
CPACR 0xC0000000
(raw value) 0xC0000000 -1073741824
DBGDIDR 0x35137041
Revision 0x1 1
Variant 0x4 4
- (RAZ) 0x70 112
Version 0x3 3 [v7 full]
Context 0x1 1 [2]
BRP 0x5 5 [6]
WRP 0x3 3 [4]
DBGDRAR 0x00000000
Valid 0x0 0
- (UNK) 0x0 0
Address 0x0 0 [0x00000000]
DBGDSAR 0x00030000
Valid 0x0 0
- (UNK) 0x0 0
Address 0x30 48 [0x00030000]
DBGDSCR 0x03000002
HALTED 0x0 0
RESTARTED 0x1 1
MOE 0x0 0
SDABORT_l 0x0 0
ADABORT_l 0x0 0
UND_l 0x0 0
FS 0x0 0
DBGack 0x0 0
INTdis 0x0 0
UDCCdis 0x0 0
ITRen 0x0 0
HDBGen 0x0 0
MDBGen 0x0 0
SPIDdis 0x0 0
SPNIDdis 0x0 0
NS 0x0 0
ADAdiscard 0x0 0
ExtDCCmode 0x0 0
- (SBZ) 0x0 0
InstrCompl_l 0x1 1
PipeAdv 0x1 1
TXfull_l 0x0 0
RXfull_l 0x0 0
- (SBZ) 0x0 0
TXfull 0x0 0
RXfull 0x0 0
- (SBZ) 0x0 0
- boot_read_sector 103604
- boot_write_sector 10361a
- 10362a: BL 104dc4
- 10180B Card init => 2
- Saving RESCUE.LOG ...
Just FYI, Canon has released firmware updates for
EOS M50 (1.0.2)
PowerShot SX740 (1.0.1)
PowerShot SX70 (1.1.0)
In this case, it's probably best to upgrade the codebase now, while there are not too many stubs and other firmware-specific constants. That could be an easy coding task for newcomers, as it's just a matter of pattern matching between the two firmware versions (and it helps you get familiar, to some extent, with Canon's code structure).
For QEMU, if the main guide is hard to follow, refer to the sticky tweet and other videos on the forum (todo: link them in the guide), then apply the patch linked earlier. I'm cleaning up my local changes and putting them through the test suite for quite some time, but I keep bumping into test failures, so it's taking a bit longer, sorry about that...
As usual, once you are ready to run and debug the proof of concept code on the camera, I'm also ready to enable the boot flag. The procedure was already tested on EOS R, so I don't expect any surprises.
Quote from: srsa on March 09, 2019, 03:33:45 PM
EOS M50 (1.0.2)
Firmware Version 1.0.2 incorporates the following fix:
1. Improves reliability of communication with external flashes.
It now works with yongnuo flash triggers.
Please find the FIR file for enabling the boot flag on the EOS/PowerShot M50:
BOOT_M50.FIR (https://a1ex.magiclantern.fm/bleeding-edge/M50/BOOT_M50.FIR) (confirmed by 71m363nd3r; works on any Canon firmware version)
This will modify your camera.
The FIR for enabling the boot flag is expected to work with any Canon firmware version (1.0.1 or 1.0.2 or any future version). However, the code from the digic6-dumper branch ("Hello World") expects firmware 1.0.1; otherwise, it simply won't boot. Support for firmware 1.0.2 is left as an easy coding "qualification" task for whoever is willing to help me on this long jurney.
After enabling the boot flag, you will need to make your card bootable (EosCard/MacBoot/make_bootable.sh) and compile the proof of concept code from the digic6-dumper branch.
Logging code:
hg up digic6-dumper -C
cd platform/M50.101
make clean; make
"Hello World" code:
hg up digic6-dumper -C
cd minimal/hello-world
make MODEL=M50 clean; make MODEL=M50
"Hello World" binary (for firmware 1.0.1 only): autoexec.bin (https://a1ex.magiclantern.fm/bleeding-edge/M50/hello/autoexec.bin)
(https://a1ex.magiclantern.fm/bleeding-edge/M50/m50-hellow.jpg)
Happy April 1st :D
Quote from: a1ex on April 01, 2019, 09:55:41 AM
"Hello World" binary (untested, for firmware 1.0.1 only): autoexec.bin (https://a1ex.magiclantern.fm/bleeding-edge/M50/hello/autoexec.bin)
Happy April 1st :D
Great! Thanks Alex )
(https://i.postimg.cc/43RhNsbH/m50-2.jpg)
magiclantern-fishy.2019Apr01.M50101.zip (https://a1ex.magiclantern.fm/bleeding-edge/M50/magiclantern-fishy.2019Apr01.M50101.zip)
(https://a1ex.magiclantern.fm/bleeding-edge/M50/bench.png)
8)
Awesome, Alex! Might be the most hardest camera to port?
It has some bits from PowerShot firmware, which makes it a bit different from all other EOS models. I mean, porting ML is no longer going to be "just" pattern matching; there will be parts of the code requiring wrappers or other "creative" solutions, not required on other models. That's where the difficulty comes from.
Trivial example: I could not find one of the stubs (GUI_Control), so I wrote a function that did the same thing, from scratch. I believe it's present on all regular EOS models (80D, 5D4, 200D, 77D, 7D2 and so on).
Another example - Canon blocked the Delete button in plain LiveView (since it's unused in their firmware in that mode), but I wanted it for ML menu, for consistency with all other models. This camera doesn't have a MPU, but has the PhySw task (like any other PowerShot), i.e. physical button status is directly visible from the main CPU. So, I've used that to detect the Delete button. That trick is not applicable to 80D, 5D4, 200D, 77D and others - these are "classic" EOS firmwares, with MPU. However, I see this as an advantage of the PowerShot firmware - if Canon did the same with the Delete button on say 200D (I don't know if they did or not), I might not be able to find a workaround.
Another quirk: exposure is stored internally in 1/3 EV steps (1 raw unit = 1/3 EV). On DIGIC 5 and earlier models, they use 1/8 EV steps (so 1/3 is actually 3/8, and 2/3 is actually 5/8). Not sure if this applies to other new models, or it might be a M50 quirk; need to check.
Another one: the shooting settings screen (i.e. what looks like plain photo mode on all other EOS models), is now running in LiveView, unlike on M/M2; it just hides the live image. Figure out how to handle it :D
You'll see these bits once I'll clean up and publish the source code.
Unsure about the EOS R - that one seems closer to "classic" EOS firmware, at first sight. For example, there are signs of a MPU being present, but button handling code looks similar to M50 (or, rather, something in-between M50 and "classic" EOS firmware).
BTW, Greg already sent me the updated stubs for 1.0.2, so the next build will run on latest firmware.
I saw the bench.mo in the software. Anyone tried the fastest write speed in play mode?
Scroll up ...
That screenshot was with SanDisk Extreme Pro 32GB UHS-I (this one (https://www.amazon.com/SanDisk-Extreme-32GB-UHS-I-SDSDXXG-032G-GN4IN/dp/B01J5RHBQ4)). Didn't try others yet.
I think Walter mentioned something about an overclockable (?) SanDisk somewhere... found:
Quote from: Walter Schulz on March 18, 2019, 02:56:57 AM
170 MByte/s is for read only and the only devices known today to use Sandisk's proprietary overclocking mode are Sandisk's newest cardreaders. Running there write rate is indeed higher, too. But with other devices they are only a tad slower compared to 95 MB/s and we don't know if older controllers (used in your M) are able to get unlocked.
See www.cameramemoryspeed.com
Do they have any documentation on this overclocking mode?
Write speed...not bad.
At the moment all I want to know is how fast is this sensor (Mhz) and how many columns does it read simultaneously ;D
I believe it's 27 MHz x 12 channels (from the silent picture mode, which runs at about 300 MPix/s).
timer A = 534, B = 4061 (6408x4061 12.451 fps?) @ e19ebbd0
Quote from: a1ex on April 03, 2019, 09:08:57 AM
Do they have any documentation on this overclocking mode?
Haven't found anything yet. SanDisk states it is proprietary. A compatible adapter is pretty cheap: SDDR-C531/SDDR-399-G46. Happy re-engineering! ;-)
Nice, faster then 5d3.
Makes the 6K April fools joke (sort of) doable, in 3:1 aspect ratio :P
https://www.eoshd.com/2019/04/canon-m50-hacked-features-6k-raw-and-a-i-driven-menus/ (https://www.eoshd.com/2019/04/canon-m50-hacked-features-6k-raw-and-a-i-driven-menus/)
Yeah. I'm rather interested in capturing unpredictable action (i.e. kids), and a 12-fps full-res burst could be exactly what I need. I'm not going to save all these frames - only 2 or 3 of the best ones, as selected by the AI.
The feature is already implemented in the regular silent picture module (Best shots), but is limited to 1080p resolution (and, unfortunately, focus evaluation is broken when using crop_rec).
There is another nice feature in DIGIC 7 and 8 - they both use dual-core Cortex A9, with MMU. That is, we can easily remap the entire ROM contents into RAM and patch it away! You've read that right - it is *trivial* to make *any* temporary changes to ROM contents!
No other camera generation has this ability! DIGIC <= 5 have this ability to a very limited extent ("cache hacks"). All our attempts to unlock this ability DIGIC 6 were... unsuccessful. This (ability to patch the ROM contents) is not required for porting the basic ML functionality, but it is certainly helpful with the advanced stuff (crop_rec, adtg_gui, sd_uhs and others are using it).
Other reasons I've picked this camera:
- EOS firmware (yes, most of its firmware *is* EOS codebase, with some bits from PowerShot - totally different from M3, M5 & others, where the firmware is... PowerShot with a few EOS bits)
- DIGIC 8, 1GB RAM (https://www.magiclantern.fm/forum/index.php?topic=5071.msg212085#msg212085) (!)
- form factor, lens compatibility (EF + EF-M + third party adapters), speed booster availability
- working autofocus (I hope; didn't test it yet, but on 5D3 I consider it unusable)
- dual pixel (remember (https://a1ex.magiclantern.fm/bleeding-edge/5D4/5d4-dual-pixel.html) my (https://a1ex.magiclantern.fm/bleeding-edge/70D/dual-pixel/70D-dual-pixel.html) notes (https://a1ex.magiclantern.fm/bleeding-edge/5D4/dual-pixel/5D4-lv-daf-raw.html)?)
- EOSHD review (https://www.eoshd.com/2018/05/canon-eos-m50-an-accidental-4k-digital-bolex/) :D
- price!
Yep, I've got it to replace the good old (https://www.magiclantern.fm/forum/index.php?topic=23622) 5D3.
Quote from: a1ex on April 03, 2019, 10:37:34 AM
- price!
Yep, I've got it to replace the good old (https://www.magiclantern.fm/forum/index.php?topic=23622) 5D3.
Ok Alex, when we can go to the shop and buy it ... with ML on board? Honestly never thought my next camera could be "M"... in world of Fuji&Sony alternatives 8)
I'm not selling preinstalled versions of ML, sorry. You can install it yourself - EOSHD already did, and I hope he's not the only one :D
The "when" question is well covered in the FAQ and previous topics, but I'm trying (https://www.magiclantern.fm/forum/index.php?topic=23738.0) to find a way to speed up the process.
I know about "when", just kidding ;) Just happy with fact there's some "visual" progress after 2 or even 3 years of researching.
What's difference that M50 has EOS firmware?
... one doesn't have to rewrite ML from scratch.
Quote from: a1ex on April 03, 2019, 11:17:47 AM
You can install it yourself - EOSHD already did, and I hope he's not the only one :D
Not the only one to try it... I love living on the bleeding edge! ;)
We are all really looking forward to seeing where this beautiful work will end up... Thank you very much @a1ex for all your hard work so far!
(https://i.ibb.co/XyJ0zq1/1.jpg) (https://ibb.co/XyJ0zq1)
(https://i.ibb.co/ZhnsVwz/2.jpg) (https://ibb.co/ZhnsVwz)
(https://i.ibb.co/LNw2f6Y/3.jpg) (https://ibb.co/LNw2f6Y)
@a1ex do you think it's possible in theory to add touchscreen navigation in ML?
Quote from: Walter Schulz on April 03, 2019, 08:50:56 AM
Scroll up ...
I was blind...sorry :-\
But 80MB/s, isn't that slow? If M5 has 81MB/s as average speed the fastest write speed with M5 should be around 90MB/s. M50 should have the same write speed as the other new Canon cameras with the same SD interface.
https://www.cameramemoryspeed.com/canon-m5/fastest-sd-cards/
Hey!
I'm following the topic for a while since deciding to get (and got) M50 recently! Really excited to see thing moving forward. Please let me know if there's anything I can help with.
Regarding the write speed why 80 MB/s on SD card should be considered slow?
The other camera I have is 7D and I just did a YouTube review (https://youtu.be/tbEaR2PhlQc) of new Kingston 256Gb CF card which had 60 MB/s in Magic Lantern benchmark, 80 MB/s while recording RAW video and was closer to 130 MB/s using USB 3.0 card reader. I thought the usual SD cards supposed to be slower than CF.
Amazing work and wonderful news! Thanks to everyone who got things this far!
I got to check the 1st April's thread and I find suggestion to monetarily boost the ML development by accepting donations from the community while keeping software free and open source.
You might think to raise funds for a specific goals - that might keep developers more motivated. I can imagine that it is difficult to work on such projects while having a number of 'real' jobs. I guess there are many M50 owners out there who would gladly contribute for an upgrade to their camera.
This is great news! hopefully the video on Raw is very soon in this camera, I have an M50 so I will be happy to help you sharing here the results of the previews
Keep it up, very good job
My M50 arrived today - Yay!
With 1.0.2 firmware - Uh oh!
and Pelican's firmware archive has the M50--KissM-v101-win.zip (https://pel.hu/eoscard/) file is listed - Yay!
But clicking on the link gives a 404 file not found error - oooooh
However, the file is there--I mean here -> https://pel.hu/down/M50-KissM-v101-win.zip
Almost ready--uh, where's the ML-SETUP.FIR file? Available only by special request? Not sure where to start. Maybe with a firmware update to 1.0.2 for starters? That's the one thing that seems almost doable at the moment. In the meantime I'm attempting to put an "M50 Canon Firmware for Testers" package on my downloads page (https://bitbucket.org/daniel_fort/magic-lantern/downloads/) so others won't have to go through that rollercoaster ride to find the "right" firmware version. Compared to other cameras these firmware updater files are humongous.
Congrats on the M50 dfort! Absolutely in love with mine.
Quote from: dfort on April 10, 2019, 02:56:29 AM
Almost ready--uh, where's the ML-SETUP.FIR file? Available only by special request? Not sure where to start. Maybe with a firmware update to 1.0.2 for starters?
This is what I used for my testing: The 'Fishy' is only running on firmware 1.0.1 currently.
Quote from: a1ex on April 01, 2019, 09:55:41 AM
Please find the FIR file for enabling the boot flag on the EOS/PowerShot M50:
BOOT_M50.FIR (https://a1ex.magiclantern.fm/bleeding-edge/M50/BOOT_M50.FIR) (confirmed by 71m363nd3r; works on any Canon firmware version)
This will modify your camera.
Quote from: a1ex on April 01, 2019, 02:03:25 PM
magiclantern-fishy.2019Apr01.M50101.zip (https://a1ex.magiclantern.fm/bleeding-edge/M50/magiclantern-fishy.2019Apr01.M50101.zip)
Appears to be a proof of concept at the moment. When I tested it, pressing the trash can button to activate only opened into the ML menu once every 5-7 times. The menu itself does not have fully fledged out functionality just yet. I am sure it will get there, obviously there is a lot of hard work that needs to go into this still. Absolutely brilliant work so far IMO! =Þ
Canon has introduced the EOS Rebel SL3 (EOS 250D / EOS Kiss X10)
https://www.dpreview.com/news/1541666691/ultra-compact-canon-eos-rebel-sl3-offers-eye-detect-af-and-disappointing-4k-capture
Quote from: dfort on April 10, 2019, 02:56:29 AM
My M50 arrived today - Yay!
Welcome to the future :D
Quote from: yokashin on April 10, 2019, 10:49:30 AM
Canon has introduced the EOS Rebel SL3 (EOS 250D / EOS Kiss X10)
Oh no, another camera to take care of!
To prepare the portable ROM dumper, I "only" need a CR3 image (i.e. wait for reviews with sample images). If that won't work, hardware hack à la EOS R.
BTW, after playing a bit with M and M50, I started to wonder what's the purpose of all other Rebel cameras on the market. Do they have better battery life, or...?
Quote from: shadimar69 on April 10, 2019, 03:50:15 AM
When I tested it, pressing the trash can button to activate only opened into the ML menu once every 5-7 times.
Really? It just worked here... and I'm pretty sure I've opened it more than 100 times.
You were in plain LiveView when pressing the delete button, right?
Quote from: a1ex on April 10, 2019, 10:57:51 AM
BTW, after playing a bit with M and M50, I started to wonder what's the purpose of all other Rebel cameras on the market. Do they have better battery life, or...?
True the only camera's from canon that matter atm are the 5D IV and canon eos r. Hope ML will run on either soon :)
Quote from: a1ex on April 10, 2019, 10:57:51 AM
Really? It just worked here... and I'm pretty sure I've opened it more than 100 times.
You were in plain LiveView when pressing the delete button, right?
Yes tested in plain LiveView. To be able to consistently get the ML menu to come up, I have to double press the trash button, about 500ms between presses. If I just press once, screen goes black for 1 second, then returns back to normal live view.
It's official, Canon 200D Mark II with DIGIC 8 Announced
https://www.techradar.com/news/canons-eos-200d-mark-ii-is-a-lightweight-4k-dslr-thats-heavy-on-features
The 200D Mark II probably belongs in the DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2) (https://www.magiclantern.fm/forum/index.php?topic=19737.0) topic.
Back to the M50. First of all, I dumped the 1.0.2 firmware. Just in case I get the urge to port the current firmware.
(https://live.staticflickr.com/7808/33703854388_cc84cc2ac2.jpg) (https://flic.kr/p/Tmi4FJ)
Then I downgraded to 1.0.1 and turned on the camera bootflag -- no turning back now?
(https://live.staticflickr.com/7816/32638247127_4fb5cd4f22.jpg) (https://flic.kr/p/RJ8xLK)
I had no problems opening the ML menu with the Trash button but the first thing I noticed was that the ML menu hiccups every few seconds. Ok--this is an early port.
Hey, the selftest module included with the "fishy" build so how well does that work on the camera?
[Pass] is_play_mode() => 0x1
[INFO] Camera model: Canon EOS M50 1.0.1 (0x412 M50)
[Pass] is_camera("DIGIC", "*") => 0x1
[Pass] is_camera(__camera_model_short, firmware_version) => 0x1
m0 = MALLOC_FREE_MEMORY => 0x60fe0
[Pass] p = (void*)_malloc(50*1024) => 0x10ff70
[Pass] CACHEABLE(p) => 0x10ff70
m1 = MALLOC_FREE_MEMORY => 0x547d0
_free(p)
m2 = MALLOC_FREE_MEMORY => 0x60fe0
[Pass] ABS((m0-m1) - 50*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
m0 = GetFreeMemForAllocateMemory() => 0x24273c
[Pass] p = (void*)_AllocateMemory(128*1024) => 0xe5288c
[Pass] CACHEABLE(p) => 0xe5288c
m1 = GetFreeMemForAllocateMemory() => 0x22272c
_FreeMemory(p)
m2 = GetFreeMemForAllocateMemory() => 0x24273c
[Pass] ABS((m0-m1) - 128*1024) => 0x10
[Pass] ABS(m0-m2) => 0x0
m01 = MALLOC_FREE_MEMORY => 0x60fe0
m02 = GetFreeMemForAllocateMemory() => 0x24273c
[Pass] p = (void*)_alloc_dma_memory(128*1024) => 0x40e528a0
[Pass] UNCACHEABLE(p) => 0x40e528a0
[Pass] CACHEABLE(p) => 0xe528a0
[Pass] UNCACHEABLE(CACHEABLE(p)) => 0x40e528a0
_free_dma_memory(p)
[Pass] p = (void*)_shoot_malloc(16*1024*1024) => 0x4660c094
[Pass] UNCACHEABLE(p) => 0x4660c094
_shoot_free(p)
m11 = MALLOC_FREE_MEMORY => 0x60fe0
m12 = GetFreeMemForAllocateMemory() => 0x24273c
[Pass] ABS(m01-m11) => 0x0
[Pass] ABS(m02-m12) => 0x0
[Pass] suite = shoot_malloc_suite_contig(16*1024*1024) => 0xeb980
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x1000000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x10ff70
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x1000000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4660c090
[Pass] UNCACHEABLE(p) => 0x4660c090
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite_contig(0) => 0xeb980
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x1
[Pass] suite->size => 0x2000000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x10ff70
[Pass] chunk->signature => 'MemChunk'
[Pass] chunk->size => 0x2000000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x7b93e470
[Pass] UNCACHEABLE(p) => 0x7b93e470
largest_shoot_block = suite->size => 0x2000000
[INFO] largest_shoot_block: 32MB
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(largest_shoot_block + 1024*1024) => 0xeb980
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x3
[Pass] suite->size => 0x2100000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x10ff70
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1388000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4660c090
[Pass] UNCACHEABLE(p) => 0x4660c090
chunk = GetNextMemoryChunk(suite, chunk) => 0x10ffa8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1780000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x46110070
[Pass] UNCACHEABLE(p) => 0x46110070
chunk = GetNextMemoryChunk(suite, chunk) => 0x10ffe0
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x2100000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x7b93e470
[Pass] UNCACHEABLE(p) => 0x7b93e470
chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x2100000
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] suite = shoot_malloc_suite(0) => 0xeb980
[Pass] suite->signature => 'MemSuite'
[Pass] suite->num_chunks => 0x4
[Pass] suite->size => 0x3f00000
[Pass] chunk = GetFirstChunkFromSuite(suite) => 0x10ff70
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1388000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x4660c090
[Pass] UNCACHEABLE(p) => 0x4660c090
chunk = GetNextMemoryChunk(suite, chunk) => 0x10ffa8
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x1780000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x46110070
[Pass] UNCACHEABLE(p) => 0x46110070
chunk = GetNextMemoryChunk(suite, chunk) => 0x10ffe0
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x3780000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x7b93e470
[Pass] UNCACHEABLE(p) => 0x7b93e470
chunk = GetNextMemoryChunk(suite, chunk) => 0x110018
[Pass] chunk->signature => 'MemChunk'
[Pass] total += chunk->size => 0x3f00000
[Pass] p = GetMemoryAddressOfMemoryChunk(chunk) => 0x7d93e480
[Pass] UNCACHEABLE(p) => 0x7d93e480
chunk = GetNextMemoryChunk(suite, chunk) => 0x0
[Pass] total => 0x3f00000
shoot_free_suite(suite); suite = 0; chunk = 0;
[Pass] strlen("abc") => 0x3
[Pass] strlen("qwertyuiop") => 0xa
[Pass] strlen("") => 0x0
[Pass] strcpy(msg, "hi there") => 0x2ca654
[Pass] msg => 'hi there'
[Pass] snprintf(a, sizeof(a), "foo") => 0x3
[Pass] snprintf(b, sizeof(b), "foo") => 0x3
[Pass] strcmp(a, b) => 0x0
[Pass] snprintf(a, sizeof(a), "bar") => 0x3
[Pass] snprintf(b, sizeof(b), "baz") => 0x3
[Pass] strcmp(a, b) => 0xfffffff8
[Pass] snprintf(a, sizeof(a), "Display") => 0x7
[Pass] snprintf(b, sizeof(b), "Defishing") => 0x9
[Pass] strcmp(a, b) => 0x4
[Pass] snprintf(buf, 3, "%d", 1234) => 0x2
[Pass] buf => '12'
[Pass] memcpy(foo, bar, 6) => 0x2ca700
[Pass] foo => 'asdfghuiop'
[Pass] memset(bar, '*', 5) => 0x2ca6e0
[Pass] bar => '*****hjkl;'
call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
call("TurnOffDisplay")
[FAIL] DISPLAY_IS_ON => 0x1
call("TurnOnDisplay")
[Pass] DISPLAY_IS_ON => 0x1
task_create("test", 0x1c, 0x1000, test_task, 0) => 0x6c6013c
[Pass] test_task_created => 0x1
[Pass] get_current_task_name() => 'run_test'
[FAIL] get_task_name_from_id(current_task->taskId) => '?'
[Pass] mq = mq ? mq : (void*)msg_queue_create("test", 5) => 0x6c8012a
[Pass] msg_queue_post(mq, 0x1234567) => 0x0
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x0
[Pass] m => 0x1234567
[Pass] msg_queue_receive(mq, (struct event **) &m, 500) => 0x9
[Pass] sem = sem ? sem : create_named_semaphore("test", 1) => 0x6ca0242
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] take_semaphore(sem, 500) => 0x9
[Pass] give_semaphore(sem) => 0x0
[Pass] take_semaphore(sem, 500) => 0x0
[Pass] give_semaphore(sem) => 0x0
[Pass] rlock = rlock ? rlock : CreateRecursiveLock(0) => 0x6cc003c
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] AcquireRecursiveLock(rlock, 500) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
[Pass] ReleaseRecursiveLock(rlock) => 0x0
SetGUIRequestMode(1); msleep(1000);
[FAIL] CURRENT_GUI_MODE => 0x0
SetGUIRequestMode(2); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x2
SetGUIRequestMode(0); msleep(1000);
[Pass] CURRENT_GUI_MODE => 0x0
[Pass] display_idle() => 0x1
GUI_Control(BGMT_PLAY, 0, 0, 0); msleep(1000);
[Pass] PLAY_MODE => 0x1
[Pass] MENU_MODE => 0x0
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(1000);
[Pass] MENU_MODE => 0x1
[Pass] PLAY_MODE => 0x0
GUI_Control(BGMT_MENU, 0, 0, 0); msleep(500);
[Pass] MENU_MODE => 0x0
[Pass] PLAY_MODE => 0x0
SW1(1,100)
[FAIL] HALFSHUTTER_PRESSED => 0x0
SW1(0,100)
[Pass] HALFSHUTTER_PRESSED => 0x0
[Pass] is_play_mode() => 0x1
[FAIL] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[FAIL] is_pure_play_movie_mode() => 0x0
[Pass] is_play_mode() => 0x1
[Pass] is_pure_play_photo_mode() => 0x0
[Pass] is_pure_play_movie_mode() => 0x0
=========================================================
Test complete, 4423 passed, 6 failed.
.
I take it this is a short test and not the one from the lua_fix branch? Still, pretty good for an early port.
about Canon EOS Rebel SL3 (EOS 250D / EOS Kiss X10)
Quote from: a1ex on April 10, 2019, 10:57:51 AM
To prepare the portable ROM dumper, I "only" need a CR3 image (i.e. wait for reviews with sample images). If that won't work, hardware hack à la EOS R.
https://cweb.canon.jp/eos/lineup/kissx10/img/sample/downloads/sample01.jpg
https://cweb.canon.jp/eos/lineup/kissx10/img/sample/downloads/sample02.jpg
Canon Image Type : Canon EOS Kiss X10
Canon Firmware Version : Firmware Version 4.0.5
Canon Model ID : Unknown (0x80000436)
About those EOS Rebel SL3 (EOS 250D / EOS Kiss X10) sample images --
Quote from: a1ex on April 10, 2019, 10:57:51 AM
...I "only" need a CR3 image...
Those links point to JPEG files.
Hum, it does have a Digic 8 processor so maybe it
should be discussed on this topic.
Now about the M50 --
Looks like the firmware dumper isn't dumping ROM1.BIN. It goes through the motions and the MD5 checks out but the entire file is filled with zeros. I'm talking about this one: https://a1ex.magiclantern.fm/debug/portable-rom-dumper/new/DUMP_M50.FIR
Maybe there's a newer one or perhaps an older one that works? I was able to get a 1.0.1 dump from @leathc a while back with a valid ROM1.BIN.
In any case, the "fishy" April 1 build did save a valid ROM1.BIN dump but if I compile an autoexec.bin file from the current digic6-dumper branch it
doesn't create a valid ROM1.BIN dump.
Just for fun I thought I'd try to port the 1.0.2 firmware and as far as I can tell it is working. Here's what the check-stubs.py script shows:
python check-stubs.py /Users/rosiefort/magic-lantern-hudson/platform/M50.101/stubs.S /Users/rosiefort/magic-lantern/platform/M50.102/stubs.S
Module termcolor missing, no color support will be available
STUB OLD NEW DELTA
current_interrupt 0x00001010 -> 0x00001010 [0x000] [contents not checked]
current_task 0x00001028 -> 0x00001028 [0x000] [contents not checked]
bmp_vram_info 0x0000fc20 -> 0x0000fc20 [0x000] [contents not checked]
init_task 0xe0040225 -> 0xe0040225 [0x000] [contents not checked] [!!!]
dump_file 0xe0085f61 -> 0xe0085f71 [0x010] [contents not checked]
memmap_info 0xe009de99 -> 0xe009deb9 [0x020] [contents not checked]
malloc_info 0xe00f1bd9 -> 0xe00f1c1d [0x044] [contents not checked]
sysmem_info 0xe00f1c71 -> 0xe00f1cb5 [0x044] [contents not checked]
create_init_task 0xe0143cbd -> 0xe0143d01 [0x044] [contents not checked]
smemShowFix 0xe0146f97 -> 0xe0146fdb [0x044] [contents not checked]
_malloc 0xe03c2307 -> 0xe03c2387 [0x080] [contents not checked]
_free 0xe03c233f -> 0xe03c23bf [0x080] [contents not checked]
task_create 0xe0545dd7 -> 0xe0545e4f [0x078] [contents not checked] [!!!]
_FIO_OpenFile 0xe0546429 -> 0xe05464a1 [0x078] [contents not checked]
_FIO_CreateFile 0xe05464db -> 0xe0546553 [0x078] [contents not checked]
_FIO_RemoveFile 0xe0546811 -> 0xe0546889 [0x078] [contents not checked]
_FIO_ReadFile 0xe05468ab -> 0xe0546923 [0x078] [contents not checked]
FIO_SeekSkipFile 0xe0546977 -> 0xe05469ef [0x078] [contents not checked]
_FIO_WriteFile 0xe0546a37 -> 0xe0546aaf [0x078] [contents not checked]
FIO_CloseFile 0xe0546c4b -> 0xe0546cc3 [0x078] [contents not checked]
_FIO_GetFileSize 0xe0546de7 -> 0xe0546e5f [0x078] [contents not checked]
_FIO_RenameFile 0xe054781b -> 0xe0547893 [0x078] [contents not checked]
_FIO_CreateDirectory 0xe0547ca5 -> 0xe0547d1d [0x078] [contents not checked]
FIO_Flush 0xe0547e8f -> 0xe0547f07 [0x078] [contents not checked]
_FIO_FindFirstEx 0xe0548107 -> 0xe054817f [0x078] [contents not checked]
FIO_FindNextEx 0xe054820d -> 0xe0548285 [0x078] [contents not checked]
FIO_FindClose 0xe05482cf -> 0xe0548347 [0x078] [contents not checked]
SetTimerAfter 0xe054ce09 -> 0xe054ce81 [0x078] [contents not checked]
CancelTimer 0xe054cebf -> 0xe054cf37 [0x078] [contents not checked]
msleep 0xe05597ef -> 0xe0559867 [0x078] [contents not checked]
uart_printf 0xe055a7a9 -> 0xe055a821 [0x078] [contents not checked]
_alloc_dma_memory 0xe055a9e9 -> 0xe055aa61 [0x078] [contents not checked]
_free_dma_memory 0xe055aa1d -> 0xe055aa95 [0x078] [contents not checked]
GetSizeOfMaxRegion 0xe055ade7 -> 0xe055ae5f [0x078] [contents not checked]
GetMemoryInformation 0xe055ae13 -> 0xe055ae8b [0x078] [contents not checked]
_AllocateMemory 0xe055af89 -> 0xe055b001 [0x078] [contents not checked]
_FreeMemory 0xe055b141 -> 0xe055b1b9 [0x078] [contents not checked]
call 0xe05721bb -> 0xe0572233 [0x078] [contents not checked]
dcache_clean 0xe05776c5 -> 0xe057773d [0x078] [contents not checked]
icache_invalidate 0xe0577799 -> 0xe0577811 [0x078] [contents not checked]
DryosDebugMsg 0xe0577ec5 -> 0xe0577f3d [0x078] [contents not checked]
bzero32 0xe0578c59 -> 0xe0578cd1 [0x078] [contents not checked]
SetHPTimerAfterNow 0xe0732957 -> 0xe0732abf [0x168] [contents not checked]
SetHPTimerNextTick 0xe07329b7 -> 0xe0732b1f [0x168] [contents not checked]
Copying the M50.102 autoexec.bin to a bootable card (and with the camera bootflag set of course) will create a valid ROM0.BIN and an invalid ROM1.BIN just like the M50.101 version. That's pretty much all it does but hey--that's something!
Another issue with the 1.0.2 port is getting the firmware signature. Following my own tutorial (https://www.magiclantern.fm/forum/index.php?topic=19417.0) I defined CONFIG_HELLO_WORLD but it required a value for SIG_M50_102 or it would not compile and it didn't print "Hello World" on the LCD, much less print out the firmware signature.
One last piece of the puzzle:
platform/M50.102/Makefile.platform.default
FIRMWARE_ID = 0x00000412 # Not sure where to find this
Quote from: dfort on April 11, 2019, 08:31:35 PM
Another issue with the 1.0.2 port is getting the firmware signature. Following my own tutorial (https://www.magiclantern.fm/forum/index.php?topic=19417.0) I defined CONFIG_HELLO_WORLD but it required a value for SIG_M50_102 or it would not compile and it didn't print "Hello World" on the LCD, much less print out the firmware signature.
Easy way is to use Qemu with a faked value in src/fw-signature.h and let it print what src/reboot.c expect to be :)
Quote from: dfort on April 11, 2019, 08:31:35 PM
One last piece of the puzzle:
platform/M50.102/Makefile.platform.default
FIRMWARE_ID = 0x00000412 # Not sure where to find this
You can find it under "Canon CanonModelID Values" at https://sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html (https://sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html) or https://github.com/lclevy/libcraw2/blob/54caceb6aa3ec8aff1ae3102a498cb5438a75d74/docs/cameras.txt (https://github.com/lclevy/libcraw2/blob/54caceb6aa3ec8aff1ae3102a498cb5438a75d74/docs/cameras.txt)
Are they discovered from image metadata?
Also usually last digits are printed on serial console by the camera at firmware startup (ex. K412) and is reported under Model ID of the rom dumper.
Ah -- there it is, first line on the RESCUE.LOG:
Magic Lantern Rescue
----------------------------
- Model ID: 0x412 M50
- Camera model: Canon EOS KISS M
- Firmware version: 1.0.2 / 7.0.0 34(00)
- IMG naming: 100CANON/????0000.JPG
- User PS: ??? ??? ???
- Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
- ROMBASEADDR: 0xE0040000
- boot_read_sector 103604
- boot_write_sector 10361a
- 10362a: BL 104dc4
- 10180B Card init => 2
- Dumping ROM0... 100%
- MD5: 0f1e58aea6c1b77d2d8ac244050069c0
- Dumping ROM1... 100%
- MD5: 2c7ab85a893283e98c931e9511add182
- No serial flash.
- Saving RESCUE.LOG ...
Ok, so that's the Model ID. I suspected that but wanted to make sure. Of course it doesn't change on a firmware update.
Looked up those links and it appears that the M50 hasn't been integrated into exiftool or libcraw2 or dcraw for that matter. There is one little hint on the dcraw source code (https://www.cybercom.net/~dcoffin/dcraw/dcraw.c) about the M50:
{ "Canon EOS M5", 0, 0, /* also M50 */
{ 8532,-701,-1167,-4095,11879,2508,-797,2424,7010 } },
That might be useful for future reference though if you run the latest build of dcraw with the -T option on a .CR3 file from the M50 all you come up with is a black frame.
To run the M50 in QEMU it still needs to be patched (https://a1ex.magiclantern.fm/bleeding-edge/M50/qemu.patch). I saved a patched version in my repository so I merged in the latest qemu branch changes and -- ugh, more to do. There is a bunch of stubs that need to be updated in debugmsg.gdb. Hope I got all of them right:
qemu-eos/M50/debugmsg.gdb
# ./run_canon_fw.sh M50 -d debugmsg
# ./run_canon_fw.sh M50 -d debugmsg -s -S & arm-none-eabi-gdb -x M50/debugmsg.gdb
source -v debug-logging.gdb
# To get debugging symbols from Magic Lantern, uncomment one of these:
symbol-file ../magic-lantern/platform/M50.102/magiclantern
#symbol-file ../magic-lantern/platform/M50.102/autoexec
#symbol-file ../magic-lantern/platform/M50.102/stubs.o
macro define CURRENT_TASK 0x1028
macro define CURRENT_ISR (*(int*)0x100C ? (*(int*)0x1010) : 0)
macro define NUM_CORES 2
macro define NULL_STR 0xE0041041
# GDB hook is very slow; -d debugmsg is much faster
# ./run_canon_fw.sh will use this address, don't delete it
# b *0xE0577F3C
# DebugMsg_log
b *0xE0786538
assert_log
b *0xE0545E4E
task_create_log
# what's the difference?!
b *0xE0546072
task_create_log
b *0xE057783C
register_interrupt_log
b *0xE05721B8
register_func_log
if 0
b *0xE05727D0
create_semaphore8_log
b *0xE0572896
take_semaphore_log
end
b *0xE0559272
CreateStateObject_log
b *0xE02A89E4
mpu_send_log
b *0xE016F31A
generic_log
b *0xE074F0F0
generic_log
b *0xE00508B0
generic_log
b *0xE0577ADC
generic_log
b *0xE06704E4
commands
silent
print_current_location
printf "I2C_Write(%x, %x, %x, %x)\n", $r0, $r1, $r2, $r3
set $r0 = 0
set $pc = $lr
c
end
b *0xE0573522
commands
silent
print_current_location
printf "!! NIGHTMARE !! S_PROPAD_INVALIDPARAMETER 20003\n"
set $r0 = 0
set $pc = $lr
c
end
b *0xE004490E
commands
silent
print_current_location
printf "DataLoad_wait hack\n"
set $r1 = 1000
c
end
b *0xE004A488
commands
silent
print_current_location
printf "lens init?\n"
set $r0 = 0
set $pc = $lr
c
end
b *0xE01E1318
commands
silent
print_current_location
printf "RemCPUSwChk\n"
set $r0 = 0
set $pc = $lr
c
end
b *0xE016F31A
commands
silent
print_current_location
printf "conductor\n"
set $r0 = 0
set $pc = $lr
c
end
if 0
b *0xE01E12B8
commands
silent
print_current_location
printf "SwitchCheck\n"
set $r0 = 5
set $r1 = 0
set $pc = 0xE07599BC
c
end
end
b *0xE0759A98
commands
silent
print_current_location
KRED
printf "LED drive %x %x\n", $r0, $r1
KRESET
log_result
c
end
if 0
b *0xE05E994E
commands
silent
print_current_location
printf "rtc drv\n"
set $r0 = 0
set $pc = $lr
c
end
end
#b *0x1b1d40
#b *0x1b1c40
#b my_cstart
#b my_dcache_clean
#b *0xE0004cea thread 2
#b *0xe00400fe
#commands
# dump binary memory 40000000.bin 0x40000000 0x40100000
# dump binary memory DF000000.bin 0xDF000000 0xDF100000
#end
# i2c_read
b *0xE0670444
generic_log
# i2c_write
b *0xE06704E4
generic_log
# hpcopy
if 0
b *0xE02E02EE
commands
silent
print_current_location
KRED
printf "HPCopy(%x, %x, %x)\n", $r0, $r1, $r2
KRESET
set $r2 = 0x4
tbreak *($lr & ~1)
commands
silent
print_current_location
KRED
printf "HPCopy ret %x\n", $r0
KRESET
end
end
#generic_log
end
# HPCopy
# Hardware protocol looks complex; emulating from GDB for now
b *0xE02E02EE
commands
silent
print_current_location
KRED
printf "HPCopy(%x, %x, %x)\n", $r0, $r1, $r2
KRESET
# execute plain memcpy instead (same arguments)
set $pc = 0xe065e8dd
# we need to return 0 on success, unlike memcpy
tbreak *($lr & ~1)
commands
silent
set $r0 = 0
c
end
c
end
b *0xE01E1318
b *0xE06599A0
commands
silent
print_current_location
KRED
printf "Wakeup\n"
KRESET
c
end
b *0xE01E12B8
commands
silent
print_current_location
KRED
printf "SwitchCheck skipping\n"
KRESET
set $pc = $lr
c
end
b *0xE01A4B92
commands
silent
print_current_location
KRED
printf "RTCMgrState_S00_I00 skipping\n"
KRESET
set $pc = $lr
c
end
b *0xE01E3796
commands
silent
print_current_location
KRED
printf "PhySw stuff skipping\n"
KRESET
set $pc = $lr
c
end
b *0xE0040C90
commands
silent
print_current_location
KRED
printf "take_sem WaitCCInit\n"
KRESET
set $r1 = 1000
c
end
b *0xE00EE288
commands
silent
print_current_location
KRED
printf "SubCPU something skipping\n"
KRESET
set $pc = $lr
c
end
#b *0xE00504B2
cont
As I recall the gui emulation isn't working yet. The invalid 1.0.2 ROM1.BIN is a problem, QEMU kept crashing so I "borrowed" the valid file from 1.0.1 and the Frankenstein monster awoke:
(https://live.staticflickr.com/7832/47589234861_f70ba8d9c7.jpg) (https://flic.kr/p/2fvigxk)
Reason I'm calling it Frankenstein is because even though it is clearly running 1.0.2, the CineStyle Picture Style came from the 1.0.1 firmware dump ROM1.BIN file from @leathc.
Ok--so how about running my firmware update on it to get the firmware signature? It did seem to run fine on the camera but no matter how high I flew the kites or number of lightning strikes, qemu refused to go past this:
Now jump to AUTOEXEC.BIN(0x00800000)!!
[CPU0] 00800008: MRC p15,0,Rd,cr0,cr0,5: MPIDR -> 0x80000000
Two reasons I have encountered which can make it hang there:
1. It reached firmware signature check and failed to pass
2. Some wrong address for patching cache or others in platform/m50/constants.h
Have you compiled with Qemu debugging messages enabled?
Firmware signature message are that kind of type (like this (https://www.magiclantern.fm/forum/index.php?topic=19737.msg213298#msg213298)).
I've got the debugging messages enabled.
./run_canon_fw.sh M50,firmware="boot=0" -d debugmsg -s -S & arm-none-eabi-gdb -x M50/debugmsg.gdb
Lot of this going on:
[CPU0] [ HeartBeat0:e0234c7f ] SubCPU something skipping
Went back and forth between M50.101 and M50.102 and as far as I can see they are both running the same in QEMU with the exception of not being able to get past that sticking point (with "boot-1" of course) because of the firmware signature. Just to see if your suggestion of a "faked" value will show a message like what you got on the 200D I changed the M50.101 firmware signature and it got stuck at exactly the same place.
So--looks like I got a firmware update that is 99% there. It is just missing the key to unlock it. :-X
Yeah, I know--this firmware update is just a minor one but going through the process is a good way to get familiar with the camera.
Firmware Version 1.0.2 incorporates the following fix:
1. Improves reliability of communication with external flashes.
I mean compile with CONFIG_QEMU=y to enable qprintf in console.
Can't retrieve the exact command line now, should be appended after make command (tried in makefile one time and didn't worked with digic6 branch so not sure about that method)
make CONFIG_QEMU=y
BINGO!
[CPU0] 00800008: MRC p15,0,Rd,cr0,cr0,5: MPIDR -> 0x80000000
[boot] firmware signature: 0x3b70901c (997232668)
expected: 0x80bd9b4b (-2135057589)
computed from: 0xe0040000 (-536608768)
It woke up:
[BOOT] jumping to relocated startup code at 0x1b2349 (1778505)
[CPU0] 001B1890: MCR p15, ... : CACHEMAINT x514 (omitted)
[CPU0] 001B2348: MCR p15,0,Rd,cr12,cr0,0: VBAR <- 0xE008F6E0
[CPU0] 001B2352: MRC p15,0,Rd,cr0,cr0,5: MPIDR -> 0x80000000
Wake up CPU1
Wake up CPU1
[CPU1] E00088B4: MRC p15,0,Rd,cr0,cr0,5: MPIDR -> 0x80000001
[CPU1] E00088C4: MCR p15,0,Rd,cr12,cr0,0: VBAR <- 0xE000001D
Now how to get a valid ROM1.BIN dump. It is working on the "fishy" build but that hasn't been pushed to the remote yet. (Probably because there's something fishy with that changeset?)
Magic Lantern fishy.2019Apr01.M50101
Camera : M50
Firmware : 101
Changeset: dd284faf66c8 (fishy-april-fools) tip
Built on : 2019-04-01 12:00:19 by alex@thinkpad
hg up -C dd284faf66c8
abort: unknown revision 'dd284faf66c8'!
dfort, this is very cool to watch!
keep sharing...
will anyone send a link to the full m50 software? pleas!!
There is no full ML for M50 yet.
Here's the obligatory "Hello, World!" shot of the M50 running firmware version 1.0.2.
(https://live.staticflickr.com/7812/47595697921_62700336af.jpg) (https://flic.kr/p/2fvSoMp)
Pull request submitted:
https://bitbucket.org/hudson/magic-lantern/pull-requests/955/m50-update-to-canon-firmware-version-102/diff
Quote from: aprofiti on April 11, 2019, 08:48:41 PM
Easy way is to use Qemu with a faked value in src/fw-signature.h and let it print what src/reboot.c expect to be :)
You can find it under "Canon CanonModelID Values" at https://sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html (https://sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html) or https://github.com/lclevy/libcraw2/blob/54caceb6aa3ec8aff1ae3102a498cb5438a75d74/docs/cameras.txt (https://github.com/lclevy/libcraw2/blob/54caceb6aa3ec8aff1ae3102a498cb5438a75d74/docs/cameras.txt)
Are they discovered from image metadata?
Also usually last digits are printed on serial console by the camera at firmware startup (ex. K412) and is reported under Model ID of the rom dumper.
you can use Exiftool to extract modelId from raw (CR2, CR3) or jpeg.
C:\Users\laurent>exiftool -CanonModelId d:\cr3_samples\m50\canon_eos_m50_02.jpg
Canon Model ID : EOS M50 / Kiss M
C:\Users\laurent>exiftool -CanonModelId d:\cr3_samples\250d\sample01.jpg
Canon Model ID : Unknown (0x80000436)
C:\Users\laurent>exiftool -CanonModelId d:\cr3_samples\r\447A0582.CR3
Canon Model ID : EOR R
for CR3 you can study parse_cr3.py
https://github.com/lclevy/canon_cr3
for CR2 see this poster : https://github.com/lclevy/libcraw2/blob/master/docs/cr2_poster.pdf,
it is stored in Makernote
you can also use craw2tool : https://github.com/lclevy/libcraw2/blob/master/user_manual.md
Thanks for the tips.
Quote from: dfort on April 12, 2019, 02:06:32 AM
...the M50 hasn't been integrated into exiftool...
Oops, needed to update my exiftool. Now it works properly:
exiftool -CanonModelID IMG_0003.CR3
Canon Model ID : EOS M50 / Kiss M
I had an old version and the best it could so was this on jpeg files:
exiftool -CanonModelID IMG_0003.JPG
Canon Model ID : Unknown (0x412)
By the way, you can get the latest version of exiftool through the ML build scripts:
magic-lantern/modules/dual_iso/Makefile.cr2hdr
# Find the latest version of exiftool
EXIFTOOL_VERS=$(shell echo $$(curl -s https://www.sno.phy.queensu.ca/~phil/exiftool/ | grep -Em 1 'Download|Version' | grep -Eo '[0-9]+([.][0-9]+)?') | cut -d ' ' -f 1)
...
exiftool.tar.gz:
# Mac and Linux
wget http://www.sno.phy.queensu.ca/~phil/exiftool/Image-ExifTool-$(EXIFTOOL_VERS).tar.gz -O exiftool.tar.gz
exiftool.zip:
# Windows
wget http://www.sno.phy.queensu.ca/~phil/exiftool/exiftool-$(EXIFTOOL_VERS).zip -O exiftool.zip
That Makefile can also compile the latest dcraw and cr2dhr. Check it out. 8)
Quote from: lorenzo353 on April 13, 2019, 10:46:00 AM
you can use Exiftool to extract modelId from raw (CR2, CR3) or jpeg.
Thanks, you just confirmed my initial thinking on how it was discovered for newer models
Quote from: lorenzo353 on April 13, 2019, 10:46:00 AM
for CR2 see this poster : https://github.com/lclevy/libcraw2/blob/master/docs/cr2_poster.pdf,
it is stored in Makernote
Had a look at the poster and it helped me to understand better how offsets are handled inside the file format :)
Quote from: lorenzo353 on April 13, 2019, 10:46:00 AM
you can also use craw2tool : https://github.com/lclevy/libcraw2/blob/master/user_manual.md
@lorenzo353 I also looked at your library when tried to manipulate exif tags (https://www.magiclantern.fm/forum/index.php?topic=23683.msg213729#msg213729) in cr2 image, but if I don't remember wrong it's not minded to overwrite metadata.
Do you have any suggestions?
Hello. I just wanted to ask - how is the current state of ML port for M50? I would need bracketing function as I believe its not possible with the original firmware. I would also help contributer as I am developer, but I am javascript specialist and I think there is no use of that. :)
Thx. :)
Quote from: ioman on April 17, 2019, 11:32:55 PM
Hello. I just wanted to ask - how is the current state of ML port for M50? I would need bracketing function as I believe its not possible with the original firmware. I would also help contributer as I am developer, but I am javascript specialist and I think there is no use of that. :)
Thx. :)
Welcome, you can start by clone repo, setup the toolchain and try to compile ML, that way you can follow development and make your tests, give feedback, make small changes (at first) and who knows that maybe the next big discoveries will come from your findings...
I'm thinking to get a M50 too, even if I was more interested in the RP but the new firmware signature freezed my hopes (for now)
@scrax Getting M50 now is a good choose! Ultra cheap, Viltrox SpeedBooster and with ML it will be a small beast.
Quote from: KelvinK on April 18, 2019, 10:04:20 AM
@scrax Getting M50 now is a good choose! Ultra cheap, Viltrox SpeedBooster and with ML it will be a small beast.
Exactly, those are the reason mainly.
Ok, I will try to compile. I can compile and run QEMU even when I have not M50 yet right?
As for the cheapness.. do you think it could get cheaper maybe in 6 months? (canon about to release 2 new M models).
The current price is still to much for me. Now I have M10 and I need to go to M50 (big improvement. :) )
Regards,
Jakub
Quote from: ioman on April 18, 2019, 10:26:01 AM
Ok, I will try to compile. I can compile and run QEMU even when I have not M50 yet right?
As for the cheapness.. do you think it could get cheaper maybe in 6 months? (canon about to release 2 new M models).
The current price is still to much for me. Now I have M10 and I need to go to M50 (big improvement. :) )
Regards,
Jakub
I was thinking you already had it; to run qemu you need a dump of the firmware from the camera you want to emulate
Ok, and there arent any dumps from someone who has the camera?
Regards,
Jakub
Not for sharing here. ML team considers public sharing/posting ROM dump contents violating Canon's IP rights. 2 options:
- Shout out and hope someone will reply by PN to a new member.
- Prepare a card with a ROM dumper and find a way to use it with an M50.
Ok, got it. In my local camera shop they allow me to test the M50 with my card anytime I come here so this might be ok.
Jakub
hello guys! I'm totally new here and I want to install ML on my M50. Can someone step by step explain this to me?
Thanks,
Jacob
Quote from: ughhhml on April 20, 2019, 06:10:08 PM
hello guys! I'm totally new here
No, you are not. See reply #123.
Quote from: ughhhml on April 20, 2019, 06:10:08 PM
and I want to install ML on my M50. Can someone step by step explain this to me?
See reply #124
Offtopic stuff about the 'when' question moved over here (https://www.magiclantern.fm/forum/index.php?topic=23927.0).
TLDR - I'll share the code as soon as I'll clean it up and make sure it's compatible with other models (DIGIC 6/7/8, without breaking 4 and 5). However, that will happen after taking a short break (could be a month or two, maybe more, maybe less). Sorry, I have to.
Diaphora - IDA PRO plugin for comparing the firmware :
https://github.com/joxeankoret/diaphora
M50 1.0.1 vs 1.0.2
(https://i.postimg.cc/8zJBKYX1/101vs102.jpg)
.
Not sure why but my canon m50 doesn't recognize it as a firmware. Is this an April fools joke?
Hello! I am new in the forum. Despite being new user, I follow the forum for some time. I would like to know if the version of ML that is passed is compatible with 1.02 and if anyone can help me install it. Thank you!
What is "it"? And unsure what you mean by "doesn't recognize".
http://www.catb.org/~esr/faqs/smart-questions.html#beprecise
I meant that my canon m50 does not recognize the magic lantern firmware and it won't do a firmware update. I already put in the autoexec.bin file but the camera says "memory card containing firmware is required to update"
From where you get the magic lantern firmware for m50?
What andy kh said and (again): http://www.catb.org/~esr/faqs/smart-questions.html#beprecise esp. the part about reproducing an error.
Quote from: Matt222Yt on May 26, 2019, 06:00:34 AM
I meant that my canon m50 does not recognize the magic lantern firmware and it won't do a firmware update. I already put in the autoexec.bin file but the camera says "memory card containing firmware is required to update"
the basic is out in JUST THE START not full magic lantern.
It is not only the basic ml april fools you need.
If you look in the forums you will see post with the files you need.
you will need fir files
just the find function on the forum : BOOT_M50.FIR
Personaly i get the awnsers you get from others.
But the forum is for helping others?I send you in the right direction but do know that ML is not in it full form.
i was also in the dark for the how to, but i invested time and surfed and searched the forum and found my awnsers. TY DFORT for the pointers (Again a hint for searching Matt222Yt)
Also please do not ask ET for full version. just my to cents. alex needs the break
M50 1/200s ISO 100 - White Level
Exif - 11892
Looking at the raw data:
R - 16383
G - 15500 safe limit for my camera
B - 16383
Green channel clipping 15750 :
(https://i.postimg.cc/Qt486yWQ/green-15750.png)
???
M50 bit depth
Single - 14-bit
Continuous Low - 12-bit?
Continuous High - 12-bit?
Histograms (single, continuous low, continuous high) :
(https://i.postimg.cc/kGDkP9YT/single.png) (https://i.postimg.cc/ZRsMc2Yp/continuous-low.png) (https://i.postimg.cc/gjwBBsr5/continuous-high.png)
If you want to use 14-bit exposure bracketing, you need to quickly press the shutter button, continuous modes are not 14-bit.
Intresting...
How did you test it?
Just curious.
These histograms show dark frames (lens cap photography).
Look at the histogram and you'll see the missing bits. It looks like 12-bit converted to 14-bit.
Quote from: Greg on July 26, 2019, 10:31:08 PM
M50 bit depth
Single - 14-bit
Continuous Low - 12-bit?
Continuous High - 12-bit?
The manual says that the data for continuous recordings are converted into 12 bits...
Do you have a link to said manual? It's embarrasing but all I can find online is a manual resembling a pre-school children book.
Quote from: Walter Schulz on August 04, 2019, 07:27:26 PM
Do you have a link to said manual?
Only the German version 'EOS_M50_Help_Guide_DE.pdf'
https://www.canon.de/support/consumer_products/products/cameras/digital_slr/eos-m50.html?type=manuals&manualid=tcm:83-1667469
Page 88 or search about 12 bit.
The M5 also has 12 bit in continuous mode...
Thanks! Found english "help-guide" here: http://gdlp01.c-wss.com/gds/2/0300030642/02/EOS_M50_Help_Guide_EN.pdf and the information about continuous shooting bit-depth on page 88, too.
M50 - rolling shutter measurements - https://www.magiclantern.fm/forum/index.php?topic=23040.msg208479#msg208479
It looks like we have 3 readout modes :
timer A = 534, timer B = 4061 @ E19EBAC8
timer A = 1064, timer B = 4061 @ E19EBB20
timer A = 772 timer B = 4061 @ E19EBB78
[SHTC] ShutterType(1) ReadOutMode(1) ReleaseType(1) // Manual mode, mechanical shutter
[SHTC] ShutterType(3) ReadOutMode(0) ReleaseType(1) // Silent mode, electronic shutter
[SHTC] ShutterType(1) ReadOutMode(0) ReleaseType(2) // Manual mode, mechanical shutter, AEB continuous
ShutterType(1 - mechanical, 2 - ???, 3 - electronic rolling shutter) // 2- electronic global reset?
ReadOutMode(0 - 12 bit, 1 - 14 bit, 2 - ???)
ReleaseType(1 - ???, 2 - ???)
Quote from: c_joerg on August 04, 2019, 04:37:39 PM
The manual says that the data for continuous recordings are converted into 12 bits...
I didn't know about it. :o
Banding correction 200D (M50 also has this problem) before/after :
(https://i.postimg.cc/QC95yZmm/200-D-before-after-IMG-0635.jpg)
dpreview (https://www.dpreview.com/reviews/image-comparison/fullscreen?attr144_0=canon_eos200d&attr144_1=nikon_d5600&attr144_2=canon_eos200d&attr144_3=nikon_d5600&attr146_0=100_4&attr146_1=100_4&attr146_2=100_5&attr146_3=100_5&normalization=full&widget=545&x=0.127613738&y=0.5084248)
Quote from: Greg on August 06, 2019, 12:00:56 AM
Banding correction 200D (M50 also has this problem) before/after :
The EOS R too, just compared it.
Quote from: Greg on August 06, 2019, 12:00:56 AM
Banding correction 200D (M50 also has this problem) before/after :
(https://i.postimg.cc/QC95yZmm/200-D-before-after-IMG-0635.jpg)
dpreview (https://www.dpreview.com/reviews/image-comparison/fullscreen?attr144_0=canon_eos200d&attr144_1=nikon_d5600&attr144_2=canon_eos200d&attr144_3=nikon_d5600&attr146_0=100_4&attr146_1=100_4&attr146_2=100_5&attr146_3=100_5&normalization=full&widget=545&x=0.127613738&y=0.5084248)
Any tutorial how to remove that kind of banding? Or just dark frame substraction?
Quote from: 71m363nd3r on August 07, 2019, 12:03:02 AM
The EOS R too, just compared it.
Didn't the latest firmware for EOS R solve that?
Quote from: 71m363nd3r on August 07, 2019, 12:03:02 AM
The EOS R too, just compared it.
EOS R (before/after)
(https://i.postimg.cc/3RbLhd4y/EOSR-before-after-447-A3152.jpg)
Quote from: Sapporo on August 07, 2019, 02:48:47 PM
Any tutorial how to remove that kind of banding? Or just dark frame substraction?Didn't the latest firmware for EOS R solve that?
I don't know if I should publish this script, maybe I should sell it to Canon?
Quote from: Greg on August 07, 2019, 05:43:05 PM
EOS R (before/after)
(https://i.postimg.cc/3RbLhd4y/EOSR-before-after-447-A3152.jpg)
I don't know if I should publish this script, maybe I should sell it to Canon?
Is that EOS R with the latest firmware 1.2.0? I saw samples of before/after with big difference. But yes, your script is impressive.
https://youtube.com/watch?feature=youtu.be&v=dfenxw0OKbc
My first post, I am the owner of an M50. I eagerly await ML for it. I am trying to read as many posts as possible.
Am I right to say ML for m50 is still experimental? I will follow these posts for updates and advice.
Cheers
There is no ML for M50 and don't hold your breath.
No hope in life, takes out knife and cuts cheese and pours wine... ;D
well if there is anything that can be done, I'm sure some on may be doing something or maybe just drinking wine and eating cheese
Quote from: RandomSynr on August 13, 2019, 05:23:17 AM
No hope in life, takes out knife and cuts cheese and pours wine... ;D
well if there is anything that can be done, I'm sure some on may be doing something or maybe just drinking wine and eating cheese
Are you willing to donate few bucks ?
Quote from: walter_schulz on August 12, 2019, 09:50:09 PM
There is no ML for M50 and don't hold your breath.
Well there is this fishy build (https://a1ex.magiclantern.fm/bleeding-edge/M50/magiclantern-fishy.2019Apr01.M50101.zip) -- which requires setting the camera boot flag:
Quote from: a1ex on April 01, 2019, 09:55:41 AM
BOOT_M50.FIR (https://a1ex.magiclantern.fm/bleeding-edge/M50/BOOT_M50.FIR) (confirmed by 71m363nd3r; works on any Canon firmware version)
This will modify your camera.
Right now I'd really like to unset the camera boot flag because when inserting a card that has ML for another camera on it the M50 just goes into a coma. I'd ask for a FIR file but last time I asked for something--well, I won't ask.
Quote from: dfort on August 16, 2019, 04:12:57 AM
Right now I'd really like to unset the camera boot flag because when inserting a card that has ML for another camera on it the M50 just goes into a coma.
https://www.magiclantern.fm/forum/index.php?topic=17360.msg204747#msg204747
Thanks Greg, that was easy.
Anyone else who wants to do this make sure you also set CONFIG_BOOT_BOOTFLAG=y
hello guys! I'm totally new here and I want to install ML on my M50. Can someone step by step explain this to me?
:)
@ DFort & WeEIMC
"when inserting a card that has ML for another camera on it the M50 just goes into a coma"
Should work if You simply "Hide" ML in a "HidingPlace" Folder/Directoy ~
ORR ~ DeanB
I am new to all this ML thing, But really want to test out this ML. So today I tested the fishy build on my M50.
The procedure was simple for me, just placed the boot m50.fir into the memory card and updated my firmware from canon menu. After that, I placed the entire fish build into my sd card and by using EOScard made my sd card bootable. Then just booted my camera. And I saw the log getting captured over my display.
(https://flic.kr/p/2h8UiLR)
And to enter the magic lantern settings, I need to press the delete button, but it didn't take to the ML settings during those presses as much as I need. Then I found that I need to be in video mode to get into ML settings. On video mode, Every press of delete button took me to ML menu.
(https://flic.kr/p/2h8TAwR)
Also, there is no extra function available on this Fishy build. the modules available are benchmark and self-test modules. Also, the video module in ML menu causes to freeze the camera and the only available option is to remove the battery.
Note guys, I don't know any technical stuff that much right now cause it's my first experience of flashing a custom ROM on Camera. So if any of you guys are free, feel free to let me know about all the technical stuff or at least what I did by flashing that boot m50.fir and how it's going to affect the future of my m50.
You set the "boot flag" on your cam. It will now check for a bootable card each time battery hatch is closed and each time the cam is powered up from powersave. If you insert an incompatible card (very, very old EyeFi cards) cam will get stuck. If a bootable card is found it will check for autoexec.bin. If no autoexec.bin is found cam will get stuck. Just don't use bootable cards without autoexec.bin.
You haven't flashed a custom ROM to your card. Your firmware wasn't replaced. ML runs from card, not from NVRAM.
And you may consider not going somewhere without checking the consequences of your actions. Maybe consider asking before doing something if you're unable to check the consequences.
Just saying ...
Quote from: Walter Schulz on September 04, 2019, 09:41:46 AM
You set the "boot flag" on your cam. It will now check for a bootable card each time battery hatch is closed and each time the cam is powered up from powersave. If you insert an incompatible card (very, very old EyeFi cards) cam will get stuck. If a bootable card is found it will check for autoexec.bin. If no autoexec.bin is found cam will get stuck. Just don't use bootable cards without autoexec.bin.
You haven't flashed a custom ROM to your card. Your firmware wasn't replaced. ML runs from card, not from NVRAM.
And you may consider not going somewhere without checking the consequences of your actions. Maybe consider asking before doing something if you're unable to check the consequences.
Just saying ...
So, which are the functions avaiable on the fishy build or it's just a visible GUI with no features for the april fool's day?
Thanks i want to test it too but i have no time right now, thanks @safwanck for your post.
Thanks for the info. I personally test everything myself, ie why tested the fishy build without looking for more details.
Quote from: 71m363nd3r on August 13, 2019, 06:36:42 PM
Are you willing to donate few bucks ?
Yes. send me/reply with a link?
Do you happen to know if any of the devs have an M50 and if that's the major block to further development?
Hi,
Could you please provide me raw samples in continuous mode (both raw and c-raw) ?
So that I can check it is 12bits or not ?
It should be stored in CMP1, offset 32.
Kind regards
Laurent
https://github.com/lclevy/canon_cr3
@lorenzo353
Might be helpful to state Who are You asking these ?s of ~
Search engine -> CHDK lorenzo353
I don't think devs share your problem. See nanomad's reply https://www.magiclantern.fm/forum/index.php?topic=3096.msg14579#msg14579
Hi,
I'm documenting the CR3 format here : https://github.com/lclevy/canon_cr3
Any CR3 capable model with continuous model can help, please.
12bits in continuous mode has been discussed in this thread, that's why I'm asking here.
Kind regards
Laurent
https://github.com/lclevy/canon_cr3 and http://lclevy.free.fr/cr2/
Quote from: lorenzo353 on September 12, 2019, 09:13:56 PM
Hi,
I'm documenting the CR3 format here : https://github.com/lclevy/canon_cr3
Any CR3 capable model with continuous model can help, please.
12bits in continuous mode has been discussed in this thread, that's why I'm asking here.
Kind regards
Laurent
https://github.com/lclevy/canon_cr3 and http://lclevy.free.fr/cr2/
No problem, send me your contacts over PM, I will create the files for you.
Hi,
It seems continuous mode in M50 produces 14 bits, sorry.
But G5 X Mark II and G7 X Mark III do produce 'raw burst', with several pictures in one CR3.
https://www.dpreview.com/reviews/canon-powershot-g5-x-mark-ii-review/5
"Another thing to note - the camera saves all the image in a sort of 'wrapper,' with the 'CR3' suffix. To open them on a desktop machine, you'll need to use Canon's Digital Photo Professional software. You can also extract and process individual files from the camera and save them out as JPEGs that way if you prefer."
Kind regards
Laurent
Quote from: lorenzo353 on September 14, 2019, 08:15:35 PM
It seems continuous mode in M50 produces 14 bits, sorry.
Sure?
I also looked at the RAW data of the M50 some time ago. The data in continuous mode looked like the histograms of the previous posts. There is definitely a lack of information. Maybe the result will only be shifted to 14bit.
Canon has released a firmware update for the recent PowerShot G7X III. Can someone take a look at the FIR and tell whether the current decoder/decrypter can still cope with it?
http ://gdlp01.c-wss.com/gds/6/0400005076/01/psg7xm3-v110-win.zip
It appears to use the same file format as EOS R/RP and 250D. That means, I'm unable to look inside without physical access to the camera (such as the UART interface).
Quote from: a1ex on October 25, 2019, 02:33:45 PM
It appears to use the same file format as EOS R/RP and 250D.
Thanks. That means, reversing the new format will be mandatory before any serious development effort on these new (and future) models.
Quote from: a1ex on October 25, 2019, 02:33:45 PM
It appears to use the same file format as EOS R/RP and 250D. That means, I'm unable to look inside without physical access to the camera (such as the UART interface).
Does that say that it is an EOS firmware?
Quote from: srsa on October 25, 2019, 06:30:51 PM
Thanks. That means, reversing the new format will be mandatory before any serious development effort on these new (and future) models.
Would a firmware dump in the camera bring more?
The FIR file format is the one used by EOS firmware. Whatever is inside, I don't know, but I'd expect something similar to the other EOS/PowerShot "hybrids".
Not exactly a priority for me right now - but once (if ever?) I'll be able to handle the already-started DIGIC 6/7/8 ports, including M50, I'll also look into newer models. The only problem is time - if you solve that for me, I can handle the rest :)
How can I post an image? I have something to show and ask.
Use a pic host service and link it here
[IMG]https://hoster of your choice/mypic1.png[/IMG]
Hey!
New firmware on duty for M50! (1.0.3)
I think it's not good for us!
No news about m50 develop?
If there was, it would be in this thread. But there isn't, so it's not ;)
Hello! I have tried eveything to get the software working my canon m50 but I can't seem to figure it out. I have been able to get the magic lantern on the camera and get to the green screen that makes you take your battery out and out it back in. But I can't get the menu to come up on the camera. Any help?
Same thing here on my M50. I can not get past the screen that says remove battery. FWIW I made the mistake of upgrading my firmware from 1.0.2 to 1.0.3 before discovering ML. I've tried to downgrade but my camera keep giving the old firmware error and I can not go back to 1.0.2. I'm able to start camera on eosDisk and I'm even able to run the firmware dump.fir (which generates rom dump) but no action on ML nor when I try to downgrade.
Hello
Newbie here. I have a canon m50 and I don't know if there is a downloadable mod for this camera available or not. My dream is having anamorphic mode and raw video on this camera. Is it possible at the moment?
Quote from: csabalandi on April 11, 2020, 01:56:34 PM
Hello
Newbie here. I have a canon m50 and I don't know if there is a downloadable mod for this camera available or not. My dream is having anamorphic mode and raw video on this camera. Is it possible at the moment?
Not available yet. You have to wait or help in work.
How can I help in work?
Hello! I'm new here and I can see that there isn't a full version of ML for EOS M50.
I have this camera and I want to know how can I help.
Thanks.
If you are fluent in C, Assembler and reverse engineering embedded devices (ARM preferred) and have several hundred hours of spare time you may want to chat with the devs.
If not: Consider to learn those skills. If *you* are not doing it, why should anybody?
I thought that maybe I could help like betatester or simillar. Giving feedback.
If you start to learn now we may have a beta around 2023.
Because if someone listened 2 years ago we may have an alpha now.
Quote from: Walter Schulz on April 20, 2020, 05:10:32 PM
If you start to learn now we may have a beta around 2023.
Because if someone listened 2 years ago we may have an alpha now.
Is that an optimistic estimate?
I probably would have the skills but not the time.
Maybe one first project when I retire in 10 years...
I'm serious: https://www.magiclantern.fm/forum/index.php?topic=19737.msg225763#msg225763
(https://i.postimg.cc/5NyPHdtH/m50.jpg)
Quote from: Greg on April 22, 2020, 06:00:18 PM
(https://i.postimg.cc/5NyPHdtH/m50.jpg)
What does this mean? Is it a good new?
QuoteWhat does this mean? Is it a good new?
That's why I suggested some time ago to replace "Magic Lantern Rescue" header with different string, at least for new developments where there's no real ML build - as this may suggest otherwise. Not that I experienced it when posted similar shots for EOS R on twitter ;).
"Custom code test" would get people a
little less excited.
M50 1.0.2 - 7 frames exposure bracketing
(https://i.postimg.cc/qBtBB21d/M50.jpg)
THUMB_FN(0xE04E05BE, GUI_SetCFnBktSheetsData)
#define BktSheets3 0x3
#define BktSheets5 0x5
#define BktSheets7 0x7
extern int GUI_SetCFnBktSheetsData(int);
GUI_SetCFnBktSheetsData(BktSheets7);
M50 1.0.2 - manual silent shutter (M, Av, Tv, P) also works in continuous mode :
THUMB_FN(0xE053607E, GUI_SetSilentShutter)
#define SilentShutter_OFF 0x0
#define SilentShutter_ON 0x1
extern int GUI_SetSilentShutter(int);
GUI_SetSilentShutter(SilentShutter_ON);
30s - 1/4000s - OK
Bulb - ERR70
Are you publishing documented code or is that even code modified and used on the camera?
These few lines of code modify properties, unlock features that the M50 doesn't have in the Canon menu.
Yes, I see. And also c-code. Are you working your own branch?
I compiled this code in digic6-dumper branch. This is not ML, but 2 features with which the M50 is more useful.
Quote from: Greg on April 26, 2020, 11:36:55 PM
I compiled this code in digic6-dumper branch. This is not ML, but 2 features with which the M50 is more useful.
maybe there is something to turn on Dual Pixel AF in 4k mode? M6 ii and 90D with Digic 8 have this DPAF, so it can be locked in our firmware
The M50 sensor is too slow to do this. You need 2x more data to read a dual pixel. So maybe at 10-15 FPS?
At the current stage of development, we should not think about such advanced features.
Quote from: Greg on May 05, 2020, 02:33:23 AM
The M50 sensor is too slow to do this. You need 2x more data to read a dual pixel. So maybe at 10-15 FPS?
At the current stage of development, we should not think about such advanced features.
But for sure FHD with DAF could be possible.
Hello guys, I'm still new here, but would like to try Magic Lantern on my M50, unfortunately I installed version 1.0.3. Can I downgrade the version to 1.0.1 or 1.0.2? Does anybody have experiences with it?
Best regards
Quote from: finnschmolke on May 05, 2020, 04:26:35 PM
Hello guys, I'm still new here, but would like to try Magic Lantern on my M50, unfortunately I installed version 1.0.3. Can I downgrade the version to 1.0.1 or 1.0.2? Does anybody have experiences with it?
Best regards
TBH looks like we'd have to wait until the devs have had time to look into a fix to downgrade. As of now some guys are obviously working on the m50 code but they are far from the looking into a fix if the m50 downgrade ability has truly been locked at 1.0.3. With all the other cameras running ML, all attention is apparently focused on getting stable builds for those cameras.
If it makes you feel better, I too own an m50 on v1.0.3. I too am unable to downgrade. I too want to try out ML but the only code for this camera is not even a complete build. I'm not sure if I want to sell this thing and get something older, attempt to compile a code of my own (dangerous) or just be patient and await for an official port of ML on m50.
After all, I love this camera. I love the footprint, build quality & internals. I think it would be a monster of a camera when the time comes. In regards downgrade options, I have not yet found one that works. I've tried every available lead :'(
Quote from: LevV on May 08, 2020, 04:18:57 PMI've tried every available lead :'(
Including this one? https://builds.magiclantern.fm/5D3-113.html -> Installation -> Installation -> Method B
Yes that one as well. Which reminds me, I need to upload that video of me attempting the downgrade. Like I mentioned in a different thread: my m50 utilize wireless EOS utility. You can connect via usb "but" you can not write/alter the mounted card. Not sure if this is something that canon is beginning to implement in their new FW.
Hey guys,
I wanted to check with you if you could possibly recommend any courses from Udemy etc to get started working on magic lantern and ARM programming etc.
This has been a dream for me to study for the last few years and I am really afraid that if I dont approach this in the right manner, I may quit by being overwhelmed.
I can't give you specific courses because I don't know them. Here's a skill list:
- C (not C++, you'll find some people use the terms interchangeably)
- ARM assembly, some ARM variant that has Thumb instructions
- Practical ARM hardware knowledge. I am very weak in this area so cannot give you good advice
- IDA Pro or Ghidra. Ghidra is free, IDA is expensive. Probably the state of tutorials and books is better for IDA, but still okay for Ghidra and will improve over time.
Assuming you're starting from nothing, it will take several months to get good at C. Let's say another month to get good enough at assembly. A few weeks to get okay with IDA or Ghidra.
You can start building ML for yourself and running it on a supported camera with very little C knowledge (a day or two to learn how building an existing project works). That would let you experiment in some limited ways.
Quote from: Ascari10 on May 09, 2020, 07:41:29 AM
Hey guys,
I wanted to check with you if you could possibly recommend any courses from Udemy etc to get started working on magic lantern and ARM programming etc.
This has been a dream for me to study for the last few years and I am really afraid that if I dont approach this in the right manner, I may quit by being overwhelmed.
My 2 cents.
Learning C and assembly is like learning new languages, like Spanish or English, in the begining its going to be difficult, but when you understand the structure and sematic of the langage it's going to be fun.
I started programming basic on a commondor 16 back around 1986, and ended up becomming a programmer, and now with 30+ years of programming, my best advcie to you is buy an arduino nano or uno
(both are arm processors) and install the arduino software. It's going to be fun, you'll beable to experiment and practice your c-skill right away, and keeping fun in the picture is pretty important.
I can not recommand any cources, I did take a look. I would suggest starting with some online youtube videos. There is big difference between wishing (as in hobby) or must (due to school,jobs) to learn c and assembly language. If you want to learn@hobby remeber always to take the fun path, otherwise it can be very boring. In fact most c programming is boring until you run the code.
Quote from: heder on May 11, 2020, 12:45:45 PMmy best advcie to you is buy an arduino nano or uno (both are arm processors)
None of them has anything to do with ARM. They both utilize ATmega328, which is an 8-bit AVR microcontroller.
Fully agree with the rest of your post though!
Quote from: ArcziPL on May 11, 2020, 09:22:51 PM
None of them has anything to do with ARM.
No. Some modern (https://store.arduino.cc/arduino-nano-33-iot-with-headers) Arduinos already contain ARM Cortex-M0.
what @heder said ! it can be very hard at times to understand but start by just reading everything .
I'm by not means a programmer but I focus on the things I wanted to do e.g. "Crop_Rec" on 5D2
It took me from April ,2017 to Dec , 2018 to get a working crop_rec (with help from main dev.a1ex) & now I got the 50D working in crop_rec .
from that I now understand more and can develop more advance features etc. ...
I can't write C code from scratch but I followed code sample , that are all over the forum and in the source code .
Then made the code modifications as needed for the camera I was working on , it's always a work in progress ;)
Start small and work you way up , before long you will be writing code .....
Simple and slow dumper script for cameras with Powershot-legacy (EOS M, PowerShot). It works on at least one model. Whether Canon intends to keep scripting is to be found out.
About the language (https://chdk.fandom.com/wiki/Canon_Basic). Card setup (https://chdk.fandom.com/wiki/Canon_Basic/Card_Setup). Note that some people have problems making a usable script card. If that happens, try again.
As usual, please do not post ROM dumps publicly.
' hex dumper
dim start = 0xe0000000
dim length = 0x100000
private sub save_as_hex(fn,addr,size)
f = OpenFileCREAT(fn)
CloseFile(f)
f = OpenFileWR(fn)
p = addr
' 1MB ~ 64 sec
do while p < (addr+size)
p1 = *p
p = p + 4
p2 = *p
p = p + 4
p3 = *p
p = p + 4
p4 = *p
p = p + 4
p5 = *p
p = p + 4
p6 = *p
p = p + 4
p7 = *p
p = p + 4
p8 = *p
p = p + 4
WriteFileString(f,"%08x%08x%08x%08x%08x%08x%08x%08x\n",p1,p2,p3,p4,p5,p6,p7,p8)
loop
CloseFile(f)
end sub
private sub Initialize()
save_as_hex("B:/ROM.TXT",start,length)
end sub
I have not been able to find "normal" read()- and write()-like event procedures, thus the hex dump. You may want to adjust 'start' and 'length' at the beginning of the script, but note the time requirement. Camera user interface will be locked up while the script runs.
Any error in the script will crash the camera and require a battery pull.
It appeared to me that these file operations happily make multiple files with the same name when used repeatedly, so be careful.
A C program to turn the word based hex dump to binary:
#include <stdlib.h>
#include <stdint.h>
#include <stdio.h>
const char *usage = "Decode hex files made with CBasic EOS dumper (LE words)\n"
"\nUsage: %s <input> <output>\n\n";
int32_t hex2char(uint8_t a) {
if (a<0x30) {
return -1;
}
else if (a<=0x39) {
return a-0x30;
}
a = a & 0xdf;
if (a<0x41) {
return -1;
}
else if (a<=0x46) {
return a - 0x41 + 10;
}
return -1;
}
int hex2uint32(FILE *f, uint32_t *u) {
int32_t n,m;
uint8_t c;
int ret = 0;
*u = 0;
for (n=7; n>=0; n--) {
int r;
c = 0;
r = fread(&c,1,1,f);
if (c == '\n') {
r = fread(&c,1,1,f);
}
if (r<1) {
ret = -1;
break;
}
m = hex2char(c);
if (m>=0) {
*u |= ((uint32_t)m)<<(n*4);
}
}
return ret;
}
FILE *fil;
FILE *filp;
int main(int ac, const char **av) {
if (ac < 3) {
fprintf(stderr, usage, av[0]);
exit(0);
}
const char *fi = av[1];
const char *fp = av[2];
filp = fopen(fp, "w+b");
if (!filp) {
fprintf(stderr,"Failed to open output file\n");
return -1;
}
fil = fopen(fi, "r+b");
if (!fil) {
fprintf(stderr,"Failed to open input file\n");
fclose(filp);
return -2;
}
uint32_t u;
while ( !hex2uint32(fil, &u) ) {
fwrite(&u, 1, 4, filp);
}
fclose(filp);
fclose(fil);
exit(0);
}
edit:
It turned out that there are better ways (https://www.magiclantern.fm/forum/index.php?topic=25305.0) to dump ROM content - I can tell what they are if anyone is interested.
edit2:
Edited previous edit to reduce confusion. There is now a dedicated thread for scripting.
Hi!
I don't know why I upgraded to 1.0.3 before checking here, I use my T5i with ML and I really like it. I am a C dev but a bit short on time lately, it's been a while since I used some assembler... I would love to help, but being short on time and with the upgraded firmware I don't know I can do much.
In any case it would be great to check how things are going and see if I can be of any help. When I have a chance I'll check the git and any availabile resources, and see if I can find a way to downgrade the firmware. Maybe there's a way to tweak the old firmware to make it seem like a newer one. Best would be to appear the 1.0.3 so coming back and forth doesn't require tweaking it every time.
For this finding the way to modify the firmware is one step, and making the checksum give it a pass is another problem. Maybe someone already failed at this and can point me to where to start.
Regards and my support for the developers working on this.
JS
@srsa - weird and fun, thank you! Can confirm Hello World works on G15, although the message is only visible outside of play mode, so you must play mode -> Func -> exit play mode. Couldn't trigger it on M2 or 200D - don't know if it's supposed to work there (M2 more likely?). Wiki said DryOS can have it, but neither of those have a zoom control and they're both Q/Set. Any ideas on how to trigger it?
Let me know if the G15 rom dump test would be useful to you.
Quote from: names_are_hard on May 19, 2020, 10:01:43 PM
Couldn't trigger it on M2 or 200D - don't know if it's supposed to work there
No, those are fully EOS models codebase-wise.
I posted this in the DIGIC 8 thread because this kind of scripting is expected to work on the mixed codebase models (mostly EOS with some Powershot legacy). Those are the newer Powershots (sx740, sx70, g5xII, g7xIII) and EOS M cameras (M50, M200, M6II). I'm sure about the M50 and sx740 (having seen their firmware), the rest is speculated. No idea about the other DIGIC 8 cameras.
If someone happens to have a firmware dump for any untested models, the presence of some strings ("extend.m", the keywords, etc) may indicate this feature.
I should note that only keywords and syntax are common between the PowerShot and EOS version of Canon Basic, most event procedures are different, the examples from that wiki will not work here.
As for the dump, thanks, but I already have all CHDK-supported fw dumps.
I did not mention it yet, but setting the camera bootflag(s) should also be possible from a script, without requiring an encrypted binary. Executing fw functions (named or not) is also possible.
(https://i.postimg.cc/KzVNLGZ0/ml6.jpg)
Nice, proper menus. Is this based on the infamous "fishy" build? Have you got a repo? I'm sure it would help with my 200D work.
You can see on the screenshot: it's based on the digic6-dumper branch.
Yes, he's been working on getting more features into digic6-dumper branch, I'm asking where that code is coming from - I'd assume the fishy m50 build as it's reasonably advanced. I was ambiguous, sorry!
What's the current state of the development of ML for the EOS M50?
See reply #232ff
Quote from: names_are_hard on May 23, 2020, 07:46:29 PM
Is this based on the infamous "fishy" build?
I don't have the "fishy" build code. This is digic6-dumper branch and stubs, consts, button codes, several modifications (bmp_vram, disabled audio tasks etc).
You can load "fishy" autoexec.bin in IDA/ghidra, convert the file M50_101.sym to idc script to name the functions.
(https://i.postimg.cc/hPgYnHZj/ml8.png)
Thanks. Such a shame you have to work from the binaries! I'll keep watching, and slowly updating my 200D work.
Hello, I am total newbie here. Is there a chance that someone kind will tell me step by step how to install ML on EOS M50 1.0.3 ? I have tried it few ways with making card bootable - black screen and installin one of linked on this forum files .FIR As firmware update and I failed. I will be more than thankful for instructions together with links to necessary files. Thank you in advance !
M50 1.0.3
(https://i.postimg.cc/cHNwbmGT/ml7.jpg)
A picture is worth a thousand words.
Congrats!
Hell yeah Greg!
it's genius
you will say to me that "no it's work"
it is true
but there is genius
:) :) :)
:D
Hey guys, could someone please share the ML-files for the m50 1.0.3 with me. That would be helpful! Thank you
Best regards, Finn
so, what now is there to do for getting the M50 with unlocking especially the 30min limit?
also be nice to be able to shoot 120p at 4k :)
Quote from: bhedrington on May 29, 2020, 11:45:32 PM
also be nice to be able to shoot 120p at 4k :)
We can get 8K@120FPS. It will work like 4K in M6II - M6II vs M50 4K (https://www.dpreview.com/reviews/image-comparison/fullscreen?attr29_0=canon_eosm6ii&attr29_1=canon_eosm50&attr72_0=4k&attr72_1=4k&normalization=full&widget=729&x=0&y=0.00989010989010989) ;D
I have M50 and I registered to write to Greg that he is almost my hero. If everything works out, I'll be ready to kiss your legs. You give some hope. Really looking forward to recording RAW-video on my M50.
Just writing to say thanks for all the efforts!
Really cant wait to try it!
Hi,
I didnt understand correct procedure to install ML in M50.
I've M50 1.0.2, i format sd card from camera, i make it bootable with eoscard and i upgrade my firmaware with several FIR files ( dump_m50, boot_m50 etc ) and i copy fishy ML and autoexec.
upgrade and Remove battery, but nothing...no ML menu.
I need only silent mode on M, TV, AV mode and focus stacking function.
I saw that someone use digic6 branch, but where i can find files ( ML and autoexec ) ?
Regards
Yow guys
Thank u soo much ... i can't thank u enough
Oooh man i have been waiting for this moment for a while
Can't wait to try it
I have a spare M50 (waiting for a replacement motherboard for it) to test with, also what repo is being worked with currently with these changes (I'm a DevOps engineer moving away from IT into film so I can code some). I saw digic6-dumper was the codebase being used, is that still the case? I'd love to dive in and contribute to this effort. I've been largely lurking. Knowing the capabilities of this camera gets me going, having a second M50 I can spare (I have other cameras to replace if this one goes kaput as my B cam).
We have something for 1.0.3?
Can't wait!!!! :o :o :o :o :o
just want focus stacking, as all other features too! LOL
me too i got the latest version and i dont know what to do !!
could u guys help us please
Finally :)
A build that's showing progress. I can not wait until I get to try this out.
For the meantime if you don't have the dev build for M50, I'd just be patient and wait for the contributors to work their magic. I really wish that I could help speed things up but I can't speak/read/write C. Only if this was WebScript language :) but until then, I'm not going to bother anyone until there's a broken link to download this FW :D good job devs, keep up the great work
Also joined this forum to wish luck to Greg and the rest of the contributors. Do chime in if there's any way for us to support your effort.
An M50 with a clean HDMI and AutoFocus would be amazing for streaming.
All the Best!
History in the making!
Ostro Greg !
I've been using ML for years on my t5i so I'm a big fan of y'alls' work, and I just bought an M50. I'm a Junior in computer engineering at UCSC so I know C and Assembly (at least in an academic setting... I don't know anything about how ML/canon's firmware is written) and I'd love to help out in any way I can :)
How is going the development?
Does exist any patreon account to donate to the dev?
I'm going to be the guy to ruin the party here. If ML comes to M50 at 4k I will easily pay $150 for it by selling my eos m. OMG please let this work, so tired of using technicolor.
Unless I'm mistaken, ML hasn't come to a Canon camera made after 2013. What odds that it will come to one made in 2018? It'd require significant interest from the community (perhaps that exists), a significant time investment from those who have developed ML for other cameras, and a lengthy Beta testing period.
Since the camera market has begun to include affordable small cameras, some of which can shoot RAW (i.e. Sigma FP), I can't see ML on the M50 happening.
Really , what's this
https://www.magiclantern.fm/forum/index.php?topic=23296.msg227396#msg227396
https://www.magiclantern.fm/forum/index.php?topic=23296.msg227501#msg227501
never say never when magic lantern is concerned , it will surprise you !
plucas. sigma is still 16 times the price of canon M.100 EUR vs 1600EUR.
With M50 im curious whats the maximum card reader writing speed on it and if it could do lossless full resolution raw in 24fps in theory.
Also it might have that nice vintage look when shooting RAW which isnt that present on 5DII that i have.I guess its digic 4 vs 5 thing.
The M50 ML possibility would be crazy enough to give the new EOS R Series a run for their money considering its current price point, 14 bit, 120fps, a good amount of Dynamic Range etc... Sheesh...
I have M50 with 1.0.3 firmware. I'd love to test newest ML and help with development. I'm proficient in Python if it's helpful in any way.
I suspect it wont be able to record much higher than M , its 4k mode is cropped crippled probably cause of writing speeds.I hope im wrong tho.
Hell yeah @Greg and I am with you on this boat. Keep up the great work!
Quote from: 2blackbar on June 26, 2020, 09:44:11 PM
I suspect it wont be able to record much higher than M , its 4k mode is cropped crippled probably cause of writing speeds.I hope im wrong tho.
I think it's possible to get 4k without a crop on the M50. I mean, the fact that it can utilize the full sensor for 1080p means that all the pixels of the sensor are being read and downsampled into 2k, right? Unless there is some sort of computational binning or line skipping happening in the sensor, which I highly doubt, I've only ever heard of it happening outside the sensor. It's definitely not limited by the bandwidth of the card interface, because uncropped 4k should have the same bandwidth as cropped 4k, which it can handle well. I have no idea why there is so much rolling shutter in 4k mode. It must be something to do with the DSP, and not the sensor, because this doesn't happen in 2k mode. I hope I'm not mistaken, because this camera could really have some great potential. And good luck to the ML devs and other contributors! :)
Some further debate on this topic:
https://www.dpreview.com/forums/post/61413652 (https://www.dpreview.com/forums/post/61413652)
Quote from: Walter Schulz on May 08, 2020, 04:34:43 PM
Including this one? https://builds.magiclantern.fm/5D3-113.html -> Installation -> Installation -> Method B
this method work for canon m50
I downgraded from 1.0.3 to 1.0.2
before this method, I rename file `CCF19103.FIR to CCF19104.FIR` and after that I did on method B
Where can I get the ML for M50 1.0.2?
Just to calm my nerves.
Quote from: anykill on June 23, 2020, 08:49:59 PM
How is going the development?
Does exist any patreon account to donate to the dev?
https://www.magiclantern.fm/donate.html
ATM you won't accelerate development by donating money.
Donating my budget for the bmpcc 8k and the canon c300 so I can have canon m50 raw 5k with 14bit and auto focus stacking in 1080p. =p
How is going the development?
Is there any place to follow the dev?
Thank you
It makes no sense to ask every few weeks. It should be totally sufficient to check here twice or thrice a year. "To check", not "to post".
This is so crazy when I'm on the verge of selling my EOS M50 and keeping the EOS M......MLV is a complete beast that makes this so mind blowing to me. I really thought the 4k mode was going to be sharp enough to get me away from the M until I could save up for the r6 but it's definitely not.
Very crazy that I'm 2 video comparisons away from selling the EOS m50.
The M50 4K isn't the best in the field, definitely not...better off with an Xt30/XT3, G9 or A6400 for good 4K Quality at a low price.
But yeah, the EOS M is Magic with Raw, the colour pop you get with 14-bit is amazing. Great cam 🎥😎👌
Canon should support the developers, they make the cameras sell even more with this "hacks".
And not everyone will use, the pros with budget will buy the expensive ones.
Cant wait to try any build if has one!
Quote from: srsa on May 16, 2020, 05:05:44 PM
Simple and slow dumper script for cameras with Powershot-legacy (EOS M, PowerShot). It works on at least one model. Whether Canon intends to keep scripting is to be found out.
Confirmed working on M50. Very cool!
Quote from: a1ex on September 02, 2020, 07:04:35 AM
Confirmed working on M50. Very cool!
As I dont undestand nothing about it...
This will help the development?
Thank you for the hard work of developers!
Wait someone said something is working? What?
Quote from: WeakestLinkForNow on September 09, 2020, 05:49:39 AM
Wait someone said something is working? What?
And a very good morning to you, too! https://www.magiclantern.fm/forum/index.php?topic=25305.0
=O what's going on here? I read it and it looked like they are moving straight to Digix X instead.
It's a volunteer project. People work on whatever they find fun or interesting, or on whatever cam they have.
Quote from: Greg on April 26, 2020, 05:04:03 PM
M50 1.0.2 - manual silent shutter (M, Av, Tv, P) also works in continuous mode :
THUMB_FN(0xE053607E, GUI_SetSilentShutter)
#define SilentShutter_OFF 0x0
#define SilentShutter_ON 0x1
extern int GUI_SetSilentShutter(int);
GUI_SetSilentShutter(SilentShutter_ON);
30s - 1/4000s - OK
Bulb - ERR70
Hello !
Do you need coding skills to install this feature on the m50 ?
Quote from: Sténo on October 20, 2020, 11:13:02 AM
Hello !
Do you need coding skills to install this feature on the m50 ?
I would love to know too !!
This with an intervalometer mode ooooh 🔥🔥🔥
Quote from: Greg on April 26, 2020, 05:04:03 PM
M50 1.0.2 - manual silent shutter (M, Av, Tv, P) also works in continuous mode :
THUMB_FN(0xE053607E, GUI_SetSilentShutter)
#define SilentShutter_OFF 0x0
#define SilentShutter_ON 0x1
extern int GUI_SetSilentShutter(int);
GUI_SetSilentShutter(SilentShutter_ON);
30s - 1/4000s - OK
Bulb - ERR70
Hi! Could somebody please help me get this code posted by Greg running or at least point me into right direction? I basically understand what his code does, but I have no idea, where to actually place it.
I'm familiar with coding, know C, can orient in ASM, even know some ARM basics. I understand canon basic scripts can be used on M50 and I've already tried ROM dumper with success. I guess running his code however requires different approach, similar to running ML, which involves cloning some repo, modifying it and compiling it? At this point I'm just guessing, so any help would be appreciated. Thanks!
From Greg's post a few down from the one you quote: "I compiled this code in digic6-dumper branch". You can get that branch from Heptapod repo. Greg hasn't been very forthcoming with what other changes would be needed to get this compiling and working - I think you'll need to ask him.
If you need more help with getting ML building, there are many old threads, or you could join the Discord.
FOR GODS SAKE! Someone remove the April Fools Post!!! I fell for it, yes I'm stupid. I bought the M50 because I want to install ML on it. I've been reading this forum for weeks trying to find ANY information that could put me on the right path. I don't know if "Fishy***" build is real or fake. All the links that go to anything that offer "hope" are broken. I'm losing my mind!)@#*. Can someone just set the record straight? Does anything work on the M50? If so, where is the file.
Thank you for saving my sanity.
https://mobile.twitter.com/autoexec_bin/status/1323582194959470593?p=p
And it took me about 5 minutes to find a link to fishy build. See reply #168.
The Fishy build is effectively a work-in-progress, available in binary only, no source code. I don't have an M50 but I understand it is incomplete and not very useful.
Hi, just to keep the topic alive.
We have any news?
Thank you, my english is not the best, thats why I didnt make a very polite text!
eheh
Most dev talk do happen on ML's unofficial discord server. And nothing big to report for M50 and nothing at all for SX70 and SX740.
I think it would be a good idea to watch a1ex' twitter account www.twitter.com/autoexec_bin for news. He keeps track of things worth to write home about. No need to look here every 3 months or so ...
Quote from: anykill on December 18, 2020, 10:14:44 PM
Thank you, my english is not the best, thats why I didnt make a very polite text!
It's not about the language, but the attitude. Even if you wrote in your native language, your message would have been just as rude. Such behavior is one of the reasons (https://www.magiclantern.fm/forum/index.php?topic=23927.msg215471#msg215471) I had to take a long break from contributing, and to stop posting updates. I'm still affected by this bug, and it won't be fixed overnight. Sorry.
From the forum rules:
Quote from: Francis on April 29, 2012, 07:42:44 PM
-Do not bump topics by posting replies that do not further the discussion.
From the FAQ:
Quote from: https://wiki.magiclantern.fm/faq#any_progress_on_xyz
Any progress on XYZ?
If you can't find anything about it in the relevant forum thread, it's safe to assume there was none.
[...]
If you don't have the right skills, asking this question will only serve to annoy those who might have them. Doing some research about XYZ and sharing your findings would be much better - this may encourage others to take a look at it.
And you kept doing this after being told to stop multiple times :(
I don't want to encourage such behavior, but... well... I might (https://www.magiclantern.fm/forum/index.php?topic=24548.msg233038#msg233038) soon have news. Not specific to M50, but for the entire ML project in general. We might be able to launch a fundraising campaign soon, without worrying anymore about the legal aspects, and that would allow me to resume the development.
So, I've started to think about providing a way to allow such kind of "bumps" -
it would be called a "support contract" edit: nope, bad behaviors won't be allowed, no matter how much you might pay ;)
Guys, did someone tryied a1ex version of MagicLanter on an update to 1.1.0v firmware Canon M50? how was the experience in case?
thanks
Mate, where can I find informations about this build?
thanks
There is no available build for the M50.
Please stop asking. It is annoying. There will be updates if a build is available, you don't need to ask.
Subject should get enhanced, I suppose: G5 X Mark II, G7 X Mark III firmware have *.FIR suffix. M200 still without confirmation but listed as compatible to EOS Webcam Utility and "real" PowerShot doesn't seem to be supported at all.
Quote from: Sténo on October 20, 2020, 11:13:02 AM
Hello !
Do you need coding skills to install this feature on the m50 ?
GUI_SetSilentShutter sets a property which is persistent (survives a battery pull) until it is deactivated. Therefore this could also be done via Canon Basic script. Silent shutter mode can also be deactivated by entering SCN mode and leaving it again.
Sounds cool!
Will it be as simple as this?
private sub Initialize()
GUI_SetSilentShutter(1)
end sub
No, GUI_SetSilentShutter is not an Event Procedure and you need to export it first.
The following script meight work on M50 v1.0.2 (untested, use at own risk!):
private sub Initialize()
ExportToEventProcedure("GUI_SetSilentShutter", 0xe053607f)
GUI_SetSilentShutter(1)
end sub
Thanks! I'm on 1.1.0, so need the new adress first (and add +1, for setting the THUMB flag).
Script for M50 v1.1.0 is:
private sub Initialize()
ExportToEventProcedure("GUI_SetSilentShutter", 0xe0536113)
GUI_SetSilentShutter(1)
end sub
When sharing scripts that are likely to be run by regular users, I strongly recommend performing some kind of camera model / firmware version checking. CHDK do this for scripts meant to be run by users (look up "check_compat").
Most of the time, the effect of calling an invalid stub - which would usually jump in the middle of some random Canon function - will be a crash, but if one is unlucky enough, that crash might lead to a memory write that will end up written back into main ROM at camera shutdown (yes, Canon firmware does this (https://www.magiclantern.fm/forum/index.php?topic=19369.0)). Or, what if - on some different camera model - that stub might be in the middle of EraseSectorOfRom? Very unlikely, but still...
I've got a fair amount of backlash in the past for recommending this timeless article (https://marcan.st/2011/01/safe-hacking/) to other developers, but I still believe the advice there is very good (long answer (https://twitter.com/marcan42/status/1342419760101740544)). And I have no experience unbricking recent Canon models, btw ;)
Quote from: coon on February 06, 2021, 12:51:09 AM
Script for M50 v1.1.0 is:
private sub Initialize()
ExportToEventProcedure("GUI_SetSilentShutter", 0xe0536113)
GUI_SetSilentShutter(1)
end sub
It works, thank you! This feature is fantastic! :)
Thanks Greg for finding this function and trying out.
Quote from: coon on February 06, 2021, 12:26:11 AM
[...] (untested, use at own risk!):
But I agree that having some check_compat function in our scripts would be better, especially on code which modifies properties.
Model name and version number in string representation are stored somewhere in the ROM. I may try to compare against those in future.
As mentioned/ranted some time ago: Some users will intentionally disregard such warnings and trying to mess with any script available -> Unable or unwilling to take risks into consideration. (I can provide examples showing a lack of understanding and jackass attitude which will ripple your foot nails, as we say here).
Please consider some checks, at least. Won't prevent worst kind users from getting their hair burned to the skin but majority will not get a clue why a script won't work because of said checks.
And please add some comment why these checks are implemented and the risks involved. Leaving only people wanting to see the world burn wanting to remove them.
I am thinking about something like this (pseudo code):
dim model_name = "Canon EOS RP"
dim firmware_version = "1.6.0"
dim model_name_addr = 0xe121d57c
dim firmware_ver_addr = 0xe00408e0
public sub check_compat()
if model_name_addr == model_name and firmware_ver_addr == firmware_version then
check_compat = 1
else
check_compat = 0
end if
end sub
That way the code would self document for what model the script is for. I Just need to find a way to do a strncmp in canon basic for that.
Does anyone have an idea if there is a function to change ISO selection steps from 1/3EV to 1EV? On 70D it's an option in Canon menu but it's not present on M50.
I personally find the 1/3EV steps a disadvantage. They make changing ISO with the dial way too slow for my taste and it's just a digital push/pull which can be done in post.
Greg, maybe you have digged in this direction already?
The last time I looked at the M50 rom dump was almost a year ago. There was a lot of functionality not visible in the menu but I don't remember.
If the R/RP has this feature, the M50 should also have it, but not visible in the menu.
You can check - "GUI_SetIsoSettingStep"
Yep, it exists! Thanks!
GUI_SetIsoSettingStep Value(%d)
Hello!
Thanks a lot for your hard work!
I really hope that someday there will be a working magic lantern firmware for this device.
I own this camera a few year.
I am ready to help as much as I can.
Can you please tell me, if it is possible to make a clean hdmi on this camera (by analogy with the m200) using autofocus?
I really want to use it not only for video recording, but also for streaming. Autofocus would be a great helper!
Thank you!
Quote from: Greg on April 26, 2020, 02:06:58 PM
M50 1.0.2 - 7 frames exposure bracketing
(https://i.postimg.cc/qBtBB21d/M50.jpg)
THUMB_FN(0xE04E05BE, GUI_SetCFnBktSheetsData)
#define BktSheets3 0x3
#define BktSheets5 0x5
#define BktSheets7 0x7
extern int GUI_SetCFnBktSheetsData(int);
GUI_SetCFnBktSheetsData(BktSheets7);
This is all I want to do. How do I do this, please? My camera came with 1.1.0. Do I need to replace with 1.0.2? And how do I access/change the code to allow 7 brackets?
haven't read the whole thread, but will the M50 have similiar hacked capabilities like the original M at some point?
Sorry, unable to answer ATM. All devs are busy running a side quest (https://wiki.magiclantern.fm/faq#troll_questions) to regain magic balls stolen by the Illuminati!
When one day you woke up an decided to speedrun a port:
(https://kitor.pl/eos_r/img/eos_m50_ml_th.jpg) (https://kitor.pl/eos_r/img/eos_m50_ml.jpg)
Code is at the moment on my Github: https://github.com/kitor/magiclantern_simplified/tree/M50_110_speedrun
Merged to dev: https://github.com/reticulatedpines/magiclantern_simplified/tree/dev
Same stuff as EOS R and 200D: Menus, nothing more. Even funnier as if you open any submenu in ML menus and then exit to Canon GUI - a wild ERR70 appears. fixed, bad stub ;)
(it may have something to do with messages on UART, seems that there's some memory leak?)
ERROR [MEM] Over Permanet Memory cache 48 17348
Another caveat: Trash button won't send any keycode in LV until you assign a function in C.fn. And code depends on function assigned.
Touchscreen events works differently than on M/M2, so I mapped ML menu into M.fn button.
Anyway I prepared 2 days before I got M50 in my hands and this is what I leave you - as I just send M50 to its real owner.
Yes, this means I won't proceed any further with M50, R is enough for me. But this bring up M50 to similar status and codebase as R and 200d.
In the process I found UART TX line, more about this in Battery grip pins / UART (https://www.magiclantern.fm/forum/index.php?topic=7531.msg235437#msg235437)
I am wondering if there is an option to set minimum shutter speed for AutoISO on M50.
In the rom dump i can find some function
GUI_SetLimitedTvValueAtAutoIso Null
But this null confuses me. e.g. others are like
GUI_SetSilentShutter Value(%d)
Is it possible to put this code on the M6 mkII?
Every camera needs individual work. Nobody is working on the M6, and I think you'd want CHDK for that, not Magiclantern.
Quote from: names_are_hard on May 11, 2021, 12:38:33 PM
I think you'd want CHDK for that, not Magiclantern.
Actually no: M6 II is ours. Firmware file name: 6200111.FIR
Thanks - why must the M series be so confusing? :)
You tell me! And there are at least 2 more PowerShots with EOS inside: G5X II and G7X III.
Quote from: jo.meatloaf on May 11, 2021, 12:03:20 PM
Is it possible to put this code on the M6 mkII?
https://www.magiclantern.fm/forum/index.php?action=profile;area=showposts;u=87780
If you ask 10 more times in 5 more threads, maybe some miracle will happen. Until then - wait for information, and stop asking the same question over and over again.
Quote from: Walter Schulz on May 11, 2021, 12:56:41 PM
Actually no: M6 II is ours. Firmware file name: 6200111.FIR
you can link to the file, I want to check?
Click! (https://letmegooglethat.com/?q=canon+firmware+6d+Mark+ii)
Quote from: kitor on May 07, 2021, 08:37:43 PM
Same stuff as EOS R and 200D: Menus, nothing more. Even funnier as if you open any submenu in ML menus and then exit to Canon GUI - a wild ERR70 appears.
(it may have something to do with messages on UART, seems that there's some memory leak?)
ERROR [MEM] Over Permanet Memory cache 48 17348
Just a tiny update - tested by @br - crash was due to bad _FreeMemory stub (I traced it on R after triggering it there too), it is fixed on dev already. The errors in UART log with typo included in ROM ( ;) ) are probably still there, as we play on the edge of tiny amount of memory that we can allocate right now.
Do we have any test build?
Is there something working with ML on m50?
Thank you
No. Asking over and over again in thread with no replies won't change it.
I guarantee you that when we will have something to share, it will be a huge news. And it probably still won't do anything really useful except menus and some camera info.
Thank you Kitor, you know... any news bad or good is news!
I recently became the owner of the m50, so if I can help with testing - let me know)
Do we have any develop going?
I have my M50 and I can help with something if needed...
Hi,
Could you please run this script on Digic8 and Digic10 cameras?
https://discord.com/channels/671072748985909258/936696899120005230/944929235070484511
model_id : 0x80000453
rom version: 4.9.0
GetFirmwareVersion: 150
fw signature from 0xe0100000: 0x129372a8
fw signature from 0xe0040000: 0xce84b41f
at e0100000: 09480cee100fbff36f8f42f20000c0f20000854610eeb05f15f00f0001
at e0040000: cef81cc143f2300cddf81ce0cef820c14ef22e7cddf81ce0cef824c1dd
Quote from: coon on February 06, 2021, 03:21:04 PM
I am thinking about something like this (pseudo code):
dim model_name = "Canon EOS RP"
dim firmware_version = "1.6.0"
dim model_name_addr = 0xe121d57c
dim firmware_ver_addr = 0xe00408e0
public sub check_compat()
if model_name_addr == model_name and firmware_ver_addr == firmware_version then
check_compat = 1
else
check_compat = 0
end if
end sub
That way the code would self document for what model the script is for. I Just need to find a way to do a strncmp in canon basic for that.
(https://kitor.pl/eos_r/img/740hs_th.jpg) (https://kitor.pl/eos_r/img/740hs.jpg)
I guess this is the final confirmation?
SX740 HS indeed runs what appears (at least on surface) very similar to regular EOS ROM.
Looks like it have 1GB RAM. No MPU (everything handled on ICU)
Interface is stretched vertically from 3:2 (720x480) into 4:3 (640x480), thus it looks a bit odd (vertical scaling ratio 8/9).
Interesting is that it doesn't have raw photo capabilities at all (in the firmware).
Also, it seems to have ROM0 only (32MB)
Unfortunately that photo marks my first case in a long time where semi-broken device ended up worse in my hands than it arrived.
It was slightly water damaged - lens was making high pitched noises. Both aperture and IS ribbons just snapped in half when I attempted to disassemble it ::)
Thus right now it just gets ERR60 if booted in regular mode...
If you have a broken SX740 (SX730 might work as it seems they might just updated the pcb) that lens is still intact, please contact me on priv - we may make a deal.
(https://kitor.pl/eos_r/img/740hs_menus_th.jpg) (https://kitor.pl/eos_r/img/740hs_menus.jpg)
So far firmware is very similar to EOS R. SX740 runs DryOS +p3, while R/RP does use +p4.
In fact I was able to use compositor code that so far I thought was R specific (RP and later have more sane implementation by Canon).
Code is "so much EOS" that it has all the regular lens info structures even though this is point and shoot with fixed lens.
I even found (and successfully poked) some GUI dialogs from R that should not exists here, but this requires a bit more research.
CR3 raw from SX740 8)
(https://kitor.pl/eos/sx740/sx740_cr3_th.jpg) (https://kitor.pl/eos/sx740/sx740_cr3.jpg)
Caveats:
- RAW only works, RAW+JPG L crashes
- Canon code is confused as it has no settings for RAW modes at all, and screams on UART when it is enabled.
- File opens fine in Windows preview (including actual RAW render), RawTherapee (missing EXIF data) and http://exif.regex.info/exif.cgi (EXIF data only)
- File does not open in Lightroom/Photoshop.
To work properly it will most likely require us to understand MMU and patch a ROM in a few places (to make it "understand" RAW).
Right now this can be achieved by
GUI_SetImgComposition(1,0,6,3,4); // set RAW only for card1
GUI_SetImgComposition(2,0,6,3,4); // set RAW only for card2
This is C code, I won't share stub (it is easy to find) since we have no idea what are the consequences of leaving camera in that state (other than a ton of debug messages logged).
Thus don't ask how to run that on camera. If you don't know how to do it, you most probably shoudn't try in this state.
If anyone want to dig into cr3 file, here it is: https://kitor.pl/eos/sx740/sx740_raw.cr3
One can reset settings to JPG by just opening menu and setting back to JPG.
===
On the other notes I have a lot of Digic 8 ML code working on SX740, but also have a nasty crash that I can't trace yet. Thus for now it lives on branch in my fork.
Quote from: kitor on March 26, 2022, 09:52:02 PM
On the other notes I have a lot of Digic 8 ML code working on SX740, but also have a nasty crash that I can't trace yet. Thus for now it lives on branch in my fork.
It is always a stub. This time
FreeMemory was bad.
PR opened, including unsafe CR3 experiment. Merged to dev branch.
Since Names_are_hard is experimenting with MMU and ROM patches, it may become safe(ish) in near future.
Quote from: kitor on March 26, 2022, 09:52:02 PM
If anyone want to dig into cr3 file, here it is: https://kitor.pl/eos/sx740/sx740_raw.cr3
What focal length was this done with?
Quote from: kitor on March 26, 2022, 09:52:02 PM
- File opens fine in Windows preview (including actual RAW render),
Interesting. I also see the preview image first and after about 3s the RAW data are probably interpreted. I then get wrong colors and the lens correction disappears.
Ever tried to copy the EXIF data from the JPG to the CR3 with EXIFTOOL?
7mm from EXIF should be about right, as it was quite wide and lens is 4.3-172mm.
No, I had no time to dig into that RAW more. Most likely it needs a rom patching in a few places to get it right.
Like enabling CR3+JPG gives ERR70 after a shot attempt, which is for sure code hitting some assert.
EXIFTOOL shows 71mm.
Adobe DNG Converter shows a parising Error
Update:
Do you see all this E70 with CamInfo_Debug?
No idea, unfortunately now I don't have a lot of time to do any development stuff, I just took the small opportunity I had to upstream SX740/R5 work.
If you have SX740, you can try yourself - code is already on dev branch of magiclantern_simplified repo. I don't remember what params needs to be set to
GUI_SetImgComposition to enable JPG+RAW. But I found a partial crash log on Discord, and it was indeed an assert:
10806: 36140.093 [SHTD] ERROR SemTimeOut SetJpegDispEncodePathForRawJpeg
10807: 36140.144 [STARTUP] ERROR ASSERT : Warp::ShtDevCommon.c
10808: 36140.323 [STARTUP] ASSERT : Task = ShootEncodeSub
10809: 36140.330 [STARTUP] ASSERT : Core 0
10810: 36140.334 [STARTUP] ASSERT : Line 125
10811: 36140.338 [STARTUP] ASSERT : bFlag
10812: 36140.346 [STARTUP] < StackDump >
QuoteEXIFTOOL shows 71mm.
Windows shows 7mm, see my screenshot / "Długość ogniskowej" = Focal Length. Though other parameters doesn't make any sense, like 60s expo... yes, for sure.
I don't have a SX740 and didn't want to have an SX anymore but with CR3 support I would think about it again...
Yes my window shows 7mm as well and EXIFTOOL Focal Length : 71.45 mm
ISO800 and Exposure Time 1/60s is same on windows and EXIFTOOL (and f4)
(https://kitor.pl/eos_r/img/sx70_th.jpg) (https://kitor.pl/eos_r/img/sx70.jpg)
Back in the PowerShot land. This time SX70 HS. It runs runs DryOS +p4 like R/RP.
But the code is more RP alike - new "high" gui modes, XCM implementation that is used on RP onwards.
I still have to trace possibly a bad stub - it doesn't recognize it is in LV, FEATURE_SHOW_FREE_MEMORY hard locks when entering free memory menu, FEATURE_GLOBAL_DRAW hard locks after a few seconds from boot.
Turns out that "Powershot" based models don't have MPU but use small Cortex M0 instead. At least on SX70 and SX740, I don't have a good photo of M50 to confirm.
But there seems to be a visually matching chip, SD slot side, bottom right corner if SD slot is facing down.
M17M6, 36 pin XFBGA -> https://www.nxp.com/docs/en/data-sheet/KL17P64M48SF2.pdf
Today I desoldered DIGIC and that Cortex M0 from my water damaged SX70 HS board.
https://twitter.com/_kitor/status/1656369031383773188
With some measurements I was able to identify about 1/2 of the pins.
It doesn't seem to have any UART output.
Interesting ones: Power, Play and WiFi buttons go to Cortex M0, not ICU. This makes sense as both can wake up the camera.
However INFO button also goes to M0. Reason is unknown.
pin where? signal (mode)
A1
A2
A3
A4 to DIGIC SPI0_MISO (alt2)
A5 to DIGIC SPI0_SCLK (alt2)
A6 to DIGIC SPI0_PCS0 (alt2)
B1
B2
B3
B4 to DIGIC SPI0_MOSI (alt2)
B5
B6
C1
C2 button Play PTE16 (alt1)
C3 VDD
C4 GND
C5
C6 at DNE chip I2C0_SDA (alt2)
D1
D2
D3 VDDA
D4 GND
D5 at debug conn RESET (default)
D6 at DNE chip I2C0_SCL (alt2)
E1
E2
E3
E4 button Power PTA2 (alt1)
E5 at debug conn SWD_IO (default)
E6 at crystal EXTAL_0 (default)
F1 button INFO PTE23 (alt1)
F2
F3 at debug conn SWD_CLK (default)
F4 button WIFI PTA1 (alt1)
F5
F6 at crystal XTAL_0 (default) @crystal
Hello guys. Do you think that any success is possible with R100?
Get me an R100 and I'll tell you.
But I'm fairly sure it uses newer DryOS that first appear on R3 and locks out our entry methods.
I am sure that when the R100 is available we can all donate a small amount to buy one for you devs to try it.
Do you think that R100 has a chance to become "the new EOS M"?
It looks like it is one of the most affordable newer cams so it might get popular.
QuoteIt looks like it is one of the most affordable newer cams so it might get popular.
That's your opinion. I heard a variant of that about every single model.
QuoteDo you think that R100 has a chance to become "the new EOS M"?
EOS M is overhyped. R100 seems to be crap sensor with relatively good CPU.
If we ever get to the state where R100 will make any sense, M50 will probably be much better and cheaper 2nd hand.
Quotewe can all donate a small amount to buy one for you devs to try it.
Also you are clearly not familiar with our latest status update if you think ML will pop out of nowhere for just released Digic 8 model.
https://www.magiclantern.fm/forum/index.php?topic=26852.0
Okay, thanks for the info.
Can you please tell how you know if a sensor in a particular camera is good or crap?
Do you look at the specs or watch sample photos videos?
And what is the criteria for bad or good sensor?
Is it something subjective or you have some metrics?
Sensor seems to be recycled again from 1300D/2000D - 24MPx, 4k only cropped and with contrast detection.
Camera looks like 1300D/2000D with Digic 8 and RF mount.
Nah, they are different.
It got M50II's sensor.
DPAF in 1080p. Contrast detection in 4k.
M50, M50II have no AF in 4k.
Quote from: Walter Schulz on May 31, 2023, 07:56:48 PM
M50, M50II have no AF in 4k.
M50 has contrast AF in 4k.
As for me I'm very happy about the fact that there is cropped 4K - this should be a relatively clean image as compared to full sensor width image scaled without pixel binning, right? For many folks this could be usable even in stock H264 flavor. R100 even has 4K All-I for timelapse. If we can make it All-I for regular 4K then it would already be a good boost.
List the cams that got ALL-I with the help of ML ...
It is already in the cam, it's just limited to timelapse mode.
Well, there's a surprise. M50 mkII is not cbasic/uart locked, even though it runs latest DryOS version. I guess PowerShot team didn't get the memo.
Also there's 1.0.4 firmware in the wild, by google results it seems to be shipped since December last year. However there's no firmware update available (latest on the site is 1.0.3).
Even though firmware downgrade is locked (and we have no 1.0.4 file to use card swap method), Names found a way to downgrade any downgrade-locked camera without a real "same version as installed" file.
QuoteWell, there's a surprise. M50 mkII is not cbasic/uart locked, even though it runs latest DryOS version. I guess PowerShot team didn't get the memo.
Very interesting.
How low spec we can get with mlv_lite?
SX740 the answer... at least for now :)
Yes, the jpeg-only cam now records RAW too.
(https://kitor.pl/eos/img/sx740_raw.th.jpg) (https://kitor.pl/eos/img/sx740_raw.jpg)
Interface seems to max out at 86R/80W. Not enough for continuous 1080p at a normal frame rate.
But tbh that was mostly a test "if sx740 can do it, every model can do it".
SX740 lacks EDMAC mem2mem copy code which I partially used on R so I had to reimplement whole EDMAC memcopy using pure EDMAC functions and cross my fingers that channels used by R were unused here. And it worked fine :)
Very impressive...! :o
I value portability more than quality for regular use, so even if it's just a test and never gets usable, I find super cool to see this tiny cam recording RAW video 8)
What was the actual video resolution for 1080p mode?
D8 cams have buffer >= 1920x1080, so is is true 1080p+.
Not tested for line skipping/binning atm (R does binning).