Magic Lantern Forum

Magic Lantern Releases => Camera-specific discussion => Topic started by: dichterDichter on July 18, 2012, 08:55:06 AM

Title: Canon 40D
Post by: dichterDichter on July 18, 2012, 08:55:06 AM
wow. I have a 40D and i think the 5Dc and the 40D are both VxWorks. Am i right? So would it work on a 40D?
It would be awsome to be able to record movies with the 40D.

nice work.
Title: Re: Canon 40D
Post by: a1ex on July 18, 2012, 09:09:09 AM
In theory, you have the foundation for running user code on 40D and most other VxWorks cameras.

In practice, there should also be a developer who must have this camera, skills and lots of time to work on it.
Title: Re: Canon 40D
Post by: dichterDichter on July 18, 2012, 09:24:59 AM
thank you.
ok... i have that camera, skills : hmmm, lots of time : doh!
but why not. maybe as a winter project.
Is it the current release or is there a special fork?
Title: Re: Canon 40D
Post by: a1ex on July 18, 2012, 09:30:59 AM
It's in the current source tree.
Title: Re: Canon 40D
Post by: dichterDichter on July 18, 2012, 02:41:20 PM
ok, lets see what happens when i start that on my 40D this evening.
Title: Re: Canon 40D
Post by: a1ex on July 18, 2012, 02:50:42 PM
Don't run that code blindly, first understand how it works. It has zero chances to work on 40D unmodified, and can be dangerous.

http://magiclantern.wikia.com/wiki/Other_dslr
http://magiclantern.wikia.com/wiki/For_Developers

First get a firmware dump, find out LED address and try blinking it.
Title: Re: Canon 40D
Post by: dichterDichter on July 18, 2012, 04:21:06 PM
yes, right. i will start with little steps. Thank you.
Title: Re: Canon 40D
Post by: coutts on July 18, 2012, 06:29:52 PM
I suggest you look at my initial project for the 5dc:
www.bitbucket.org/coutts/5dplus (http://www.bitbucket.org/coutts/5dplus)

Everything starts in entry.S. First use a dumper tool to extract the firmware image from a canon firmware update file (see the build_scripts/eos_tools_v11 folder in that project linked above). Use decrypt_fw and then dissect_fw to split the FIR up. See this wiki page for more details:
http://magiclantern.wikia.com/wiki/Packing_FIR_Files (http://magiclantern.wikia.com/wiki/Packing_FIR_Files)

After you analyze the firmware dump using a program like IDA Pro (or the free ARM Console (http://magiclantern.wikia.com/wiki/GPL_Tools/ARM_console) created by Alex) to see how the camera boots/works, then attempt to boot a custom FIR file running user code. Use the assemble_fw perl script in the eos_tools directory to assemble a new FIR file with your usercode (compiled autoexec.bin) instead of canon's payload. The final step is to run decrypt_fw again on this fir to sign it for the camera to accept it. (Note: this step may or may not be necessary, depends on the camera. Try both if one doesn't work). Start by just blinking an LED or something basic to know your code runs. You don't need to boot the main firmware to blink an LED.

If 40d is similar to the 5dc, then you won't be able to run any practical code from a FIR (including calling the EnableBootDisk function or booting the firmware/camera) so you will need to write some code that scans the bootloader area (0xFFFF0000-0xFFFFFFFF) for function signatures to identify the read/write bootflag functions. This will allow you to set the camera's bootflag, to boot an autoexec.bin file with a prepared card, and development takes off from there (you will be able to boot the firmware and do anything from autoexec). I created this bootdisk code from the 350d method, using the 400d bootloader to find the signatures I needed. Only modification you will need is to change are the references to these:
Quote
read_bootflag = (ft_read_bootflag)0xFFFF8AE0;
write_bootflag = (ft_write_bootflag)0xFFFF89F0;
https://bitbucket.org/coutts/5dplus/src/e486f2e53796/bootdisk.c (https://bitbucket.org/coutts/5dplus/src/e486f2e53796/bootdisk.c)

The 5dc took me many hours to get going, I dumped many memory addresses through LED blinks in binary, you should be prepared to do the same. Here is some code that you can use to blink out the contents of a memory address if you know the red/blue LED addresses:
https://bitbucket.org/coutts/5dplus/src/a1cc964de4af/init.c

You can use this to write code to search for specific signatures of the read_bootflag and write_bootflag functions. Some signatures would be instructions like:
Quote
MOVEQ   R7, #0xF8000000
which is assembled and looks like this in memory:
Quote
0x03A0733E

Use the 5dc bootloader (I can send you it) to know what signatures you're looking for (unique instructions that would only appear in the read/write bootflag functions). After you find a signature and have a match at some spot in the BL area (0xFFFF0000-0xFFFFFFFF), use this address and search in reverse (going backwards in memory to lower addresses) until you find the nearest PUSH (STMFD) instruction, this will be the address of the start of the function so that you can call it / use it.



I'll just tell you the signatures to find.
First, for write_bootflag. Here is a small snippet from that function, the first 5 instructions:
Quote
ROM:FFFF89F0                 STMFD   SP!, {R4-R8,LR}
ROM:FFFF89F4                 MOV     R5, R1
ROM:FFFF89F8                 MOV     R4, #0
ROM:FFFF89FC                 CMP     R0, #0
ROM:FFFF8A00                 MOVNE   R7, #0xF8000000
If you were scanning memory, these 5 instructions would look like this(starting at 0xFFFF89F0 on the left and ending on 0xFFFF8A00 on the right):
Quote
0xE92D41F0 0xE1A05001 0xE3A04000 0xE3500000 0x13A0733E

So, look for the signature for the MOVNE R7, #0xF8000000 instruction, then once you find it, search backwards for the STMFD (push) instruction signature, and you will have located write_bootflag in the 40d bootloader. Chances are the functions will probably be identical, but take caution to verify at least 3 times that you have located the correct function and it seems the same / similar to the 5dc one (remember we are working blind here).


Now, read_bootflag. First 5 instructions look like:
Quote
ROM:FFFF8AE0                 STR     LR, [SP,#var_4]!
ROM:FFFF8AE4                 CMP     R0, #0
ROM:FFFF8AE8                 MOVNE   R3, #0xF8000000
ROM:FFFF8AEC                 ADDNE   R3, R3, #0x2000
ROM:FFFF8AF0                 MOVNE   R2, #0x40
And in memory would look like this (same thing as before, starting at 0xFFFF8AE0 on left and ending at 0xFFFF8AF0 on the right):
Quote
0xE52DE004 0xE3500000 0x3E33A013 0x12833A02 0x13A02040
Note: there isn't a STMFD (push) instruction in read_bootflag. The 400d bootloader is like this too, so chances are the 40d is as well.

NOTE: you may need to reverse endianness of the assembled instructions above to see them in memory, but maybe not, I can't remember :P


So, once you have located read_bootflag() and write_bootflag(), you will be able to really start developing. :) This may seem confusing, and I'm sorry, but I hope you will see how valuable this information is (I had to figure it all out on my own). The 350d people dumped the bootloader using a photo diode and the LED to blink the code in binary to a computer, I couldn't figure that out so I did it this way. Let me know if you have any questions, I can probably help a lot. Do you use gmail?
Title: Re: Canon 40D
Post by: dichterDichter on July 23, 2012, 01:54:30 PM
Argh, first i have to repair my camera... broken release.
Thats really annoying.
Title: Re: Canon 40D
Post by: Michael Zöller on July 23, 2012, 04:20:39 PM
coutts, thats some very helpful information and should probably go into the wiki!
Title: Re: Canon 40D
Post by: coutts on July 24, 2012, 10:01:22 PM
coutts, thats some very helpful information and should probably go into the wiki!
should be more than enough to get any port started :)
Title: Re: Canon 40D
Post by: imme on July 27, 2012, 07:18:23 AM
There are plenty of Canon 40d users like me waiting to use MagicLantern on their 40d. Please! Make it happen. I am not a developer.....all can I do is to pray for your success :)

 
Title: Re: Canon 40D
Post by: jplxpto on July 29, 2012, 02:09:36 AM
Finally some good news! I am enjoying the ML. I thank all who have worked on this project. I hope one day to use the ML with a 40D. I hope to give my contribution to make this possible.

I think the work done by Coutts to 5DC will be useful for even the 40D and 400D.
Title: Re: Canon 40D
Post by: jplxpto on July 31, 2012, 01:30:31 AM
I'm thinking start doing the first tests.
I know it's a bit risky. Certainly, I will need your help.
Firstly, I will begin by installing and configuring ubuntu to compile the project. When I can, I will test the tools specified by Coutts.

Title: Re: Canon 40D
Post by: jplxpto on August 05, 2012, 02:39:09 AM
Hi,

I still have nothing to work but I have spent many hours reading the forums CHDK / ML.
I'm learning, have some patience with me. This still seems very complicated. Sorry if the questions are basic.

I got the firmware version 40d1.1.1. With application dissect_fw3_2, I got the unencrypted header and body. I've compiled a small application to try to find the addresses of the red and blue LED, but I've got a problem. I do not know how to encrypt the new firmware to be able to use on my machine. I read a lot about it but I could not understand the steps that have to follow.

If I can correctly encrypt my firmware I can proceed with my tests.

Since I've been searching for some string in the firmware files and I could see some interesting things. I found the string EnableBootDisk.

After seeing the flashing LEDs, I'll try to do a DUMP the firmware.
When I succeed in the previous tests, I proceed to the discovery of the function EnableBootDisk addresses.

Someone can help me create my own firmware for the 40D?

Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 05:09:08 AM
I have a 40D with version 1.1.1. After much reading and testing I was able to flash both LEDs.
Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 04:07:49 PM
I used the information provided by Coutts to flash both LEDs.

See the examples:


1_1000D LED Finder (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/1_1000D%20LED%20Finder/)

2_1000D LED-Dumper (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/2_1000D%20LED-Dumper)

These are the addresses of blue and red LEDs:

LED_RED     0xC02200E0
LED_BLUE    0xC02200E8
Title: Re: Canon 40D
Post by: coutts on August 10, 2012, 08:20:03 PM
I used the information provided by Coutts to flash both LEDs.

See the examples:


1_1000D LED Finder (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/1_1000D%20LED%20Finder/)

2_1000D LED-Dumper (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/2_1000D%20LED-Dumper)

These are the addresses of blue and red LEDs:

LED_RED     0xC02200E0
LED_BLUE    0xC02200E8
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.

For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus
Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 08:35:04 PM
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.

For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus


Coutts,

yes I am currently reading your posts in CHDK.
In 2008 there were major developments, but for some unknown reason you moved away from this project. Made great advances that have helped future ports to other cameras but 40D & 450D were forgotten! Why?! ...

Their progress in the port 1000D can give a great help! I think the cameras 1000D, 450D, 40D have many similarities. This can be an advantage.

Thank you for providing the code :

https://bitbucket.org/coutts/1000d_dev
Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 08:42:48 PM
I really want to install the Magic Lantern in my camera and give my modest contribution to the community but,
 without your precious help will not go away.

You have done an excellent job over the years.

Congratulations.
Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 08:58:18 PM
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.

For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus


Many will read this and get to thinking that an easy task! ;)
Title: Re: Canon 40D
Post by: jplxpto on August 11, 2012, 05:45:19 PM
Has anyone done a dump of the ROM and BL fir v 1.1.1.?
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 06:31:20 AM
I read a lot and follow the tips and suggestions from Coutts.

I analyzed the 5DC BL code and found the signatures of functions and read_bootflag write_bootflag.
Later, I created a small program to find them in my 40d fir 1.1.1.

I still do not know the original values of bootflags but I have called the function read_bootflags.

Not yet confirmed, but I believe that the addresses are:

read_bootflag -> 0xffff 63a8
write_bootflag -> 0xffff 62b8
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 06:34:09 AM
Someone can explain me how to operate the boot flags?
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 08:07:59 PM
The original values of bootflags are:

F8000000 =  0
F8000004 =  0
F8000008 = -1
F800000C = -1
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 08:58:35 PM
I have good news.

The autoboot already works!!!

I used the addresses of functions and LEDs that I presented to you earlier.
I used some test applications of Coutts, and made the necessary changes.

The second obstacle has been overcome.

I level up but, the game becomes more complicated and risky.

Wish me luck! ;)
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 09:04:03 PM
My next steps are:

1) find the addresses of the functions Open, Write and Close;

2) create BL & ROM dumps.
Title: Re: Canon 40D
Post by: coutts on August 13, 2012, 04:50:10 AM
My next steps are:

1) find the addresses of the functions Open, Write and Close;

2) create BL & ROM dumps.
you must boot the firmware first. you cannot call file i/o until it has been initialized by VxWorks. now that you can run autoexec.bin, you can boot the firmware :)
Title: Re: Canon 40D
Post by: jplxpto on August 13, 2012, 07:16:22 AM
I've been reading the forums and ML CHDK and found some examples to dump the ROM and BL.

http://chdk.setepontos.com/index.php?topic=1651.45 (http://chdk.setepontos.com/index.php?topic=1651.45)

I found one that allowed you to dump the 40D FW 1.0.8.
They called on four functions in the code of the flasher.
The 'ASalina' made ??the dump from earlier versions.
I now want to do with version 1.1.1.

They found these features in version 1.0.8:

/ / 40d - flasher v1.0.8
         open = (ft_open) 0x00989a34;
         create = (ft_creat) 0x00989a44;
         write = (ft_write) 0x00989534;
         close = (ft_close) 0x009896a0;

I've been researching the same functions in version 1.1.1:

/ / 40d - flasher v1.1.1
         open = (ft_open) 0x00989a3c;
         create = (ft_creat) 0x00989a4c
         write = (ft_write) 0x0098953c;
         close = (ft_close) 0x009896a8;

I've thought maybe it was not possible to call these functions before starting VxWorks.
I got confused with anything ...

The flasher code calls functions of the ROM?! ...

I still can not understand well the memory map and this is making me lose some time and let me crazy :)

Someone can give me some tips? Maybe you Coutts ... ;) Again ...
Title: Re: Canon 40D
Post by: jplxpto on August 13, 2012, 07:33:16 AM
you must boot the firmware first. you cannot call file i/o until it has been initialized by VxWorks. now that you can run autoexec.bin, you can boot the firmware :)


Coutts I understand but how do I boot VxWorks?! ...
My apologies if the question is basic! ;)

I've been to see the entry.S 5DC but still seems to me very complicated.
How do you know the sequence of function calls to boot.
I studied multitasking, but on the VxWorks I only know the name: (

How do I use AUTOEXEC.BIN to start the VxWorks?! ...

Can I use the functions DEBUGMSG and dump before starting VxWorks?
Title: Re: Canon 40D
Post by: coutts on August 13, 2012, 05:25:21 PM

Coutts I understand but how do I boot VxWorks?! ...
My apologies if the question is basic! ;)

I've been to see the entry.S 5DC but still seems to me very complicated.
How do you know the sequence of function calls to boot.
I studied multitasking, but on the VxWorks I only know the name: (

How do I use AUTOEXEC.BIN to start the VxWorks?! ...

Can I use the functions DEBUGMSG and dump before starting VxWorks?

Those functions you listed earlier sound like they are bootloader functions but they are being called from RAM, so I wouldn't call those (not sure if the functions are copied there or not). I've been looking for file i/o in the bootloader for a while but haven't found it, if you have found these functions in the BL, then that is huge progress! It will help new ports a lot.

Now for booting VxWorks, what I mean is you must copy/paste the boot code starting at 0xFF810000 far enough to where you can spawn your own task. We need to hook ourselves into VxWorks. Once we have started our one task, we can hand execution back to canon and boot the camera like normal.

So, I used some bootcode from chuchin but it is literally copy/pasted line for line from the ROM (at FF810000). As a test, see if you can make your entry.S jump execution to FF810000 and see if the camera boots like normal.

Then begin tracing the boot process to know how much code needs to be re-written. You only need to write until the part where it calls CreateTask on the startup task. We can hook our task in here.
Title: Re: Canon 40D
Post by: jplxpto on August 14, 2012, 08:59:59 PM
Quote
As a test, see if you can make your entry.S jump execution to FF810000 and see if the camera boots like normal.

I'll test it ...
Title: Re: Canon 40D
Post by: jplxpto on August 17, 2012, 09:44:46 PM
I'm working on it ...

I already have the dump of the ROM. I've also got the boot flag active.

The Coutts and Cucho have given me a great help ..
They have been fantastic.


The Nano has sent me a file entry.S.

I'll be a little busy, but soon I hope to present you some results.


Does anyone else want to help me?! ... Any help is welcome.
Title: Re: Canon 40D
Post by: jplxpto on August 18, 2012, 09:11:57 PM

I have good news ...

I already have a tread running ... flashing blue LED!

The LED turns off when the TFT is turned off but with the MENU button it lights up again.

I already found the address of some functions but there is still much work ahead to be able to integrate my code with ML.
Title: Re: Canon 40D
Post by: jplxpto on August 26, 2012, 11:45:30 PM
Hi guys,

I keep working on this project and I having some successes

Now I can write logs on the card.

I've been analyzing the logs and found some messages that can help me identify the VRAM.

Then I present some:

Code: [Select]
   304:   591.053 < GUI Lock > InitializeGUILock (PUB)
   305:   592.017 [GUI] MasterResultCBR
   306:   592.224 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
   307:   593.033 [GUI] -> handleGuiInit
   308:   598.963 [DispCon] InitializeDisplayDeviceController (PUB)
   309:   600.121 [IMP] (PUB) InitializeImagePlayer 1113
   310:   601.818 [CERES] RegisterAdapterStatusCallback
   311:   607.638 [Graphics] GuiStartGraphics (PUB)
   312:   608.057 [IMP] (PUB) StartImagePlayer(mode=0) 1189
   313:   608.094 [IMP] CreateVram 665
   330:   684.874 [Graphics] GuiClearImage
   331:   684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
   332:   684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
   333:   685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644
   334:   685.052 [IMP] GetVramNumber 580
   335:   685.072 [IMP] GetVramNumber 580
   336:   716.486 [IMP] (PUB) RefreshImageVram 1597
   337:   716.519 [IMP] GetVramNumber 580
   338:   716.765 [IMP] GetVramNumber 580
   339:   716.791 [IMP] GetVramNumber 580
   340:   716.823 [GUI] StopDateTimer
   341:   716.852 [GUI] ClearColorPalette (0)
   342:   716.924 [GUI] GUI_RegisterPropertySlave
   343:   724.367 [GUI] MasterResultCBR_AvailableMyMenuList(0x79594c)
   344:   724.618 [GUI] MasterResultCBR_ErrBattery(0x79599c)
   345:   725.033 [DP]Dp_GetGlbRegisterCbrTAdr()
   346:   725.182 [DP]Dp_GetGlbRegisterCbrTAdr()
   347:   725.645 [GUI] GUI_SetLanguage (15)
Title: Re: Canon 40D
Post by: a1ex on August 26, 2012, 11:54:20 PM
Sounds good.

Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.

Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
Title: Re: Canon 40D
Post by: jplxpto on August 27, 2012, 02:37:40 AM
Now I'm trying to change the logging level.
I hope to see something else, but I'm not having great success.

I have to confirm my stubs ... I must be doing something wrong.

I changed the amount of logging that is written but there is something wrong.
I have to understand what is happening.

I wanted to make sure that those are the addresses of VRAM.

I'm going to dump the VRAM (1M) but I still do not know what to do with it... :(
Title: Re: Canon 40D
Post by: jplxpto on August 27, 2012, 02:40:41 AM
Sounds good.

Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.

Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.


These  EDMAC registers are also valid in the DIGIC III?
Title: Re: Canon 40D
Post by: a1ex on August 27, 2012, 07:34:33 AM
You can post them here.

I have no idea what's inside DIGIC III.
Title: Re: Canon 40D
Post by: jplxpto on August 28, 2012, 12:36:22 AM
Thanks Alex, I'll analyze the problem better
Title: Re: Canon 40D
Post by: coutts on September 05, 2012, 08:24:52 PM
One way to find vram:

All vram buffers are like structures, with off_0x00 pointing to a string in the ROM that says "Vram Instance". There's a few of these so you'll have to check for all of them. But, you can dump say the first 0x10000 bytes of ram and look for these pointers. Tip for dumping: you might need to do what I have to do with the 5dc (which I learned from 0xAF with the 400d) and dump using a buffer.

For whatever reason, I can't seem to dump very much without using a buffer. simple code:

Code: [Select]
//~ dump memory 64kb at a time using a buffer.
void dump_with_buffer(int addr, int len, char* filename)
{
    FIO_RemoveFile(filename);
    FILE* f = FIO_CreateFile(filename);
    if (f!=-1)
    {
        int address = addr;
        while (address<addr+len)
        {
            char buf[0x10000];
            memcpy(buf, (void*)address, 0x10000);
            FIO_WriteFile(f, buf, 0x10000);
            address += 0x10000;
        }
        FIO_CloseFile(f);
    }
}
Title: Re: Canon 40D
Post by: coutts on September 05, 2012, 08:32:41 PM
when I found the 5dc vram, I did it a bit oddly. I used img.py (http://magiclantern.wikia.com/wiki/VRAM/550D#How_to_find_segments[/url]). You should look into this. You already know the dimensions of the buffer (same as 5dc): 720x240 with a pitch of 360 I believe. so, dump an area of memory and run it all through img.py to see if you can see the menu or whatever screen you dumped the ram at.
Title: Re: Canon 40D
Post by: jplxpto on September 06, 2012, 12:38:07 AM
Coutts, once again thank you for your help.

I already knew that page. I've also ran this section of your code.
I've done dump part of RAM, but I have not had time to test this python script. Once I have the opportunity I will do this test.

However, I've spent a few hours looking at the 40D firmware. I identified many functions on my camera.
I think there are too many in your 5DC. If you want I send you my stubs for 40D v1.1.1.

I try to read all your posts. You have written some things that I have been very useful for my port.

Soon I will try to present some results. I've been working on it a little every day.
Title: Re: Canon 40D
Post by: jplxpto on September 09, 2012, 02:20:15 AM
I have found many functions in 40D firmware.
These are the ones that create the state objects (I still do not know if missing some function)

Code: [Select]
NSTUB(0xFFD4F17C, CreateTaskClass);

NSTUB(0xFFD4EE48, CreateStateObject);

NSTUB(0xFFB04634, DpImgEditState_CreateStateObject);
NSTUB(0xFFB06DC4, DpState_CreateStateObject);
NSTUB(0xFFBB0A2C, TOMState_CreateStateObject);
NSTUB(0xFFC7F9E0, USBC20State_CreateStateObject);

NSTUB(0xFFBB7DFC, CeresState_CreateStateObject);
NSTUB(0xFFB72BEC, PtpDpsState_CreateStateObject);
NSTUB(0xFF84BD74, RMTState_CreateStateObject);
NSTUB(0xFFB57FC4, FSSState_CreateStateObject);
NSTUB(0xFFC86AFC, PropState_CreateStateObject);
NSTUB(0xFFB618B8, RDState_CreateStateObject);
NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject);
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject);
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject);
NSTUB(0xFFB32CB8, LVState_CreateStateObject);
NSTUB(0xFFBFDB18, FWState_CreateStateObject);
NSTUB(0xFFBFB9A8, FRState_CreateStateObject);
NSTUB(0xFFBF0B6C, MrkState_CreateStateObject);
NSTUB(0xFFB56580, FCSState_CreateStateObject);
NSTUB(0xFFBAE9D8, SdioTskState_CreateStateObject);
NSTUB(0xFFBD5564, FMNormalState_CreateStateObject);
NSTUB(0xFFD5CEA4, DMState_CreateStateObject);
Title: Re: Canon 40D
Post by: a1ex on September 09, 2012, 11:30:54 AM
Yay!

http://a1ex.bitbucket.org/ML/states/40D-alt/index.html

Some functions named automatically with my scripts: http://a1ex.magiclantern.fm/bleeding-edge/40D.111.idc

Try to dump from MEM(0x7768), size MEM(0x7764), while you are in LiveView. If successful, we can record MJPEG video :)
Title: Re: Canon 40D
Post by: jplxpto on September 10, 2012, 03:43:54 PM
Alex,

Thanks for your help.

I'll do this test ..
Title: Re: Canon 40D
Post by: jplxpto on September 13, 2012, 02:14:55 AM
Yay!

http://a1ex.bitbucket.org/ML/states/40D-alt/index.html

Some functions named automatically with my scripts: http://a1ex.magiclantern.fm/bleeding-edge/40D.111.idc

Try to dump from MEM(0x7768), size MEM(0x7764), while you are in LiveView. If successful, we can record MJPEG video :)


----------------------------------------

Alex,

I want to know which of your script made ​​this excellent work. I have little experience in the use of your tools. I saw nothing that did that.

I found hundreds of methods in firmware but it took me many hours looking at the assembly.

And how did you get those addresses? ...

Thanks in advance ...



Title: Re: Canon 40D
Post by: ilguercio on September 13, 2012, 02:34:03 AM
How is this going on? :)
Title: Re: Canon 40D
Post by: a1ex on September 13, 2012, 08:55:43 AM
This one:

1) guessfunc.run(dump) in arm console
2) run -i namefuncx.py

http://a1ex.magiclantern.fm/name_funcx.py
Title: Re: Canon 40D
Post by: jplxpto on September 14, 2012, 01:05:06 AM
IT'S WORKING !!! IT'S WORKING !!! IT'S WORKING !!!

Alex, thanks for the tip

Finally, I got a little time I did the test and it worked!!

I got the JPEG successfully.
Title: Re: Canon 40D
Post by: jplxpto on September 14, 2012, 01:36:48 AM

LV - JPEG

1024 x 680

-----

LCD

mode :  w x h

0 : 720 x 240
1 : 704 x 480
2 : 720 x 576
Title: Re: Canon 40D
Post by: jplxpto on September 14, 2012, 02:00:45 AM
Code: [Select]
51722: 13249.867 [DispCon] TurnOnDisplay (PUB)
 51723: 13266.642 [LV] lvSetPsave 0x0
 51724: 13267.371 [LV] LV_GetPtpZoomWindowArea IX=1560(16384), IY=1038(0)
 51725: 13267.404 [LV] LV_GetPtpZoomWindowArea CX=0, CY=0
 51726: 13268.004 [LV] lvSetWbIntegRegisterForAe 1
 51727: 13268.045 [LV] StartLiveViewWbPass
 51728: 13268.920 [LVCDEV]->lvcdevStartDev
 51729: 13270.190 [LV] lvResetPsave
 51730: 13270.396 [LV] WB 1974 1151 1151 2533(1377)
 51731: 13270.503 [LV] lvResetPsave(1) 0x5A 0x454 0x49E
 51732: 13270.528 [LV] lvResetPsave(2) 0x0 0x0 0x0
 51733: 13271.801 [LVCDEV]->lvcdevResourceGet(0,1)
 [b]51734: 13272.366 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0[/b]
 51735: 13275.198 [LV] lvVDInterrupt
 51736: 13275.363 [LV] WB 1974 1151 1151 2533(1158)
 51737: 13279.334 [DEV] LV_JPG YuvWriteCompleteCBR
 51738: 13279.373 [DEV] LV_JPG YUVReadCompleteCBR
 51739: 13279.499 [DEV] LV_JPG JpCoreCompleteCBR( 0x2e1c6 )
 51740: 13279.553 [DEV] LV_JPG JpegPopCompleteCBR
[b] 51741: 13279.672 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1ca9e28e Y411:0x107a0e20[/b]
 51742: 13280.277 [LVCDEV]->PD(VF:0x107927ec,MS:0x485540)
[b] 51743: 13282.818 [LV] lvReturnVram[/b]
 51744: 13282.851 < GUI Lock > GUILock_PermitPowerLock (PUB)
 51745: 13283.134 < GUI Lock > GUILockTask 1
Title: Re: Canon 40D
Post by: Chucho on September 14, 2012, 02:46:30 AM
In 2008 dataghost teased the world be getting video from his 40d. Now it looks like it might just happen for other 40d users. Congratulation on your hard work!!!
Title: Re: Canon 40D
Post by: a1ex on September 14, 2012, 07:35:59 AM
Yay!

I think this is a lot better than Dataghost obtained (I've followed the thread back then). If all goes well, we will have MJPEG 422 at 1024x680.

Sure, we need to have a working port first. If you share the current status and code, I can help with this.
Title: Re: Canon 40D
Post by: imme on September 14, 2012, 08:07:28 AM
Congrats you have done marvelous job...........eagerly waiting to use it on my 40d :)
Title: Re: Canon 40D
Post by: jplxpto on September 14, 2012, 11:54:06 AM
Thank you all, but this would not have been possible without your help.

The Coutts, Chucho and the A1ex helped me a lot.

I have to thank also to the guys of CHDK. In the past they did an excellent job.
Without this work and without tools Alex would be very complicated.

I have spent many hours on it. I'm a little tired. Once you have a little time, I'll share with you my code.

My next steps will be to change the boot process.
I want to do something similar to what exists for other cameras.

I've read some things and did not seem very complex. With time and with your help will be easy.

Title: Re: Canon 40D
Post by: a1ex on September 14, 2012, 12:04:25 PM
Take it easy. This low-level stuff can take a lot of time, even for experienced people.
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 02:55:22 AM
'Vram Instance' : 0xFF9B943C
Title: Re: Canon 40D
Post by: ilguercio on September 15, 2012, 12:50:19 PM
That's the same LV resolution as the 50D, what about frame rates though?
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 03:45:14 PM
Some strings from 40dv111 ...


s vram
Code: [Select]
[b]ffca0178: '[IMP] CreateVram %d' [/b]
ffca0930: '[IMP] CompleteVramSyncroClearCBR err:%d'
ffca0d48: '[IMP] (PUB) SetVramInformation(w:%ld h:%ld) %d'
[b]ffca7528: '[IMPV] MakeHDVram %d' [/b]
ffca0e9c: '[IMP] DrawImageToVram GetJpegInfo():%d'
ffca1298: '[IMP] (PUB) RefreshImageVram %d'
ffca12b8: '[IMP] RefreshImageVram : VramNo not found'
ffca15a8: '[IMP] (PUB) AbortDrawImageToVram %d'
[b]ffca648c: '[IMPV] SetVramImageInfo %d' [/b]
ffca2c04: '[IMP] (PUB) SyncroClearImagePlayVram %d'
ffca089c: '[IMP] ImageVramCompleteCBR err:%d'
ffca349c: '[IMP] (PUB) SetVisibleImageVramOffset %d'
ffca3518: '[IMP]  pVramImagePositionY %d'
ffcaff38: 'Not Exist Bitmap Vram!!'
[b]ffca32fc: '[IMP] (PUB) GetVramImageInfo %d' [/b]
[b]ffca0ec4: '[IMP] ERROR DrawImageToVram %s, %d' [/b]
ffca644c: '[IMPV] Complete MakeHDVram Error(%d)\n'
[b] ffca64a8: '[IMPV] SetVramImageInfo x:%ld y:%ld w:%ld h:%ld' [/b]
ff906cd4: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramWidth(%d)'
ff906d88: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramHeight(%d)'
ffca087c: '[IMP] ImageVramCompleteCBR %d'
[b]ffca12e4: '[IMP] RefreshImageVram VramAdd:0x%lX' [/b]
[b]ffca7b8c: '[IMPV] MakeHDVramFromJpeg Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7f74: '[IMPV] (PUB) MakeHDVramCheck %d' [/b]
[b]ffca8254: '[IMPV] GetVramImagePosAndSize s:%ld y:%ld w:%ld h:%ld' [/b]
[b]ffca01b4: '[IMP] Vram%d:0x%lX' [/b]
ffca34f8: '[IMP]  pVramImagePositionX %d'
[b]ffcb16fc: '[BmpDDev] RefreshPhysicalVram (PUB)' [/b]
ffca7c84: '[IMPV] MakeHDVram Error!'
ffca02a8: '[IMP] DeleteVram %d'
ffca02bc: '[IMP] CopyCurrentDisplayVramToIdleVram %d'
ffca08c0: '[IMP] CompleteVramSyncroCopyCBR %d'
[b]ffcb0290: '[BmpDDev] CreatePhysicalVram (PUB)' [/b]
[b]ffb2d1d0: 'lv_vram_dump' [/b]
ffca7bd8: '[IMPV] WorkAdd:0x%lX VramAdd:0x%lX RotWork:0x%lX'
[b]ffca7b68: '[IMPV] (PUB) MakeHDVramFromJpeg %d' [/b]
ffca7c50: '[IMPV] VramWork basew:%ld x:%ld y:%ld w:%ld h:%ld'
[b]ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d' [/b]
ffca2984: '[IMP] ERR: Not Found Display Vram'
ffcb03b4: '[BmpDDev] DeletePhysicalVram (PUB)'
ffca822c: '[IMPV] (PUB) GetVramImagePosAndSize %d'
ffcb1ba8: '[ImgDDev] WARNING Divide Zero Vram Width (%d)'
ffca2ff8: '[IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine %d'
ff9122a4: '[GUI] CalcLvVramSize VramSize X(%d) Y(%d) W(%d) H(%d)'
[b]ffb32b30: '[LV] lvReturnVram' [/b]
ffcb3204: 'Already Vram For Adjust!!'
ff8b30ac: '[GUI] PlayModel.c DrawAspectFrame VramSize X(%d) Y(%d) W(%d) H(%d)'
ffca331c: '[IMP] GetVramImageInfo x:%ld y:%ld w:%ld h:%ld'
ffca334c: '[IMP] (STUB) SetImageVramColorMode(color:%ld) %d'
ffcb3530: 'Not Exist Vram For Adjust!!'
ffb34d94: '[LV] WriteEDmacVramCompleteCBR_x5'
[b]ffca3810: '[IMP] (PUB) GetVramInformation %d' [/b]
ffca08e4: '[IMP] CompleteVramSyncroCopyCBR err:%d'
ffca090c: '[IMP] CompleteVramSyncroClearCBR %d'
ffb361c4: '[LV] WriteEDmacVramCompleteCBR_x10'
ff883b18: '[TestEndDrawToVram] dwErrCode = %d'
ffcb8b6c: '[DispCon] GetVramSize (PUB)'
ffb39140: '[LV] WriteEDmacVramCompleteCBR_x1'
[b]ff9b943c: 'Vram Instance' [/b]
ff9b9558: 'pVram->Image.pPaletteIndex != NULL'
ff9b9594: '!IS_ERROR(pVram->hSemaphore)'
ff9b96b0: 'pVram->Mode == LOGICAL_VRAM'
ffca2e4c: '[IMP] (PUB) SyncroAllClearImagePlayIdleVramWithoutEngine %d'
ffca2e88: '[IMP] ERROR : Vram State'
ffca0e6c: '[IMP] (PUB) DrawImageToVram(rot:%d cb:0x%lX) %d'
ffca0d88: '[IMP] (PUB) SetCopyVramMode(mode=%d) %d'
ff87ece8: '  [Graphics] EndDrawToVram (PRI), err %d'
ffcaa8bc: '[IMP][PBFEN] Fencing_StartVRAMMode'
ffca0e0c: 'SetImageVramParameter x:%ld y:%ld w:%ld h:%ld/* Aspect:%d*/'
ffc9ff6c: '[IMP] GetVramNumber %d'
ffc9ffa0: '[IMP] SetVramImageParameter %d'
ffc9ffc0: '[IMP] SetVramImageParameter add:0x%lX BaseW:%ld'

s 411
Code: [Select]
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffc492c0: '[DPATH] LV_YPACK START Y411:%#lx YPACK:%#lx'
ffc492ec: '[DPATH] LV_YPACK STOP Y411:%#lx YPACK:%#lx'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc46e00: '[DPATH] LV_JPG START Y:%#lx J:%#lx Y411:%#lx'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffc46fbc: '[DPATH] LV_JPG STOP Y:%#lx J:%#lx Y411:%#lx'
ffc96db0: '[IMP][PBRSZ] GetCnv411Mode %d'

s 422
Code: [Select]
ffc96d90: '[IMP][PBRSZ] GetCnv422Mode %d'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'

s YUV
Code: [Select]
ffc95578: '<RESIZE> SetParameterResizeYuv Abort End Before Lock'
ffc955fc: '[IMP][PBRSZ] RequestResizeYuv RdAdr:%#lx, WrAdr:%#lx'
ffcb56b8: 'gyuv'
ffb301f8: '[LV] YuvAddress = 0x%08lX'
ffb00db8: 'Dp_ReduceImageData_Yuv()'
ffc498dc: 'PonyYuvPath'
ffc95810: '[IMP][PBRSZ] RegisterCBROfCompleteResizeYuv %d'
ffb01094: 'Dp_AdobeRgbToSRgb_Yuv()'
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffb013c0: 'Dp_ClearWidth_Yuv()'
ffc959b8: '[IMP][PBRSZ] Zoom:%d InYuv:%d OutYuv:%d'
ffafaf14: 'Dp_ExecuteYuvRotatingCBR() ErrorCode [0x%08x]'
ffc49f7c: '[DEV] Pony YuvWriteCompleteCBR'
ffca6754: '[IMPV] Yuv:%d Add:0x%lX BaseW:%ld'
ffb02720: 'Dp_CopyImageData_Yuv()'
ffb02738: 'pDstYuvDataAddress [%d]'
ffb02750: 'pSrcYuvDataAddress [%d]'
ffc45c34: 'FactoryYuvPath'
ffc444b8: '[DEV] JPG_EN YuvWriteCompleteCBR'
ffaf9fa8: 'Dp_YuvToYuv()'
ffca47a8: '[IMPL] Yuv:%d Add:0x%lX BaseW:%ld'
ffca4c1c: '[IMPL] (PUB) CalculateYuvResizeParameter %d'
ffb36258: '[LV] WriteEDmacYuvCompleteCBR_x10'
ffc988b0: '<ROTATE> RequestRotationYuv Before Lock'
ffca5294: '[IMPL]_CalcResizeSizeForRotZoom InYuv:%d OutYuv:%d Aspect:%d'
ff84534c: '[FA] FA_YuvDevelopTestImage'
ffca580c: '[IMPL] _CalcResizeSize InYuv:%d OutYuv:%d Aspect:%d'
ffc4604c: '[DEV] FactoryYuvPath_ChangeCBR(ID=%#lx)'
ffca630c: '[IMPV] GetAjustUnitYUV %d'
ffb018bc: 'Dp_CutImageWidth_Yuv()'
ffca6dec: '[IMPV] YuvMode:%d'
ffc47068: '[DEV] LV_JPG YuvWriteCompleteCBR'
ffca72e0: '[IMPV] YuvMode:%d BaseAdd:0x%lX BaseW:%ld'
ffca730c: '[IMPV] YuvMode:%d  BaseAdd:0x%lX BaseW:%ld'
ffcadf00: '[IMP][DECWIN] SetNQDecParam adr:0x%08lX yuv:%d'
ffb01438: 'Dp_ExpandImageWidth_Yuv()'
ffb01490: 'Dp_ShiftYuvRotationData_Yuv()'
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
ffc49c90: '[DPATH] Pony2 START YUV1:%#lx YUV2:%#lx'
ffc9c32c: '[IMPD] (PUB) ExecuteYuvRotating %d'
ffcb6ddc: '[DispCon] Err Factory Adjust For DisplayYUVGain'
ffc49ae4: '[DPATH] Pony1 START C:%#lx YUV:%#lx'
ffc49c2c: '[DPATH] Pony1 STOP C:%#lx YUV:%#lx'
ffc458c0: '[DEV] YuvWriteCompleteCBR'
ffc47048: '[DEV] LV_JPG YUVReadCompleteCBR'
ffb01b2c: 'Dp_AdjustCroppingSize_Yuv()'
ffc49e94: '[DPATH] Pony2 ReStartPonyYuvPath2'
ffb0134c: 'Dp_ClearHeight_Yuv()'
ffc49eb8: '[DPATH] Pony2 STOP YUV1:%#lx YUV2:%#lx'
ffc99db0: '[IMPD] YuvMode:%d'
ffc99de4: '[IMPD] StartYuvResizing Comp'
[b]ffb2d1e0: 'lv_yuv_dump' [/b]
ffcad330: '[IMP][DECWIN] SetResizeParam OutYuv:%d InputSel:%d'
ffcada9c: '[IMP][DECWIN] SetWinResDecParam adr:0x%08lX yuv:%d base:%ld'
ffcb15fc: '[BmpDDev] GetYUVPaletteFromDisplayDevice (PUB)'
ffb02798: 'Dp_ShiftImageHeight_Yuv()'
ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d'
ffc8f344: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc8f3a0: '[IMP][PBLOT]  RequestRotationYuv Before Lock'
ffcb0608: '[BmpDDev] SetYUVPaletteToDisplayDeviceh (PUB)'
ffad0f50: 'YuvMode[%d]'
ffad0fd0: 'YuvMode[%d] BaseAddress[%d]'
ffafa738: 'ResizeYuvT Input nYuvMode [%d]'
ffb391d4: '[LV] WriteEDmacYuvCompleteCBR_x1'
ffc98708: '[IMP][PBROT]  OUTPUT --- Yuv:%d Add:0x%lX Base:%ld'
ffca6d94: '[IMPV] ZoomMode:%d YuvMode:%d'
ffb0ff6c: 'Dp_YuvToJpeg [0x%08x]'
ffcadfa0: '[IMP][DECWIN] pYuvAddress:%#lx'
ffb02004: 'Dp_AdjustFrameWithWhite_Yuv()'
ffb34e28: '[LV] WriteEDmacYuvCompleteCBR_x5'
ffca5dd0: '[IMPL] rot:%d zoom:%d inYUV:%d outYUV:%d'
ffcb8d9c: '[DispCon] GetYUVGain'
ffc95520: '[IMP][PBRSZ] SetParameterResizeYuvForMovie %d'
ffc95634: '<RESIZE> RequestResizeYuv Abort End Before Lock'
ffc95664: '[IMP][PBRSZ] ERROR pResizeYuvCompleteCBR is NULL'
ffc95698: '[IMP][PBRSZ] CancelResizeYuv %d'
ffc95840: '[IMP][PBRSZ] UnregisterCBROfCompleteResizeYuv %d'
ffc95874: '[IMP][PBRSZ] AbortResizeYuv %d'
ffc96334: '[IMP][PBRSZ] Input:%ld Output:%ld InYuv_f:%ld OutYuv_f:%ld'
ffc46030: '[DEV] YuvWriteCompleteCBR'
ffc4937c: '[DEV] LV_YPACK YuvReadCompleteCBR'
ffb0ff5c: 'Dp_YuvToJpeg()'
ffcb7564: "[DispCon] Warning: YUV Gain Don't Adjust"
ffb17f6c: '[GYO]Dp_YUVDustReduction'
ffc98684: '[IMP][PBROT] SetParameterRotationYuv %d'
ffc986ac: '[IMP][PBROT]  INPUT  --- Yuv:%d Add:0x%lX Base:%ld'
ffc98838: '[IMP][PBROT] RequestRotationYuv %d'
ffc9885c: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc98cc0: '[IMP][PBROT] CancelRotationYuv %d'
ffc98ce4: '[IMP][PBROT] RegisterCBROfCompleteRotationYuv %d'
ffc98d18: '[IMP][PBROT] UnregisterCBROfCompleteRotationYuv %d'
ffaf9720: 'Dp_JpegToYuvNew() Layout[0x%08x]'
ffaf97a4: 'Dp_JpegToYuvNew [0x%08x]'
ffcad788: '[IMP][DECWIN] SetResWinParam yuv:%d InputSel:%d'
ffb01160: 'YuvBaseAddress [0x%08x]'
ffc99dc4: '[IMPD] StartYuvResizing TIMEOUT'
ffc9a150: '[IMPD] StartYuvRotating Comp'
ffafa4cc: 'Not Executed Dp_YuvToYuvHalf()'
ffafa6a8: 'Dp_YuvToYuvCopy()'
ffafa6d8: 'Dp_YuvToYuvReduce()'
ffafa720: 'Dp_ExecuteYuvResizing()'
ffafa758: 'ResizeYuvT Output nYuvMode [%d]'
ffafa998: 'Dp_ExecuteYuvResizingCBR() ErrorCode [0x%08x]'
ffafa9dc: 'Dp_YuvRotation() Rotate:%d'
ffc8f1c8: 'EvenSize >= YuvUnit'
ffc9f1e0: '  < IMD > ERR: YUV mode'
ffafaf44: 'ExecuteYuvRotation'
ffc99d44: '[IMPD] StartYuvResizing %d'
ffc955d0: '<RESIZE> SetParameterResizeYuv Before Lock'
ffc99d78: '[IMPD] ZoomMode:%d YuvMode:%d'
ffc99e04: '[IMPD] ResizeYuv:%d'
ffc9b9d8: '[IMPD] ERROR Dpx_ExecuteYuvAngleAdjust %d'
ffc49f9c: '[DEV] PonyYuvPath_ChangeCBR(ID=%#lx)'
ffc9c308: '[IMPD] (PUB) ExecuteYuvResizing %d'
ffc9a0f0: '[IMPD] StartYuvRotating %d'
ffcaf664: '  [BmpDDev] ConvertYUVPaletteToPBPalette (PRI)'
ffc44d70: '[DPATH] DCF_EN START DCF:%#lx YUV:%#lx'
ffc44f24: '[DPATH] DCF_EN STOP DCF:%#lx YUV:%#lx'
ffafa4b8: 'Dp_YuvToYuvHalf()'
ffc9c350: '[IMPD] (PUB) ExecuteYuvRotatingFor2Buffer %d'
ffafa68c: 'Dp_YuvToYuv64up() W:%d H:%d'
ff83e778: 'FA_YuvDevelopTestImage'
ff83e844: 'FA_GetYuvImage'
ffb151a8: 'YUV-Control Done'
ffca62f4: '[IMPV] SetUnitYUV %d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'
ffafa9c8: 'ExecuteYuvResize'
ff845488: '[FA] FA_GetYuvImage'
ffca0e48: '[IMP] (PUB) SetYuvColorParameter %d'
ffc95550: '[IMP][PBRSZ] SetParameterResizeYuv %d'
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 05:05:51 PM

something interesting... mbm29lv2mx16

ROM:FFD5D808 aAssertionFai_0 DCB "Assertion failed: (char*)WriteDataInFastModeOnRam > (char*)Erasi"
ROM:FFD5D808                                         ; DATA XREF: sub_FFD5DE00+28o
ROM:FFD5D808                                         ; ROM:off_FFD5DE80o
ROM:FFD5D808                 DCB "ngMethodOnRam, file ../MTD/mbm29lv2mx16/mbm29lv2mx16.c, line 86",0xA
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 06:02:20 PM
some more addresses : 0xC0F1407C , 0xC0F14074
   
In [12]: r 0xC0F1407C

str:[DispCon]_TurnOnDisplay_PUB+172:
str:[DispCon]_ShowBitmap_PUB+60:
str:[DispCon]_HideBitmap_PUB+60:
str:[DispCon]_SetDisplayType_PUB+372:

In [13]: r 0xC0F14074

str:[DispCon]_ShowImage_PUB+60:
str:[DispCon]_HideImage_PUB+60:
str:[DispCon]_SetDisplayType_PUB+356:
str:[DispCon]_TurnOnDisplay_PUB+156:
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 06:59:58 PM
GetDisplayType_FFCB8668

return *0xBEA0

--------------------------------------------------------------------------------

GetDisplayWidth_FFCB6CAC

if *0xBEA4 == 0 /*EQ*/:
    return 720
return 704

--------------------------------------------------------------------------------

GetDisplayHeight_FFCB8B04

if *0xBEA4 == 0 /*EQ*/:
    return 240
if *0xBEA4 == 1 /*EQ*/:
    return 480
return 576

--------------------------------------------------------------------------------


Display Resolution/Mode (maybe):

0 : w = 720, h = 240
1 : w = 704, h = 480
2 : w = 704, h = 576


--------------------------------------------------------------------------------

0x5B74 : unknown
0x5B78 : unknown
0x5BB8 : unknown
0x5BF8 : Vram Instance (maybe)
0x5BFC : unknown
0x5C00 : unknown
0x5C04 : unknown
0x5C08 : unknown
0x5C0C : unknown

0xB854 : unknown

0xBEA0 : DISPLAY TYPE
0xBEA4 : DISPLAY MODE (maybe)


0x1E004 : VRAM SEMAPHORE (maybe)
0x1E010 : VRAM INFORMATION
0x1E0A8 : unknown
0x1E100 : VRAM PARAMETERS  // 0x1E0A8 + 0x58 = 0x1E100
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 09:36:16 PM
   302:   589.004 [GUI] MasterResultCBR
   303:   589.210 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
   304:   589.992 [GUI] -> handleGuiInit
   305:   595.929 [DispCon] InitializeDisplayDeviceController (PUB)
   306:   597.086 [IMP] (PUB) InitializeImagePlayer 1113
   307:   598.805 [CERES] RegisterAdapterStatusCallback
   308:   604.642 [Graphics] GuiStartGraphics (PUB)
   309:   605.045 [IMP] (PUB) StartImagePlayer(mode=0) 1189
   310:   605.096 [IMP] CreateVram 665
   311:   605.252 [IMP] Vram0:0x1065BE00
   312:   605.354 [IMP] Vram1:0x106F3C8C
   ...
   858: 10003.647 myTaskDumpf:80: [MY_TEST] VRAM INFO:
   859: 10003.702 myTaskDumpf:84: [MY_TEST] Show ImageVramParameter : x:0 y:24 w:720 h:216
   861: 10118.505 [IMP] (PUB) GetVramInformation 3766
   862: 10118.608 myTaskDumpf:101: [MY_TEST] GetVramInformation : arg0=1065BE00 ; Vram0
   863: 10118.642 myTaskDumpf:102: [MY_TEST] GetVramInformation : arg1=00000000
   864: 10118.683 myTaskDumpf:103: [MY_TEST] GetVramInformation : arg2=106F3C8C ; Vram1
   865: 10118.708 myTaskDumpf:104: [MY_TEST] GetVramInformation : arg3=00000002
   866: 10118.739 myTaskDumpf:105: [MY_TEST] GetVramInformation : arg4=000002D0 ; 720
   867: 10118.768 myTaskDumpf:106: [MY_TEST] GetVramInformation : arg5=000002D0 ; 720
   868: 10118.798 myTaskDumpf:107: [MY_TEST] GetVramInformation : arg6=000000F0 ; 240


0x1E010+0x00 -> arg0
0x1E010+0x04 -> arg4
0x1E010+0x08 -> arg5
0x1E010+0x0C -> arg6
0x1E010+0x10 -> arg1
0x1E010+0x14 -> arg2
0x1E010+0x24 -> arg3
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 11:00:24 PM
Some more stubs :
Code: [Select]
NSTUB(0xFFCB02B4, CreatePhysicalVram)
NSTUB(0xFFCA01C8, CreateVram)
NSTUB(0xFFCA75C4, MakeHDVram)
NSTUB(0xFFB32EA0, LV_lvReturnVram)
NSTUB(0xFFCA130C, RefreshImageVram)
NSTUB(0xFFCA38DC, SetVramInformation)
NSTUB(0xFFCA432C, GetVramInformation)
NSTUB(0xFFCA3AA0, SetImageVramParameter)
NSTUB(0xFFCA6520, SetVramImageInfo)
NSTUB(0xFFCA3EC4, GetVramImageInfo)
NSTUB(0xFFCA8498, GetVramImagePosAndSize)
NSTUB(0xFFCA35D0, GetWorkImageLengthAndPosition)
Title: Re: Canon 40D
Post by: jplxpto on September 16, 2012, 02:12:02 AM
I did dump some state-objects and found that the structure appears to be the same as 5DC.


NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject);   // Mem 0x7770 / state matrix : 0xFFB3C9D4
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject);    // Mem 0x7748 / state matrix : 0xFFB3B540
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject);    // Mem 0x7738 / state matrix : 0xFFB39F5C
NSTUB(0xFFB32CB8, LVState_CreateStateObject);      // Mem 0x7628 / state matrix : 0xFFB2EDC4
NSTUB(0xFFD5CEA4, DMState_CreateStateObject);      // Mem 0xEFDC / state matrix : 0xFFD5CD84

   973: 11003.762 logMemory:24: DUMP DMState:
   974: 11003.815 logMemory:30: MEM(0x00201AD8) = 0xFFD4EE3C : type - "StateObject"
   975: 11003.861 logMemory:30: MEM(0x00201ADC) = 0xFFD5CD7C : name - "DMState"
   976: 11003.890 logMemory:30: MEM(0x00201AE0) = 0x00000000 : auto_sequence
   977: 11003.935 logMemory:30: MEM(0x00201AE4) = 0xFFD4F018 : StateTransition_maybe
   978: 11003.980 logMemory:30: MEM(0x00201AE8) = 0xFFD5CD84 : state_matrix
   979: 11004.009 logMemory:30: MEM(0x00201AEC) = 0x0000000E : max_inputs
   980: 11004.039 logMemory:30: MEM(0x00201AF0) = 0x00000002 : max_states
   981: 11004.069 logMemory:30: MEM(0x00201AF4) = 0x00000000 : current_state
   
   983: 11004.124 logMemory:24: DUMP LVState:
   984: 11004.169 logMemory:30: MEM(0x00797940) = 0xFFD4EE3C
   985: 11004.214 logMemory:30: MEM(0x00797944) = 0xFFB2F454
   986: 11004.244 logMemory:30: MEM(0x00797948) = 0x00000000
   987: 11004.289 logMemory:30: MEM(0x0079794C) = 0xFFD4F018
   988: 11004.335 logMemory:30: MEM(0x00797950) = 0xFFB2EDC4
   989: 11004.366 logMemory:30: MEM(0x00797954) = 0x0000000F
   990: 11004.396 logMemory:30: MEM(0x00797958) = 0x0000000E
   991: 11004.426 logMemory:30: MEM(0x0079795C) = 0x00000000

   993: 11004.483 logMemory:24: DUMP LVCAEState:
   994: 11004.528 logMemory:30: MEM(0x00796FB4) = 0xFFD4EE3C
   995: 11004.573 logMemory:30: MEM(0x00796FB8) = 0xFFB39F50
   996: 11004.603 logMemory:30: MEM(0x00796FBC) = 0x00000000
   997: 11004.648 logMemory:30: MEM(0x00796FC0) = 0xFFD4F018
   998: 11004.693 logMemory:30: MEM(0x00796FC4) = 0xFFB39F5C
   999: 11004.724 logMemory:30: MEM(0x00796FC8) = 0x0000000A
  1000: 11004.754 logMemory:30: MEM(0x00796FCC) = 0x00000006
  1001: 11004.784 logMemory:30: MEM(0x00796FD0) = 0x00000002

  1003: 11004.841 logMemory:24: DUMP LVCAFState:
  1004: 11004.887 logMemory:30: MEM(0x0079742C) = 0xFFD4EE3C
  1005: 11004.932 logMemory:30: MEM(0x00797430) = 0xFFB3B534
  1006: 11004.962 logMemory:30: MEM(0x00797434) = 0x00000000
  1007: 11005.007 logMemory:30: MEM(0x00797438) = 0xFFD4F018
  1008: 11005.052 logMemory:30: MEM(0x0079743C) = 0xFFB3B540
  1009: 11005.082 logMemory:30: MEM(0x00797440) = 0x0000000C
  1010: 11005.112 logMemory:30: MEM(0x00797444) = 0x00000009
  1011: 11005.143 logMemory:30: MEM(0x00797448) = 0x00000001

  1013: 11005.199 logMemory:24: DUMP LVCDEVState:
  1014: 11005.245 logMemory:30: MEM(0x0079754C) = 0xFFD4EE3C
  1015: 11005.290 logMemory:30: MEM(0x00797550) = 0xFFB3C9C8
  1016: 11005.320 logMemory:30: MEM(0x00797554) = 0x00000000
  1017: 11005.365 logMemory:30: MEM(0x00797558) = 0xFFD4F018
  1018: 11005.410 logMemory:30: MEM(0x0079755C) = 0xFFB3C9D4
  1019: 11005.440 logMemory:30: MEM(0x00797560) = 0x00000008
  1020: 11005.471 logMemory:30: MEM(0x00797564) = 0x00000003
  1021: 11005.501 logMemory:30: MEM(0x00797568) = 0x00000001
Title: Re: Canon 40D
Post by: jplxpto on September 16, 2012, 04:37:19 AM
DUMP FROM MEMORY ADDRESS 0x0001E000:
   
MEM(0x0001E000) = 0x00000000 (0)         // unknown parameter
MEM(0x0001E004) = 0x0011C1B0 (1163696)      // VRAM SEMAPHORE (maybe)
MEM(0x0001E008) = 0x0011C18C (1163660)      // maybe another semaphore
MEM(0x0001E00C) = 0x00000000 (0)         // unknown parameter
   
MEM(0x0001E010) = 0x1065BE00 (275103232)   // Vram0 address - (GetVramInformation - arg 0)
MEM(0x0001E014) = 0x000002D0 (720)         // Vram0 width (maybe) - (GetVramInformation - arg 4)
MEM(0x0001E018) = 0x000002D0 (720)         // Vram0 pitch (maybe) - (GetVramInformation - arg 5)
MEM(0x0001E01C) = 0x000000F0 (240)         // Vram0 height (maybe) - (GetVramInformation - arg 6)
MEM(0x0001E020) = 0x00000000 (0)         // unknown parameter - (GetVramInformation - arg 1)
   
MEM(0x0001E024) = 0x106F3C8C (275725452)   // Vram1 address - (GetVramInformation - arg 2)
MEM(0x0001E028) = 0x000002D0 (720)         // Vram1 width (maybe)
MEM(0x0001E02C) = 0x000002D0 (720)         // Vram1 pitch (maybe)
MEM(0x0001E030) = 0x000000F0 (240)         // Vram1 height (maybe)
MEM(0x0001E034) = 0x00000002 (2)         // unknown parameter - (GetVramInformation - arg 3)
   
MEM(0x0001E038) = 0x1DBC0064 (498860132) // Some Video memory
MEM(0x0001E03C) = 0x00000798 (1944)         // RAW (w / 2) - SRAW ???
MEM(0x0001E040) = 0x00000798 (1944)         // RAW (w / 2) - SRAW ???
MEM(0x0001E044) = 0x00000510 (1296)         // RAW (h / 2) - SRAW ???
MEM(0x0001E048) = 0x00000798 (1944)         // WorkImageSize - w
MEM(0x0001E04C) = 0x00000510 (1296)         // WorkImageSize - h
   
MEM(0x0001E050) = 0x00000000 (0)
MEM(0x0001E054) = 0x00000000 (0)
MEM(0x0001E058) = 0x00000000 (0)
MEM(0x0001E05C) = 0x00000000 (0)
MEM(0x0001E060) = 0x00000000 (0)
MEM(0x0001E064) = 0x00000000 (0)
MEM(0x0001E068) = 0x00000000 (0)
MEM(0x0001E06C) = 0x00000000 (0)
MEM(0x0001E070) = 0x00000000 (0)
MEM(0x0001E074) = 0x00000000 (0)
MEM(0x0001E078) = 0x00000000 (0)
MEM(0x0001E07C) = 0x00000000 (0)
MEM(0x0001E080) = 0x00000000 (0)
MEM(0x0001E084) = 0x00000000 (0)
   
MEM(0x0001E088) = 0x00484E5C (4738652)
MEM(0x0001E08C) = 0x00400000 (4194304)
MEM(0x0001E090) = 0x00000001 (1)

MEM(0x0001E094) = 0x00000F30 (3888)         // JpegSize - w
MEM(0x0001E098) = 0x00000A20 (2592)         // JpegSize - h

MEM(0x0001E09C) = 0x00001D40 (7488)         // EffectiveSizeOfJpeg - w
MEM(0x0001E0A0) = 0x00001380 (4992)         // EffectiveSizeOfJpeg - h

MEM(0x0001E0A4) = 0x00000000 (0)


MEM(0x0001E0A8) = 0x00000001 (1)   // star of some structure - unknown parameter ???
MEM(0x0001E0AC) = 0x00000000 (0)
MEM(0x0001E0B0) = 0x00000000 (0)

MEM(0x0001E0B4) = 0x1DBC0064 (498860132)        // SetImageWorkMemory - 1
MEM(0x0001E0B8) = 0x1E26F264 (505868900)         // SetImageWorkMemory - 2
MEM(0x0001E0BC) = 0x106F3C8C (275725452)    // Vram1 address

MEM(0x0001E0C0) = 0x00000000 (0)
   
MEM(0x0001E0C4) = 0x00484E5C (4738652)
MEM(0x0001E0C8) = 0x00400000 (4194304)
MEM(0x0001E0CC) = 0x00000000 (0)
MEM(0x0001E0D0) = 0x00000000 (0)

MEM(0x0001E0D4) = 0x00000F30 (3888)         // RAW w
MEM(0x0001E0D8) = 0x00000A20 (2592)         // RAW h

MEM(0x0001E0DC) = 0x000009C0 (2496)         // SetImageWorkMaxPixel - w
MEM(0x0001E0E0) = 0x00000750 (1872)         // SetImageWorkMaxPixel - h

MEM(0x0001E0E4) = 0x00000000 (0)
MEM(0x0001E0E8) = 0x00000000 (0)
MEM(0x0001E0EC) = 0x00000000 (0)
MEM(0x0001E0F0) = 0x00000000 (0)
MEM(0x0001E0F4) = 0x000002D0 (720)
MEM(0x0001E0F8) = 0x000001E0 (480)
MEM(0x0001E0FC) = 0x000002D0 (720)
   
================================================================
   
DUMP FROM MEMORY ADDRESS 0x0001E100:
   
MEM(0x0001E100) = 0x00000000 (0)         // pVramImagePositionX - ImageVramParameter
MEM(0x0001E104) = 0x00000018 (24)         // pVramImagePositionY - ImageVramParameter
MEM(0x0001E108) = 0x000002D0 (720)         // WholeWidth - ImageVramParameter
MEM(0x0001E10C) = 0x000000D8 (216)         // WholeHeigh - ImageVramParameter
MEM(0x0001E110) = 0x0001DC00 (121856)      // Aspect - ImageVramParameter ???
MEM(0x0001E114) = 0x00000000 (0)
MEM(0x0001E118) = 0x00000000 (0)
MEM(0x0001E11C) = 0x00000000 (0)
MEM(0x0001E120) = 0x00000000 (0)
MEM(0x0001E124) = 0x00000000 (0)
MEM(0x0001E128) = 0x00000000 (0)
MEM(0x0001E12C) = 0x00000000 (0)
MEM(0x0001E130) = 0x00000000 (0)
MEM(0x0001E134) = 0x00000000 (0)
MEM(0x0001E138) = 0x00000000 (0)
MEM(0x0001E13C) = 0x00000000 (0)
MEM(0x0001E140) = 0x005E5558 (6182232)
MEM(0x0001E144) = 0x00000000 (0)
MEM(0x0001E148) = 0x0001DB90 (121744)
MEM(0x0001E14C) = 0x00000000 (0)
MEM(0x0001E150) = 0xFF8851E4 (-7843356)
MEM(0x0001E154) = 0x00012D6C (77164)
MEM(0x0001E158) = 0x00000000 (0)
MEM(0x0001E15C) = 0x00000000 (0)
MEM(0x0001E160) = 0xFFCA415C (-3522212)
MEM(0x0001E164) = 0x00000000 (0)
MEM(0x0001E168) = 0x00000000 (0)
MEM(0x0001E16C) = 0x00000000 (0)
MEM(0x0001E170) = 0x00000000 (0)

MEM(0x0001E174) = 0x00000000 (0) // SetVramImageInfo - x
MEM(0x0001E178) = 0x00000018 (24) // SetVramImageInfo - y
MEM(0x0001E17C) = 0x000002D0 (720) // SetVramImageInfo - w
MEM(0x0001E180) = 0x000000D8 (216) // SetVramImageInfo - h

MEM(0x0001E184) = 0x00000000 (0)
MEM(0x0001E188) = 0x00000000 (0)
   
MEM(0x0001E18C) = 0x106F3C8C (275725452)   // Vram1 address
MEM(0x0001E190) = 0x000002D0 (720)
MEM(0x0001E194) = 0x000000F0 (240)
MEM(0x0001E198) = 0x00000000 (0)
MEM(0x0001E19C) = 0x00000018 (24)
MEM(0x0001E1A0) = 0x000002D0 (720)
MEM(0x0001E1A4) = 0x000000D8 (216)
   
MEM(0x0001E1A8) = 0x00000000 (0)
MEM(0x0001E1AC) = 0x00000000 (0)
MEM(0x0001E1B0) = 0x00000000 (0)
MEM(0x0001E1B4) = 0x00000000 (0)
MEM(0x0001E1B8) = 0x00000000 (0)
MEM(0x0001E1BC) = 0x00000000 (0)
MEM(0x0001E1C0) = 0x00000000 (0)
MEM(0x0001E1C4) = 0x00000000 (0)
MEM(0x0001E1C8) = 0x00000000 (0)
MEM(0x0001E1CC) = 0x00000000 (0)
MEM(0x0001E1D0) = 0x00000000 (0)
MEM(0x0001E1D4) = 0x00000000 (0)
MEM(0x0001E1D8) = 0x00000000 (0)
MEM(0x0001E1DC) = 0x00000000 (0)
MEM(0x0001E1E0) = 0x00000000 (0)
MEM(0x0001E1E4) = 0x00000000 (0)
MEM(0x0001E1E8) = 0x00000000 (0)
MEM(0x0001E1EC) = 0x00000000 (0)
MEM(0x0001E1F0) = 0x00000000 (0)
MEM(0x0001E1F4) = 0x00000000 (0)
MEM(0x0001E1F8) = 0x00000000 (0)
MEM(0x0001E1FC) = 0x00000000 (0)
   

Vram0:0x1065BE00
Vram1:0x106F3C8C
Title: Re: Canon 40D
Post by: jplxpto on September 17, 2012, 01:36:51 AM
   698:  3711.532 [GUI] StartPlayMain
   699:  3718.551 [Graphics] CreateSharedBuffer !!!
   700:  3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
   701:  3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200

   702:  3719.292 [Graphics] GuiGraphicsNormalMode (PUB)


ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264


0x1dbc0064 + 0x6af200 = 0x1e26f264

0x6af200 size (maybe)


Maybe YUV422 VRAM - Playback Image
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 01:37:33 AM
I found four 'Vram Instance' strings in memory.
I believe that is the beginning of the structure vram_object.
I think two of them should be cacheable version and the other two uncacheable version.

0x00400B84   
0x00800B84
   
0x10400B84
0x10800B84
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 03:41:21 AM
    I found a service menu on the 40D.
    I ran the function at 0xFF8170D4 and appeared to me an error in the CMOS camera's LCD.

   NSTUB(test_servicemenu_maybe, 0xFF8170D4)  at v1.1.1

   757: 59388.950 [GUI] DlgMnMainTabHeader.c PRESS_MLT_LEFT_BUTTON
   758: 59403.149 [GUI] DlgMnMainPlay1 GOT_TOP_OF_CONTROL
   760: 60043.684 [GUI_E] GUI_Control:60 0x0
   761: 60044.247 [GUI] IDLEHandler SERVICE_MENU
   762: 60044.300 [GUI] SetGUIRequestMode(25)
   763: 60044.324 [GUI] NotifyGUIEvent(1)

---------------------------------------------

ERR    123 123 123 025 032

REL     11709

CMOS  J0369547

---------------------------------------------
Title: Re: Canon 40D
Post by: a1ex on September 19, 2012, 07:38:48 AM
Be careful what you call, some things can do permanent damage.
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 11:33:29 AM
Thank you Alex. I'll be careful. I am aware that there is dangerous.
Title: Re: Canon 40D
Post by: nanomad on September 19, 2012, 12:39:53 PM
no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them
Title: Re: Canon 40D
Post by: a1ex on September 19, 2012, 01:00:23 PM
For a first port, take a look at 7D changeset, once you find the stubs it's probably a good starting point.
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 01:07:30 PM
Ok, i'll do that...

Thank you
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 11:05:19 PM
no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them

I appreciate your advice. I've been through some of these stubs and thought the same.

I hope not to make any serious mistake ... I really want to have the ML in my precious camera.

Thank you
Title: Re: Canon 40D
Post by: jplxpto on September 20, 2012, 01:18:51 AM
40D v 1.1.1 - StateObjects List

Code: [Select]
NSTUB(0x62B4, DpImgEditState);
NSTUB(0x5D88, DpState);
NSTUB(0x7E38, TOMState);

//NSTUB(, USBC20State_1);
//NSTUB(, USBC20State_2);
//NSTUB(, USBC20State_3);
//NSTUB(, USBC20State_4);

NSTUB(0x7E60, CeresStateState);
NSTUB(0x1AF60, PtpDpsStateState);
NSTUB(0x1AF64, PtpEvtListAccsSem);
NSTUB(0x1D34, RMTState);

NSTUB(0x7824, FSSState);
//NSTUB(0xB710, PropState);  // maybe
NSTUB(0x7840, RDState);
NSTUB(0x7770, LVCDEVState);
NSTUB(0x7748, LVCAFState);
NSTUB(0x7738, LVCAEState);
NSTUB(0x7628, LVState);
//NSTUB(???, FWState);
//NSTUB(???, FRState);
NSTUB(0x834C, MrkState);
NSTUB(0x781C, FCSState);
NSTUB(0x7E10, SdioTskState);
NSTUB(0x82CC, FMNormalState);
NSTUB(0xEFDC, DMState);
Title: Re: Canon 40D
Post by: jplxpto on September 20, 2012, 02:28:17 AM
Dump from 0x00007600 to 0x00008000, when camera menu is showed and mode equal to M :
Code: [Select]
MEM(0x00007600) = 0xFFB2BDA4 (-5063260)
MEM(0x00007604) = 0xFFB2C4A0 (-5061472)
MEM(0x00007608) = 0x00000000 (0)
MEM(0x0000760C) = 0x00000000 (0)
MEM(0x00007610) = 0x1024F09C (270856348)
MEM(0x00007614) = 0x00000001 (1)
MEM(0x00007618) = 0x10206DC0 (270560704)
MEM(0x0000761C) = 0x10252520 (270869792)
MEM(0x00007620) = 0x10223820 (270678048)
MEM(0x00007624) = 0x007975F4 (7960052)
MEM(0x00007628) = 0x00797940 (7960896)
MEM(0x0000762C) = 0x00000000 (0)
MEM(0x00007630) = 0xC0F03030 (-1058000848)
MEM(0x00007634) = 0x80010000 (-2147418112)
MEM(0x00007638) = 0xC0F03068 (-1058000792)
MEM(0x0000763C) = 0x80010004 (-2147418108)
MEM(0x00007640) = 0xC0F03070 (-1058000784)
MEM(0x00007644) = 0x80010007 (-2147418105)
MEM(0x00007648) = 0xC0F0B008 (-1057968120)
MEM(0x0000764C) = 0x00000000 (0)
MEM(0x00007650) = 0xFFFFFFFF (-1)
MEM(0x00007654) = 0xFFFFFFFF (-1)
MEM(0x00007658) = 0xC0F03044 (-1058000828)
MEM(0x0000765C) = 0x00000002 (2)
MEM(0x00007660) = 0xC0F03044 (-1058000828)
MEM(0x00007664) = 0x00000000 (0)
MEM(0x00007668) = 0xC0F0B000 (-1057968128)
MEM(0x0000766C) = 0x00000000 (0)
MEM(0x00007670) = 0xC0F0B004 (-1057968124)
MEM(0x00007674) = 0x00000001 (1)
MEM(0x00007678) = 0xC0F09000 (-1057976320)
MEM(0x0000767C) = 0x00000001 (1)
MEM(0x00007680) = 0xFFFFFFFF (-1)
MEM(0x00007684) = 0xFFFFFFFF (-1)
MEM(0x00007688) = 0xC0F09000 (-1057976320)
MEM(0x0000768C) = 0x80000000 (-
MEM(0x00007690) = 0xC0F0B000 (-1057968128)
MEM(0x00007694) = 0x00000001 (1)
MEM(0x00007698) = 0xC0F0B004 (-1057968124)
MEM(0x0000769C) = 0x00000000 (0)
MEM(0x000076A0) = 0xFFFFFFFF (-1)
MEM(0x000076A4) = 0xFFFFFFFF (-1)
MEM(0x000076A8) = 0xC0F03030 (-1058000848)
MEM(0x000076AC) = 0x00000000 (0)
MEM(0x000076B0) = 0xC0F03068 (-1058000792)
MEM(0x000076B4) = 0x00000000 (0)
MEM(0x000076B8) = 0xC0F03070 (-1058000784)
MEM(0x000076BC) = 0x00000000 (0)
MEM(0x000076C0) = 0xFFFFFFFF (-1)
MEM(0x000076C4) = 0xFFFFFFFF (-1)
MEM(0x000076C8) = 0xC0F0851C (-1057979108)
MEM(0x000076CC) = 0x00060258 (393816)
MEM(0x000076D0) = 0xC0F08520 (-1057979104)
MEM(0x000076D4) = 0x032C0568 (53216616)
MEM(0x000076D8) = 0xC0F11250 (-1057942960)
MEM(0x000076DC) = 0x00900000 (9437184)
MEM(0x000076E0) = 0xC0F11254 (-1057942956)
MEM(0x000076E4) = 0x028F02FF (42926847)
MEM(0x000076E8) = 0xFFFFFFFF (-1)
MEM(0x000076EC) = 0xFFFFFFFF (-1)
MEM(0x000076F0) = 0xC0F0851C (-1057979108)
MEM(0x000076F4) = 0x00060258 (393816)
MEM(0x000076F8) = 0xC0F08520 (-1057979104)
MEM(0x000076FC) = 0x032C0568 (53216616)
MEM(0x00007700) = 0xC0F11250 (-1057942960)
MEM(0x00007704) = 0x011000C0 (17825984)
MEM(0x00007708) = 0xC0F11254 (-1057942956)
MEM(0x0000770C) = 0x020F0241 (34538049)
MEM(0x00007710) = 0xFFFFFFFF (-1)
MEM(0x00007714) = 0xFFFFFFFF (-1)
MEM(0x00007718) = 0x00000000 (0)
MEM(0x0000771C) = 0x00000006 (6)
MEM(0x00007720) = 0xFFB38304 (-5012732)
MEM(0x00007724) = 0x00000000 (0)
MEM(0x00007728) = 0x00796F74 (7958388)
MEM(0x0000772C) = 0x00000000 (0)
MEM(0x00007730) = 0x00000000 (0)
MEM(0x00007734) = 0x00000000 (0)
MEM(0x00007738) = 0x00796FB4 (7958452)
MEM(0x0000773C) = 0x00000000 (0)
MEM(0x00007740) = 0x007973EC (7959532)
MEM(0x00007744) = 0x10202438 (270541880)
MEM(0x00007748) = 0x0079742C (7959596)
MEM(0x0000774C) = 0x00000000 (0)
MEM(0x00007750) = 0x00000000 (0)
MEM(0x00007754) = 0x0079750C (7959820)
MEM(0x00007758) = 0x00000000 (0)
MEM(0x0000775C) = 0x00000005 (5)
MEM(0x00007760) = 0x00000000 (0)
MEM(0x00007764) = 0x00000000 (0)
MEM(0x00007768) = 0x00000000 (0)
MEM(0x0000776C) = 0x00000000 (0)
MEM(0x00007770) = 0x0079754C (7959884)
MEM(0x00007774) = 0x00000000 (0)
MEM(0x00007778) = 0x00010339 (66361)
MEM(0x0000777C) = 0xFFFF0000 (-65536)
MEM(0x00007780) = 0x00040002 (262146)
MEM(0x00007784) = 0x00080004 (524292)
MEM(0x00007788) = 0x009000A4 (9437348)
MEM(0x0000778C) = 0x00200010 (2097168)
MEM(0x00007790) = 0x00FA0020 (16384032)
MEM(0x00007794) = 0x0015FF06 (1441542)
MEM(0x00007798) = 0xFFE80000 (-1572864)
MEM(0x0000779C) = 0x00100040 (1048640)
MEM(0x000077A0) = 0x0018000E (1572878)
MEM(0x000077A4) = 0x00480078 (4718712)
MEM(0x000077A8) = 0x00000010 (16)
MEM(0x000077AC) = 0x00000098 (152)
MEM(0x000077B0) = 0x00000060 (96)
MEM(0x000077B4) = 0x00000088 (136)
MEM(0x000077B8) = 0x0000006F (111)
MEM(0x000077BC) = 0x00000048 (72)
MEM(0x000077C0) = 0x00000058 (88)
MEM(0x000077C4) = 0x00000056 (86)
MEM(0x000077C8) = 0x00000100 (256)
MEM(0x000077CC) = 0x00000080 (128)
MEM(0x000077D0) = 0x00000000 (0)
MEM(0x000077D4) = 0x00000000 (0)
MEM(0x000077D8) = 0x00000000 (0)
MEM(0x000077DC) = 0x00000000 (0)
MEM(0x000077E0) = 0x00000000 (0)
MEM(0x000077E4) = 0x00000000 (0)
MEM(0x000077E8) = 0x00000000 (0)
MEM(0x000077EC) = 0x00000001 (1)
MEM(0x000077F0) = 0x00000000 (0)
MEM(0x000077F4) = 0x00000000 (0)
MEM(0x000077F8) = 0x00000004 (4)
MEM(0x000077FC) = 0x00000000 (0)


Code: [Select]
MEM(0x00007648) = 0xC0F0B008 (-1057968120)
Title: Re: Canon 40D
Post by: jplxpto on September 20, 2012, 04:15:34 AM
Sounds good.

Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.

Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.

        These are the values ​​I got ...

   EDMAC Registers (maybe)
Code: [Select]
MEM(0xC0F04008) = 0x3FBFFFF6
MEM(0xC0F04108) = 0x3695B69E
MEM(0xC0F04208) = 0x3F802DFC
MEM(0xC0F04308) = 0x1BB044CA
MEM(0xC0F04408) = 0x3E04583E
MEM(0xC0F04508) = 0x3A91B07C
MEM(0xC0F04608) = 0x1EA3FFCC
MEM(0xC0F04708) = 0x00000000
MEM(0xC0F04808) = 0x3A6F3EDE
MEM(0xC0F04908) = 0x3F20DE9E
MEM(0xC0F04A08) = 0x3D701EFE
MEM(0xC0F04B08) = 0x194F3D52
MEM(0xC0F04C08) = 0x34794AD6
MEM(0xC0F04D08) = 0x2A674EDE
MEM(0xC0F04E08) = 0x00000000
MEM(0xC0F04F08) = 0x00000000


at 0xFFCF8184 : MOV     R3, 0xC0F04008

Code: [Select]
NSTUB(0xFFCF8184, GetEDmacAddress)
Title: Re: Canon 40D
Post by: a1ex on September 20, 2012, 08:35:01 AM
Doesn't look like anything known, so it's probably not edmac.
Title: Re: Canon 40D
Post by: jplxpto on September 20, 2012, 12:27:58 PM
I also did not like the results.
Title: Re: Canon 40D
Post by: jplxpto on September 21, 2012, 02:25:14 AM
I found several LV functions that are registered, so they can be invoked by name.

FW v 1.1.1

Code: [Select]
NSTUB(0xFFB2E208, lv_start)
NSTUB(0xFFB2E244, lv_stop)

NSTUB(0xFFB2E280, lv_vram_dump)
NSTUB(0xFFB2E308, lv_yuv_dump)
NSTUB(0xFFB2E38C, lv_fps)

NSTUB(0xFFB2E3FC, lv_psave_on)
NSTUB(0xFFB2E46C, lv_psave_off)

NSTUB(0xFFB2DB54, lv_debug_ae)
NSTUB(0xFFB2DCF4, lv_debug_wb)
NSTUB(0xFFB2E4DC, lv_debug_af)

NSTUB(0xFFB2E5F8, lv_ae)
NSTUB(0xFFB2E668, lv_wb)
NSTUB(0xFFB2E6D8, lv_af_raw)

NSTUB(0xFFB2E748, lv_debug_flag)

NSTUB(0xFFB2E588, lv_data_count)

NSTUB(0xFFB2E82C, lv_eshutter)
NSTUB(0xFFB2E97C, lv_tvaf_start)
NSTUB(0xFFB2E89C, lv_magnify)

NSTUB(0xFFB2E90C, lv_save_raw)
Title: Re: Canon 40D
Post by: LensPainter on September 21, 2012, 10:01:58 AM
Hi,
I'm new here and anxious to see the 40D to be used with ML:)
This is very very techy-stuff and hard for me to understand - so I'd just like to know, if there is a lantern at the end of the tunnel;)

Is there any way to support you?

Kind regards

Uwe
Title: Re: Canon 40D
Post by: jplxpto on September 21, 2012, 11:33:17 AM
Hi,
I'm new here and anxious to see the 40D to be used with ML:)
This is very very techy-stuff and hard for me to understand - so I'd just like to know,
if there is a lantern at the end of the tunnel;)

Is there any way to support you?

Kind regards

Uwe


I'm also very anxious to see the ML working for the first time ... and on my camera :)

I am new at this but I'm motivated ... soon I hope to ignite that light ...
for now i just lit the blue and red LED :)

I never received anything for my work, but donations are welcome.
They are the fuel needed to be able to see the light ... My God! :)

Title: Re: Canon 40D
Post by: jplxpto on September 21, 2012, 11:37:48 AM
I found the location of the structure 'vram_info'.

Code: [Select]
/** VRAM info in the BSS.
 *
 * Pixels are in an YUV 422 format.
 * This points to the image VRAM, not the bitmap vram
 */
struct vram_info
{
        uint8_t *               vram;           // off 0x00
        uint32_t                width;          // maybe off 0x04
        uint32_t                pitch;          // maybe off 0x08
        uint32_t                height;         // off 0x0c
        uint32_t                vram_number;    // off 0x10
};
SIZE_CHECK_STRUCT( vram_info, 0x14 );

extern struct vram_info vram_info[2];

Code: [Select]
NSTUB(0x0001E010, vram_info)

 MEM(0x0001E010) = 0x1065BE00 (275103232)
 MEM(0x0001E014) = 0x000002D0 (720)
 MEM(0x0001E018) = 0x000002D0 (720)
 MEM(0x0001E01C) = 0x000000F0 (240)
 MEM(0x0001E020) = 0x00000002 (2)
 
 MEM(0x0001E024) = 0x106F3C8C (275725452)
 MEM(0x0001E028) = 0x000002D0 (720)
 MEM(0x0001E02C) = 0x000002D0 (720)
 MEM(0x0001E030) = 0x000000F0 (240)
 MEM(0x0001E034) = 0x00000000 (0)
Title: Re: Canon 40D
Post by: mediabaron on September 23, 2012, 04:36:05 AM
Having the 40D record video would be excellent. The resolution of 1024 x 680 is plenty for web video.

People do have to realize that the 40D was never intended to shoot video so it doesn't have a microphone or audio circuitry built into it. You will have to capture audio separately or lay down a background track of something like music.

But having the other ML still image features would greatly increase the use of the 40D for things like time-lapse photography and other applications.
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 05:31:55 PM
Having the 40D record video would be excellent. The resolution of 1024 x 680 is plenty for web video.

People do have to realize that the 40D was never intended to shoot video so it doesn't have a microphone or audio circuitry built into it. You will have to capture audio separately or lay down a background track of something like music.

But having the other ML still image features would greatly increase the use of the 40D for things like time-lapse photography and other applications.


I have spent many hours with my camera, but I've done a few shots. I can not say when will release the first version for testing. I believe there are many users around the world who have this camera. I started this project because I feel a little revolted. The canon has never released a version with AF microadjustment. Many of us bought high quality lenses that would greatly benefit from this functionality. We gave billions of profit to Canon. I think they should respect us more and remember living of our money. I know the camera was discontinued but I did not let being a customer paying for a quality service. I may be a drop in the ocean with sharks but many, donald duck got rich collecting small coins. This is my response to the canon. If things go the way I want in a few months you can all enjoy my work without being forced to pay a penny.
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 06:41:38 PM
I found some more interesting things:

Code: [Select]
strings -t x 40d.111.ROMF1.0xFF800000.bin | perl renumber.pl 0xFF800000 > 40d.111.ROMF1.0xFF800000.string

grep 40d.111.ROMF1.0xFF800000.strings -e "Mgr$"

Code: [Select]
ffacff30 DpMgr
ffb04078 DpImgEditMgr
ffb2d10c LiveViewMgr
ffbaee34 TOMgr
ffbc55a0 FileMgr
ffc49060 DDDMgr
ffc877fc PropMgr
ffd17614 CardServiceMgr
ffd4c084 DbgMgr
ffd5a30c PowerMgr


With this simple command is simple filter many of the file names of the source code.
Sometimes it may be useful to help find some things in the dump.

Code: [Select]
grep 40d.111.ROMF1.0xFF800000.strings -e ".*\.c" > 40d.111.ROMF1.0xFF800000.files
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 07:13:01 PM
Some memory address at firmware:

Code: [Select]
ffff1c6c Write Address : 0x00000000
ffff1c8c Write Address : 0x04000000
ffff2714 4.Erase TORNADO and Command area (0x%x -> 0x%x)
ffff2748 5.Erase Program area (0xF8010000 -> 0xF862FFFF)
ffff3578 Is flg written(Y=ON(0xFFFFFFFF)/N=OFF(0x00000000))? :
ffff3608 Is flg written(Y=ON(0x00000000)/N=OFF(0xFFFFFFFF))? :
ffff3774 ERASE [ROM1][0x00000000]
ffff39e4 Input start_address (ram 0x00000000 -> 0x40000000) :
ffff3a1c Input end_address   (ram 0x00000000 -> 0x40000000) :
ffff3a54 Input address       (rom 0xf8000000 -> 0xf87FE000) :
ffff5914 FROM Check Sum is 0x%08x
ffff5930 ( 0xF8010000 - 0xF85FFFFF )
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 07:27:06 PM


grep 40d.111.ROMF1.0xFF800000.strings -e ".*[GUI].*StartMn" | awk -F' ' '{ print $3 }' | sort | uniq -u

Code: [Select]
StartMnActiveSweepApp
StartMnActiveSweepAutoApp
StartMnBrightnessApp
StartMnBusyApp
StartMnBusyKeepEventBtnApp()
StartMnCameraClearApp
StartMnCameraRegApp
StartMnCameraRegConfirmApp
StartMnCameraUnRegApp
StartMnCameraUnRegConfirmApp
StartMnCameraUnRegSelectApp
StartMnCardExtensionApp
StartMnCardFormatBeginAp
StartMnCardFormatexcuteApp
StartMnCopyBusyApp()
StartMnCopyConfirmApp
StartMnCopyMsgApp(
StartMnCopyResultApp(
StartMnCustomFnApp(%d)(%d)
StartMnCustomFnClearApp
StartMnDustOffDataApp
StartMnDustOffDataCompleteApp
StartMnDustOffDataExcuteApp
StartMnEraseImageApp
StartMnEraseImageBusyApp
StartMnEraseImageConfirmApp
StartMnEraseImageDummyApp
StartMnHandWorkSweepApp
StartMnImageZoneQualityApp
StartMnLanguageApp
StartMnLiveViewApp
StartMnMainCustomFuncApp()
StartMnMainMyMenuApp()
StartMnMainPlay1App()
StartMnMainPlay2App()
StartMnMainRec1App()
StartMnMainRec2App()
StartMnMainSetup1App()
StartMnMainSetup2App()
StartMnMainSetup3App()
StartMnMainStudioApp()
StartMnMmMessageApp(
StartMnMwbImageConfirmApp
StartMnMWBWarningApp
StartMnMyMenuDeleteApp()
StartMnMyMenuPreRearrange(
StartMnMyMenuRearrange(
StartMnMyMenuSelect()
StartMnMyMenuSetting()
StartMnPictureStyleDetailApp
StartMnPictureStyleMain
StartMnPictureUserDetail
StartMnQualityApp
StartMnQualityDivideApp
StartMnQualityDivideSelectApp
StartMnSensorCleanApp
StartMnStroboBuiltInSettingApp
StartMnStroboControlApp
StartMnStroboCustomFnApp
StartMnStroboCustomFnClearApp
StartMnStroboErrorApp
StartMnStroboFnSettingApp
StartMnStroboFnSettingClearApp
StartMnStroboFnSettingHeaderApp()
StartMnStroboOldOutSettingApp
StartMnStroboWirelessApp
StartMnStudioModeChangeConfirmApp
StartMnWBApp
StartMnWbBktApp

With this command we can get the list of menus available in firmware. This command can be useful for finding the code some functionality that is available in the original firmware.
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 07:59:18 PM
Some more strings...

Code: [Select]
grep -e "libc" 40d.111.ROMF1.0xFF800000.strings
Code: [Select]
ffcb9150 ../libcsvg/svg_canvas.c
ffcbd930 gfff../libcsvg/svg_paint.c
ffcbe118 ../libcsvg/svg_render.c
ffcbeb48 ../libcsvg/dom/dom.c
ffcbfc5c ../libcsvg/dom/dom_common.c
ffcc22e4 ../libcsvg/dom/dom_trait.c
ffcc629c ../libcsvg/core/attrib_core.c
ffcc6a88 ../libcsvg/core/attrib_graphics.c
ffcc733c ../libcsvg/core/attrib_paint.c
ffcca84c ../libcsvg/core/elem_anim.c
ffcd3138 ../libcsvg/core/elem_path.c
ffcd5b54 ../libcsvg/core/elem_shape.c
ffcd8354 ../libcsvg/core/elem_struct.c
ffcda5fc ../libcsvg/core/render_path.c
ffcdb054 ../libcsvg/core/render_shape.c
ffcdda64 ../libcsvg/core/stack_canvas.c
ffcddba4 ../libcsvg/core/stack_common.c
ffcddd38 ../libcsvg/core/stack_coordinate.c
ffcddedc ../libcsvg/core/stack_core.c
ffcde000 ../libcsvg/core/stack_element.c
ffcdebf8 ../libcsvg/core/stack_transform.c
ffce0f44 ../libcsvg/common/hash.c
ffce1274 ../libcsvg/common/id_table.c
ffce15b0 ../libcsvg/common/queue.c
ffce3a1c ../libcsvg/common/utils.c
ffce5bd8 ../libcucs/ucs.c
ffce9b34 ../libcsvg/common/uriref.c
ffcea324 ../libcsvg/svg_path.c
ffcef4e0 ../libcsvg/core/attrib_animtiming.c
ffcf09f4 ../libcsvg/core/datatype_preserveaspectratio.c
ffcf1568 ../libcsvg/core/render_anim.c
Title: Re: Canon 40D
Post by: a1ex on September 23, 2012, 08:05:33 PM
Those Start***App sometimes can be started, but it's not a clean method for using them IMO. These calls may bring the correct dialog, but they do not setup the keys (guimode) and probably other things.

There is a SVG library inside, but nobody figured out how to use it.
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 10:08:54 PM
I keep looking for the addresses of VRAM ... My next goal is to write on the LCD.

Unfortunately I have not got great results ... soon, I hope to get this my goal.

I know there are many similarities between the 5DC and 40D cameras.
So I decided to look some things coutts already found in your 5DC.



from magic lantern source code...

Code: [Select]
/** Canon data structure containing BMP VRAM address.
 *
 * LCD: it points to a 720x480 cropped area, but the image buffer is actually 960x540.
 * HDMI: it points to the full image buffer.
 *
 * ML alters this pointer to always indicate the 720x480 cropped area
 * (to avoid the possibility of buffer overflow due to race conditions when changing display modes).
 */
struct bmp_vram_info
{
        uint8_t *               vram0;
        uint32_t                off_0x04;
        uint8_t *               vram2;
};

extern struct bmp_vram_info bmp_vram_info[];

from 5DC.111 firmware...

Code: [Select]

NSTUB(0x29448, bmp_vram_info)

MakeName(0xFFB0A95C, "str:[BmpDDev]_SelectParameter");
MakeName(0xFFB0B174, "str:[BmpDDev]_DisplayPhysicalScreen");

REAL BMP VRAM  : 0x29320+8 =0x29328

REAL BMP VRAM  : 0x29330+8 =0x29338
REAL BMP VRAM  : 0x29350+8 =0x29358

from 40D.111 firmware...

Code: [Select]
NSTUB(0x1E450, bmp_vram_info)

MakeName(0xFFCAFAE0, "str:[BmpDDev]_SelectParameter");
MakeName(0xFFCB0468, "str:[BmpDDev]_DisplayPhysicalScreen");

REAL BMP VRAM  : 0x1E328+8 = 1E330

REAL BMP VRAM  : 0x1E338+8 = 1E340
REAL BMP VRAM  : 0x1E358+8 = 1E360




Here are some of the logs generated by my tests ...

Code: [Select]
   667: 10003.609 myTaskDumpf:204: [JP] VRAM INFO:
   668: 10003.670 printVramInfo:25: [JP] VRAM_INFO: vram address = 0x1065BE00
   669: 10003.698 printVramInfo:26: [JP] VRAM_INFO: width = 720
   670: 10003.722 printVramInfo:27: [JP] VRAM_INFO: pitch = 720
   671: 10003.746 printVramInfo:28: [JP] VRAM_INFO: height = 240
   672: 10003.767 printVramInfo:29: [JP] VRAM_INFO: vram_number = 0
   673: 10003.806 printVramInfo:25: [JP] VRAM_INFO: vram address = 0x106F3C8C
   674: 10003.830 printVramInfo:26: [JP] VRAM_INFO: width = 720
   675: 10003.853 printVramInfo:27: [JP] VRAM_INFO: pitch = 720
   676: 10003.876 printVramInfo:28: [JP] VRAM_INFO: height = 240
   677: 10003.897 printVramInfo:29: [JP] VRAM_INFO: vram_number = 2
   678: 10003.921 printBmpVramInfo:45: [JP] BMP_VRAM_INFO: i = 0x00
   679: 10003.961 printBmpVramInfo:46: [JP] BMP_VRAM_INFO: vram0 address = 0x10631714
   680: 10003.988 printBmpVramInfo:47: [JP] BMP_VRAM_INFO: off_0x04 address = 0x00000000
   681: 10004.027 printBmpVramInfo:48: [JP] BMP_VRAM_INFO: vram2 address = 0x48544F00

   687: 11143.643 myTaskDumpf:230: [JP] MEM(0x0001E330) = 0x10631714  // vram0 address
   688: 11143.707 myTaskDumpf:231: [JP] MEM(0x0001E340) = 0x10631714  // vram0 address
   689: 11143.741 myTaskDumpf:232: [JP] MEM(0x0001E360) = 0x00000000
   690: 11143.773 myTaskDumpf:234: [JP] MEM(0x0000BEA0) = 0x00000000 // DisplayType
   691: 11143.802 myTaskDumpf:235: [JP] MEM(0x0000BEA4) = 0x00000000 // W x H = 720x240
   692: 11143.832 myTaskDumpf:236: [JP] MEM(0x0000B854) = 0x00000002
Title: Re: Canon 40D
Post by: jplxpto on September 24, 2012, 01:42:59 AM
These stubs are very important for our work so I decided to put them here ... require confirmation ...
I have not tested them all. I have used them to make some memory dumps.

40d v 1.1.1

Code: [Select]
NSTUB(0xFFC39AE4, FIO_RemoveFile)
NSTUB(0xFFD1682C, FIO_OpenFile)
NSTUB(0xFFD168F8, FIO_CreateFile)
NSTUB(0xFFD16A80, FIO_ReadFile)
NSTUB(0xFFD16BF0, FIO_WriteFile)
NSTUB(0xFFD16CA8, FIO_CloseFile)
NSTUB(0xFFD16D5C, FIO_GetFileSize)
NSTUB(0xFFD17244, FIO_GetDeviceName)
NSTUB(0xFFD7A968, FIO_FindNextEx)
Title: Re: Canon 40D
Post by: a1ex on September 24, 2012, 08:40:42 AM
Can you dump around 200K from each VRAM address?

Use the cacheable addresses if you can't (remove the first 1).
Title: Re: Canon 40D
Post by: jplxpto on September 24, 2012, 12:01:31 PM
Can you dump around 200K from each VRAM address?

Use the cacheable addresses if you can't (remove the first 1).

Yes, I will do that ..
Title: Re: Canon 40D
Post by: coutts on September 26, 2012, 08:12:32 PM
Yes, I will do that ..
A simple test to see if you found the vram is to try and paint on the screen, write something like 64kb of 1s to the buffer and you should see a colored square on the screen.

great to see your progress!!
Title: Re: Canon 40D
Post by: jplxpto on September 27, 2012, 12:39:35 AM
A simple test to see if you found the vram is to try and paint on the screen, write something like 64kb of 1s to the buffer and you should see a colored square on the screen.

great to see your progress!!


Cloutts, thank you for this suggestion ... more I had thought about doing something similar but I am afraid to write to memory before I was sure it matches the VRAM.
Title: Re: Canon 40D
Post by: jplxpto on September 27, 2012, 02:05:52 AM
Hi guys

I did some more tests today ...
I finally got the memory address of LV_VRAM.
I made a small application that writes into log file the addresses of LV_VRAM.
I put the camera in LV mode, and every 40ms, I wrote in the log file, the address and size of the LV_VRAM.

I repeated the process twice, and got the following data:

Address : 0x1CA700C8 / Average Size : ??????????

Address : 0x1CEAE304 / Average Size : 0x0003D068


I've also downloaded the JPEG. I had done before but did not know the memory address.

The JPEG has 1024x680 pixels and has a size of 213446 bytes


Some logs...

Code: [Select]
45578: 63053.752 [LVCDEV]->lvcdevResourceGet(0,1)
 45579: 63054.313 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0
 45580: 63057.331 [LV] lvVDInterrupt
 45581: 63057.493 [LV] WB 1926 1135 1135 2454(1158)
 45582: 63059.349 [LV] lvReturnVram
 45583: 63059.379 < GUI Lock > GUILock_PermitPowerLock (PUB)
 45584: 63059.666 < GUI Lock > GUILockTask 1
 45585: 63059.735 [DispCon] TurnOnDisplay (PUB)
 45586: 63061.319 [DEV] LV_JPG YuvWriteCompleteCBR
 45587: 63061.365 [DEV] LV_JPG YUVReadCompleteCBR
 45588: 63061.498 [DEV] LV_JPG JpCoreCompleteCBR( 0x4af66 )
 45589: 63061.558 [DEV] LV_JPG JpegPopCompleteCBR
 45590: 63061.701 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1cabb02e Y411:0x107a0e20
 45591: 63062.313 [LVCDEV]->PD(VF:0x1078d7e8,MS:0x485540)
 45592: 63081.284 [LV] WriteEDmacWbIntegCompleteCBR


 45579: 63054.313 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0
 45590: 63061.701 [DPATH] LV_JPG STOP   Y:0x1df97c64 J:0x1cabb02e  Y411:0x107a0e20
Title: Re: Canon 40D
Post by: jplxpto on September 27, 2012, 06:26:54 AM

I managed to blur the image of the LCD. I now have to know the coordinates valid in order to draw a rectangle.

I used this STUB, and wrote somewhere in vram0.

NSTUB(0x1E450, bmp_vram_info)

In the coming days, I'll want to have a bmp_printf(...) function to write text on the display.

Once you get it, I want to improve the boot process.
Title: Re: Canon 40D
Post by: jplxpto on September 28, 2012, 01:07:44 AM
Some additional information:

http://en.wikipedia.org/wiki/Canon_EOS_40D (http://en.wikipedia.org/wiki/Canon_EOS_40D)
Title: Re: Canon 40D
Post by: coutts on September 28, 2012, 08:49:36 AM
I managed to blur the image of the LCD. I now have to know the coordinates valid in order to draw a rectangle.

I used this STUB, and wrote somewhere in vram0.

NSTUB(0x1E450, bmp_vram_info)

In the coming days, I'll want to have a bmp_printf(...) function to write text on the display.

Once you get it, I want to improve the boot process.

you should start porting ML to the 40d, clone the latest repo and look for CONFIG_5DC, maybe add #define CONFIG_5DC CONFIG_40D and copy the same diretory structure / entry.S of the 5dc. All of the changes for the 5dc in menu.c should be valid for the 40d too.
Title: Re: Canon 40D
Post by: jplxpto on September 28, 2012, 12:16:12 PM
Thanks Coutts ... I'm working on it :)
Title: Re: Canon 40D
Post by: jplxpto on September 30, 2012, 02:15:07 AM
Good news ...

In recent days, me and Alex, we can give a good progress in 40D port.

Finally, we have a "Hello World" working ...

soon I'll post a picture here ...
Title: Re: Canon 40D
Post by: dichterDichter on October 01, 2012, 04:22:18 PM
Awsome. My Camera is still broken and im trying to repair it.
Title: Re: Canon 40D
Post by: imme on October 03, 2012, 07:21:48 AM
Me and many others are silently waiting for Good news
Title: Re: Canon 40D
Post by: jplxpto on October 03, 2012, 11:45:50 AM
With a little time and patience, one day will come true ...

The Coutts and Alex have done an excellent job with 5DC.
I think that much of this work can be useful for the 40D.
Title: Re: Canon 40D
Post by: jplxpto on October 04, 2012, 01:08:11 AM
Some more stubs

40D v1.1.1

Quote

NSTUB(0x1E458, LCD_Palette)
NSTUB(0x1E498, RGB_Palette)
NSTUB(0x1E388, PB_Palette)

NSTUB(0xFFCB0B6C, SetRGBPaletteToDisplayDevice)
NSTUB(0xFF867AA8, ChangeColorPalette)
NSTUB(0xFFCAFA0C, SetParameterToBitmapDisplayDevice)

NSTUB(0xFFCB7EBC, EnableBitmapVBufferForPlayBackAndWaiting)

NSTUB(0xFFCB9078, BmpDDev_give_semaphore);
NSTUB(0xFFCB9028, BmpDDev_take_semaphore);

NSTUB(0xFF8156F8, bindGUISwitchCBR)



Alex... I'm working on it :)
Title: Re: Canon 40D
Post by: jplxpto on October 04, 2012, 03:35:29 AM
Code: [Select]

  3878: 23394.264 [MC] M:1,ID:B(29)
  3879: 23394.303 [BIND] Switch (11, 5)
  3880: 23394.345 [GUI_E] GUI_Control:25 0x0
  3881: 23394.537 [JP] (50/3) my_gui_main_task:85: EVT 246[0]: p=19 *o=0x0/0x0/0x0 a=0
  3884: 23426.474 [JP] (50/3) my_gui_main_task:85: EVT 247[4]: p=0 *o=0x80030014/0x96/0x0 a=0
  3887: 23445.017 [MC] M:1,ID:B(30)
  3888: 23445.059 [BIND] Switch (11, 3)
  3889: 23445.092 [GUI_E] GUI_Control:23 0x0
  3890: 23458.398 [JP] (50/3) my_gui_main_task:85: EVT 248[0]: p=17 *o=0x0/0x0/0x0 a=0
  3893: 23489.950 [GUI] DlgPlayMain.c PRESS_MLT_RIGHT_BUTTON
  3894: 23490.172 [DispCon] SetTempForBackLight Temp 150
  3895: 23490.318 [GUI] DlgPlayMain.c PRESS_MLT_RIGHTUP_BUTTON
  3896: 23495.865 [MC] M:1,ID:B(31)
  3897: 23495.904 [BIND] Switch (11, 2)
  3898: 23495.941 [GUI_E] GUI_Control:22 0x0
  3899: 23496.137 [JP] (50/3) my_gui_main_task:85: EVT 249[0]: p=16 *o=0x0/0x0/0x0 a=0
  3902: 23527.803 [GUI] DlgPlayMain.c PRESS_MLT_UP_BUTTON
  3903: 23546.781 [MC] M:1,ID:B(32)
  3904: 23546.821 [BIND] Switch (11, 4)
  3905: 23546.853 [GUI_E] GUI_Control:24 0x0
  3906: 23547.040 [JP] (50/3) my_gui_main_task:85: EVT 250[0]: p=18 *o=0x0/0x0/0x0 a=0
  3909: 23578.686 [GUI] DlgPlayMain.c PRESS_MLT_LEFTUP_BUTTON
  3910: 23589.717 [MC] M:1,ID:B(0)
  3911: 23589.753 [BIND] Switch (11, 6)
  3912: 23589.790 [GUI_E] GUI_Control:26 0x0
  3913: 23589.970 [JP] (50/3) my_gui_main_task:85: EVT 251[0]: p=1a *o=0x0/0x0/0x0 a=0
  3916: 23621.610 [GUI] DlgPlayMain.c PRESS_MLT_LEFT_BUTTON
  3917: 23640.641 [MC] M:1,ID:B(1)
  3918: 23640.683 [BIND] Switch (11, 8)
  3919: 23640.721 [GUI_E] GUI_Control:28 0x0
  3920: 23640.907 [JP] (50/3) my_gui_main_task:85: EVT 252[0]: p=1c *o=0x0/0x0/0x0 a=0
  3923: 23672.516 [GUI] DlgPlayMain.c PRESS_MLT_LEFTDOWN_BUTTON
  3924: 23691.575 [MC] M:1,ID:B(2)
  3925: 23691.617 [BIND] Switch (11, 9)
  3926: 23691.655 [GUI_E] GUI_Control:29 0x0
  3927: 23691.839 [JP] (50/3) my_gui_main_task:85: EVT 253[0]: p=1d *o=0x0/0x0/0x0 a=0
  3930: 23723.499 [GUI] DlgPlayMain.c PRESS_MLT_DOWN_BUTTON
  3931: 23793.658 [MC] M:1,ID:B(3)
  3932: 23793.698 [BIND] Switch (11, 5)
  3933: 23793.737 [GUI_E] GUI_Control:25 0x0
  3934: 23793.937 [JP] (50/3) my_gui_main_task:85: EVT 254[0]: p=19 *o=0x0/0x0/0x0 a=0
  3937: 23825.534 [GUI] DlgPlayMain.c PRESS_MLT_RIGHT_BUTTON
  3938: 23844.343 [MC] M:1,ID:B(4)
  3939: 23844.384 [BIND] Switch (11, 3)
  3940: 23844.420 [GUI_E] GUI_Control:23 0x0
  3941: 23844.610 [JP] (50/3) my_gui_main_task:85: EVT 255[0]: p=17 *o=0x0/0x0/0x0 a=0
  3944: 23876.253 [GUI] DlgPlayMain.c PRESS_MLT_RIGHTUP_BUTTON
  3945: 23895.276 [MC] M:1,ID:B(5)
  3946: 23895.315 [BIND] Switch (11, 0)
  3947: 23895.350 [GUI_E] GUI_Control:21 0x0
  3948: 23895.543 [JP] (50/3) my_gui_main_task:85: EVT 256[0]: p=15 *o=0x0/0x0/0x0 a=0
  3951: 23945.275 [MC] M:1,ID:B(6)
  3952: 23945.317 [BIND] Switch (11, 6)
  3953: 23945.354 [GUI_E] GUI_Control:26 0x0
  3954: 23945.559 [JP] (50/3) my_gui_main_task:85: EVT 257[0]: p=1a *o=0x0/0x0/0x0 EVT 257 a=0
  3957: 23977.234 [GUI] DlgPlayMain.c PRESS_MLT_LEFT_BUTTON

Title: Re: Canon 40D
Post by: nanomad on October 04, 2012, 09:22:14 PM
Do you have a fork with your 40D work on bitbucket? I'd like to "follow" it
Title: Re: Canon 40D
Post by: jplxpto on October 04, 2012, 11:53:12 PM
Do you have a fork with your 40D work on bitbucket? I'd like to "follow" it


Nanomad.  I haven't shared my code in this repository.
I sent my initial developments to Alex's email.
After that, he then began to integrate it into the ML.
We've been working together a few hours.
I loved working with him on this project, but we had little time.

Right now, I have a problem displaying the menus on the LCD.
I suspect there is a problem of any competition in memory access, calculations wrong, wrong resolutions or access buffers that were allocated dynamically and are already invalid.

Yes, I am thinking to create a repository on bitbucket

I also hope to have their precious help ;)

BR
Title: Re: Canon 40D
Post by: jplxpto on October 05, 2012, 02:05:30 AM
Hi guys

My 40D camera now say :

"Magic Lantern is up and running...3 tasks started."


... but has serious problems on the LCD. I still can not see the menu of ML :(
I can only see messages like "Hello World!" and sometimes appears at the top of the image a green rectangle,
a little blurred with pixels of other colors. I think is the menu! And sometimes the entire screen flashes.
It seems that, we switch the color palette. This is something very strange happens.

I'll have to ask someone for help ... I still can not fully understand the code of VRAM.
We should be using buffers invalid or the wrong dimensions. If I can I do some tests for next week

Guys? Someone can help me on this? ... Maybe you Alex ... ;)
Thank you in advance!

I'll keep you updated with the latest news ...
Title: Re: Canon 40D
Post by: jplxpto on October 05, 2012, 02:10:25 AM
I identified some errors ...

Code: [Select]

   618:  1078.659 [JP] (50/3) read_entire_file:889: File 'A:/ML/DATA/FONTS.DAT' size 32744 by
   619:  1091.459 [FR] readsize = 0x20000
   620:  1110.717 [FR] readsize = 0x20000
   621:  1124.497 [FR] readsize = 0x20000
   622:  1141.060 [FR] readsize = 0x20000
   623:  1155.195 [FR] readsize = 0x20000
   624:  1172.910 [FR] readsize = 0x1f000
   625:  1187.773 [FR] A:/DCIM/100CANON/IMG_1685.JPG read done (8288KB/S)
   626:  1187.961 [GUI] SetPlInfoPLAYMode(100_1685)
   627:  1188.080 [IMP] (PUB) SetDpRotationAngle 2845(0)
   628:  1188.119 [IMP] (PUB) SetColorConvertTable 2832( 0x0 )
   629:  1188.137 [Graphics] GuiDrawOneImage (PUB)
   630:  1188.180 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
   631:  1188.208 [IMP] (PUB) SyncroClearImagePlayVram 2569
   632:  1188.226 [IMP] GetVramNumber 580
   633:  1188.246 [IMP] GetVramNumber 580
   634:  1189.050 <RECTCOLOR> RequestRectangleColor Before Lock
   635:  1189.432 [FW] fwSetUnitSize (0x200000)
   636:  1191.298 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
   637:  1191.367 [IMP] (PUB) SetImageAspect 3683
   638:  1191.451 SetImageVramParameter x:48 y:24 w:340 h:102/* Aspect:976264*/
   639:  1191.489 [IMP] (PUB) SetImageFileParameter 1348
   640:  1191.567 [IMP] (PUB) DrawImageToVram(rot:0 cb:0xFF8851E4) 1393
   641:  1191.593 [IMP] GetJpegInfo 750
   642:  1192.330 <DJP> RequestDecodeJpeg Before Lock
   643:  1214.231 [IMP] SetRotationAngle 616
   644:  1214.264 [IMP] SetVramImageParameter 640
   645:  1214.294 [IMP] GetVramNumber 580
   646:  1215.508 <DJP> RequestDecodeJpeg Before Lock
   647:  1242.982 [JP] (50/3) Calling init_func ../../src/bmp.c (b807f4)
   648:  1247.041 [JP] (50/3) Calling init_func ../../src/font-dyn.c (b82aa8)
   649:  1247.089 [JP] (50/3) Calling init_func debug (b87f68)
   650:  1247.193 [JP] (50/3) Calling init_func ../../src/property.c (b8b020)


   651:  1248.238 [PROPAD] ERROR GetPropertyData ID = 0x0205000E
   652:  1248.373 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0205000E L:874
   653:  1248.839 [JP] (50/3) _prop_handler_PROP_LAST_JOB_STATE:1781: job state: 0
   654:  1249.631 [PROPAD] ERROR GetPropertyData ID = 0x0206001E
   655:  1249.745 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0206001E L:874
   656:  1249.901 [PROPAD] ERROR GetPropertyData ID = 0x0204000D
   657:  1249.983 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0204000D L:874

   658:  1250.579 [JP] (50/3) Calling init_func ../../src/tweaks.c (b8bf38)
   659:  1251.006 [JP] (50/3) Calling init_func lens (b8f1f8)
   660:  1251.151 [JP] (50/3) Calling init_func ../../src/zebra.c (b93e00)
   661:  1251.681 [JP] (50/3) Calling init_func shoot (b9f87c)
   662:  1252.387 [JP] (50/3) Calling init_func ../../src/movtweaks.c (ba7b30)
   663:  1252.554 [JP] (50/3) Calling init_func help_menu (ba8fbc)
   664:  1252.724 [JP] (50/3) Calling init_func ../../src/focus.c (ba97c0)
   665:  1253.079 [JP] (50/3) Calling init_func ../../src/notify_box.c (bab220)

Code: [Select]
  1381:  1791.326 < GUI Lock > GUILock_TurnOnDisplay (PUB)
  1382:  1791.488 < GUI Lock > GUILockTask 1
  1383:  1791.527 [DispCon] TurnOnDisplay (PUB)
  1384:  1791.555 [DispCon] TFT_POWDET Low Wait
  1385:  1792.743 [DispCon] TFT_POWDET Low Wait
  1386:  2262.465 [CFS] Mini Info. (0x1000000e)
  1387:  2262.552 [JP] (50/3) read_entire_file:910: failed
Title: Re: Canon 40D
Post by: jplxpto on October 05, 2012, 02:23:00 AM
The my_gui_main_task seems to be working... ;)

Code: [Select]
  5938: 15903.631 [MC] M:1,ID:E(1)
  5939: 15903.676 [BIND] Switch (14, 1)
  5940: 15903.714 [GUI_E] GUI_Control:1 0x0

  5941: 15903.898 [JP] (50/3) my_gui_main_task:85: EVT 372[0]: p=1
  5942: 15903.942 [JP] (50/3) my_gui_main_task:90: EVT 372 *o=0x0/0x0/0x0
  5943: 15903.973 [JP] (50/3) my_gui_main_task:93: EVT 372 a=0
  5944: 15935.627 [GUI] DlgPlayMain.c ROTATE_ELECTRONIC_SUB_DIAL_RIGHT

  5945: 15935.719 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5946: 15935.804 [FC] _FC_GetDriveObject (1,1)
  5947: 15935.884 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5948: 15935.999 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5949: 15936.053 [FC] _FC_GetDriveObject (1,1)
  5950: 15936.104 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5951: 15936.160 [GUI] ChangeMultiCurrentPositionForMove hOldFile(0x51906950)
  5952: 15936.213 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5953: 15936.253 [FC] _FC_GetDriveObject (1,1)
  5954: 15936.297 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5955: 15936.334 [FC] _FC_GetFirstFileHandle
  5956: 15936.368 [FC] ctgFileGetFirstFileHandle (1, 0, 0, 0)

  5957: 15936.958 [JP] (50/3) my_gui_main_task:85: EVT 373[4]: p=0
  5958: 15937.035 [JP] (50/3) my_gui_main_task:90: EVT 373 *o=0x2050000/0x7f3c2c/0x6c
  5959: 15937.070 [JP] (50/3) my_gui_main_task:93: EVT 373 a=0
  5960: 15968.951 [JP] (50/3) my_gui_main_task:85: EVT 374[4]: p=0
  5961: 15969.028 [JP] (50/3) my_gui_main_task:90: EVT 374 *o=0x2050000/0x7f3d24/0x6c
  5962: 15969.061 [JP] (50/3) my_gui_main_task:93: EVT 374 a=0

  5963: 16000.466 [GUI] GUI_SetFileIndexInDrive(1)
  5964: 16000.993 [JP] (50/3) my_gui_main_task:85: EVT 375[4]: p=0
  5965: 16001.076 [JP] (50/3) my_gui_main_task:90: EVT 375 *o=0x2050000/0x7f3e1c/0x6c
  5966: 16001.115 [JP] (50/3) my_gui_main_task:93: EVT 375 a=0
  5967: 16032.895 [JP] (50/3) my_gui_main_task:85: EVT 376[4]: p=0
  5968: 16032.969 [JP] (50/3) my_gui_main_task:90: EVT 376 *o=0x2050000/0x7f3f14/0x6c
  5969: 16033.003 [JP] (50/3) my_gui_main_task:93: EVT 376 a=0
  5970: 16064.777 [JP] (50/3) my_gui_main_task:85: EVT 377[4]: p=0
  5971: 16064.855 [JP] (50/3) my_gui_main_task:90: EVT 377 *o=0x2050000/0x7f400c/0x6c
  5972: 16064.890 [JP] (50/3) my_gui_main_task:93: EVT 377 a=0
  5973: 16096.291 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)


I think that once the problem of LCD is resolved, we can say that we have the ML running on 40D :)


Be patience, ... we still have much work ahead!

Title: Re: Canon 40D
Post by: samacochan on October 05, 2012, 09:29:09 PM
The my_gui_main_task seems to be working... ;)

Code: [Select]
  5938: 15903.631 [MC] M:1,ID:E(1)
  5939: 15903.676 [BIND] Switch (14, 1)
  5940: 15903.714 [GUI_E] GUI_Control:1 0x0

  5941: 15903.898 [JP] (50/3) my_gui_main_task:85: EVT 372[0]: p=1
  5942: 15903.942 [JP] (50/3) my_gui_main_task:90: EVT 372 *o=0x0/0x0/0x0
  5943: 15903.973 [JP] (50/3) my_gui_main_task:93: EVT 372 a=0
  5944: 15935.627 [GUI] DlgPlayMain.c ROTATE_ELECTRONIC_SUB_DIAL_RIGHT

  5945: 15935.719 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5946: 15935.804 [FC] _FC_GetDriveObject (1,1)
  5947: 15935.884 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5948: 15935.999 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5949: 15936.053 [FC] _FC_GetDriveObject (1,1)
  5950: 15936.104 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5951: 15936.160 [GUI] ChangeMultiCurrentPositionForMove hOldFile(0x51906950)
  5952: 15936.213 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5953: 15936.253 [FC] _FC_GetDriveObject (1,1)
  5954: 15936.297 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5955: 15936.334 [FC] _FC_GetFirstFileHandle
  5956: 15936.368 [FC] ctgFileGetFirstFileHandle (1, 0, 0, 0)

  5957: 15936.958 [JP] (50/3) my_gui_main_task:85: EVT 373[4]: p=0
  5958: 15937.035 [JP] (50/3) my_gui_main_task:90: EVT 373 *o=0x2050000/0x7f3c2c/0x6c
  5959: 15937.070 [JP] (50/3) my_gui_main_task:93: EVT 373 a=0
  5960: 15968.951 [JP] (50/3) my_gui_main_task:85: EVT 374[4]: p=0
  5961: 15969.028 [JP] (50/3) my_gui_main_task:90: EVT 374 *o=0x2050000/0x7f3d24/0x6c
  5962: 15969.061 [JP] (50/3) my_gui_main_task:93: EVT 374 a=0

  5963: 16000.466 [GUI] GUI_SetFileIndexInDrive(1)
  5964: 16000.993 [JP] (50/3) my_gui_main_task:85: EVT 375[4]: p=0
  5965: 16001.076 [JP] (50/3) my_gui_main_task:90: EVT 375 *o=0x2050000/0x7f3e1c/0x6c
  5966: 16001.115 [JP] (50/3) my_gui_main_task:93: EVT 375 a=0
  5967: 16032.895 [JP] (50/3) my_gui_main_task:85: EVT 376[4]: p=0
  5968: 16032.969 [JP] (50/3) my_gui_main_task:90: EVT 376 *o=0x2050000/0x7f3f14/0x6c
  5969: 16033.003 [JP] (50/3) my_gui_main_task:93: EVT 376 a=0
  5970: 16064.777 [JP] (50/3) my_gui_main_task:85: EVT 377[4]: p=0
  5971: 16064.855 [JP] (50/3) my_gui_main_task:90: EVT 377 *o=0x2050000/0x7f400c/0x6c
  5972: 16064.890 [JP] (50/3) my_gui_main_task:93: EVT 377 a=0
  5973: 16096.291 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)


I think that once the problem of LCD is resolved, we can say that we have the ML running on 40D :)


Be patience, ... we still have much work ahead!
Good job. I am waiting.
Title: Re: Canon 40D
Post by: Indy on October 06, 2012, 04:03:28 PM
Jplxpto,

First: impressive progress for your first port!
if you could publish your code (bitbucket fork?) we can better help you...
for example see missing stubs/consts

Indy
Title: Re: Canon 40D
Post by: jplxpto on October 07, 2012, 10:18:49 PM
Jplxpto,

First: impressive progress for your first port!
if you could publish your code (bitbucket fork?) we can better help you...
for example see missing stubs/consts

Indy


Hi Indy

Will I have a great honor to also have your help.
You have given me a fantastic help. I am very grateful to you all.

My current code is all in hudson repository of ML.

For more details we can exchange some PM.

BR
Title: Re: Canon 40D
Post by: jplxpto on October 07, 2012, 11:44:33 PM
Sounds good.

Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.

Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.


I found this :

MEM(0x00007648) = 0xC0F0B008

http://www.magiclantern.fm/forum/index.php?topic=1452.msg12152#msg12152
Title: Re: Canon 40D
Post by: jplxpto on October 08, 2012, 02:04:15 AM
I found three 40D v 1.1.1 fonts:

I used the script find_fnt.py but I changed it a bit.

Code: [Select]
...

print 'Find bitmap fonts in Canon DSLR firmwares'
print 'Arm.Indy. based on work by Pel, Trammel Hudson and A1ex\n'

off = 0
while off < len(m) and off <> -1:
  off = m.find('FNT\0', off)
  if off <> -1:
    val = getShortLE(m, off+4)
    if val==0xffd8 or val==0xffe2               or val==0xffec:
      parseFont(m, off, base)
    off = off + 4
...

Code: [Select]
python ../../../../find_fnt.py 40d.111.ROMF1.0xFF800000.bin 0xFF800000
Code: [Select]
Find bitmap fonts in Canon DSLR firmwares
Arm.Indy. based on work by Pel, Trammel Hudson and A1ex

0xff9ed2e4: FNT
0xff9ed2e8: (+0x04) 0xffec
0xff9ed2ea: (+0x06) font_width = 20
0xff9ed2ec: (+0x08) charmap_offset = 0x24
0xff9ed2f0: (+0x0c) charmap_size = 0x21f0
0xff9ed2f4: (+0x10) bitmap_size = 0x36858
0xff9ed2f8: (+0x14) font name = 'HCanonGothic'
0xff9ed308: (+0x24) char_codes[]. 2172 chars
0xff9ef4f8: (+0x2214) offsets[]. Last offset value = 0x367ea
0xff9f16e8: (+0x4404) bitmaps[]
  0xffa27ed2: (+0x3abee) last bitmap
  +0x00: bitmap width = 36
  +0x02: bitmap height = 36
  +0x04: char width = 36
  +0x06: X offset = 0
  +0x08: Y offset = 0
    bitmap size = 0xb4

0xffa27f40: FNT
0xffa27f44: (+0x04) 0xffe2
0xffa27f46: (+0x06) font_width = 30
0xffa27f48: (+0x08) charmap_offset = 0x24
0xffa27f4c: (+0x0c) charmap_size = 0x170
0xffa27f50: (+0x10) bitmap_size = 0x2eb8
0xffa27f54: (+0x14) font name = 'HCanonGothic'
0xffa27f64: (+0x24) char_codes[]. 92 chars
0xffa280d4: (+0x194) offsets[]. Last offset value = 0x2e36
0xffa28244: (+0x304) bitmaps[]
  0xffa2b07a: (+0x313a) last bitmap
  +0x00: bitmap width = 30
  +0x02: bitmap height = 30
  +0x04: char width = 30
  +0x06: X offset = 0
  +0x08: Y offset = 0
    bitmap size = 0x78

0xffa2b0fc: FNT
0xffa2b100: (+0x04) 0xffe2
0xffa2b102: (+0x06) font_width = 36
0xffa2b104: (+0x08) charmap_offset = 0x24
0xffa2b108: (+0x0c) charmap_size = 0x170
0xffa2b10c: (+0x10) bitmap_size = 0x4448
0xffa2b110: (+0x14) font name = 'HCanonGothic'
0xffa2b120: (+0x24) char_codes[]. 92 chars
0xffa2b290: (+0x194) offsets[]. Last offset value = 0x438a
0xffa2b400: (+0x304) bitmaps[]
  0xffa2f78a: (+0x468e) last bitmap
  +0x00: bitmap width = 36
  +0x02: bitmap height = 36
  +0x04: char width = 36
  +0x06: X offset = 0
  +0x08: Y offset = 0
    bitmap size = 0xb4
Title: Re: Canon 40D
Post by: a1ex on October 08, 2012, 12:06:17 PM
Sounds good.

On 5Dc, ML changes the palette, so it's probably normal. Can you post some screenshots?

You can map the button codes, and once this is done, menu should be usable.
Title: Re: Canon 40D
Post by: Indy on October 09, 2012, 08:23:27 PM
At least someone else is using this script ;-) maybe I should put them on bitbucket...

@jplxpto
your files on bitbucket are one week old and comments are "not tested"
- what is working/not working ?
- what are missing / working stubs and consts values ?

Indy
Title: Re: Canon 40D
Post by: jplxpto on October 09, 2012, 11:06:57 PM
At least someone else is using this script ;-) maybe I should put them on bitbucket...

@jplxpto
your files on bitbucket are one week old and comments are "not tested"
- what is working/not working ?
- what are missing / working stubs and consts values ?

Indy



Indy, you're right files have one week ... in the last days I had little time to work on it.
I was just looking for some stubs and clarify my doubts with other forum members.

Yes I used your script and it was useful to confirm the addresses of fonts.

I have enabled the bootflags and dump the ROM dump.

Last week, me and Alex located the HD & BMP VRAM, but I still do not know the address of the LV VRAM.
I already have some ML threads running but, still could not see any menu. Is there any problem in presenting the image on the LCD.
I should have solved this, but my lack of time and knowledge has not allowed me to resolve this issue.
There is also a problem in the image display on the LCD.
The can.on menus are constantly changing color. The problem must be related to the color palette.
I already found the addresses of color palettes and some stubs used by Alex in 5DC. I did not upload but did post here.



Title: Re: Canon 40D
Post by: jplxpto on October 10, 2012, 02:58:07 AM
Some more stubs

40D v1.1.1

Code: [Select]
NSTUB(0xFFD4F338, TryPostEvent)
NSTUB(0xFFD4F398, TryPostEvent_end)

NSTUB(0xFFD56470, TryPostStageEvent)
NSTUB(0xFFD564FC, TryPostStageEvent_end) // PendStageEvent

NSTUB(0xFFD6A1C8, get_current_task) // 0x22E00
NSTUB(0xFFD69F8C, get_task_info)
NSTUB(0xFFD6B8B0, get_active_task_list)
Title: Re: Canon 40D
Post by: jplxpto on October 10, 2012, 03:45:29 AM
I commented out the calls to the set_ml_palette and set_ml_palette_if_dirty functions and,
now the colors are presented as they were before.

I have not created my repository to share my changes with you, but I hope to do that later this week.

After upgrading my project with the latest version of ML available,
I checked that the code does not compile.
 Some more stubs are needed to 40D. I however able find what was missing.

I'm now using changeset a53eef8d1c7d.

Code: [Select]
NSTUB(0xFFD6A1C8, get_current_task) // 0x22E00
NSTUB(0xFFD69F8C, get_task_info)
NSTUB(0xFFD6B8B0, get_active_task_list)


My next step is to draw a rectangle on the screen to see if I understand what is happening with the VRAM. Later, I'll validate events. The ML is already processing some events but I have to review all the constants.
Title: Re: Canon 40D
Post by: a1ex on October 10, 2012, 07:59:28 AM
For drawing, use bmp_fill and bmp_draw_rect (they both have the same syntax, so rectangles drawn with those two functions should overlap).
Title: Re: Canon 40D
Post by: Indy on October 10, 2012, 04:06:30 PM
jplxpto,

As long as you're a way to progress, it sounds good. That's not easy after all...
How about audio threshold (there is a script for that :-) and stubs ?
maybe I could help here...

Indy
Title: Re: Canon 40D
Post by: jplxpto on October 10, 2012, 11:05:03 PM
For drawing, use bmp_fill and bmp_draw_rect (they both have the same syntax, so rectangles drawn with those two functions should overlap).

Thanks, I'll test it soon ...
Title: Re: Canon 40D
Post by: jplxpto on October 11, 2012, 12:06:24 AM
jplxpto,

As long as you're a way to progress, it sounds good. That's not easy after all...
How about audio threshold (there is a script for that :-) and stubs ?
maybe I could help here...

Indy

"How about audio threshold (there is a script for that :-) " ...

I'm sorry but I did not understand what you mean.
Why tell me in audio?
Title: Re: Canon 40D
Post by: Indy on October 11, 2012, 01:09:39 PM
Dear Jplxpto,

sorry I was not clear.
do you have all audio stubs ? and the address of audio threshold ?

Indy
Title: Re: Canon 40D
Post by: jplxpto on October 11, 2012, 01:14:39 PM
"How about audio threshold (there is a script for that :-) " ...

I'm sorry but I did not understand what you mean.
Why tell me in audio?

Sorry, I also do not explained well
I think the 40D has no audio.
Title: Re: Canon 40D
Post by: a1ex on October 11, 2012, 01:22:31 PM
Well.. the 40D doesn't record video normally, but will do so with Magic Lantern. We already have the ingredients :)
Title: Re: Canon 40D
Post by: jplxpto on October 12, 2012, 05:37:52 AM
Today I had a big scare. I was trying to get all the constants of the buttons and my camera blocked. Moments later I realized that it was not possible to navigate the menus of the canon. Only the icons appeared, but the items were not presented. After a few tries, remove card, remove battery, put battery, remove the lens, place the lens, changes ... so, disconnect, connect, etc, etc ... I was scared but I can resurrect my camera. After a few attempts, I managed to solve the problem because I was able to open the 'My Menu' ... (Mode C1 + Menu  + SET) ... this sequence showed me the items of 'My Menu' and I registered the function that cleans the camera settigns, and I enabled this custom menu. After I accept the changes, the camera is working again normally. It seemed a miracle!!!! Huufff

I have not given up yet, I'll start having more careful ... I'll analyze the firmware to obtain the constants of a safer way. I think the code that writes the LCD acceded to an invalid memory area. I still have problems with the VRAM. Solving this problem is now a top priority.
Title: Re: Canon 40D
Post by: a1ex on October 12, 2012, 07:18:01 AM
There are a few other features that write to RAM (e.g. magic zoom writing on LV buffer, fast zoom in play mode altering the current zoom value, exposure override, SET+MainDial changing the image buffers). Look through consts.h to see how each thing is used - and if you are not sure about that constant, and it's used for writing, don't enable that feature.

For menu, you should start only the two menu-related tasks and some button/event handlers.
Title: Re: Canon 40D
Post by: jplxpto on October 12, 2012, 11:47:26 AM
Hello Alex,

I think almost everything is disabled. How can I check the tasks/features are being launched?

I checked that some of the listed buttons are wrong.
I was trying to solve this problem. I just enabled the hijack of the events and removed the comment from end_gui_...
How can I force automatic presentation of the menu at system startup.

I've done some tests with bmp_fill, bmp_draw_rec, draw_palette.
Soon I will send you a picture with the palette drawn on the LCD.

Thank you
Title: Re: Canon 40D
Post by: a1ex on October 12, 2012, 11:53:18 AM
The source from ML repo only starts 3 tasks (debug, menu, menu_redraw) => it's OK. There are a few features that run from button handlers too (e.g. histogram in playback mode, which you showed me).

To start the menu... give_semaphore(gui_sem).

Edit: if you use the 5DC method for task hijacking (which you probably should, I don't know a better one), leave the gui_init commented (Canon code already did it).
Title: Re: Canon 40D
Post by: jplxpto on October 12, 2012, 12:22:50 PM
Alex, thanks for your clarification.  I'll see it better.
Title: Re: Canon 40D
Post by: jplxpto on October 13, 2012, 04:27:29 PM

Finally I had a little time to create my repository ...

https://bitbucket.org/jplxpto/magic-lantern
Title: Re: Canon 40D
Post by: jplxpto on October 13, 2012, 10:13:28 PM
Some more constants (gui.h)

Code: [Select]
#define BGMT_WHEEL_UP   0x00  
#define BGMT_WHEEL_DOWN 0x01
#define BGMT_WHEEL_LEFT               0x02
#define BGMT_WHEEL_RIGHT              0x03
#define BGMT_PRESS_SET                0x04

#define BGMT_MENU                     0x05
#define BGMT_INFO                     0x06
#define BGMT_JUMP                     0x07
#define BGMT_PLAY                     0x08
#define BGMT_TRASH                    0x09

#define BGMT_PICSTYLE                 0x13

#define BGMT_PRESS_ZOOMIN_MAYBE       0x0a
#define BGMT_UNPRESS_ZOOMIN_MAYBE     0x0b

#define BGMT_PRESS_ZOOMOUT_MAYBE      0x0c
#define BGMT_UNPRESS_ZOOMOUT_MAYBE    0x0d

#define BGMT_PRESS_DIRECT_PRINT       0x0e
//#define BGMT_UNPRESS_DIRECT_PRINT_     0x0f WRONG MAYBE

//~ happens anytime joy stick is unpressed from any position
#define BGMT_UNPRESS_UDLR             0x15
#define BGMT_PRESS_UP                 0x16
#define BGMT_PRESS_UP_RIGHT           0x17
#define BGMT_PRESS_UP_LEFT            0x18
#define BGMT_PRESS_RIGHT              0x19
#define BGMT_PRESS_LEFT               0x1a
#define BGMT_PRESS_DOWN_RIGHT         0x1b
#define BGMT_PRESS_DOWN_LEFT          0x1c
#define BGMT_PRESS_DOWN               0x1d
#define BGMT_PRESS_CENTER             0x1e

// dummy
#define BGMT_PRESS_HALFSHUTTER   0x0b
//#define BGMT_UNPRESS_HALFSHUTTER   -12345

#define BGMT_UNPRESS_SET   -123456789

#define GMT_GUICMD_OPEN_SLOT_COVER   0x28
#define GMT_GUICMD_START_AS_CHECK   -12345678
#define GMT_GUICMD_LOCK_OFF     -12345678

#define BGMT_Q BGMT_PRESS_DIRECT_PRINT
#define BGMT_LV BGMT_JUMP

#define BTN_ZEBRAS_FOR_PLAYBACK BGMT_JUMP

#define GMT_OLC_INFO_CHANGED -12344
Title: Re: Canon 40D
Post by: ilguercio on October 13, 2012, 10:16:18 PM
Same button codes as the 50D.
What about unpress_set though? Does the camera correct the unpress correctly?
Title: Re: Canon 40D
Post by: jplxpto on October 13, 2012, 10:17:35 PM
Same button codes as the 50D.
What about unpress_set though? Does the camera correct the unpress correctly?

Sorry but I still do not know!

Title: Re: Canon 40D
Post by: jplxpto on October 13, 2012, 10:22:56 PM
Hello guys,

I keep working on this project and A1ex has helped me a lot.

Now I'm trying to open the ML menu.

Again ... thanks Alex
Title: Re: Canon 40D
Post by: jplxpto on October 14, 2012, 01:39:21 AM
Hi Guys,

I've got to see the menus of ML. But I still have some problems ... DOUBLE_BUFFERING with 1 not working.
The menus are constantly flashing. The keys work almost all.
Title: Re: Canon 40D
Post by: jplxpto on October 15, 2012, 01:30:21 AM
Hi guys,

After a few hours of work and an excellent help from Alex,
I could finally see the menus of ML. This is a modest contribution but I'm happy.

The port of ML for 40D was not planned and I donated a few hours of my work and
dedication to one day also be a user of this wonderful sofware.

I'm still new to this project and I have a lot to learn but motivated to continue so that one day all
40D owners can also take advantage of ML.

Today, I made ​​my first Pull Requests into hudson repository.

If you are interested can follow my development at:

https://bitbucket.org/jplxpto/magic-lantern (https://bitbucket.org/jplxpto/magic-lantern)
Title: Re: Canon 40D
Post by: ilguercio on October 15, 2012, 01:53:48 AM
Thumbs up and thanks for the effort.
The family is getting bigger as time passes.
:)
Title: Re: Canon 40D
Post by: jplxpto on October 15, 2012, 12:15:15 PM
Thumbs up and thanks for the effort.
The family is getting bigger as time passes.
:)

Thank you!
Title: Re: Canon 40D
Post by: jplxpto on October 16, 2012, 12:23:00 AM

Don't click me! ;)

https://bitbucket.org/jplxpto/magic-lantern/changeset/6c64a92b94bbd81619a6b128c9e2d24d01660bd3 (https://bitbucket.org/jplxpto/magic-lantern/changeset/6c64a92b94bbd81619a6b128c9e2d24d01660bd3)
Title: Re: Canon 40D
Post by: nanomad on October 19, 2012, 12:28:17 AM
Your ptp_register_handler function is correct
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 01:37:18 AM
Your ptp_register_handler function is correct

For me this is a good and bad news ... : (

I can't connect to the camera with --chdk switch and i don´t know why...

I see the logs of the camera again ... perhaps there is some hint

Thank you!!!
Title: Re: Canon 40D
Post by: Faxe on October 19, 2012, 01:30:25 PM
Created account just to state that we are more people that eagerly and happily follow your progression.   ;)
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 02:56:19 PM

I'm happy to know there are more people interested in this project.

I and other developers have been working on this project almost every day.
The Coutts, the Chochin the A1ex, the Nanomad and G3gg0 and Indy have helped me.

Thanks to all of them ...
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 03:00:14 PM
In recent days I and G3gg0 have invested some time trying to change the boot process.
The idea is to do something similar to what has already been done for other cameras.

The G3gg0 have helped me a lot ... it also has many technical skills and is an excellent 'colleague';)

Thank you G3gg0.
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 03:03:59 PM
I've done some testing in order to use PTP to transfer ML for my camera.

To perform the tests sometimes need to constantly insert and remove the card ...
I've done it dozens or hundreds of times.
I want to make this task easier and increase the life of the CF connector of my camera.
Title: Re: Canon 40D
Post by: Faxe on October 19, 2012, 03:15:38 PM
I want to make this task easier and increase the life of the CF connector of my camera.

It isn't easier, but have you thought about an SD to CF converter? I know they exist, but not sure how they would work with ML. http://forums.dpreview.com/forums/post/29819778 (http://forums.dpreview.com/forums/post/29819778) looks a little suspicious in terms of 40D, but that was in 2008... If it worked it would at least remove the strain on your CF connector.
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 07:59:21 PM
It isn't easier, but have you thought about an SD to CF converter? I know they exist, but not sure how they would work with ML. http://forums.dpreview.com/forums/post/29819778 (http://forums.dpreview.com/forums/post/29819778) looks a little suspicious in terms of 40D, but that was in 2008... If it worked it would at least remove the strain on your CF connector.

I'll see that...

Thank you

Title: Re: Canon 40D
Post by: g3gg0 on October 19, 2012, 09:24:28 PM
n/p, you are welcome ;)

check your mail, i sent you a new version.
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 10:56:33 PM
n/p, you are welcome ;)

check your mail, i sent you a new version.

Thank you G3 ...
Title: Re: Canon 40D
Post by: jplxpto on October 20, 2012, 09:59:27 PM
More some stubs for 40d v1.1.1 :

NSTUB(0xFFD427B0, register_interrupt)
NSTUB(0xFFC8DF90, SIO3_ISR)
NSTUB(0xFFC8DEC8, MREQ_ISR)
Title: Re: Canon 40D
Post by: jplxpto on October 21, 2012, 06:01:11 AM
Hello everybody.

I come here today to inform you that I finally able change the boot process in 40D.
Now I use the cache_hacks.

I have to thank once again the A1ex and G3gg0.
They have many skills and have helped me a lot.

If you wish you can see my changes in:
https://bitbucket.org/jplxpto/magic-lantern/changeset/af731ecd17a42f0714f0f9f4d13383ba073a604f (https://bitbucket.org/jplxpto/magic-lantern/changeset/af731ecd17a42f0714f0f9f4d13383ba073a604f)
Title: Re: Canon 40D
Post by: g3gg0 on October 21, 2012, 10:10:54 AM
you got it working? nice, good job!
Title: Re: Canon 40D
Post by: silverfirebird on October 21, 2012, 12:13:00 PM
I own a 40D, and I look forward to seeing this! I also own a Rebel T3i with Magic Lantern installed, and it works great. I'm eager to see what this port has to offer! ;D
Title: Re: Canon 40D
Post by: jplxpto on October 21, 2012, 10:14:24 PM
you got it working? nice, good job!

Without your valuable help I would never have succeeded.

Thank you.
Title: Re: Canon 40D
Post by: Polanin on October 21, 2012, 11:39:27 PM
Hi
I'm just another guy who is keeping fingers crossed for this port.
I have 40D with firmware 1.0.8. (not updated yet) so if any testing on this firmware is needed you can sign me in.
Title: Re: Canon 40D
Post by: jplxpto on October 22, 2012, 01:44:52 AM
Hi
I'm just another guy who is keeping fingers crossed for this port.
I have 40D with firmware 1.0.8. (not updated yet) so if any testing on this firmware is needed you can sign me in.

I'm working with the latest version available ... 1.1.1. I advise you to update the firmware of your camera. see page of the canon ... is simple and fast.
Title: Re: Canon 40D
Post by: nanomad on October 22, 2012, 10:42:53 AM
And, unless I'm mistaken, you can always roll-back to an older fw version
Title: Re: Canon 40D
Post by: jplxpto on October 22, 2012, 12:10:25 PM
And, unless I'm mistaken, you can always roll-back to an older fw version

I already did rollback to version 1.0.8 just to create a dump :)
Title: Re: Canon 40D
Post by: jplxpto on October 23, 2012, 04:18:23 AM
Some more progress ... now with PTP ;)

http://www.magiclantern.fm/forum/index.php?topic=1512.msg16147#msg16147
Title: Re: Canon 40D
Post by: dor1847 on October 26, 2012, 09:44:53 PM
hi, 40D owner here :)

i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..

i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!

i hope to hear some good news soon!

Good Luck :)
Title: Re: Canon 40D
Post by: samacochan on October 27, 2012, 03:48:19 PM
hi, 40D owner here :)

i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..

i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!

i hope to hear some good news soon!

Good Luck :)

A donation will be a good gesture of support.
Title: Re: Canon 40D
Post by: jplxpto on October 27, 2012, 08:18:53 PM
hi, 40D owner here :)

i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..

i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!

i hope to hear some good news soon!

Good Luck :)


Thanks for your eulogy.

My friend, everything in life has its risks. Currently, I just got this camera. If you ever want to try ML in your camera will have to take the risk. They may be very low, but there will always be a risk associated with it.
Title: Re: Canon 40D
Post by: jplxpto on October 27, 2012, 08:22:30 PM
A donation will be a good gesture of support.

I'm perfectly in accordance with your comment.
Title: Re: Canon 40D
Post by: jplxpto on November 02, 2012, 03:55:43 AM
Hi,

My work on this project continues. I've made some progress.

I have been trying to use the PTP and GDB in 40D.

1) With the help of g3gg0 and their fantastic cache hacks I managed to change the boot of the 40D. This may solve some legal problems.

2) I've able register the operations of ML & CHDK but this subject is not yet closed. I still have some unresolved issues.

I've done some tests but still can not debug with GDB. I'm trying the GDB Stubs created by g3gg0. This task is not a priority but soon I hope to get back to doing some tests and be successful.

3) In the last days, I spent some time with the overlays.
I'm trying to use the code developed for 5DC.
With Alex's help I managed to display some overlays in play mode.
Title: Re: Canon 40D
Post by: LensPainter on November 02, 2012, 03:45:06 PM
Hi all,

have you considered to integrate the additional menus of the WFT-E3 and the GPS Menu? Maybe this is disturbing a little bit the ability to read out all the parameters and set the values. The screen flashing because of nulls/values missing??
I think it's the most complicated part of the menu-structure! Lots of menus where you can really get lost...

I could shoot some pics with my iPhone and mail them, if you are interested.

Kind regards

Uwe
Title: Re: Canon 40D
Post by: jplxpto on November 03, 2012, 03:51:29 PM

@LensPainter

Hi,

I just had a chance to answer it now.
I appreciate your suggestion, but I do not know if this is possible.

I do not own any of these devices, so I never saw these menus.
I know they exist because I've seen some strings in the firmware.
I would love to see these photos. I'm waiting ... Thank you.
Title: Re: Canon 40D
Post by: LensPainter on November 05, 2012, 12:11:42 PM
@jplxpto
Hi,

I think I need your email-address - there are 98 pictures so far...

Kind regards

Uwe
Title: Re: Canon 40D
Post by: jplxpto on November 06, 2012, 12:20:50 AM

Thank you!
Title: Re: Canon 40D
Post by: LensPainter on November 06, 2012, 12:36:44 AM
Hi Pedro -  and your welcome - de nada (is that right?)

Hope it helps!

Kind regards

Uwe
Title: Re: Canon 40D
Post by: jplxpto on November 11, 2012, 06:34:02 PM
Some screenshots:

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fi.imgur.com%2FfSV5U.jpg&hash=58d42ad71648de37f3cad3ca462b32b6)

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fi.imgur.com%2FcX2od.jpg&hash=3b3ca1bc19c1e53a941208ee49377e74)

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fi.imgur.com%2F0T3EJ.jpg&hash=aac64259b7d1eb4ef97e70ff651310ff)

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fi.imgur.com%2FNq8le.jpg&hash=ad5a083a42904835dc3919c411fff47b)

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fi.imgur.com%2FM0NeM.jpg&hash=7f85d93b4d6d26aa5aff178ddacb0827)

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fi.imgur.com%2F2AIC3.jpg&hash=86f2435d54dd60b732383dcd6dff6a65)
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 03:12:41 AM
I think, finally found a buffer of LVRAM.
I had seen the address of a memory dumps I made with the help of ptpcam.
With the help of Alex and his img.py file. I can guess the width and height of the image as well as the pitch.
I intercepted the PRINT key event and did two dumps of RAM starting at address 0x10000000 and a size of 256M.

I followed the instructions described on the following page

http://magiclantern.wikia.com/wiki/VRAM/550D

Code: [Select]
ipython

run -i img.py

a = readsampled("./VRAM_01.DAT")

b = readsampled("./VRAM_02.DAT")

d = array(a) - array(b)

d[d != 0] = 1

plot(d); show()

After reviewing the chart and repeat the test a few times, I identified the pitch.

guessed pitch = 2916
width = pitch / 2 = 1458
height = 1458 / (3/2) = 972

With the help of graphic and addresses that I found when I did a dump to address 0x1e000.
I suspected that the address 0x1dbc0064 is an address VRAM.

I subtract the address of the beginning of my dump and got the following value:

0x1dbc0064 - 0x10000000 = 0xdbc0064 = 230424676

Code: [Select]
x = 230424676

gw = 1458
gh = 972
gp = 2916

gx = x + gp * (0)

gs = gp * gh

s = readseg("./VRAM_02.DAT", gx, gs)

imgseq(s, gp)

hex(gx)

In the end I visualized the images generated and to my surprise
I finally had my picture in perfect condition (black and white).
The best picture was the 000-odd.png

Code: [Select]
MEM(0x1e020 + 0x18) = MEM(0x1E038) = 0x1dbc0064
MEM(0x1e0a0 + 0x14) = MEM(0x1E0B4) = 0x1dbc0064

<conn> w 0x1e000 512
0001e000 00000000 0013a2dc 0013a2b8 00000000 10687248 000002d0 000002d0 000000f0
0001e020 00000000 1071f0d4 000002d0 000002d0 000000f0 00000002 1dbc0064 00000798
0001e040 00000798 00000510 00000798 00000510 00000000 00000000 00000000 00000000
0001e060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e080 00000000 00000000 00484e5c 001ee400 00000001 00000f30 00000a20 00001d40
0001e0a0 00001380 00000000 00000001 00000000 00000000 1dbc0064 1e26f264 1071f0d4
0001e0c0 00000000 00484e5c 001ee400 00000000 00000000 00000f30 00000a20 000009c0
0001e0e0 00000750 00000000 00000000 00000000 00000000 000002d0 000001e0 000002d0
0001e100 00000000 00000018 000002d0 000000d8 0001dc00 00000000 00000000 00000000
0001e120 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e140 0080478c 00000000 0001db90 00000000 ff8851e4 00012d6c 00000000 00000000
0001e160 ffca415c 00000000 00000000 00000000 00000000 00000000 00000018 000002d0
0001e180 000000d8 00000000 00000000 1071f0d4 000002d0 000000f0 00000000 00000018
0001e1a0 000002d0 000000d8 00000000 00000000 00000000 00000000 00000000 00000000
0001e1c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e1e0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 03:19:28 AM
(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fi.imgur.com%2Fcsh1y.png&hash=ef6ae6837101389ebad81e193709d428)
Title: Re: Canon 40D
Post by: nexiabass on November 12, 2012, 07:16:31 AM
Wow, really great to see this progress!
Is it possible to extend highiso to 12.800?
What about AF-microadjust?

If this could be added, we could name this cam 45D ^^
Title: Re: Canon 40D
Post by: a1ex on November 12, 2012, 09:44:36 AM
LV buffer is the one used for LiveView display, it's extremely unlikely to have higher resolution than 720x480.

If you alter the data in the LV buffer, the changes should be visible on the display (that's how magic zoom works).

What you found seems to be a buffer used to decode the images in playback (before downsampling it for display), and probably the zoom operations are based on that buffer. It's not used in LiveView (otherwise 40D would be the first Canon dslr that can record 2K). 5Dc has one too.

Check repo.
Title: Re: Canon 40D
Post by: Indy on November 12, 2012, 12:04:25 PM
Hi,

good progress Jplxpto !

maybe by enable debug on these functions we can find LVRAM addresses (offsets in firmware in the 1st column) :
  4a0290 [BmpDDev] CreatePhysicalVram (PUB)
 4a03b4 [BmpDDev] DeletePhysicalVram (PUB)


in 40d 1.1.1 it seems there are function to monitor the MPU=TX19A
  32fa8 MonOpen
  32fb0 MonClose
  32fbc MonRead
  32fc4 MonReadAndGetData
  32fd8 MonWrite
  32fe4 MonCall
  32fec FA_TestMonRead
  32ffc FA_TestMonCall
  3300c FA_TestMonReadAndWrite
  33130 m_hSemaphoreDataComp
  33148 ../MpuMonitor.c


Indy
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 10:32:42 PM
Wow, really great to see this progress!
Is it possible to extend highiso to 12.800?
What about AF-microadjust?

If this could be added, we could name this cam 45D ^^

Welcome to our forum.

Thank you for your nice words.

Remember, we can add great features in ML but still can not transform an old black & white TV to a color TV with a feature like HD and 3D.

For now, I just think support the features that already exist in other cameras, If I ever get that it will be a big win for me :)

When I reach that goal, I hope to have your help to test the result of my work.

BR
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 10:53:49 PM
Hi,

good progress Jplxpto !

maybe by enable debug on these functions we can find LVRAM addresses (offsets in firmware in the 1st column) :
  4a0290 [BmpDDev] CreatePhysicalVram (PUB)
 4a03b4 [BmpDDev] DeletePhysicalVram (PUB)


in 40d 1.1.1 it seems there are function to monitor the MPU=TX19A
  32fa8 MonOpen
  32fb0 MonClose
  32fbc MonRead
  32fc4 MonReadAndGetData
  32fd8 MonWrite
  32fe4 MonCall
  32fec FA_TestMonRead
  32ffc FA_TestMonCall
  3300c FA_TestMonReadAndWrite
  33130 m_hSemaphoreDataComp
  33148 ../MpuMonitor.c


Indy


Hi, Indy.

I hope you're well.

To be honest I had met some of these stubs 'Mon' but I did not know its purpose.
I still do not know what is in them. I no longer have to availability or knowledge to explore these stubs.
Maybe you are one of the people with the capacity to accomplish this task.

I had already looked at the [BmpDDev] CreatePhysicalVram and [BmpDDev] DeletePhysicalVram but
I did not know how to intercept the calls to these functions.
I think I saw something in your post about the 500D or 550D.

I'll follow your suggestion ...

Thank you.

Code: [Select]
NSTUB(0xFF8448B4, FA_TestMonCall)
NSTUB(0xFF8446EC, FA_TestMonReadAndWrite)
NSTUB(0xFF8445AC, FA_TestMonRead)
NSTUB(0xFF844528, MonCall)
NSTUB(0xFF844284, MonClose)
NSTUB(0xFF84425C, MonOpen)
NSTUB(0xFF844354, MonReadAndGetData)
NSTUB(0xFF8442AC, MonRead)
NSTUB(0xFF844480, MonWrite)
NSTUB(0xFFB27438, mon)
NSTUB(0xFF843024, mon_funcs_table)

Code: [Select]
grep -i mon 40d.111.ROMF1.0xFF800000.strings

ffb44014  (Called->MoveFocusLensForPcMon)
ffb44038 Err:MoveFocusLensForPcMon, Unexpected PC_MON_MF_MODE = %d
ffb44074  MoveFocusLensForPcMon LatestStep=%d
ffb46c38 Err:HaveLensError, Mounting MonitorTool
ffb47a28 Err:CalcMovingStepForPcMon, Unexpected Coeff = %d
ffb47a5c Err:CalcMovingStepForPcMon, Result step is over 2bytes
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 11:48:26 PM
Here is the result of my first analysis to function BmpDDev_CreatePhysicalVram.

Code: [Select]
NSTUB(0xFFCB02B4, BmpDDev_CreatePhysicalVram);
Code: [Select]
extern int BmpDDev_CreatePhysicalVram(int *pWidth, int *pHeight, int *pPitch, int **pVRamAddress);

int width;
int height;
int pitch;
int *vRamAddress;

int result;

result = BmpDDev_CreatePhysicalVram(&width, &height, &pitch, &vRamAddres);

result is :
   0 when : The parameters are all valid and was allocated a block of 0x15184 bytes
   3 when :(pWidth == NULL || pHeight == NULL || pPitch == NULL || pVRamAddress == NULL)
   5 when : Could not allocate memory (pVRamAddress != NULL && *pVRamAddress == NULL)

width  is 0x2D0 (720)
height is 0x0F0 (240)
pitch  is 0x2D0 (720)
*pRamAddress is the vram address allocated by DMA a filled with zeros.

block size = 0x15180+4 = 86404 d = 360 * 240 bytes

I think, it takes 4 bits per pixel or 2 pixels per byte...
then the resolution should be: 720 * 240

Code: [Select]
   313:   608.094 [IMP] CreateVram 665
   330:   684.874 [Graphics] GuiClearImage
   331:   684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
   332:   684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
   333:   685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644

I will explore the mechanisms of debug, developed by g3gg0 and try to get the list of function parameters.
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 11:54:35 PM
I think, there is another memory location (temporary?) in memory address 0x1e26f264.

Code: [Select]
0001e0a0 00001380 00000000 00000001 00000000 00000000 1dbc0064 1e26f264 1071f0d4

   698:  3711.532 [GUI] StartPlayMain
   699:  3718.551 [Graphics] CreateSharedBuffer !!!
   700:  3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
   701:  3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200

   702:  3719.292 [Graphics] GuiGraphicsNormalMode (PUB)


ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264



0x1dbc0064 + 0x6af200 = 0x1e26f264

0x6af200 size (maybe)


Seems I actually found two memory locations that I had seen in the past.
ImageWorkMemory 1 & 2. They are YUV 411. W:2496, H:1872 and size: 0x6af200 (>6,68MB)
Title: Re: Canon 40D
Post by: jplxpto on November 13, 2012, 12:27:10 AM
LV buffer is the one used for LiveView display, it's extremely unlikely to have higher resolution than 720x480.

If you alter the data in the LV buffer, the changes should be visible on the display (that's how magic zoom works).

What you found seems to be a buffer used to decode the images in playback (before downsampling it for display), and probably the zoom operations are based on that buffer. It's not used in LiveView (otherwise 40D would be the first Canon dslr that can record 2K). 5Dc has one too.

Check repo.

"otherwise 40D would be the first Canon dslr that can record 2K" ... that would be fantastic, a miracle! :)
Thank you
Title: Re: Canon 40D
Post by: jplxpto on November 13, 2012, 12:34:37 AM
I found these stubs for testing :

Code: [Select]
NSTUB(0xFF83EE50, FA_CaptureTestImage)
NSTUB(0xFF8473B4, FA_CreateTestImage)
NSTUB(0xFF83F1C4, FA_DefectsTestImag)
NSTUB(0xFF847538, FA_DeleteTestImage)
NSTUB(0xFF840880, FA_DetectDefTestImage)
NSTUB(0xFF83FF80, FA_FA_ProjectionTestImage)
NSTUB(0xFF840060, FA_FA_ShadingTestImage)
NSTUB(0xFF84037C, FA_ObIntegTestImage)
NSTUB(0xFF840C78, FA_ShadingTestImageForLV)
NSTUB(0xFF83F084, FA_SubtractTestImage)
NSTUB(0xFF8448B4, FA_TestMonCall)
NSTUB(0xFF8446EC, FA_TestMonReadAndWrite)
NSTUB(0xFF8445AC, FA_TestMonRead)
NSTUB(0xFF84144C, FA_VProjectionTestImage)
NSTUB(0xFF845380, FA_YuvDevelopTestImage)

NSTUB(0xFF8841E4, GuiTestOneImage)

NSTUB(0xFFB64954, LVTest)
Title: Re: Canon 40D
Post by: jplxpto on November 13, 2012, 01:34:23 AM

I checked that there are several functions that use the memory address registered in memory location
MEM(0x1e020 + 0x18) = MEM(0x1E038) = 0x1dbc0064. (SetImageWorkMemory 1)

For example, in the function IMP_PUB_DrawImageToVram the following happens:


FFCA110C : R0=0x1E038
...
FFCA1120 call IMPV_PUB_MakeHDVramFromYuv_FFCA7D48

I think that in this case the address 0x1E038 is the parameter of the function IMPV_PUB_MakeHDVramFromYuv

Code: [Select]
NSTUB(0xFFCA0EE8, IMP_PUB_DrawImageToVram)
NSTUB(0xFFCA7D48, IMPV_PUB_MakeHDVramFromYuv)
Title: Re: Canon 40D
Post by: jplxpto on November 13, 2012, 02:02:11 AM
I think that the memory allocated by BmpDDev_CreatePhysicalVram is stored at (*0x5C00)->off_0x4.
You can see that at FF9B9510 (sub_FF9B944C).

Today, I no longer have time to test ... tests are for another day!
Title: Re: Canon 40D
Post by: nexiabass on November 13, 2012, 06:36:05 AM
When I reach that goal, I hope to have your help to test the result of my work.

For sure :)

I can't wait to see this happen to the good old 40D!
Title: Re: Canon 40D
Post by: jplxpto on November 23, 2012, 02:55:50 AM
Hello people...

I have good news...

As I told you before, I don't have much time to dedicate myself to this project but, 
I have devoted some time to understand code and read some documentation.
I have talked to other ML developers and they have helped me a lot.
They have been fantastic ... I think we have a team motivated, united and well organized.

Yesterday I have dedicated some time to test autofocus patterns (AF POINTS)
I can now choose the focus points.

Title: Re: Canon 40D
Post by: scaricame on November 23, 2012, 10:13:54 AM
Thanks from an Italian fan for the job that is doing, also I possess a canon 40D is I wait for good news!  ;)
Title: Re: Canon 40D
Post by: jplxpto on November 23, 2012, 12:17:05 PM
Thanks from an Italian fan for the job that is doing, also I possess a canon 40D is I wait for good news!  ;)

You're welcome!
Title: Re: Canon 40D
Post by: tanninety on November 25, 2012, 12:05:58 AM
40D owner here. Been eying the T4i for a while. If I could get video out of this 40D (atleast 480p) I'd be holding off getting the T4i for now.

Thanks for the time that's already been put towards this and the efort that's currently being invested.

And thanks jplxpto!
Title: Re: Canon 40D
Post by: jplxpto on November 25, 2012, 03:22:51 AM
40D owner here. Been eying the T4i for a while. If I could get video out of this 40D (atleast 480p) I'd be holding off getting the T4i for now.

Thanks for the time that's already been put towards this and the efort that's currently being invested.

And thanks jplxpto!

The work is advancing slowly ... in the last days were made many changes to the code of ML.
I'm now trying to recover what has been working.
The g3gg0 needed to make changes to the boot process and the camera stopped doing boot.
He is helping me solve this problem.
Title: Re: Canon 40D
Post by: jplxpto on November 29, 2012, 01:49:12 AM
I have to find STUB PtpPropSetUILock.
The Coutts used to unlock the UI when the PTP is connected. I need to do the same.

40d 111

ffb66f7c %s PtpPropSetUILock [%x][%x]

STUB(0xFFB67014, PtpPropSetUILock__maybe);

https://bitbucket.org/hudson/magic-lantern/commits/f85b386a2d61c369050edf490fa324da17794e40
Title: Re: Canon 40D
Post by: jplxpto on December 03, 2012, 02:52:09 AM
Here is the result of my first analysis to function BmpDDev_CreatePhysicalVram.

Code: [Select]
NSTUB(0xFFCB02B4, BmpDDev_CreatePhysicalVram);
Code: [Select]
extern int BmpDDev_CreatePhysicalVram(int *pWidth, int *pHeight, int *pPitch, int **pVRamAddress);

int width;
int height;
int pitch;
int *vRamAddress;

int result;

result = BmpDDev_CreatePhysicalVram(&width, &height, &pitch, &vRamAddres);

result is :
   0 when : The parameters are all valid and was allocated a block of 0x15184 bytes
   3 when :(pWidth == NULL || pHeight == NULL || pPitch == NULL || pVRamAddress == NULL)
   5 when : Could not allocate memory (pVRamAddress != NULL && *pVRamAddress == NULL)

width  is 0x2D0 (720)
height is 0x0F0 (240)
pitch  is 0x2D0 (720)
*pRamAddress is the vram address allocated by DMA a filled with zeros.

block size = 0x15180+4 = 86404 d = 360 * 240 bytes

I think, it takes 4 bits per pixel or 2 pixels per byte...
then the resolution should be: 720 * 240

Code: [Select]
   313:   608.094 [IMP] CreateVram 665
   330:   684.874 [Graphics] GuiClearImage
   331:   684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
   332:   684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
   333:   685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644

I will explore the mechanisms of debug, developed by g3gg0 and try to get the list of function parameters.

I think that the memory allocated by BmpDDev_CreatePhysicalVram is stored at (*0x5C00)->off_0x4.
You can see that at FF9B9510 (sub_FF9B944C).

Today, I no longer have time to test ... tests are for another day!

Code: [Select]
MEM(0x5BF8) = 0xff9b943c
MEM(ff9b943c) = 'Vram Instance' (0x6D617256 0x736E4920 0x636E6174 0x00000065)

Code: [Select]
00005be0 aaaaaa7f bbbbbb7f cccccc7f dddddd7f eeeeee7f ffffff7f ff9b91e4 ff9b943c
00005c00 0065cae4 000002d0 000000f0 00000001 00000001 00000000 006301dc 0062ffcc
00005c20 0065cae4 00671d2c 000002d0 000001e0 00000000 00000000 007c417c 00687104
00005c40 ff9c1918 000ea508 00000007 00000001 00000000 00000000 00000000 00000000
00005c60 ff9c3540 0065bbec 0065bcb0 0065c28c 0065c424 0065c1ec 0065bf0c ff9caf40
00005c80 ff9caf50 ff9caf68 0062e8d8 00000000 ff9ed2bc ffa2f848 ffa913e4 ff9d1368

Code: [Select]
0065cae0 00000038 ff9b943c 000002d0 000002d0 000000f0 10671da4 000ea52c 00000000
0065cb00 00000000 00000000 000002d0 000000f0 0065cad8 00671d20 00015210 22f586fa
0065cb20 50bf205e 0c2f13f7 407d0aff 12fa6ff5 05f758ff 08f70afa 00df0aed 81f92c25
0065cb40 409fe0ff 00fe3dff 01bc04df 027f0d1f 84fe20fc 017db0e5 08fd08cf 22222222

Code: [Select]
MEM(0x5BFC) = 0xff9b943c  ; pointer to 'Vram Instance'

MEM(0x5c00) = 0x0065cae4  ; VRAM Address (maybe)
MEM(0x5c04) = 0x000002d0  ; width (720)
MEM(0x5c08) = 0x000000f0  ; height(240)
MEM(0x5c0C) = 0x00000001  ; ???

MEM(0x5c24) = 0x00671d2c  ; VRAM Address (maybe)
MEM(0x5c28) = 0x000002d0  ; width (720)
MEM(0x5c2c) = 0x000001e0  ; height(480)
MEM(0x5c3f) = 0x00000000  ; ???

MEM(0x0065cae4) = 0xff9b943c  ; pointer to 'Vram Instance'
MEM(0x0065cae8) = 0x000002d0  ; width  (720)
MEM(0x0065caec) = 0x000002d0  ; pitch  (720)
MEM(0x0065caf0) = 0x000000f0  ; height (240)
MEM(0x0065caf4) = 0x1065cb5c  ; ???

MEM(0x00671d2c) = 0xff9b943c  ; pointer to 'Vram Instance'
MEM(0x00671d30) = 0x000002d1  ; width  (721) ???
MEM(0x00671d34) = 0x000002d0  ; pitch  (720)
MEM(0x00671d38) = 0x000000f0  ; height (240)
MEM(0x00671d3C) = 0x10671da4  ; ???

size = 0x15180 bytes ( 720 / 2  * 240 )
Title: Re: Canon 40D
Post by: jplxpto on December 04, 2012, 04:36:24 AM
In search of lost VRAM of 40D111...

Code: [Select]
MEM(ff9b943c) = 'Vram Instance' (0x6D617256 0x736E4920 0x636E6174 0x00000065)
Code: [Select]
hexdump -C DUMP_RAM_0x0_0x100000.bin | grep "3c 94 9b ff"
Code: [Select]
00005bf0  7f ee ee ee 7f ff ff ff  e4 91 9b ff 3c 94 9b ff  |............<...|
000ea4e0  12 00 00 00 02 00 00 00  3c 94 9b ff 01 00 00 00  |........<.......|
000ea530  3c 94 9b ff 01 00 00 00  38 a5 0e 00 38 a5 0e 00  |<.......8...8...|
0065cae0  38 00 00 00 3c 94 9b ff  d0 02 00 00 d0 02 00 00  |8...<...........|
00671d20  10 cb 65 00 58 1d 67 00  38 00 00 00 3c 94 9b ff  |..e.X.g.8...<...|

Code: [Select]
MEM(0x00005BF0) = 0xFF9B943C

MEM(0x000EA4E8) = 0xFF9B943C (LV VRAM 1) maybe
MEM(0x000EA530) = 0xFF9B943C (LV VRAM 2) maybe

MEM(0x0065CAE4) = 0xFF9B943C (BMP VRAM 1) maybe
MEM(0x00671D2C) = 0xFF9B943C (BMP VRAM 2) maybe
Title: Re: Canon 40D
Post by: TTS on December 05, 2012, 12:19:21 AM
I've got 2 x 40D, therefore following this development with a smile :-)
Title: Re: Canon 40D
Post by: jplxpto on December 05, 2012, 02:25:26 AM
I've got 2 x 40D, therefore following this development with a smile :-)

Thank you!

When there is life there is hope ... do not give up.
Sometimes dreams do come true. If not I give you this, others will certainly do it!
Title: Re: Canon 40D
Post by: tanninety on December 08, 2012, 12:44:14 AM
I crossed the T4i off my Christmas list. Still holding on to my 40D :)
Title: Re: Canon 40D
Post by: jplxpto on December 08, 2012, 12:54:10 AM
I crossed the T4i off my Christmas list. Still holding on to my 40D :)

Unfortunately, I've been a little tired and busy with other tasks. Soon I hope to dedicate myself more time to this port. The good news I have to give you is that in principle we have more developers to work with me on this port. We have verified that there are still very users interested in having ML this camera so, you'll spend more time. This of course depends on our available time.
Title: Re: Canon 40D
Post by: RenatoPhoto on December 08, 2012, 01:57:08 AM
Unfortunately I just sold my 40D!  But I root for your success!  Nice work.
Title: Re: Canon 40D
Post by: jplxpto on December 08, 2012, 02:15:15 AM
Unfortunately I just sold my 40D!  But I root for your success!  Nice work.

Thank you and good Christmas
Title: Re: Canon 40D
Post by: moodoki on December 08, 2012, 05:10:15 AM
newbie developer on the block and willing to help, just had my toolchain setup and looking for a place to start :)

I have a 40D and i'm more than willing to help with the porting effort.
Title: Re: Canon 40D
Post by: jplxpto on December 08, 2012, 06:44:22 PM
newbie developer on the block and willing to help, just had my toolchain setup and looking for a place to start :)

I have a 40D and i'm more than willing to help with the porting effort.

You are welcome to our team.

http://www.magiclantern.fm/develop

"
Become developer
Our development capacity is limited. A lot of time goes into bugfixing and working towards a stable version.

If you'd like to help, here are the steps for getting started:

Step 1. Get the source code
hg clone -r unified https://bitbucket.org/hudson/magic-lantern

Step 2. Setup the compiler
http://magiclantern.wikia.com/wiki/Build_instructions/Unified

Step 3. Start hacking
http://magiclantern.wikia.com/wiki/For_Developers
 
If you get stuck, ask here.
"

You can do: make clean; make 40D

There are some methods to launch ML but have not yet been published. You need to activate the bootflag.
I suggest you start with me to spend a few hours reading documentation. And I did that and still did not stop.
You can also look at the source code.

Thou shalt also read:

http://wiki.magiclantern.fm/install

http://wiki.magiclantern.fm/userguide

You should know that you can turn your camera into a brick. We take great care with the development but we are not free from danger.

We CAN NOT be responsible for something bad to happen to your camera.

Good Luck
Title: Re: Canon 40D
Post by: jplxpto on December 08, 2012, 06:50:05 PM
@moodoki

Some more links

http://magiclantern.wikia.com/wiki/Developing_info
http://magiclantern.wikia.com/wiki/Special:AllPages

http://www.magiclantern.fm/forum/index.php?topic=3267.msg20369#msg20369

Title: Re: Canon 40D
Post by: jplxpto on December 09, 2012, 02:12:22 AM

I found a stub with an interesting name (BugDetect).

One of two ... or Canon admits may have bugs in the firmware, or they implemented some functionality to help take pictures of wildlife :)

40d111

NSTUB(0xFFD3E2FC, BugDetect)
Title: Re: Canon 40D
Post by: moodoki on December 09, 2012, 03:41:50 PM
@jplxpto

thanks for all the links:)

got everything setup correctly (hopefully) and managed to build a version and have it run successfully on a borrowed 550D.

Now to get working on 40D..
Title: Re: Canon 40D
Post by: jplxpto on December 09, 2012, 04:09:04 PM
@jplxpto

thanks for all the links:)

got everything setup correctly (hopefully) and managed to build a version and have it run successfully on a borrowed 550D.

Now to get working on 40D..

You have to check if your camera has installed the FIR version 1.1.1

Good Luck
Title: Re: Canon 40D
Post by: mrcornelia on December 10, 2012, 11:34:43 PM
Nice work jplxpto and associates! I'm so happy to see the amazing job you guys have done so far! I'll be following with great interest!! :)
Title: Re: Canon 40D
Post by: Faxe on December 11, 2012, 12:38:05 PM
Keep it up!
As much as I want new features on the 40d I have to admit the largest problem with taking nice shots is the head behind the camera.  ::)
Title: Re: Canon 40D
Post by: jplxpto on December 11, 2012, 02:57:18 PM
Thank you!
Our team likes to know that you value our work and support us. Your words are always welcome lovable.

I'm a little busy but I still work in this port. In recent days I devoted some time to the forum and other matters of our development team. Soon I hope to have time and can get the intervalometer working. I've invested some time in this feature.

It is with pleasure that I announce you that we have another developer in the team.The 0xAF from 400dplus.
He has already started working on the port of 5DC.

There is much in common between the 40D and 5DC.
I will work in partnership with him. He is a good developer and already has much experience in this type of projects.

I hope to soon have the collaboration of Chucho.
He helped me a lot earlier this port. I hope your life, possible to devote a little more to this project.
Title: Re: Canon 40D
Post by: samacochan on December 11, 2012, 07:26:20 PM
Sounds good. Now more developers will be jumping in to explore the world of 40D ML and help to make our dream come true one day. I will not be selling my 40D definitely. I may be able to get $300 for the selling of it but keeping the camera and keep coming back to this thread everyday is like waiting for the birth of my baby and it's a lot of joy and fun.

Thank you guys.
Title: Re: Canon 40D
Post by: jplxpto on December 11, 2012, 10:47:16 PM
Sounds good. Now more developers will be jumping in to explore the world of 40D ML and help to make our dream come true one day. I will not be selling my 40D definitely. I may be able to get $300 for the selling of it but keeping the camera and keep coming back to this thread everyday is like waiting for the birth of my baby and it's a lot of joy and fun.

Thank you guys.

Hi

Thank you for your kind words.

I have the same dream and that is why I have registered in this forum.

I never thought of creating an application to run on my little princess.
I almost killed my little baby, but little by little it grows and and gaining some maturity.

I started this project by insistence.
Everyone told me that this camera has VxWorks and this made it almost impossible one day ML support this equipment.
I've always been hurt by this statement.
I thought ... why my camera need be excluded from this wonderful world that is ML.

I wanted to learn a bit more and one day be able to have ML on my camera that I decided to start learning about ML. Past few days I've registered in the forum I was admitted as a developer for this fantastic team. I'm very grateful, they all welcomed me in the best way. Until today, always helped me whenever I needed. My free time is not much but I have learned a lot. I hope one day give you this happiness. Do not worry, I'm hoping to achieve ... if not me, another member will do it for me. Keep on dreaming ... maybe one day wake up and have a surprise in our forum :)

jp
Title: Re: Canon 40D
Post by: jplxpto on December 12, 2012, 03:27:05 AM
I was examining some stubs that allow register, search and call functions by name.

I already knew them almost all but this time I found one that sounded interesting.
Some time ago I wanted to, at runtime, get the list of all registered functions.
I intend to write code that creates in the memory card, a file (registered_stubs.S) with all stubs registered by name.

I found the stub GetListOfName which I believe to be part of the tasks necessary to accomplish this goal.
When I have an opportunity I will analyze the firmware in more detail the firmware and do some testing.


40D111

Code: [Select]
NSTUB(0xFFD45DE0, GetListOfName)

NSTUB(0xFFD3E320, call);

NSTUB(0xFFD45CB8, FindName)

NSTUB(0xFFD4ECC0, Register_Func_with_Name)
NSTUB(0xFFD3E45C, Register_Func_with_Name_sub_1)
Title: Re: Canon 40D
Post by: jplxpto on December 12, 2012, 03:50:11 AM
As I mentioned in a previous post, I'm trying to put the intervalometer working.
I've been examining the firmware and found some strings that can help me find the STUB that take photos.
I suspect the FA_Release stub is that I need to take pictures.
Once I have the opportunity I will try.

Code: [Select]
NSTUB(0xFF84768C, FA_Release)
Code: [Select]
ff811130 FA_Release
ff83ebc8 FA_Release
ff83ebd4 FA_ClearReleaseModeForLV
ff83ebf0 FA_SetReleaseModeForLV

ff83edec [FA] FA_CaptureTestImage

ff8478fc Remote
ff847a58 this
ff847a60 ../Remote.c
ff847a6c rmtRelease
ff847a78 rmtSaveToPC

ff84c148 RssRemoteReleaseQue
ff84c15c [RSS]FAReleaseExecute:%lx,%lx,%lx
ff84c180 [RSS]rssFAReleaseEnd:%lx

ff84c19c FA_RemoteRelease
ff84c1b0 FA_FinishRemoteRelease
ffb64a38 PtpDpsRmtReleaseEventFlag

The strings rmtRelease and rmtSaveToPC should be used to make the registration by name but i still unknown where on the registration is done. Maybe a solution is to list all the functions that are registered by name at runtime. Maybe.....
Title: Re: Canon 40D
Post by: 0xAF on December 12, 2012, 10:00:28 AM
I was examining some stubs that allow register, search and call functions by name.

In 400d most of these registered (by name) functions are only for eventproc stuff and the internal console (the shell) stuff.
Not all functions are registered there, and I believe that they wont help you.
In 400d there is a list with strings for the functions,
let's say for example "Function1, Function2, Function3, ..."
These strings are pointing to the real functions which are:
eventproc_Function1, eventproc_Function2, eventproc_Function3, ...

So finding this list with pointers, may only help you to name the real functions (if you haven't done it so far).
But if you need to call suck function, you can directly call the eventproc_Function1(), instead of call_function("Function1");
Title: Re: Canon 40D
Post by: jplxpto on December 12, 2012, 11:52:36 AM
In 400d most of these registered (by name) functions are only for eventproc stuff and the internal console (the shell) stuff.
Not all functions are registered there, and I believe that they wont help you.
In 400d there is a list with strings for the functions,
let's say for example "Function1, Function2, Function3, ..."
These strings are pointing to the real functions which are:
eventproc_Function1, eventproc_Function2, eventproc_Function3, ...

So finding this list with pointers, may only help you to name the real functions (if you haven't done it so far).
But if you need to call suck function, you can directly call the eventproc_Function1(), instead of call_function("Function1");

Thank you
Title: Re: Canon 40D
Post by: jplxpto on December 15, 2012, 04:21:16 AM
I used a button to call the stub FA_Release.
I could take pictures inside and outside the LV mode but it always opens and closes the shutter and this should not be proper operation for the intervalometer.
Title: Re: Canon 40D
Post by: 0xAF on December 15, 2012, 02:52:26 PM
I used a button to call the stub FA_Release.
I could take pictures inside and outside the LV mode but it always opens and closes the shutter and this should not be proper operation for the intervalometer.

I'm not sure how it works on LV cameras, but in 400d it is always moving the mirror, even when MLU (Mirror Lock Up) is set. This is expected behavior.
Perhaps what you want to do is not calling the "Release". Which is basically the shutter button press. Perhaps you wanted to take snapshot of the LV screen, but then you wont have the resolution you need ?
Title: Re: Canon 40D
Post by: jplxpto on December 15, 2012, 04:28:26 PM
I'm not sure how it works on LV cameras, but in 400d it is always moving the mirror, even when MLU (Mirror Lock Up) is set. This is expected behavior.
Perhaps what you want to do is not calling the "Release". Which is basically the shutter button press. Perhaps you wanted to take snapshot of the LV screen, but then you wont have the resolution you need ?

You are right. After writing this post I read a bit more and this seems to be the expected behavior.
Title: Re: Canon 40D
Post by: jplxpto on December 16, 2012, 01:32:09 AM
I have news.

After a few days away from development ... I came back to dedicate a few hours to the 40D port.

I managed to carry one more feature. The intervalometer is already working on my 40D.

I still can not decide which will be the new feature, maybe start by getting a list of all properties (or more important).
Title: Re: Canon 40D
Post by: Crowler on December 16, 2012, 04:33:06 PM
Hello jplxpto ! Focus assist will be work in ML for 40D ? I need it very much !
Thank You !
Title: Re: Canon 40D
Post by: jplxpto on December 16, 2012, 07:42:03 PM
Hello jplxpto ! Focus assist will be work in ML for 40D ? I need it very much !
Thank You !

I hope so, but first I'll have to solve some problems with overlays.
Title: Re: Canon 40D
Post by: jplxpto on December 17, 2012, 03:09:54 AM
I'm starting to identify some necessary properties for future functionality.

I've been testing two additional features that seem to be working well:

Expo/Aperture
Expo/Shutter

I will not be already available features because they change the values ​​of properties and can turn the camera on a brick :)
I first got to have more trust in changes.

Once I have some free time, I'll try to change the value of the ISO and the program.

I'll try to provide all the features that are on the menu Expo.

Title: Re: Canon 40D
Post by: jplxpto on December 18, 2012, 01:56:14 AM
Here is a list with the names of the properties. Regular expressions are not my specialty. :)

Code: [Select]
grep ".*[[:space:]]PROP_" 40d.111.ROMF1.0xFF800000.bin.strings | sed -e "s|.*[[:space:]]PROP_|PROP_|g" | sed -e "s|[[:space:]].*$||g" | sed -e "s|[\:\=\[\(].*$||g" | sort | uniq > 40d111_properties.txt

cat 40d111_properties.txt

Code: [Select]
PROP_ABORT
PROP_ACCESS_REMAIN
PROP_ACTIVE_SWEEP_ACTIVATE_CONDITION
PROP_ACTIVE_SWEEP_MODE
PROP_ACTIVE_SWEEP_STATUS
PROP_AEB
PROP_AFPOINT
PROP_AUTO_POWEROFF_TIME
PROP_AUTO_ROTATE
PROP_BATTERY_CHECK
PROP_BATTERY_REPORT
PROP_BEEP
PROP_BODY_ID
PROP_BUILTIN_STROBO_SETTING
PROP_CARD1_CLUSTER_SIZE
PROP_CARD1_EXIST
PROP_CARD1_FILE_NUMBER
PROP_CARD1_FOLDER_NUMBER
PROP_CARD1_FREE_SIZE
PROP_CARD1_IMAGE_FORMAT
PROP_CARD1_IMAGE_QUALITY
PROP_CARD1_IMAGE_SIZE
PROP_CARD1_NEXT_FOLDER_NUMBER
PROP_CARD1_RECORD
PROP_CARD1_STATUS
PROP_CARD2_CLUSTER_SIZE
PROP_CARD2_EXIST
PROP_CARD2_FILE_NUMBER
PROP_CARD2_FOLDER_NUMBER
PROP_CARD2_FREE_SIZE
PROP_CARD2_NEXT_FOLDER_NUMBER
PROP_CARD2_RECORD
PROP_CARD2_STATUS
PROP_CARD3_CLUSTER_SIZE
PROP_CARD3_EXIST
PROP_CARD3_FILE_NUMBER
PROP_CARD3_FOLDER_NUMBER
PROP_CARD3_FREE_SIZE
PROP_CARD3_IMAGE_FORMAT
PROP_CARD3_IMAGE_QUALITY
PROP_CARD3_IMAGE_SIZE
PROP_CARD3_NEXT_FOLDER_NUMBER
PROP_CARD3_RECORD
PROP_CARD3_STATUS
PROP_CARD_EXTENSION
PROP_CARD_IMAGE_FORMAT
PROP_CARD_IMAGE_QUALITY
PROP_CARD_IMAGE_SIZE
PROP_CARD?_STATUS
PROP_CFN_TAB3
PROP_CFN_TAB4
PROP_COLOR_SPACE
PROP_COMP
PROP_COMPRESSION_L
PROP_COMPRESSION_M1
PROP_COMPRESSION_M2
PROP_CONNECT_TARGET
PROP_CONNECT_TARGET_WFT
PROP_CURRENT_MEDIA
PROP_CUSTOM_WB
PROP_DATA_INPUT_TRANSMISSION
PROP_DATE_DISPLAY_FORMAT
PROP_DEFAULT_OBWBREG
PROP_DIR_SUFFIX
PROP_DISPLAY_AF_POINTS
PROP_DP_DPOF_PARAM
PROP_DP_EXT_OPTION_PARAM
PROP_DP_STANDARD_PARAM
PROP_DSDEFINE
PROP_DUST_DELETE_DATA
PROP_ELECTRIC_SHUTTER_MODE
PROP_ERROR_FOR_DISPLAY
PROP_FILE_NUMBERING_MODE
PROP_FILE_PREFIX
PROP_FIRM_VERSION
PROP_FIXED_VERSION
PROP_FLAVOR_BW
PROP_FLAVOR_FAITHFUL
PROP_FLAVOR_LANDSCAPE
PROP_FLAVOR_MODE
PROP_FLAVOR_NEUTRAL
PROP_FLAVOR_PORTRAIT
PROP_FLAVOR_STANDARD
PROP_FLAVOR_USER1
PROP_FLAVOR_USER2
PROP_FLAVOR_USER3
PROP_FLAVOR_XXXX
PROP_GPS_STATUS
PROP_GUI_STATE
PROP_HDD_DCIM_PATH
PROP_HIGHLIGHT_ALERT
PROP_HISTOGRAM
PROP_ICU_AUTO_POWEROFF
PROP_ICU_UILOCK
PROP_Initialize
PROP_LANGUAGE
PROP_LAST_JOBID
PROP_LAST_JOB_STATE
PROP_LCD_BRIGHTNESS
PROP_LCD_STATE
PROP_LENS
PROP_LIVE_VIEW_GRID
PROP_LIVE_VIEW_VALID
PROP_LOGICAL_CONNECT
PROP_LOGICAL_CONNECT_WFT
PROP_LV_AF_RESULT
PROP_LV_AVAILABLE_AREA
PROP_LV_EXPOSURE_MODE
PROP_LV_HISTOGRAM
PROP_LV_OUTPUT_DEVICE
PROP_LV_SPDN_BTN_STATUS
PROP_LV_TEST_REMOTE_RELEASE
PROP_MENU_POSITION
PROP_METERING_MODE
PROP_METERING_TIMER_FOR_LV
PROP_MWB
PROP_MWB1
PROP_MYMENU_LIST
PROP_NO_CARD_RELEASE
PROP_NUMBER_OF_CONTINUOUS_MODE
PROP_PC_FLAVOR1_PARAM
PROP_PC_FLAVOR2_PARAM
PROP_PC_FLAVOR3_PARAM
PROP_PC_FREE_SIZE
PROP_PC_WB1
PROP_PC_WB2
PROP_PC_WB3
PROP_PC_WB4
PROP_PC_WB5
PROP_PERMIT_ICU_EVENT
PROP_PHOTO_STUDIO_ENABLE_ISOCOMP
PROP_PHOTO_STUDIO_ISOCOMP
PROP_PHOTO_STUDIO_MODE
PROP_PHOTO_STUDIO_MODE_CHANGE_AUTO_PASSWORD_KEY
PROP_PHOTO_STUDIO_MODE_CHANGE_MANUAL_PASSWORD
PROP_PHOTO_STUDIO_SETUP_PASSWORD
PROP_PHYSICAL_CONNECT
PROP_QUICKREVIEW
PROP_QUICKREVIEW_MODE
PROP_RED_EYE_REDUCTION
PROP_REMOTE_BULB_RELEASE_END
PROP_REMOTE_BULB_RELEASE_START
PROP_REMOTE_RELEASE
PROP_SAVE_MODE
PROP_SaveMpuDebugData
PROP_SDIO_PHYSICAL_CONNECT
PROP_SDIO_PHYSICAL_CONNECT_START
PROP_SELECTED_FILE_PREFIX
PROP_SET_TV
PROP_SHOOTING_TYPE
PROP_SHUTTER_COUNTER
PROP_SPECIAL_OPTION
PROP_STARTUP_CONDITION
PROP_STROBO_CFN
PROP_STROBO_SETTING
PROP_STROBO_WIRELESS_SETTING
PROP_TEMP_STATUS
PROP_TRANS_METHOD_WFT
PROP_TUNING_FLAG
PROP_USBDEVICE_CONNECT
PROP_USER_FILE_PREFIX
PROP_USER_FILE_PREFIX2
PROP_VIDEO_PHYSICAL_CONNECT
PROP_VIDEO_SYSTEM
PROP_WBB_BA
PROP_WBB_GM
PROP_WB_MODE
PROP_WBS_BA
PROP_WBS_GM
PROP_WFT_ADAPTERINFO
PROP_WFT_CAPTION
PROP_WFT_DELIMITER_STATUS
PROP_WFT_DONGLE
PROP_WFT_FTP
PROP_WFT_HOSTINFO
PROP_WFT_HTTP
PROP_WFT_IMAGE_TRANS
PROP_WFT_LOCK
PROP_WFT_SYSTEM
PROP_WFT_TCPIP
PROP_WFT_TRANSMISSION
PROP_WFT_WIRED
PROP_WFT_WIRELESS
PROP_WIZARD_WFT

I think it is not missing any. If you detect any problems let me know. Thank you.
Title: Re: Canon 40D
Post by: jplxpto on December 18, 2012, 02:15:02 AM
I think that 40D only allows MF on LV mode. What is the purpose of this property? ...

PROP_LV_AF_RESULT
Title: Re: Canon 40D
Post by: CaesarB on December 19, 2012, 09:15:42 PM
I think that 40D only allows MF on LV mode. What is the purpose of this property? ...

PROP_LV_AF_RESULT

Hi guys, glad to see an active develop thread on the 40D.

My 2 cents: 40D can indeed autofocus in LV, via C. Fn. III-6. Please check http://photography-on-the.net/forum/showthread.php?t=428535, so PROP_LV_AF_RESULT is probably related to it.

Regards
Title: Re: Canon 40D
Post by: jplxpto on December 20, 2012, 12:27:24 AM
Hi Thank you for registering at our forum. You are welcome to this community.
I appreciate your link. I learn a little more. Glad to hear that works with a 40D.
I hope one day to enhance your camera.

BR
Title: Re: Canon 40D
Post by: CaesarB on December 20, 2012, 12:35:11 AM
I'm sure you will.

Thank you very much!
Title: Re: Canon 40D
Post by: imme on December 29, 2012, 09:11:31 AM
waiting waiting waiting :)

Just tried ML on a friend's 400d and now waiting aggressively for 40d version.......JPL really nice work and dedication.......

Title: R: Re: Canon 40D
Post by: nanomad on December 29, 2012, 11:32:16 AM
waiting waiting waiting :)

Just tried ML on a friend's 400d and now waiting aggressively for 40d version.......JPL really nice work and dedication.......
There's no ML for the 400D. It's a different project altogether called 400plus. We do share some code and ideas though
Title: Re: Canon 40D
Post by: imme on December 31, 2012, 02:07:37 PM
Thanks ......I thought it was ML. 400plus is a good project. I am waiting for 40d ML. It good to see you people working on this project
Title: Re: Canon 40D
Post by: scaricame on January 10, 2013, 06:04:18 PM
News??? :)
Title: Re: Canon 40D
Post by: imme on January 11, 2013, 01:56:47 PM
Is there any progress? Any idea (days or months) when we will be able to run ML on our 40d? Please! Do something we are waiting waiting waiting.
Title: Re: Canon 40D
Post by: jplxpto on January 12, 2013, 06:22:51 PM
Is there any progress? Any idea (days or months) when we will be able to run ML on our 40d? Please! Do something we are waiting waiting waiting.

I can't answer that question.
I work on this project whenever I have time and disposition.
I'm busy finishing a project and I have many issues to deal with in my life.
I hope soon to be able to continue with this port.

I started making the discovery of most properties.
Many of them are critical to continue the port but this task takes a long time.

In recent days I have devoted some time to the 650D.
I have a camera with me and I'll start doing some tests with ML.
Title: Re: Canon 40D
Post by: imme on January 14, 2013, 09:01:47 AM
JPLXPTO........i am a big fan of your work. It was you who started working on this port. I am hopeful you will make 40d ML very soon.
Title: Re: Canon 40D
Post by: jplxpto on January 24, 2013, 11:21:19 PM
Thank you!
Title: Re: Canon 40D
Post by: j_veitch on February 04, 2013, 06:59:12 PM
I just wanted to say I remember sitting in the earlier days of ML, hoping a 40D patch would come, then hearing not, and I don't know how I missed this thread...

Anway, just going to give some moral support, and when I get a little time see if I can assist further (I do own a 40D, and am happy to help where I can).

PS I am really impressed by the work of the developers and the talented people using ML.
Title: Canon 40D
Post by: lalama on February 04, 2013, 10:59:40 PM
Took time following the fantastic work they are doing you, and just wanted to congratulate you for it.
I also give my moral support to this project, because as j-Veitch said I too have been waiting for the arrival of the patch to the 40D.
I think we all know how hard it must be to create this, and I also believe strongly that the EOS 40D ML deserves.
I hope to be helpful at some point and I apologize for my bad English.
A greeting.
Title: Re: Canon 40D
Post by: scaricame on February 21, 2013, 10:28:14 AM
news???
Title: Re: Canon 40D
Post by: ariznaf on February 21, 2013, 06:38:21 PM
I have just registered just to post here and give you a thumbs up.

Great effort, I have been long waiting for somebody to port ML to my 40D.
It would be great to be able to record video and many of the ML features in photography, like focus peaking, advance bracketing, focus bracketing, etc.

I am seeking for any news about it.

Please keep trying and thanks for your efforts.
I will pay for the firmware as soon as there is an early versión.
Title: Re: Canon 40D
Post by: samacochan on February 28, 2013, 12:03:54 AM
I have just registered just to post here and give you a thumbs up.

Great effort, I have been long waiting for somebody to port ML to my 40D.
It would be great to be able to record video and many of the ML features in photography, like focus peaking, advance bracketing, focus bracketing, etc.

I am seeking for any news about it.

Please keep trying and thanks for your efforts.
I will pay for the firmware as soon as there is an early versión.

I am afraid you will be disappointed. Come back in six months and see if I am wrong.
Title: Re: Canon 40D
Post by: j_veitch on February 28, 2013, 12:13:49 AM
Well, firmware is new to me. And I am reading what I can in the time I have.  i did get round to dl'ing the ubuntu vm... And one o the devs at my work has at least used vxworks amd arm in the past. But, really not sure where to go from here.  Anyway, i haven't given up hope yet.
Title: Re: Canon 40D
Post by: blue9 on March 01, 2013, 02:02:57 PM
I have several Eos cameras, however the 40D has the best sharpness per pixel performance. Just look at DP preview's review of 50D and how it compared to the 40D 10mp sensor. So if someone are able to fix ML for the 40D, it think it will be one of the sharpest video enabled DSLR.
Title: Re: Canon 40D
Post by: jurojuro on March 04, 2013, 10:03:45 PM
 I will also pay something if I get HD video properties to 40D! Would be great to utilize the old camera!!
Title: Re: Canon 40D
Post by: imme on March 05, 2013, 11:49:00 AM
We all are desperately waiting for 40d Magiclantern version. But I think 40d is not on priority list of ML.

Please! I request that If 40d port is possible than keep this thread alive in other case close this thread and say 40d port is not possible due to all new camera portings. It will close the case forever. I am not disappointed or emotional but I am trying to convey feelings of several 40d users who are anxiously waiting for 40d version. But there is no development priority for this.
Title: Re: Canon 40D
Post by: ariznaf on March 06, 2013, 11:13:04 PM
The dveloper does  not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.

Of course this is not  probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.
Title: Re: Canon 40D
Post by: jplxpto on March 21, 2013, 01:56:47 AM
I'M LIVE :)

Sorry ... I have spent many days with health problems and hard work.
My life has been a bit complicated but I hope to get back to work on this project a few days from now.
I'll need to read some posts. I am now a bit outdated.

I think the developers have done an excellent job.

I promise appear shortly.

BR
Title: Re: Canon 40D
Post by: jplxpto on March 21, 2013, 02:04:22 AM
The dveloper does  not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.

Of course this is not  probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.

YES!!! You are right! Thank you for your kindness.

You may not believe but I finally went and uncle have not photographed the child with a DSLR. :(

I love to shoot a little of everything but children are at the top of my list. And now I have a new reason to shoot.

BR
Title: Re: Canon 40D
Post by: jplxpto on March 21, 2013, 02:08:01 AM
The dveloper does  not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.

Of course this is not  probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.

I still have some outstanding issues to resolve but I will endeavor to return soon.
Title: Re: Canon 40D
Post by: blue9 on March 21, 2013, 12:14:52 PM
I have several eos cameras, the 40D however produses very sharp and clean images for it's size (10Mp). Take a look at DP's (Digital preview) review of the 50D where the older 40D at delivered the same image quality as the 50D when magnefied, even if the 50D has a 15.1 Mp sensor.

I think a Magic Lantern converted 40D camera would be one of the best and sharpest film cameras, and to a fair price.  ;)
Title: Re: Canon 40D
Post by: ariznaf on March 21, 2013, 10:21:07 PM
YES!!! You are right! Thank you for your kindness.

You may not believe but I finally went and uncle have not photographed the child with a DSLR. :(

I love to shoot a little of everything but children are at the top of my list. And now I have a new reason to shoot.

BR
Well come back and many thanks for your efforts.  Glad to hear from you.
Hope your personal troubles and your health issues have been solved.

Programming is a very time consuming task,  and this kind of programming Is even more demanding.
Hope you find the time to complete the task,  but even if you cannot complete it,  we should be gratefully for your efforts and time.

I come often to the thread to read about the progress.  I would like to test ml in my 40d and test video in a DSLR.

May be in the near future,  when the price lowers more,  I will buy a 7d as my video camera is dead,  but I am not sure that a DSLR is an alternative to a consumer video camera.

Anyway there are many interesting g things in ml for photography too.
Title: Re: Canon 40D
Post by: mincanphoto on March 24, 2013, 02:33:52 AM
jplxpto,I found some information for you
1.http://valexvir.narod.ru/      -----from Russian,for 40D, 50D, 5D Mark II и 1Ds Mark III -  record video 1024x680 with a pc.
2.DIGIC III - (VxWorks OS) from CHDK    http://chdk.wikia.com/wiki/For_Developers
3.one  chinese cracked the firmware of 40D,found out the “factory menu”;ISO 50-6400;AF CK;but he stoped (write text.bin),
http://bbs.fengniao.com/forum/1397306_8.html
http://bbs.fengniao.com/forum/1397306_9.html
Title: Re: Canon 40D
Post by: jplxpto on March 24, 2013, 03:37:32 AM
jplxpto,I found some information for you
1.http://valexvir.narod.ru/      -----from Russian,for 40D, 50D, 5D Mark II и 1Ds Mark III -  record video 1024x680 with a pc.
2.DIGIC III - (VxWorks OS) from CHDK    http://chdk.wikia.com/wiki/For_Developers
3.one  chinese cracked the firmware of 40D,found out the “factory menu”;ISO 50-6400;AF CK;but he stoped (write text.bin),

Thank you!
Title: Re: Canon 40D
Post by: jplxpto on March 30, 2013, 03:42:18 AM
My dear friends,

Finally, I got some time to update my repositories and make the necessary changes to make the build of ML for 40D.

My next task will be to fix the menus.
Many changes were made to the menu system and now some things are not well presented. For example, icons appear with double the size.

I think, users of 5DC will have the same problem.
I made small fixes that should have an impact on 5DC but I do not have this camera for testing.

https://bitbucket.org/hudson/magic-lantern/pull-request/71/some-change-to-build-ml-for-vxworks/diff
Title: Re: Canon 40D
Post by: j_veitch on March 30, 2013, 10:15:27 AM
Just want to say, thanks for all your efforts so far.  I just never seem to have the time to look further myself... It is quite a learning curve for me.
Title: Re: Canon 40D
Post by: jplxpto on March 30, 2013, 08:32:55 PM
Some screenshots:

http://i.imgur.com/qfFlm6w.jpg

http://i.imgur.com/cqslQ9x.jpg

http://i.imgur.com/eRVDcgb.jpg

http://i.imgur.com/X0YpUVX.jpg
Title: Re: Canon 40D
Post by: muzsielod on March 31, 2013, 11:50:44 PM
This are great news ;D
Title: Re: Canon 40D
Post by: nexiabass on April 02, 2013, 07:58:52 AM
Great to see progress.
I really would like to help, so if some alpha-testing is necessary ^^
Do you already have an idea if a iso expansion would work?
Title: Re: Canon 40D
Post by: ilguercio on April 02, 2013, 09:24:10 AM
It does already, use Lightroom.
;)
Title: Re: Canon 40D
Post by: nexiabass on April 02, 2013, 10:26:29 AM
Thats the standard answer ;)
But it's a bit easier and better to handle to select a iso value instead of underexposure.
It's just the standard workflow with the cam - for me ;)
Title: Re: Canon 40D
Post by: adentallon on April 04, 2013, 04:57:34 AM
Created an account to show support for this project.  I'll also throw my camera up for grabs for testing if needed.
Title: Re: Canon 40D
Post by: fotosi on April 06, 2013, 03:59:29 PM
Hello! I have created account too, just to show my support. I already follow this thread unregistered, from the its begining and just because of maybe incoming Magic Lantern for 40D, I still keep my three 40D's.
Many many thanks to the developers of Magic Lantern! When I watch what you guys do, it seems to my like a rocket science. Really unbeliveable...
If you successfuly finish this project, you will receive a donation from me, for your big success.
Big thanks in advance and I will stay tuned to the new happening.... :)
Title: Re: Canon 40D
Post by: jplxpto on April 07, 2013, 02:31:34 AM
Thank you!
Title: Re: Canon 40D
Post by: Bimmer_E30 on April 08, 2013, 12:47:47 AM
I too have created account, to congratulate you all, for trying. My 40D is wainting to test ML.
Title: Re: Canon 40D
Post by: danniorn on April 09, 2013, 04:12:44 PM
I did the same thing as anyone else :) i made an account just to say good work and keep it going! i would love to make my 40d take short clips but i have one thing to ask, would it be hard to add the timelaps feature in the 40d magic lantern?  becouse i would loe to take some timelaps without the 200$+ remote  :o

Keep doing your awesome work  8)
Title: Re: Canon 40D
Post by: vladzilla on April 09, 2013, 04:24:55 PM
 :) will we be able to film video on 40D?) cool
Title: Re: Canon 40D
Post by: ariznaf on April 10, 2013, 10:32:27 PM
Great, I see that you are now back in the developement and makin progress.

Thank you for your work and time.
Title: Re: Canon 40D
Post by: thome on April 11, 2013, 03:33:03 AM
I love my 40D - its a great camera and it does a great job!
If ML is going to hit it, it would be a big rebirth for the cam.
I am thankful to all of  the developers for their personal effort in ML as a whole and jplxpto in special for his work on the 40D.
It's an "old" camera, so it is not a matter of course that someone takes over such a hard and long work for it. So: thumbs up for you jpl and never forget: don't mind how many people are asking for features/dates/whatever: there are more important things in life.
Title: Re: Canon 40D
Post by: Faxe on April 11, 2013, 03:17:04 PM
> there are more important things in life.

Such as?!

No, seriously. While I go to this page almost every day in the hope of some progress, I realize that ML is not a make or break for me becoming a better photographer. And, sadly enough, neither is getting new lenses... But the geek in me would love to test out new features on the 40D any day, so I keep coming back. Keep it up jplxto, really appreciated!
Title: Re: Canon 40D
Post by: a1ex on April 11, 2013, 04:59:50 PM
At this point, anyone with a 40D and some C skills can grab the source code and improve it. So... what are you waiting for? ;)
Title: Re: Canon 40D
Post by: samacochan on April 11, 2013, 07:57:30 PM
Alex is right about it.
 
But is there an easier way to do it for the majority who may not know how to do with the source codes. Is there a simplified version with only a few functions e.g. intervalometer, auto WB control etc. to start with. I think most 40D owners will agree to pay to finance the development.

Any thoughts from the supporters of this thread.
Title: Re: Canon 40D
Post by: a1ex on April 11, 2013, 08:21:23 PM
Compiling the current source code will give you that version to get started. The menu works, but other than that I have no idea what else works.

Maybe jplxpto can publish the devkit (the FIR for enabling the bootflag and dumping the firmware)?
Title: Re: Canon 40D
Post by: muzsielod on April 15, 2013, 09:22:26 PM
How much it cost the developing of a working firmware?
Title: Re: Canon 40D
Post by: nanomad on April 15, 2013, 09:34:51 PM
Hundreds of man-hours.
Title: Re: Canon 40D
Post by: blue9 on April 19, 2013, 01:27:33 AM
I bought a second 40D (i have another 40D from before) that i intend to reserve for use with and furure realease of ML.
Title: Canon 40D
Post by: n0rt0n on April 19, 2013, 11:04:16 AM
Hello all!
Tell me please, where I can download current source code?
Is there AF microadjustment function? I need only this one.
Or maybe I can adjust AF without ML?
Thank you for this job!
And sorry for my english, I'm from Russia :)
Title: Will this bring ML to 450D
Post by: ixtlan on April 23, 2013, 11:11:28 AM
@ jplxpto , coutts.

Thanks guys for all your efforts and hard work.  :)

If finally we get a ML download for 40D, do we get a ML for 450D as well?
Title: Re: Canon 40D
Post by: a1ex on April 23, 2013, 04:38:58 PM
No, but it will be easier to port, if anyone is interested in doing that.
Title: Re: Canon 40D
Post by: eugene-r on April 23, 2013, 07:57:54 PM
Is there AF microadjustment function?
Нету в ML микроаджустмента, такчто даже не надейтесь.

Or maybe I can adjust AF without ML?
У 40д нет такой фичи, так что только нести объектив в сервис.

I'm from Russia :)
Ничего, бывает =)
Title: Re: Canon 40D
Post by: zfeet on April 24, 2013, 05:25:36 AM
I have 40D and would like to give it a try with Magic Lantern. I have a background with CHDK but never thought about ML until now. If anyone has a dumped 1.1.1 please PM me.
Title: Re: Canon 40D
Post by: samacochan on April 26, 2013, 06:14:10 PM
Consider to switch to 50D/550D and install ML to play with. The price drop of the 40D since last year was a significant amount(from $350 to $250 on the Craigslist in Canada) and so are the other two mentioned here. 40D is good but the other two are equally good in some other aspects.

Anyway, don't waste time waiting, just go out and click, click and click.
Title: Re: Canon 40D
Post by: ixtlan on April 29, 2013, 02:00:49 PM
No, but it will be easier to port, if anyone is interested in doing that.

Thanks for the reply. I hope this happens.  :)
Title: Re: Canon 40D
Post by: a1ex on April 29, 2013, 02:07:36 PM
It's not really that hard - if you have enough time, motivation, some basic programming skills and the desire to learn, you can do it. It's quite similar to programming embedded devices or microcontrollers.

See also:
http://chdk.wikia.com/wiki/FAQ#Q._My_camera_isn.27t_ported_yet._Is_a_port_planned.C2.A0.3F_When_will_it_be_ready.C2.A0.3F_How_can_I_help.C2.A0.3F
Title: Re: Canon 40D
Post by: scaricame on May 07, 2013, 10:10:32 AM
news???
Title: Re: Canon 40D
Post by: nativeridge on May 26, 2013, 10:18:22 PM
news? oh you are wanting a personal update just for you, gotcha, sorry carry on......
Title: Re: Canon 40D
Post by: samacochan on May 27, 2013, 01:56:01 PM
http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster (http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster)

Wow......will this happen on 40D ?
Title: Re: Canon 40D
Post by: coutts on May 27, 2013, 04:28:03 PM
http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster (http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster)

Wow......will this happen on 40D ?
I found the required function stubs for it, so in theory it should work if somebody is still working on this port ;)
Title: Re: Canon 40D
Post by: Faxe on June 14, 2013, 12:43:13 PM
Too bad that the developer seems to have abandoned ship, so we may never know... :-\
Then again, this is all voluntary work, and messy stuff, so I can understand it if he suddenly decided it wasn't worth the effort... I unfortunately completely lacks the skill to finish off what he started.
Title: Re: Canon 40D
Post by: iNva on June 16, 2013, 04:34:12 PM
I have 5DmII but I would like to try ML on my 40D its any progress there? :)

+ I could help you with testing etc
Title: Re: Canon 40D
Post by: redhancer on June 16, 2013, 05:14:42 PM
this topic caught my attention as well. If I had the skills I certainly would help, I did a little of coding in my past years but I can't imagine how hard it is to achieve a firmware modification on a camera. there are certain things that an older camera like the 40D would benfefit from, like the software is really old (auto-iso etc.) but the images are still awesome (I do prefer sometimes the 10MP sensor over smaller pixels) so, what canon wants us to do: buy a newer tool. with software so complicated to adjust on cameras its really a smart step of camera manufactures to keep them at dinousaur stage.
well, I assume you all agree, what I wanted to say: If there is a way I can help, I'll invest a lot of my free time (which I got like a month for this summer) If there is enough information available that someone like me could possibly read into that field of work.

best regards
Title: Re: Canon 40D
Post by: sm105 on June 16, 2013, 05:35:08 PM
I was following this thread when it was active, but I think the 50D development has been prioritized for the moment.

I've got a 40D, so I would certainly help with testing builds, but like others I have limited programming experience.

Title: Re: Canon 40D
Post by: iNva on June 16, 2013, 07:53:02 PM
yea 40D is really good camera.. (I used 50d and I dont like it 40 was better) I like this camera cause this cam is very good in sharp and its really fast in focus (im still using it for rally etc)
Title: Re: Canon 40D
Post by: Bongle on June 22, 2013, 09:56:58 PM
I'M LIVE :)

Sorry ... I have spent many days with health problems and hard work.
My life has been a bit complicated but I hope to get back to work on this project a few days from now.
I'll need to read some posts. I am now a bit outdated.

I think the developers have done an excellent job.

I promise appear shortly.

BR

Hope things have bettered up for you 'jplxpto'. Thanks so much for the dedication you have put into the development of ML for us 40D users. (Of course gratitude goes out to Alex and all the other developers also).

I heard about ML only last night from my wife's boss who uses it on the 5D MkII. He does commercials and all that stuff with it. He's very excited about it and trust me, I can see why.
It would be a real joy to be able to shoot video on my trusty 40D. I just cant wait.
Thanks for the great work guys. I'll surely be one of the first to download ML for the 40D.
Title: Re: Canon 40D
Post by: jplxpto on July 27, 2013, 10:01:38 PM
Hello guys ... sorry ... I've been very busy with work ...and also some health problems.

I've been completely absent during the last months ...
I hope to soon be able to return to work for this magnificent community
and of course I'll come to invest some time in the port of 40D.

Best regards
Title: Re: Canon 40D
Post by: nativeridge on July 28, 2013, 10:46:01 PM
that is awesome news jplxpto, I am new to the community and although I am fortunate enough to have ML for 6D I have been hoping to see the 40D with some ML 'goodness' :D

very encouraging!! 
Title: Re: Canon 40D
Post by: imme on July 31, 2013, 09:59:31 AM
Good to hear from jplxpto after long long time. You are only person working on this port and all our eyes are on you.....May God bless you with health and you can work on this port.

Can you please tell us how much more work would be required to complete this port. Last time I think you were working with menus. hope to hear good news from you and we all pray from your health......amen
Title: Re: Canon 40D
Post by: jplxpto on July 31, 2013, 03:07:45 PM
Good to hear from jplxpto after long long time. You are only person working on this port and all our eyes are on you.....May God bless you with health and you can work on this port.

Can you please tell us how much more work would be required to complete this port. Last time I think you were working with menus. hope to hear good news from you and we all pray from your health......amen

Hi,

This week I've been reading about the latest news.

I updated the source code to the 40D but the project did not compile ...
I've started to make some changes but still could not test anything.

The menus have worked in 40D.
Before getting out of the project, I was making the discovery of the main properties.
The selection of the focus points have worked correctly.
I also able to change the aperture and shutter speed.

Some overlays also have work in play mode.
I still can not display the overlays in live view mode.
I still could not find the addresses of HDVRAM. I hope to do that soon.
Title: Re: Canon 40D
Post by: ilguercio on July 31, 2013, 03:19:58 PM
I hope your health problems are not serious.
It's nice to see you are back to work with us!
Title: Re: Canon 40D
Post by: jplxpto on July 31, 2013, 10:48:47 PM
I hope your health problems are not serious.
It's nice to see you are back to work with us!

I'm fine... Thank you...

BR
Title: Re: Canon 40D
Post by: imme on August 01, 2013, 12:54:33 PM
Goodluck........ :D
Title: Re: Canon 40D
Post by: ariznaf on August 07, 2013, 11:08:36 AM
Well come back.
Glad to hear you aee ok and tour health problemas are gone.

Great to ser you are back to the project toó.
As soon as you have a operational alpha versión i will try it in my camera.
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2013, 02:49:01 AM
After a few months away. ML works again on my 40D.

I hope soon to have time to fix the loading of modules.
At this time no module is loaded.
I also saw that there are some problems in the menus.
The fonts seem to me unclear.
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2013, 02:50:52 AM
Well come back.
Glad to hear you aee ok and tour health problemas are gone.

Great to ser you are back to the project toó.
As soon as you have a operational alpha versión i will try it in my camera.

Thanks for everything but there is still much work to be done.
Title: Re: Canon 40D
Post by: nexiabass on August 13, 2013, 11:44:58 AM
if you could add iso 12800 - i would donate some cash for your work :)
Title: Re: Canon 40D
Post by: jplxpto on August 14, 2013, 12:44:32 AM
if you could add iso 12800 - i would donate some cash for your work :)


I apologize to disappoint you, but all systems have their physical limits (hardware) and the software does not perform miracles ...
I do not think that's possible.
If I could do that, probably the noise would be so high that no one would want to use.

Still ... this fantastic community needs help to survive.
There are some very active members who deserve to be properly rewarded, even if it's with new equipment, ... new challenges, ...
and recognition of their work ... some of them work hard for this project ... day after day ...

Briefly, a help is always welcome :)

BR


Title: Re: Canon 40D
Post by: fotosi on August 14, 2013, 08:39:23 PM
Hello jplxpto, I can and wish to help if you just give me a few step-by-steps how to.
What do I need of the equipment to start working and helping in this project?
Title: Re: Canon 40D
Post by: imme on August 15, 2013, 08:50:18 AM
JPL........its good you are back on track. I know port will take time to complete and also it needs your spare time and good health. We are waiting and wish you goodluck.

Title: Re: Canon 40D
Post by: rufustfirefly on August 27, 2013, 12:32:25 AM
Is there currently a more "modern" version of the firmware extract/build instructions to create a FIR file for the 40D than the one located here : http://www.magiclantern.fm/forum/index.php?topic=1452.msg3856#msg3856 ?

Some of the tools listed in that don't exist in the repository anymore, so I'm getting the distinct impression that the build process has changed slightly.

Thanks!
Title: Re: Canon 40D
Post by: rufustfirefly on August 28, 2013, 05:45:10 PM
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.

https://bitbucket.org/rufustfirefly/magic-lantern/downloads
Title: Re: Canon 40D
Post by: jplxpto on August 29, 2013, 01:18:08 AM
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.

https://bitbucket.org/rufustfirefly/magic-lantern/downloads

http://www.magiclantern.fm/forum/index.php?topic=7955.new#new (http://www.magiclantern.fm/forum/index.php?topic=7955.new#new)
Title: Re: Canon 40D
Post by: imme on September 04, 2013, 08:17:13 AM
JPL any update???????
Title: Re: Canon 40D
Post by: rufustfirefly on September 08, 2013, 12:23:21 AM
I've got a 40D body laying around -- I'd be perfectly willing to dump the firmware, search for function calls, etc; I just have little to no expertise in doing any of that, and the Magic Lantern wiki seems perilously out of date. Could anyone point me to a somewhat more up to date walkthrough of either a) using the extracted firmware components to analyse or b) dumping active ROM to do the same -- and any postings, articles, or pages about digging for the locations of specific calls?

I know it seems like a tall order, but I'd love to help if anyone can point me in the right direction. I'm using a Linux machine, but I have a Windows VM handy (as well as a copy of WINE) if it's needed.
Title: Re: Canon 40D
Post by: imme on September 10, 2013, 07:09:33 AM
I've got a 40D body laying around -- I'd be perfectly willing to dump the firmware, search for function calls, etc; I just have little to no expertise in doing any of that, and the Magic Lantern wiki seems perilously out of date. Could anyone point me to a somewhat more up to date walkthrough of either a) using the extracted firmware components to analyse or b) dumping active ROM to do the same -- and any postings, articles, or pages about digging for the locations of specific calls?

I know it seems like a tall order, but I'd love to help if anyone can point me in the right direction. I'm using a Linux machine, but I have a Windows VM handy (as well as a copy of WINE) if it's needed.

rufustfirefly. I am not a developer but if you read this thread from start you will get lots of information. JPL, Nanomad and alex had in detail discussions related to development and 40d porting. 
Title: Re: Canon 40D
Post by: StefanKeller.AC on September 21, 2013, 12:07:01 PM
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.

https://bitbucket.org/rufustfirefly/magic-lantern/downloads

loading that 40d00111-ML.2013-08-30-007bb9a0574d.fir with the files from ML-40D.2013-08-30.53fbc6b53da5.zip on the card
doesnt work, only the upper display is on, battery has to be taken out...
how shall it work?

Title: Re: Canon 40D
Post by: rufustfirefly on September 25, 2013, 10:16:51 PM
loading that 40d00111-ML.2013-08-30-007bb9a0574d.fir with the files from ML-40D.2013-08-30.53fbc6b53da5.zip on the card
doesnt work, only the upper display is on, battery has to be taken out...
how shall it work?

I'm having some issues getting development rolling on the 40D, primarily because I've been unable to extract an unencrypted version of the 1.1.1 firmware (as I had mentioned earlier in the thread). This has left me unable to find the rest of the function locations, so getting this port working, at least at the 1.1.1 firmware revision, isn't going to happen -- pending being able to get an unencrypted copy of the firmware to work with.

Alternately, I can try to move to using 1.0.5 or 1.0.8, which have both had their encryption keys reverse engineered. I hate backing out versions of firmware, but if it's the only way I can proceed, I may go that way.
Title: Re: Canon 40D
Post by: scaricame on October 24, 2013, 06:42:36 PM
News???
Title: Re: Canon 40D
Post by: rufustfirefly on October 29, 2013, 09:12:57 PM
I have built a set of dumpers, which should dump out the active firmware. If someone wants to try to load one or the other up on their 40D running v1.1.1, we should be able to get an unencrypted dump of the firmware.

It's all based off of the previous 1.0.5 and 1.0.8 work, so mileage may vary.

https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D1.fir (https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D1.fir)
https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D2.fir (https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D2.fir)

There's a disclaimer that this could do something awful -- but one of them should just dump a file to your card (after a flurry of activity).

If anyone wants to check my work, it's all on bitbucket:

https://bitbucket.org/rufustfirefly/40d108-dumper (https://bitbucket.org/rufustfirefly/40d108-dumper)
Title: Re: Canon 40D
Post by: imme on November 02, 2013, 06:00:11 AM
rufustfirefly can you please add a little tutorial as how can I added it to 40d and CF card. sorry but I am totally new to these firmwares stuff. 
Title: Re: Canon 40D
Post by: rufustfirefly on November 08, 2013, 09:04:27 PM
rufustfirefly can you please add a little tutorial as how can I added it to 40d and CF card. sorry but I am totally new to these firmwares stuff.

The trick is to dump the .FIR file onto your CF card (presumably using a CF card reader), then use the "Update Firmware" menu option to attempt to sideload the dumper code. It won't actually upgrade your firmware, but rather attempt to run the custom code which should, in theory, spin the CF card for a bit and dump out a file containing the loaded firmware.

It could also do bad things, which it shouldn't do. If, for some reason, it locks up completely and hasn't done anything within 30 seconds or so, you might want to pull the battery.
Title: Re: Canon 40D
Post by: pixelk on November 09, 2013, 02:21:38 PM
On a 1.1.1 40D with full battery :

After a few seconds of "loading firmware update"

- 108D1.fir : White on yellow "Update file error. Please check the memory card and reload the battery and try again."
- 108D2.fir : White on yellow "Update file error. Please check the memory card and reload the battery and try again."

Both needed a battery remove, and the 40D still works fine after that.

40d00111-ML.2013-08-30-007bb9a0574d.fir : screen turns black, DSLR works apart from the fact that it doesn't recognize the CF carf anymore. Needed a battery remove to restore proper function.
Title: Re: Canon 40D
Post by: anderskvist on November 12, 2013, 01:47:38 PM
40d00111-ML.2013-08-30-007bb9a0574d.fir : screen turns black, DSLR works apart from the fact that it doesn't recognize the CF carf anymore. Needed a battery remove to restore proper function.
I see more or less the same (also with 1.1.1) - except the camera won't capture, but focus works...

/Anders
Title: Re: Canon 40D
Post by: pixelk on November 18, 2013, 08:00:01 PM
Yes sorry, I didn't try to capture, maybe it didn't work, maybe it did. But without the CF card recognised, my only urge was a full reset  ;D
Title: Re: Canon 40D
Post by: imme on December 03, 2013, 01:53:56 PM
hi,

rufustfirefly is there any update on 40d ML version you are working ????
Title: Re: Canon 40D
Post by: imme on December 23, 2013, 11:30:00 AM
jplxpto & rufustfirefly any latest update on 40d port? have not heard from you guys for a long time.
Title: Re: Canon 40D
Post by: frix23 on January 11, 2014, 08:21:04 PM
...and here's another guy willing to contribute work that
might even brick his camera for the sake of getting a
running 40d port. So, if there's anything I could
possibly do, let me know!
Title: Canon 40D
Post by: AOK on February 06, 2014, 08:15:59 PM
Hi everyone,

What is the current status? Do we have a forked development of the 40D ML or rufustfirefly progressing on his own? I am very confused.

Guys whatever the case is thank you so much! Let us hope for the best.  ;D

I've just installed his build - and it has a few features... Now I know we are talking about quite an old body. Indeed since 2007 way too many things have developed. And yet could some more features
be expected?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: imme on February 28, 2014, 01:27:32 PM
Can you please tell me what features are supported in this firmware. I just need HDR and timelapse feature. is it there?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Canon40D on March 31, 2014, 05:18:59 AM
Anyone have an update on ML for the 40D? I've read this thread start to finish and looked all over without a clear answer. The ML website claims it's compatible with the 40D but I can't get it to work. Any help or guidance is much appreciated thanks to all for the hard work and time given to make this possible.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Marsu42 on March 31, 2014, 11:37:32 AM
Anyone have an update on ML for the 40D? I've read this thread start to finish and looked all over without a clear answer. The ML website claims it's compatible with the 40D but I can't get it to work. Any help or guidance is much appreciated thanks to all for the hard work and time given to make this possible.

I also thought so and even told other people as such, but then I was told here that 40d is not working at all and this most likely won't change :-\ ... it's not even digic4 so copy/pasting code most likely won't work.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Canon40D on March 31, 2014, 08:08:53 PM
I also thought so and even told other people as such, but then I was told here that 40d is not working at all and this most likely won't change :-\ ... it's not even digic4 so copy/pasting code most likely won't work.

I'll just stick to my T2i for now, though I love the feel of my 40D over my T2i which is why I would love to get ML working on it.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: rufustfirefly on April 02, 2014, 05:49:10 PM
If anyone's still watching this, here's where I'm at:

I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:

https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)

Thanks!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: sedayu on April 03, 2014, 05:53:49 PM
If anyone's still watching this, here's where I'm at:

I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:

https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)

Thanks!

wow, god job bro
Title: Re: [UNMAINTAINED] Canon 40D
Post by: NurseBob on April 04, 2014, 11:51:18 PM
If anyone's still watching this, here's where I'm at:

I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:

https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)

Thanks!

Just joined, and have a 40D.  Noted that 40D is listed on the home page as "supported" but based on what I'm seeing, that's perhaps a bit misleading...
However, I do have code experience with the msp430 microcontrollers, and from what I'm seeing, there would be a learning curve with the controller for the 40D, but hopefully not insurmountable.  I guess time will tell.
Aside from this extensive thread, are there any other resources regarding design of the app???  Or is it just "read the code?"
Thanks!

bob
Title: Re: [UNMAINTAINED] Canon 40D
Post by: chris_overseas on April 05, 2014, 01:29:49 AM
Aside from this extensive thread, are there any other resources regarding design of the app???  Or is it just "read the code?"

I've found it to be a bit sprawling, but there is a lot of information buried on the wiki http://magiclantern.wikia.com/wiki/Magic_Lantern_Firmware_Wiki (http://magiclantern.wikia.com/wiki/Magic_Lantern_Firmware_Wiki)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: NurseBob on April 05, 2014, 07:12:53 AM
chris_overseas
Thanks!  Looks like a great starting point, and a whole lot of homework...  So it goes. :)

bob
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Faxe on April 09, 2014, 11:34:05 AM
> Thanks!  Looks like a great starting point, and a whole lot of homework...  So it goes. :)

For what it is worth, we are several people who still follow this thread closely! We wish you good luck, should you except the challenge.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: imme on April 12, 2014, 09:36:35 AM
I am following and waiting for this port for long time :D
Today I thought I must remove 40d ML updates from my RSS feeds. But NurseBob I hope you can make it a reality for lot of Magic lantern users.

I am not a developer but this whole 40d thread contains lots of information sharing by some developers and Magic lantern team lead.

Goodluck
Title: Re: [UNMAINTAINED] Canon 40D
Post by: tonesen on April 23, 2014, 12:44:55 PM
i just want to say that i would be so freakin' happy if you could make it possible to use a 40d as a video camera.
thank you very much for all the work here!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Canon40D on April 24, 2014, 02:17:24 AM
i just want to say that i would be so freakin' happy if you could make it possible to use a 40d as a video camera.
thank you very much for all the work here!

I've seen some videos on YouTube that show video recording on a 40D already. I'm going to google it now.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: dazzle on April 24, 2014, 05:31:05 PM
hi

im donating some micro bitcoins to someone who can finally make the 40d capture video at, preferably, 24fps with 720p resolution, ideally

who's with me? ive got a 40d lying around here, clean and dust free.. by the way, good job on that rufustfirefly!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Faxe on April 25, 2014, 01:44:38 PM
I've seen some videos on YouTube that show video recording on a 40D already. I'm going to google it now.

It is possible to shoot video today, but through a connected computer.

See http://sourceforge.net/projects/eos-movrec/
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ansius on April 30, 2014, 09:10:28 PM
First - thanks to those who have contributed to ML, it is an awesome tool.

I have 7D with it running, but my 40D seams to be collecting dust, because some of the tasks I would use it for would benefit form ML. like built in intervalometer, bulb timer, bulb ramping or even better - automatic ettr with deflicker. I wish i could help, even tough I have written some code in in various languages, including even low level assambler for atmel avr micro controllers, newer got a good grasp of C, somewhat it always have made me lose interest in it. now I bite my fingers, should have learned it.

I really hope that some day, before the 40D dies we would see ML in it. IMHO video functions, even tough cool, are not for the humble 40D, there are cameras much better for this. Photography would benefit greatly form ML tough.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: bubbleg5 on May 07, 2014, 04:29:09 PM
Hello friends!
I did not understand where I can download the modified firmware for my Canon 40D ... can you help?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: dazzle on May 09, 2014, 04:59:35 PM
it is still in development.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: techbp on May 14, 2014, 05:12:59 AM
Any updates? Also waiting for this firmware update... goodluck guys
Title: Re: [UNMAINTAINED] Canon 40D
Post by: dazzle on June 01, 2014, 04:58:53 PM
everyone is really anticipating this great hack/tool for a great camera 40D :)

I am waiting too! :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on June 01, 2014, 06:02:48 PM
Don't pray, code!

Also, these days you can emulate ML code in QEMU (http://www.magiclantern.fm/forum/index.php?topic=2864.msg117430#msg117430) and you have two early ports in progress. No more excuses ;)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: techbp on June 13, 2014, 08:55:26 AM
Any update?  :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on July 03, 2014, 01:10:18 PM
No volunteer for a DIGIC 3 based system.... Come one. Where is the chalenge these days?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: domovets on July 04, 2014, 02:19:57 PM
What need help? I have 40d camera.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: frank007 on July 08, 2014, 04:58:10 AM
great, it seems to work anyway.  :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ansius on July 08, 2014, 02:23:54 PM
seams to work what?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: bostjanr on July 24, 2014, 04:01:51 PM
What is working? Where???

Ok. What do you need? Voulontier? here i am. Shoot. :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kjgregory on August 08, 2014, 05:19:50 AM
Any updates? I just heard about Magic Lantern and wanted to try it on my 40D, was dissappointed to see that the latest release doesn't support it.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Z@ on August 12, 2014, 09:43:39 AM
Hi all,
Can somebody clarify about 40D?

On main page it is written

Supported Cameras:
5Dc, 5D2, 5D3, 6D, 7D, 40D, 50D, 60D, 500D (T1i), 550D (T2i), 600D (T3i), 650D (T4i), 700D (T5i), 1100D (T3), EOS M, 100D (SL1)

On download page http://www.magiclantern.fm/downloads.html is written that only these camera are supported

5D Mark ii 2.1.2
50D 1.0.9
60D 1.1.1
500D 1.1.1
550D 1.0.9
600D 1.0.2

and finally here http://www.magiclantern.fm/features.html is written that for 40D only beta version with Core ML features exists.

I completely do not understand will it work or not? and if beta exists where can I download this beta and try?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: S-tomas on August 19, 2014, 07:18:13 PM
Is somebody working on the 40D ML right now? I know it is hard to say, but when we could expect some update or even first working version. (Video recording feature will be great!)

Thank you, for any responses. ;)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Plynlimon on September 01, 2014, 12:04:58 AM
I too hope that you get ML working on the 40D I would love to do time lapse with mine and as for video....well ;)

Daf
Title: Re: [UNMAINTAINED] Canon 40D
Post by: iNva on September 09, 2014, 08:16:32 PM
i think that we will never get 40d i wanted to know programming to do it.. but idk :/  :(
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ansius on September 11, 2014, 08:10:27 AM
40D is not going to have video, it has not that much cpu power, nor hardware for that, in 50D case the feature (h264 encoding) was there, just not enabled. Other thing is that 40D is VxWorks so that is different platform at all.

for time lapses tough 40D is grate, I own one, and I would like to have histograms, intervalometer, bulb timer, dual iso there - but it seams that those few capable of doing this are not owning a 40D, so thus no progress. Sadly CHSDK says that 40D is to pro for them. so we are stuck in between.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on September 11, 2014, 08:11:40 AM
It can, both MJPEG and RAW. Read the thread ;)

(whether somebody will implement it or not, that's another story, but the proof of concept was done)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ansius on September 11, 2014, 11:05:41 AM
I ment the h264 one, mjpeg would be possible for any camera that shoots jpg, right. as for raw, Have anybody done tests on max card speed in this camera? Otherwise the 40D would be a good choice because of considerably smaller pixel count, thus when skipping lines, less moire. I really wish that I would had time to learn C, and could work on this port...
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AndreaXP on November 18, 2014, 08:10:04 AM
Has anyone done a dump of the ROM?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: imme on November 30, 2014, 10:44:00 AM
But a1ex unfortunately most of us on this 40d post are not developers. We are waiting for someone who can do this favour to us. Can you please do us a favour and do something for all people like us who are waiting for this port.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: tomce on February 09, 2015, 04:25:36 PM
any update on the port
i realy like the ML on 500D and want to have on 40d
Title: Re: [UNMAINTAINED] Canon 40D
Post by: strohscw on March 04, 2015, 06:47:15 PM
I would like to use my 40d as timelapse camera, so if there is a version that enables the main features for timelapse would be great!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: dazzle on March 06, 2015, 04:20:30 AM
I think vxworks is really very difficult task to do since no one has yet been able to create a workable solution for the 40D.

I am buying another 40D again today (since it is the cheapest decent camera I could find) after I sold that last one (due to money problems) and I would really like to see some developments for this in Magic Lantern.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Matchek on May 10, 2015, 09:52:23 PM
Any chance for 40D ? It can be without video, timelapse is what I need.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: masterhks on March 23, 2016, 02:16:49 AM
Wake UP 40D People's after 6 month non stop work on magic lantern on my 40d already i completed some verizon and tested ML 2 days now every thing work great i will continue with testing full month.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: tecgen on March 23, 2016, 01:04:54 PM
Please share a link to your bitbucket repository.  ;)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kidkoala83 on March 25, 2016, 01:05:47 AM
Is it working? Did you manage to enable video? Will you share?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Hibercoco on March 27, 2016, 04:10:06 AM
Please, Post here all the news with the 40d, there is a lot of people wanting to record video on the great 40D and you´re our last hope, we appreciate all of your work. Thanks.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: naegelejd on April 08, 2016, 05:00:15 PM
Hi everyone, I just discovered Magic Lantern for the first time and I'm interested in getting involved. I have a 40D and I'm a software engineer by profession. I'm not sure exactly where to start, i.e. what's the status on 40D support, what needs to be done, etc? I can download the code and build it but I don't want to brick my camera right off the bat. If anyone can point me in the right direction it'd be great!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: nikfreak on April 09, 2016, 02:01:40 PM
Source to use:
https://bitbucket.org/hudson/magic-lantern/src/7d67bc6f378a8e7f607369a374f617491f32d2c5/platform/unmaintained/40D.111/stubs.S?at=unified&fileviewer=file-view-default

Check also "Qeen Mum's" thread:
http://www.magiclantern.fm/forum/index.php?topic=1010.0

eduperez has also 400plus running which is not ML but they share some stuff:
https://github.com/400plus/400plus

Title: Re: [UNMAINTAINED] Canon 40D
Post by: wigyori on May 24, 2016, 05:28:40 PM
Hi all,

Do you accept pull requests for unmaintained (f.e. this very 40D) platforms? Instead of someone hacking on his/her own and later possibly dropping the whole thing for losing interest, or for not able to finish it, without telling anyone how far he/she got, it could make sense.

Thanks,
-w-
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on September 16, 2016, 08:06:44 PM
Now and then someone is posting something here. Now we have a some source files at our disposal, but how to run them on the Canon 40D?

Please could anyone explain.

Thank you in advance who ever you might be.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: vnd on September 25, 2016, 07:58:34 PM
Hi,

I checked out changeset 8159 (the last one with 40d changes) and compiled it with arm toolchain 4.6.2. It went without problems, I did not try any newer version)

Then I took the 5D installer from installer/5DC.111, replaced the addresses of LEDs and write_bootflag/read_bootflag functions with the ones found on the first page of this thread, compiled and created installer firmware with dissect_fw3 and assemble_fw tools. There is no known address for write_card_bootflag so I formatted the card manually.

Then It successfully enabled the bootflag and the camera is able to boot the built magic lantern, which works good enough to show menu. Then I dumped the fw and run ARM-console on it. Too bad that I don't understand the ARM assembler much.

I wanted the fps override function for night focusing, but I could not find anything like shadow registers, so I ended with a hack that writes hardcoded value to fps register from ISO prop handler each time when iso is set to 1600.

Also I noticed that the camera is rather unstable and crashes after several shots. I disabled everything except boot code and finally found that it gets fixed by calling cache_unlock() from ml_hijack_create_task_cmd_shell() in  platform/40D.111/init.c.

Then I just re-enabled the ISO prop hack.

The camera now provides all the functionality that I need and is quite stable, so I don't plan to work on it further,

Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on September 25, 2016, 10:53:27 PM
Sounds good!

Do you mind sending me a copy of your ROM, for trying it in QEMU? The one I have is incomplete.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on September 27, 2016, 04:13:19 PM
It would be lovely if a usable version could be made before I buy the 5D M4.

If I can make use of the huge ML features 
- Auto ETTR and
- RAW histogram
- dual ISO (if possible).

That would make quite an awesome old camera.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: rufustfirefly on October 01, 2016, 04:57:23 PM
I've been plugging away at trying to replicate vnd's success with a modern version of ML -- which has been complicated by most of the VxWorks code being relatively unmaintained (from what I can see).

I'm most of the way through getting it to compile, although there are some deficiencies I've been trying to hack around. If anyone's interested in jumping in:

https://bitbucket.org/rufustfirefly/magic-lantern (https://bitbucket.org/rufustfirefly/magic-lantern)

(I'd be more than happy to either accept pull requests or grant full access to the repository, if anyone else wants to work on it.)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: rufustfirefly on October 01, 2016, 06:41:44 PM
For a quick update:

I've got everything compiling, but I'm pretty sure some of my functions aren't defined in the right places, etc, so it's failing to link properly -- but otherwise it looks as though it's doable to get this working with the modern ML codebase, assuming that I (or someone else a bit better at this) untangle a few of the bad references and definitions in there.

That's as of this commit:

https://bitbucket.org/rufustfirefly/magic-lantern/commits/da9358bcac3caf54a0572be07cad611ee0922b3d (https://bitbucket.org/rufustfirefly/magic-lantern/commits/da9358bcac3caf54a0572be07cad611ee0922b3d)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: rufustfirefly on October 01, 2016, 11:13:50 PM
Update:

I've got it compiling and linking, although there's some serious hackery involved, as well as a bunch of functions which have been dummied up, since I'm not sure where they map on the 40D's OS.

https://bitbucket.org/rufustfirefly/magic-lantern/commits/4a738f3938437566f93fd1def8ff7168ffc90847 (https://bitbucket.org/rufustfirefly/magic-lantern/commits/4a738f3938437566f93fd1def8ff7168ffc90847)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Ant123 on October 16, 2016, 10:09:42 PM
I've got it compiling and linking
Did you try to run it on your camera?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Ant123 on October 27, 2016, 07:47:46 PM
There is no known address for write_card_bootflag so I formatted the card manually.

For 40D111 it should be 0xFFFF43A0.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on November 01, 2016, 08:46:20 PM
Some small progress that also applies to 40D:

Added the 450D and 40D changes to the vxworks branch (https://bitbucket.org/hudson/magic-lantern/branch/vxworks) in the main repo. Did some minor cleanups (compiler warnings), had some attempts at emulating it in QEMU, but didn't really check any deeper yet.

For reverse engineering, I've adapted the dm-spy-experiments (http://www.magiclantern.fm/forum/index.php?topic=2388.msg113154#msg113154) branch as vxworks-dm-spy (https://bitbucket.org/hudson/magic-lantern/branch/vxworks-dm-spy) (tested in qemu).
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on December 23, 2016, 01:09:50 AM
So is it working? :-) Sorry not quite clear for me  :-[
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on January 11, 2017, 09:12:30 PM
Nobody knows.... as it seems. A dead end :/
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Morbius on August 16, 2017, 02:48:46 PM
Is ML for the 40D working? Are there any other alternatives? Does 400Plus work on the 40D or is only for the 400D as the documentation implies.

Thanks
Title: Re: [UNMAINTAINED] Canon 40D
Post by: eduperez on August 22, 2017, 11:25:10 PM
Is ML for the 40D working? Are there any other alternatives? Does 400Plus work on the 40D or is only for the 400D as the documentation implies.

Thanks

As the documentation for 400plus clearly states, "It is designed specifically for the Canon 400D/XTi and will not work with other camera models".
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on October 09, 2017, 01:57:51 AM
Even after all this time.... Here things are as stuck as they are on the 5D4. Why do I pick the wrong for ML camera :/
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on December 02, 2017, 03:46:39 PM
Is there anyone currently working on porting ML to the 40D? If not, is that primarily due to the age of the camera, the difficulty, or the devs lacking 40Ds on hand?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Audionut on December 04, 2017, 07:35:07 AM
is that primarily due to the age of the camera, the difficulty, or the devs lacking 40Ds on hand?

Likely all three.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on December 07, 2017, 03:06:27 AM
Likely all three.

Give me a pie chart, then.  ;)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on December 23, 2017, 09:39:29 AM
Good news - 40D boots the GUI in QEMU, just like most other EOS models!

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fa1ex.magiclantern.fm%2Fbleeding-edge%2Fqemu%2F40D111.png&hash=04369c61b43b6618c33ff955030d745c) (https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fa1ex.magiclantern.fm%2Fbleeding-edge%2Fqemu%2F40D-menu16.png&hash=ecc0b3dae12ea6279a280d456aee5c78) (https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fa1ex.magiclantern.fm%2Fbleeding-edge%2Fqemu%2F40D-menu15.png&hash=ca5d6dd40e2a57c94ad13f73f09178d7)

The last screen looks a bit odd - how does it look on a real camera?

Also compiled ML from the rufustfirefly (https://bitbucket.org/rufustfirefly/magic-lantern/commits/all) repository and got a half-working Space Invaders clone (menu appears when pressing delete, navigation keys are working, fonts don't seem to work):
(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fa1ex.magiclantern.fm%2Fbleeding-edge%2Fqemu%2F40D-ml1.png&hash=680fdcd6ab89e14cce8bddde76407956) (https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fa1ex.magiclantern.fm%2Fbleeding-edge%2Fqemu%2F40D-ml2.png&hash=ba560ddb7bf16d9c6b541dbc5069b843)

What does this mean? Porting ML on this camera is no longer difficult at all - it's just a matter of fixing the remaining issues (you've just got a very powerful tool for that) and bringing the source tree up to date with the mainline code. All the changes from rufustfirefly are also in our vxworks branch (https://bitbucket.org/hudson/magic-lantern/branch/vxworks), but there are a few stubs missing; still, it shouldn't be hard to fix them and get this working in the emulator.

For the impatient: QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/), installation video for Ubuntu (https://twitter.com/autoexec_bin/status/913530810686418944), for Mac (http://www.magiclantern.fm/forum/index.php?topic=16012.msg191686#msg191686) and guide for Windows (http://www.magiclantern.fm/forum/index.php?topic=20214.0).
Next steps: dfort's porting tutorial (http://www.magiclantern.fm/forum/index.php?topic=19417.0) the EOS M2 walkthrough (http://www.magiclantern.fm/forum/index.php?topic=15895.msg185084#msg185084) and the 450D port (http://www.magiclantern.fm/forum/index.php?topic=8119.0) as reference.

As mentioned earlier - the camera is capable to record video (both MJPEG and RAW).

Want to help? Please follow the above links and confirm you can get the same results (screenshots) on your system. Proof-reading the QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/) is also very welcome.

Happy hacking!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: goldenchild9to5 on December 24, 2017, 06:32:26 AM
@a1ex WOW.. you are putting in work.  By the way happy holidays.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kyrobb on December 24, 2017, 11:51:07 PM
Possible MJPEG? Is this something unique to the 40D or have I missed out on some more recent developments?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Walter Schulz on December 25, 2017, 12:13:35 AM
https://mobile.twitter.com/autoexec_bin/status/944627528999800839
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kyrobb on December 25, 2017, 04:26:52 AM
Awesome! Thank you Walter!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on December 30, 2017, 09:47:24 AM
Good news - 40D boots the GUI in QEMU, just like most other EOS models!
...
Also compiled ML from the rufustfirefly (https://bitbucket.org/rufustfirefly/magic-lantern/commits/all) repository and got a half-working Space Invaders clone (menu appears when pressing delete, navigation keys are working, fonts don't seem to work):
.....
Happy hacking!

Lovely! MORRAL KOMBAT is next! :)))

Joke aside! This is a great news! After all these years it would be lovely to have a working 40D with advanced functions available. Even though my 40 D got so broken to the point its repair cost is the same as buying a second hand 40D. But I’ve got a friend who’s hobby is photography and he got the same body.

I hope for the best! :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Konrad on January 01, 2018, 11:16:16 AM
(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fa1ex.magiclantern.fm%2Fbleeding-edge%2Fqemu%2F40D-menu15.png&hash=ca5d6dd40e2a57c94ad13f73f09178d7)
The last screen looks a bit odd - how does it look on a real camera?

Thanks a1ex!

Here's photo of my 40d's info screen:
(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Fi.imgur.com%2FfWyLEk3.jpg&hash=b9e3628f9d4d04b24bcfba913e5a8ef8)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on January 02, 2018, 12:07:39 PM
Beautiful. You are wonderful people. :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: R on January 03, 2018, 09:53:31 PM

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fa1ex.magiclantern.fm%2Fbleeding-edge%2Fqemu%2F40D-menu15.png&hash=ca5d6dd40e2a57c94ad13f73f09178d7)

The last screen looks a bit odd - how does it look on a real camera?

Here's mine.

(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fimage.ibb.co%2Fbwu4Uw%2F20180103_214532.jpg&hash=773a8c54c9add7e01c3da8802297a48c)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ilex on February 15, 2018, 09:48:54 PM
a year ago my 50D eos where I had installed ML crashed and since then I'm using the old 40D, although I miss not being able to enjoy ML. Is there anyone who's managed to get ML running on the 40D? Thank you in advance
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on February 15, 2018, 09:56:35 PM
The closest thing I could find is reply #379 (https://www.magiclantern.fm/forum/index.php?topic=1452.msg172529#msg172529) - that provides some good hints on how to get started, and a changeset ID that is known to work, to some extent.

Next stops:
https://www.magiclantern.fm/forum/index.php?topic=991
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ilex on February 16, 2018, 02:26:59 PM
Thank you A1ex for your information and time. Unfortunately, my knowledge does not allow me to perform the tasks recommended in the posts. I will have to wait until some member can upload an operational version for the 40D  :'(. Greetings
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on May 02, 2018, 08:32:21 PM
I started to think this might happen before the 80D was cracked, but it looks that's a bit more lively at the moment.

Are the issues wholly different, or is the primary roadblock common to both efforts?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on May 02, 2018, 08:55:04 PM
This one is quite straightforward (anyone can follow a tutorial, sit down and debug ML). I've already provided and documented the tools for that.

The only roadblock is finding a 40D owner interested in porting ML on this camera (maybe you?), rather than waiting for someone else.

Don't expect a new port from me; these old models are very low on my priority list. I'm just making sure others have the tools they need to port ML, that's all.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on May 05, 2018, 09:31:25 PM
This one is quite straightforward (anyone can follow a tutorial, sit down and debug ML). I've already provided and documented the tools for that.

The only roadblock is finding a 40D owner interested in porting ML on this camera (maybe you?), rather than waiting for someone else.

Don't expect a new port from me; these old models are very low on my priority list. I'm just making sure others have the tools they need to port ML, that's all.

If you want to PM me the steps and risks involved, I might be able to help in that regard.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: tensiondriven on December 11, 2018, 03:16:16 PM
Hi All,

I have a Canon 40D and am somewhat technical, I would be happy to invest a few hours testing with the advice of someone who knows the deeper development side.

Really looking forward to getting a distributable build working for the 40D, even if it doesn't have *all* the features!

Jonathan
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on July 14, 2019, 07:28:34 AM
Just curious if anyone has made progress in the last seven months, or if things stand as before?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: acasta on July 25, 2019, 02:04:12 PM
Hi, I recently got interested in ML and would like to make something of it on my old 40D...
I'm still looking around in the forum and trying to understand how code is organized, but I'm also stuck with the preliminary step of rom dump.
I tried the portable dumper (DUMP_40D.FIR) with 4 different CF cards, also old ones with 256 MB capacity, but it does not seem to work: the MD5 for ROM1.BIN is different each time (even if the check with PC always succeeds).
I was wondering if anyone had success with DUMP_40D.FIR and could suggest anything...
Otherwise I'll have to try what previously described in this thread, but that I'll need some more work to be ready with that...
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on July 25, 2019, 05:19:54 PM
That's probably alright - Canon firmware reflashes the ROM at every shutdown, to save their settings. If you compare the two ROMs, you will see differences only in the settings area (not in the executable code).

To get the same MD5 every time, you need to avoid starting the main Canon firmware between the two attempts (i.e. just run the dumper twice, possibly on different cards, without booting the camera normally in-between).
Title: Re: [UNMAINTAINED] Canon 40D
Post by: acasta on July 26, 2019, 04:39:38 PM
Ok, I see, I'll check that.
Thank you A1ex!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: acasta on July 28, 2019, 04:44:04 PM
I checked out the vxworks branch (commit 18ac6b0, the last one on that branch) and tried to build ML for the 40D.
I am on Win7 + Cygwin at the moment and did:

Code: [Select]
cd platform/40D.111
make zip

Many modules were not built, other modules had comments such as "Will not load on 40D".
In the end I have a zip named magiclantern-Nightly.2019Jul28.40D111.zip containing, among the rest, the following modules:

Code: [Select]
$ ls -l
total 1028
-rwxr-xr-x 1 ...  33118 Jul 28 15:58 40D_111.sym
-rwxr-xr-x 1 ...  21828 Jul 28 16:03 adv_int.mo
-rwxr-xr-x 1 ...  11816 Jul 28 16:03 arkanoid.mo
-rwxr-xr-x 1 ...  17800 Jul 28 16:03 autoexpo.mo
-rwxr-xr-x 1 ...  18068 Jul 28 16:03 bench.mo
-rwxr-xr-x 1 ...   7632 Jul 28 16:03 deflick.mo
-rwxr-xr-x 1 ...  11636 Jul 28 16:03 dot_tune.mo
-rwxr-xr-x 1 ...  15488 Jul 28 16:03 dual_iso.mo
-rwxr-xr-x 1 ... 324544 Jul 28 16:03 edmac.mo
-rwxr-xr-x 1 ...  28240 Jul 28 16:03 ettr.mo
-rwxr-xr-x 1 ...  14600 Jul 28 16:03 file_man.mo
-rwxr-xr-x 1 ... 304104 Jul 28 16:03 lua.mo
-rwxr-xr-x 1 ...  42224 Jul 28 16:03 mlv_lite.mo
-rwxr-xr-x 1 ...  44372 Jul 28 16:03 mlv_play.mo
-rwxr-xr-x 1 ...  62596 Jul 28 16:03 mlv_rec.mo
-rwxr-xr-x 1 ...   5772 Jul 28 16:03 pic_view.mo
-rwxr-xr-x 1 ...  30576 Jul 28 16:03 raw_rec.mo
-rwxr-xr-x 1 ...  22028 Jul 28 16:03 silent.mo

This is my very first attempt to build ML: would you please let me know if I'm on the right track, or is there anything evidently broken?

I have disassembled my ROM dump, my next step would be trying to understand more about stubs...
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on July 30, 2019, 09:30:59 AM
Hi acasta

I'm joining in the fight to get ML running on the 40D.


The modules that "Will not load on 40D" should not have been put into your zip file I think, it looks like you get all modules in the zip file (17 out of 17 in the Makefile.modules.default).
Might be a cygwin issue (?). Compiling on a new installed ubuntu server, for 40.111/vxworks branch I get only 3 modules in my zip file:

All other modules do compile, but throws a "Will not load on 40D" and "../../modules/Makefile.modules:64: recipe for target '<module>dep' failed" on my platform.
Most of the modules are missing functions not implemented. Regardless of what - if you try to load a module with a symbol missing it just won't load so is not that big a issue.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: acasta on July 31, 2019, 11:28:44 AM
Thank heder  :)
At the moment I'm struggling a bit to build QEMU on Cygwin.
I had to modify configure_eos.sh to make it use the right compiler and then some dependecies were missing.
Now I get some compiler errors that I still have to analyze...

Indeed, building this on Cygwin is apparently not so well supported and some problems could be because of that. But I can't use WSL at the moment.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: acasta on August 01, 2019, 04:20:50 PM
...too many problems with Cygwin  :o
I switched to an Ubuntu VM and everything went smoother and much faster.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on August 12, 2019, 01:24:04 PM
Finally got abit of work done  ;). Took sometime because I had to deal with all kinds of other issues,
mainly qemu+gtk+vncserver not understanding my keys correctly, so I finally switched to sdl,
eventhou that removes the possiblity for me to see console.

Anyways :) a couple of fresh screenshots, now it's possible to see menu's .. ect.

(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2Fssay8eW4Bpcf_ycxsWPsnpS3dumbsBuyM_PuM7hvplIv2RSP-IYl_WtnmXUn6U4ABr6kYBzLuu98iHjwCwlkKQYEg67bnOss6bT7DYbfKKeGHfK9br9ZRgD4qGY9G9eizS1ODgtS_q8SogJO-0XH3AiTnCPyBdVzjtlyCY1UjdISmtxpiQIfp23n3scvkZVbebx8a9fPP543G9RIeMzi42WqXFdJlECwFBEMxb60aOHdv29T7MTc-5ihEO539Eetwb7MAvXOBVaI2uBl695eStam5bz_D0DfVTUgKM8ut04wUWprzJ3-50ye8ZWLDPiymQA31LgbV_trBNQTIWBZ32C4-Wh4wZTysx4HWJ2fLROnSOTFzV4gMGjzyPGSFt_23KuM3_ght1HBmtd-IYzH3iZJxXpqhJYAvtMEn6ee0Z_j7Pb2jlqYPdgMlvPiyR8aqUQ40Dv7c8V5MrQGasPsY0C-9d3KOK4t3kfeoca_d9wqlK1SWskZQIN0f29VY7hmYIIQqqn6qOYswLdMNibeA2RPkFiqiJ70V91K80ev98WcPgrclXq6Oz_Agc_IuWUZK-p2osMr9C2s6qfbUoLD69PHsvjUF4NXNlXk0r_CujaBjMJHg6olWmWhWL6lzx5Q6FR4hPptuvNjHdgtUrZQorQhQ-b38RlCiWV-V3L43l-GUXUg_QzgyGGtd65bHjqWK35J8ig8kwclvImMlercK3e5%3Dw544-h385-no&hash=243e08f68e0a9916adf1aa5acc59d33b)(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FurvtiD2GHa5-nnhhQSh0Tb2F0cOJoMmr97w3chh1mZbvtqQVrqOK038sAaPTcdCrgujnyWPnIPd7Lohxtw%3Dw312-h220-rw&hash=2ab30ca42696bf85cc3a4407b692642f)(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FN2cpvd8TY0TFpIWIIlOHEMnNa8WxdZSKbXElP_6VYx7zCYFCyxeU1gsdbY03Psv2GYc54D73eMuCShWFIA%3Dw311-h220-rw&hash=49cb8d409a1f6b99c192977f7ba946eb)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kitor on August 12, 2019, 01:58:02 PM
Great work!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ilex on August 13, 2019, 12:31:32 AM
Thanks for your great work!!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: helinhof on August 16, 2019, 07:28:49 PM
Here wishing luck for the peeps with the necessary knowledge, this will be an awesome budget camera with focus peaking and basic video  :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on August 16, 2019, 10:14:56 PM
I could'nt get fonts working, properly due to incorrect qemu / cf access or similar. None of the FIO funktions work.I got a bunch of cf card errors in qemu. I decided to do a quick
and dirty hack for now and use "xdd --include" to include the fonts as data and load then internally. Now everything looks like they should
(atleast for now). 

(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2F25gAo_2Jk0ufUXi3QejAMxntoC7CtownpES3MeXYBCsTTYIXM-xw8Xq5g9Kk-Wf7dDuYMT1sc0OF8OWomKr8Nn68swkariyiD0ClPy6G2Wb2MSBlx28hROh0bKUt4G8vEtZmAB4Z3Urfm4hM03kty__JKQDeGMvVArN5Y6-xYCp32MSsyxdo8PqhJx0x9S-abv9CNsHXWXZOsux2pUOGJR5OZ3PI0ZQiLVi9g7UqlE3SdylosQ-IGRdJI94s1BiBCcr2q3bOatklCA243f_PHrfYRCkjtSd8gi-7PWuWkyUCcZrdcniX6SSEYxMmKFbAat_VYBTwtp0nmow_WvHAzjh8DYDlrVxlPXSoPmKLYRj6UHXgx7xY2pBgl1oH6v6X0AE5XOaSyBfjeVJ4qQ6jmYTdbQB7dUvFcWMj6kbrintwyTogkEdQE6a3n7bwtHY5OzctKrLl3X1NW0S809lIyVkynqh-gq0JYWUAyTreZJdwqbOF-2B-CSTSM9D7CcIqJSVp44f63V1des_nsa6LdR-vy2cYIELZdim7BTV_BcrDaU7o6Ec2L7mQARv1eIAZu1_ufbRjdHdJQv1rh3o6Opj9cjFz0h_GkYCF0qU-Ym3jw95pBv1wO8EFj93mNu92cepmO6iITiqemPfTYAjwlAuksZ81U9iy8E1QOB1hx8vLusrgBGs6KsZqFkfcbRJgC4geSAUwqu-1GgNp1p8kqhVa%3Dw1602-h815-no&hash=117b014eb29bf62f0a934996957e0838)

Then I tried to load this version into the camera, nothing happened  :(. The camera did light up with the red led for a long time, and the camera worked just fine,
but no ML when pressing trash can button. 



Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on August 22, 2019, 10:35:13 PM
I need to set the bootflag in the camera to true, but I can't seems to find any ".fir" files for that.

Suggestions ?

Ok .. I found the solution .. read page 1+2 of this thread really carefully  :D and create a fir file that will toggle the camera bootflag
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on August 29, 2019, 10:42:50 AM
Finally some success!

Got a bootloader constructed and loaded with ML. Images of vxwork branch running in my camera (upper images) and changeset 8159 from unified  (lower images). I will spend the next days by getting a status of the Canon 40D progress, create proper bootloader and hopefully commit and push needed files for continued development. Then I'll make a new post.


Vxwork branch + modified (fonts have been included as static fonts)
(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2Fumeaql3xh5hBN_bmNp8GXRJEDfr1pYKAZgp1W-woO4vSkrL_LNowZ3KtOQXaZdGsmze2bpwOvrHqtsNenjMKcuVREeSgwCDyKFr8v7yMB13EEsI7CkTbN9-HiTv_ZqdC22nzKx1k3efcIBS1P-hxEidfBsWQ5ibwLjzF_YTpBw2oyktw8_S8m6gHU5g670W6K2DhQFDYZUBqe0bI0m4kioHqbeynLZvX1W0cc62X_JWGV-8yJPIFROJVqb8I_1BIniHXFr27qqLW1Hq63ODRXsYPtaOYgONIz1HXWPFjU4tpcyl6KCcVyucZf7nT7lpCW15tVcNm2xQ73HLaMTmt2XNgNSUi6beONCB8jIEWKr4ZDIv6dS1cJ26I1OIEFub15g5YMuNEwdpKVd-ynL8GmjEVcPTfxMpEi4UBn7MCqi0mQRqYB8ZoXXBYT0KNimTaeLpXvrHAWE3iVAIoGS570PjsWWe7hFeA06KTmi6ounPK_269JEIFdUx2IsG_OzLyxkEMoee6hIq4KZ2ejUbG-SCVuLpw0QoJ7jXfKTP6Fh04VR5NXgjgCg7wDwZlxpWnmdh0X6EP-6R3qX3jNJ1HZB-AD7KKneV7D5sjcgkv-waQaTZA6-EZvBmdoSdrmMbmU9uAE1jCdqD6FwbHvjjuSr44HpZXh3T79DahtIQoKMteGoUlhS7UsvdQhISdEyy5NoHxsOnauSmy1X1h5BWMbQeo%3Dw1027-h770-no&hash=e3d65bdfbe60cd8f23807d09ad310dd9)(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2F9phT5t0s4D_FMvbedGFmBgqFTm0T4gsbW0WcliUlymlI8dq3y7PB3JZNERwyJn3e2Xli8rxzmI_QNa8Tni0twjMJtPL4pTtTLNEzSrOhD_rlUNl1PcLzTNcX7Ci7B2bq0Tz4rVuSqHe5jk5XaS1yczUK2yeF9b4G7S5KNaxh8mzoaBGztjxuwkgxEZwmKTgFfZDTMWHnrNhfLGeFF9PnbXjrEQIwnwrh1GxSNwOcDpA-ZgpkeIfkNWgVll2oqPNpIMUQjVmEGqrZtMAzgG0EUScDmZcKJu0K4j-d6WrbUcd9tIhl0pkoAoSCtCAprWrLtnB4QcH6LhSb4eBF_eIEqkv0h-QqxMj8svlkMTubAseHGXIuvZfcioyTU-O_scE30QlXUSlPeqJgSrLho2LnMjQryGJIzU08b8SVSx54Wl_CDbWvXUVVDcDG_3wIIcP3qr_lfBMBFwLqY7wYcwKnmu6pjHG0yTNzhO73qNMq93jzJ10cMYtnqbZ5iztC3aV2gGOd9umrC_DiSyVEIn-nPC-QKiAC4MWlxRj6U4f1Xak27H4CEn6nVNxQX1zG6_NyH7c4tiagamz5HGbuDnnmbWOoUXtnF7u612JlfNkSu_5uveB0Tp6ujNEj9iC1RFqGf1oS8c4-UZz917-c5l-FM2pQ8ZHOpGVtCCvaOiiDKrBGWOcU8_Z-O5g7cyur7jvLR6GDEGfVrp6adjZnJqzr9DxD%3Dw1027-h770-no&hash=96d0303d1a3b06388066f36e568497ad)(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2Fyzv7BRLSpAwSjv4Lv4LRMpW1kLTEaPBPaaF6VADhup4VvANak2J3r6z0qxZ8HTkUtYEPSm-WteDIMjc9qgZ7NPz6wSKyr_MABRBC-lUChp9oRcZLbOHM6otkt2SSYIODLlDK39gJmUhm3ZeIFrHup7XYu5LwnJFSlqwqVxgXF34JGM5E3gyJUeVuqecPOiL8ywBepv0q2GhKB2bHGd9D8lBR5ePUEI0uEkeFFWuBYAqRWC7BMcxDDBfhYdbSSj4U4ii6Fe_b0jLWCAlw83bDnEzICLcDJbGcL7tIUQ9anaeclKrExerUc9H4FfSMHL0-GZvR0zvL1dXYHge-Qq3le9bV-R5Fp6hLMo__-HZEmJmsJL_FWC3aDtEyuf7Scvd70IoDoKReLlGvRLrvmW-mNS4XJSWhdPYgSE4bidDZC6a2iD82NN8BDQtMINsUddA97L-P4DAv5uHowa3ypVEsMFhIxu_4ead1JT-9sEj4rnyx_Wn5be1zPXmPWgAHdD7hbEQgmhbdUGNMvLRE5RZZmRdXqmg7RR58sbvtlXgnofVSOGX04uLyZTie07l04odtpWRwAUlHn0TnHIOGfmt-d_u8a3eNOV-hwDM4jQHVnZwFO7ixX_HAEWVjfN77q8BR6XGm5E9gYP8mi8cAHTSAqeOo9c9flThsdcS3ItIGQQuPpkENjai12x7guhsCfNArzFI63fGnyDGhYBGNWyPNORj3%3Dw1027-h770-no&hash=77b51e590ab917838b83aa1b4b9a06a4)

Unified - changeset 8159 (commit 091b9f8)
(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FS-F6MCWyeIwPyJ_IEuo9Yske5cRpQVXiawLH1k2Itk9_TpQlM2rA416dtKnGoklvhma8BKb7HRxf5xHSMlv18tl5QBPSYvtwZkojxAKfkzYXFCd8T8KFyT9X8MvdVlONCskzVhV27WHMhFha4GdipF0v9J90n6eTPLqCdtr2S6Rn-QFAtkT6d3xyIlJq6nLQp3dpNilFlldowq4QZWcXkN2QNrSd_YGNaVfez8tEXKOtJ87u_Eev2HAtOu0KNT9Vpk6a1Uv-0GR822-etTzJ8TONG4nzjqTU7vUHHGJrR9vf9sxMeDNi6iExaucgYX8L7ZSlb60XEyBUBwcCfAPa4tEdmsFf0_JSvWa4wsaPpVBxEsdryt_bjzRXy1pMiBufTLphzF1nNtzJKYQOSVi5s5Qdh8zsyZZPjEwO-I2vC_gBCHJK90g_xmS7x5VjUq2sXbTr0YV5H_PieJq_C20sxGIyZZcmrUY7BQGkZ4J-WPwUirBnuiFhux3xk1BUsa7NsdUn-IfZTLVz1PilVusidt6EVyk3NEEKcpmsv2aULoHOayft5cPFSfpeV1DHMAKSk4m_w58pnUCAHAiBu2aPQ77E97nJR4wO82ZJrVLNTI5EIosS3rTS-ttfKx_ChQ7zoinN0dak2BuiQWfwjXdUEWvKCjBIyiXAemQ9SXzqsqqqctzDT9sNEfLV9KXBqcX06nCH3fLiUDhXwHWLZ6Aec3b0%3Dw1027-h770-no&hash=90fd098d55aa5ce2d57e47f2934b5b7f)(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FI_VubBqmtUdjvhwk8uNx0krxNT8qpT-NL7_aeB4W4HfXlUhPvEB3dTeo2LQb3ba-WFh4U25Wh4JjuTAAIpLozKdiRUUuBtaBRwgBWnsgDfXbTiSB5XiFxgUbO7z8ue4ezc5eXv8oJyeFvUceqZccwYgShzhwRU7fru9yNvUzjY_x9vcpbK2S4OIIZy6bG92Ckd20iK7qm9V2sTbJtkLpLHRJHf0BN2aTVAm5GAZsA2OSu-Sb4u0uEW-OTPrIeWnbEmvliyth1qZlUu6w-jR144UCVMMFx3OZzIxOQ1aXDcokCVOiihJL_eP4FTMLz4BxGOthT5zIOfDKJck9tWQgAayKEmwfoPbSHvmdiKAZldXLb_9FifLb6N-f5dvnpXL2J7ElmfV9J82XJvNOZyKw1goMhdX0u1qwRNyyMUl2jhxwfsqbUjXczRnxjbvcxQLy9lzGEjlh3XznwYev8UElKhZmwCNwYhZe3anpae1zIdvZykpf5eT9NwAErSzNtO4Pl8eAc5frxeaiI0Aj25tLRRnXpxx1ZfoOcWR7tMB3fGfvTG_vo5NuWCz5Rp2s08Wrw3jhg22gkIliSQHdh7Cas9inA5GFpj7TQMec-U2x6-OBSVV1XoMCwlGHjqlk8RbXgY8qg1vUW_7vGC0n_jaIOTVq3d_c14FKFXUEfFZtEVyEABQFEZkXzttsVaWCoN6SSfqP3piWU1WDKXCCx9axEtvp%3Dw1027-h770-no&hash=ee79b8d19d41d090106cf0a35cbaa34a)(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FovIpWheJOXTBHfatV-ToJCN9Ol-6fup1vEGIk-OarYWFwKN5KsbptpCbeKwbJdH5Q46a91pnl263ytvE8dbO-kXgeiZCwaNG5EJzYK695vfonIQelQktGoKrygYt2Gvn6hcdW_JQCew_m2RF6QJGK7exIVDLAECl6KqJDvAnvj_rGJm3RjLOt0LfFE33rqiuX3Xu_GXL_-bmw8NqylVOVJxXMlRVqOKfVmGQuNvYyoXqXepLpaDidBVXbo4BCgeSyKX5JXlp1LqJsgcfljvc4K2Ie6NXqXjtPi35dc8PZQIcT_NiX97Vu_k1xp-ke5KT9VQpDkbSSgqbn3Q_R8kmBdF2sdCO9XrnxnfLpc0WLbyuzE2NGFnSBsYDe3EAynQ7LvVnoxC3IL7TgocCn91JTod0vYkGvrYqVBZREZmXdDFJfe8in27kRHiwvRRjAIWEAIkliKVxJMm7QxJ0wQX7TTzKr52qX2kiXkJ9K4VwWnDwSASdshxKnegJZ-ZisyFhqA-bjMoKnAwU6gSqs8xFJCHhi1nfwB1eSjOoLS8kvzSH_4S_Dbj_v2Xa7d_O-5d7cChGCmcJMvpW9XvkkGYaYvTroBcNAD87pwtlhOerW5_02lCBQodkL-LYTC8oQI8tOq2ZcBnrcVCJJyBygVLBsjZXiEHg7bN4odMh3mir8Ti3CAF7zA13LdOyknjeDvPImR3TfJvbLyKxC7PcpkalX9xs%3Dw1027-h770-no&hash=1c976457c53d3fd23d85efa9d7680d7b)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ilex on August 29, 2019, 11:03:53 AM
Up with de great work!!....Congrats.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on August 31, 2019, 04:42:51 AM
Thank you heder!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on September 03, 2019, 10:39:51 AM
Hi all! .. Long post.

I have worked the last couple of days to get a overview of the Canon 40D port which is born with the DIGIC III processor. All models with this processor have more or less stalled so getting one model ported should make it much easier to complete the others.  It's the first processor in the DIGIC series to have 14 bits support and with the Canon 40D's LiveView support, we have all the possibilities for a great ML upgrade - it's just here around the corner.

I hope more people with a canon 40d (or 450d, 1100d = all DIGIC III) will come help me creating a experimental release of ML for Canon 40d before Christmas, that would be cool (if not - its gonna be a easter release). I know it and old camera, but it still a pretty cool camera no matter if you use it as your primary or backup camera. And in these days with mercurial "sunsetting" (what a shitty word) on bitbucket we need some development to move the focus away from this.

Here is a short status:


Rom dumper
Link: https://www.magiclantern.fm/forum/index.php?topic=16534.0 (https://www.magiclantern.fm/forum/index.php?topic=16534.0)
The rom dumper work fine, but is victim of a power save mode and thus after 1-2 seconds after executing the rom dumper the screen goes dark. The rom dumper works, and you will need to wait for a minute or two before removing the battery. The ROM files are in ML\LOGS folder. Only ROM1.BIN has code, you can decompile/analyse it in Ghidra, specs are here (click image to expand):
(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FG0tbX206XJ6I_05lWtb7Fd2yx2F9z9AYix0M6ylFMaxCTSxYTZ_tWJGYJp6Yv_nLirrvLbH3sdY6qZh7mFfj2IOcycMf8zxO-H9mPWvX_Q-q0eXLxC6ilQ8qibS6657Iyb_dVrua5agfccqeQ05KxRtUNo-Jf4ulRXxybRKmuv0N_UHwLYsew4okxmEcREUlgYAV47-25VGwY3woTCziuNXrXDiS0nNtoNZwN1-XTXkqwdtz8wsw1N82eGqx9B-Bs8CMNYcI9HBJ3D07g5L-1ii4kcmzydNFVR-OskzfcgVG99d8XU3xrGBT-FRc4QFwX_GePsfNRX7-LYysCf6g6Hmrj0o3_mb7OlZA7cotHOFNbd3R4B5umkJfY_iwCMoognWbn6W_EJUGgtQjpiFeGF0Ml6Ud8bKmFSRf2mUGAstYg5d_6ZtC8CyvhUJwU0EUuX1s7fcllXhHpUMzo7iviDDZlbk9jFRopJdjOLh_f75yLX62dgr6mf8IPFj4d9xco4vCw7dhZkXXg1GWzSwgxnc0URHJ80vro3G_5BsmuYuLDPlxX8ic7K-yN0p1zpie9XlyIJ6EZj8Ri_rkJ2ZCk8hgyTw7laGQFRbXzXL7Ch97M7SNv3ySCd6PVoXxtGXsDbY0ZIrnl3q2BKrk7tgPSOk1pKyW4uzGgPaeqlvt-azcTSNeDH7YmC13HAnJ8TZFkr5IO5QL5Xovi2EktfaCwyCac_Tu3vyggCXapek96dHTm3ge%3Dw676-h420-no&hash=f311725799d41be6401f9b902a6f10c1)


Useable source repositories:
1. https://bitbucket.org/jmheder/vxworks_canon40d/src/vxworks/ (https://bitbucket.org/jmheder/vxworks_canon40d/src/vxworks/) (vxworks branch)
2. https://bitbucket.org/hudson/magic-lantern/src/vxworks/ (https://bitbucket.org/hudson/magic-lantern/src/vxworks/) (vxworks branch)
3. https://bitbucket.org/hudson/magic-lantern/unified (https://bitbucket.org/hudson/magic-lantern/unified) (unified changeset 8159)

1. My working branch, properbly the best starting point atm. This is based on 2. with a some modifications (stubs,debug, defines, temporary static rbf fonts )   
2. main "vxworks branch", rufustfirefly rework of 3. will load, but no font are loaded (so no text)
3. The branch vnd used, old menu, but with static font, so text is shown, missing cache_lock() call.


Compilers
Compilers from launchpad, which I have been lightly tested are listed below. If you are on a Linux you will need multiverse for executing the old compilers (they are x86 compiled).

(4.6.2) ok, gcc-arm-none-eabi-4_6-2012q4-20121016.tar.bz2
(4.7.3) ok, gcc-arm-none-eabi-4_7-2012q4-20121208-linux.tar.bz2
(4.7.4) ok, gcc-arm-none-eabi-4_7-2014q2-20140408-linux.tar.bz2
(4.9.3) ok, gcc-arm-none-eabi-4_9-2015q3-20150921-linux.tar.bz2
(5.4.1) ok, gcc-arm-none-eabi-5_4-2016q3-20160926-linux.tar.bz2
(6.3.1) ok, arm-none-eabi-gcc (15:6.3.1+svn253039-1build1) 6.3.1 20170620 - Ubnutu standard
(8.3.1) bad, ML crashes at boot. gcc-arm-none-eabi-8-2019-q3-update-linux.tar.bz2


Bootloader / Flipper:
It works, but the code is not ready for releasing yet. It's based on the 5DC, but it does not work consistenly everytime, but so far it has'nt kill my 40D, so the errors are not fatal. This is my priority no.1 to get done.


Status, what works
* Basic bootloader works
* Booting magic lantern works
* GUI menu system works
* Totals Clicks (in debug menu)
* Temperature partial works (only shows raw temperature, but changeset 8159 (unified) shows celcius)
* Showing edmac channels (we have 16 channels)
* Showing vxworks threads
* Dumping log via call("dumpf") works see end of post for example (unified changeset 8159)


What does'nt work
* FIO_* system does not work and will result in somekind of file system lock
* Camera will not save images after capture (FIO issue), busy spinning icon appears, when powering off.
* Fonts are not loaded (FIO_ issue)
* Modules are not found/loaded (FIO_ issue)
* Dumping rom and does not work (?)
* Small fonts is incorrect scaled, totally unreadable
* Power off will sometimes result in crash
* Menu/GUI system LiveView button (set) not recognised, after liveview press PLAY before going into ML


QEMU emulation (QEMU branch)
I'm building on vxworks, but using QEMU branch to run it. On my mini server (intel atom) QEMU is rather unstable, only using vnc or no display will get it running
properly with a properbility of 50%. The emulator plays more nice that the real camera. I don't have the same problems with file system (FIO). I can dump
rom and call("dumpf") without problems my working branch.


Digic III
The Digic III processor uses same address space like all others, yet since this is a older Digic processor it might miss out on some features. CF address space is same. EDMAC address space is same (but only have 16 channels) FPS_REGISTER_A and FPS_REGISTER_B are same as all others. DMA0 the same .. ect. Mainboard comparison 40D/50D/5DMKII can be seen here - they are quite similar (click to expand image)
(https://www.magiclantern.fm/forum/proxy.php?request=http%3A%2F%2Fwww.centralds.net%2Fcam%2Fwp-content%2Fuploads%2F2012%2F04%2F50d_5DmkII_Mainbord.jpeg&hash=930ca058e52e1789433597d978c1106e)


Medium/Larger tasks (random listed)
* Create a proper bootloader ("You may now remove the battery") (my priority 1)
* Fix FIO_* vxworks issue, file system lock (my priority 2)
* Get modules / Digic Poke working (FIO fix needed)
* Find free eDMAc channels and enable edmac_memcpy (channel 7,14,15 is reported as "unused?" in debug menu)
* Investigate how many dma channels we have, I have seen DMA0 is ghidra, but not DMA1.
* Investigate liveView
* Iso register investigation
* Bulb mode investigation
* ect ..


Small (random listed)
* Verify that we have 16 edmac channels
* Find Base Clock Mhz and compute default fps in liveView
* Compute FPS_REGISTER_B default (computed, see code at 0xFFFFA050) FPS_REGISTER_A = 0A070A07h (defined at 0xFFFFA130)
* Implement take_screenshot (FIO fix needed)
* Perform benchmark with slow and fast CF cards (bench.mo - FIO fix needed)
* Use Digit Poke to check for CF UDMA 3/4 support
  -> CFA3.0 is supported (string is present in FW)
  -> cfSetTiming does not touch UDMA registers
  -> 1Ds Mk III (DIGIC III) supports UDMA mode 3 - 45 MB/S
  -> new 2019 CF disks just uses CFA3.0 80 ns access (pio mode I guess) - see dumpf log below
* Test arkanoid for a couple of hours (long term test - FIO fixed needed)
* Investigate dump log (startup + enabling liveview), maybe the experts can find some interessing stuff in there ?

Canon 40d "dumpf" log from camera (Properly from source 3.). I started the camera and went into LiveView and then disabled LiveView again.
https://drive.google.com/file/d/10SMuQdFO1qWTv7p5qGRpd0wwj211At_6/view?usp=sharing (https://drive.google.com/file/d/10SMuQdFO1qWTv7p5qGRpd0wwj211At_6/view?usp=sharing)

/heder
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Ant123 on September 03, 2019, 12:07:09 PM
heder

Do you have the same problem (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212509#msg212509) with ML menu in LV mode?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on September 03, 2019, 02:39:20 PM
heder

Do you have the same problem (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212509#msg212509) with ML menu in LV mode?

I cannot said yet, LiveView is'nt enabled and supported on my build yet, but I will keep that in mind.

I don't known about 450D, but in Canon 40D LiveView has no special button, and must be enabled in Canon menu system. Once enabled LiveView can be enabled in some mode when pressing "set" button.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Ant123 on September 03, 2019, 04:51:27 PM
I don't known about 450D, but in Canon 40D LiveView has no special button, and must be enabled in Canon menu system. Once enabled LiveView can be enabled in some mode when pressing "set" button.

EOS 450D also uses "Set" button to turn on LiveView.

for your camera see page 161 (https://www.the-digital-picture.com/Owners-Manuals/Canon-EOS-40D-Manual.pdf)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on September 03, 2019, 09:32:39 PM
I realized driving home from work that CF card system was really slow, so I did a really quick test.  It turns out that ML uses the CF card system before it was initialized which leads to wrong behaviour and lock of the file system. Inserting a long delay after inside ml_init_task before executing anything else solved the FIO issue.  :)

* Fonts can be loaded
* Camera can shoot images
* Camera can dump logs and ROMs
Title: Re: [UNMAINTAINED] Canon 40D
Post by: aprofiti on September 06, 2019, 06:12:54 PM
@heder Can you load modules?
Make sure module_task is launched from ml_big_init_task() inside custom init.c

I get wrong behaviour with 5DC, they are listed with wrong filename (it show only last 4 characters of the module's name) so can't be found on card.
Would like to know if it’s the same with 40D.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on September 07, 2019, 03:57:24 PM
@heder Can you load modules?
Make sure module_task is launched from ml_big_init_task() inside custom init.c

I get wrong behaviour with 5DC, they are listed with wrong filename (it show only last 4 characters of the module's name) so can't be found on card.
Would like to know if it’s the same with 40D.

Hi. No I don't have the issue you have. I can now load modules in the camera - Arkanoid and File_mgr works just fine.


Title: Re: [UNMAINTAINED] Canon 40D
Post by: aprofiti on September 07, 2019, 04:51:00 PM
Thanks for checking. Need to figure out somehow to solve the issue, I'll try to have a look again
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on September 10, 2019, 10:44:01 AM
More stubs found
   
* Interface to dm_det_store_level on Canon 40D is different than other camera, but input data is the same, so I'm creating a wrapper function. 40D interface is
Code: [Select]
foo(uint32_t *) Newer camera uses
Code: [Select]
foo(uint32_t,uint32_t)
 
* Bulb mode does'nt work, PROP SW1 and SW2 is not defined exactly as in newer camera, but call("dumpf") revealed the SW1 and SW2   
  is defined. The old property values are 0x80002001{5/6} but Canon 40D checks on 0x1000002B (SW1) and 0x1000002D (SW2)
 
  ...    
  562:  4627.423 [GUI] IDLEHandler PRESS_SW1_BUTTON
  ...
  571:  4672.101 [GUI] IDLEHandler PRESS_SW2_BUTTON
  ...
  609:  7982.061 [GUI] IDLEHandler UNPRESS_SW2_BUTTON
  ...
  614:  7999.412 [GUI] IDLEHandler UNPRESS_SW1_BUTTON

 
* take_screenshot() saves incorrectly (but does'nt crash either)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: heder on September 20, 2019, 03:57:44 PM
Quick update  :)

I'm still working being the scenes, stubs, reading decompiled code to get the 40D running better. The good thing it that the boot up process work better and better. ML is becomming more
stable and with less crashes.

Boot
Debug Stuff

Shooting menu
Expo menu
(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2F65wtae1-4yRCZAsISdTUSktEvQZI7eyujPPhJcIWzneB5CPf6PQQBFyekXWeaTak05gMTY5ZXVlwYgamIkzpkFjy6NeMcXn-FYoy8Rk583EOk65xPS9V9C0APxcLAYTfGEz23YU-7-0pOoJ9X_DD90VbMjfnOT44HMw0n82gSO00tCd3P-rmMXzHaTpehcauypFKbWZ2jL2fvLkYqCfBQd8yeX9xvAUCzLrrTNTBZZcdBDnkspa8-1PG5KXf1T1Ats_lW6K1XbjAnvf2xm-xALgBk0G9wpLfPI3q_BcIQXTY1SnvDH8jUhqaxzwl19tgJLXHlZLDx_eClNMm_ErVeTM3Z9feRDSnQnuEotkBTmJliBCdSLizvywjS4w3he5h8m2ns4lbfSmEqmIaZfwjFCXDWVAKEf1nuMAYG9sNj6rkTr3lVAi5ucGKoOaOGw7KwCo79qYZ8sB1uLqI66fs6EKNYDqJ8tkJzd8oAHjz5VAJjwLzGOnh8Ybl5n2OfmY9InmSzhFBMuEOPzjb79CiZ__encp1k5jpuGzrw78RpKkhYffbbBozMclNMAdGJWfZB0O8WR89Hl6nTF1URXTamDoYU0vUTWbzHj0CjqlfgzJlf-trcjn-9LDc_oBJXloXdf52URvcW7wLz86z6ulY7E1atmTLUISI4pqRWtdYRD0JJGiDd_Q6Nti9ZsFgrrt3GriwR6QLSckd2SltGhEGLwJ852Q86xt2JGMDLZU7TNL2pkiI%3Dw1000-h750-no&hash=28560dcbcc6e7eb3f95299d5fa39cc42)
Title: Re: Canon 40D
Post by: ilex on September 20, 2019, 05:36:17 PM
@heder
Thanks for your great effort to run ML in 40D. Regards
Title: Re: Canon 40D
Post by: heder on September 27, 2019, 11:33:45 AM
Weekly status report, week 39

Font bugs (due to the SW uses HD buffers rather than LV buffers

CF card benchmark (using new Sandisk 833x card)

LiveView

Exposure menu

Stubs and consts

Modules status

Code
Title: Re: Canon 40D
Post by: heder on September 29, 2019, 09:50:00 AM
Last engio write before liveview start to stream

5584:  8729.649 [ENGIO][0](Addr:0xc0f06008, Data:0x5490549 )
5585:  8729.703 [ENGIO][1](Addr:0xc0f0600c, Data:0x5490549 )
5586:  8729.741 [ENGIO][2](Addr:0xc0f06010, Data:0x549 )
5587:  8729.781 [ENGIO][3](Addr:0xc0f06084, Data:0x20271 )
5588:  8729.826 [ENGIO][4](Addr:0xc0f06088, Data:0x369050d )
5589:  8729.857 [ENGIO][5](Addr:0xc0f06000, Data:0x1 )
5590:  8729.908 [ENGIO][0](Addr:0xc0f06014, Data:0x49d )
5591:  8729.940 [ENGIO][1](Addr:0xc0f06000, Data:0x1 )
     
T1 = 1181+1 = 1182
T0 = 1353+1 = 1354
VideoClock = 30 fps * 1182 * 1354 = 48012840  => 48 Mhz.

AFAIK this is the highest video clock of all Canon EOS, see https://docs.google.com/spreadsheets/d/16cgnRivbUv7nA9PUlCLmLdir3gXdIN3pqzCNAAybepc/edit#gid=3 (https://docs.google.com/spreadsheets/d/16cgnRivbUv7nA9PUlCLmLdir3gXdIN3pqzCNAAybepc/edit#gid=3)
Title: Re: Canon 40D
Post by: heder on September 30, 2019, 10:57:58 AM
I don't get this

5587:  8729.781 [ENGIO][3](Addr:0xc0f06084, Data:0x20271 )
5588:  8729.826 [ENGIO][4](Addr:0xc0f06088, Data:0x369050d )

According to https://magiclantern.fandom.com/wiki/Register_Map (https://magiclantern.fandom.com/wiki/Register_Map) this means

0xC0F06084 RAW first line|column.  = 0x2    | 0x0271  =   2  |  625
0xC0F06088 RAW last line|column.  = 0x369 | 0x050d  = 873| 1293

RAW LV image size = 871 x 668 ???

Title: Re: Canon 40D
Post by: a1ex on September 30, 2019, 12:58:42 PM
The 450D appears to have 56 MHz x 1 channel (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212440#msg212440) :)

For the raw buffer size, the lower half is the number of column groups read out in parallel (i.e. it needs to be multiplied by 2 or 4 or something like this). More likely, 1336x871. Judging from still photo resolution (3888×2592, maybe slightly higher with dcraw), expected active area in LiveView is about 1296x864, as most EOS cameras use 3x3 column binning / line skipping.

Timing analysis, similar to the one from 450D:
- VSizeSetting = 0xFFC2F5F4 (called after [CAP] GetPassResources)
- 53 microseconds / line (from emulating VSizeSetting)
- timer A in still photo mode: 0xA0D + 1 (from FFC2F358 -> FFC32D90 -> 0x94B4 -> 0xc0f06008: 0xa0d0a0d)
- the above confirms the 48 MHz clock and gives 53.625 microseconds / line
- timer B in still photo mode: 2622? (guessed from VSizeSetting)
- 140 ms / frame (up to 7.1 fps burst; 6.5 fps official - check)

Not bad at all - 48 MHz x 2 channels, i.e. as fast as 5D2 (https://www.magiclantern.fm/forum/index.php?topic=23084.msg208824#msg208824) :D
Title: Re: Canon 40D
Post by: heder on September 30, 2019, 02:32:32 PM
Title: Re: Canon 40D
Post by: heder on September 30, 2019, 03:35:00 PM
5580:  8729.414 [LV] GetImageTrimming X(1998)=0(0, 0), Y(1319)=0(0, 0)
5581:  8729.469 [LV] GetAfWindowArea W=1336, H=872
5582:  8729.498 [LV] GetAfWindowArea X=567, Y=353
5583:  8729.524 [LV] GetAfWindowArea AfW=256, AfH=172

Yes liveview is 1336x872
Title: Re: Canon 40D
Post by: heder on October 09, 2019, 10:07:46 AM
Nothing much going on other than I'm trying to decode the CF address and registers .. updating https://magiclantern.fandom.com/wiki/Register_Map/40D this might take awhile
Title: Re: Canon 40D
Post by: heder on October 31, 2019, 10:16:07 AM
Working on LiveView  ;)

(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FAHhCdoLMfOfB1ALToUfVZgfKd6d6MOPAwVCHTmknrSaQ6km4L4_CW760Ar_4tFzMoQqhP0hSPNiwD2-76pCeZuWC9nr_R8xduAiazkHxgOw3zzrVnEncgPeu9wM3raIKb2xWVAdqoDD-AWGSldEnus1NVLJTUx3jN6YHNn885OKZR8q5yGb5CZ_0UeUBPvd3jGjwqaCxDV8gqYaAEZCMpkXAgTOPhemwnf81X5zpVONNMY2sgpoFxklRW4tRKRWkJMVwSW5xKV3UG5lMPY4qutH1y5nlpJ-5BHHXWCNgCVIl1z4ub2l9FjQLC_raqLKJzYOK2R666wLvRmd89XxwrN-AtopaCtKrY82C0XNZaMJZwz9YksCyL3_13Rps4IGDYROcbpCZMxelzRtLPTRQO3_MXYg-AYXszE2RpsbOT8WITphC901AylC_b6SEQZjfbjud2ATayGQOfiAj-oaOskcNLGvLqdeCLW6AIwWcfyViqVN33jws1WdBahss-QsdDxiyp3j-vQ03iZ0tvtz0I_s-T7Q8dmBc2s0Zt0a5JUji8bCx6LGWVaQL2BMLU6EvxKXKmknHyGETllDP6cl6By3lBJSwauRHfS6Ig8kgv6lomWgTRdOE-RAte9ibB85655GsQhrDxUeIMyxbLcpOHYl4_hccY343QNA5qnk2s4YsK9FX7POdMs4Meu3RLfhjFLrY0SlNBN8Z1AQunWeptg0hT8HwOOrZ1ncDHWFPrhRnJkoX%3Dw660-h495-no&hash=f44d5b7404bb7fa2e65df6cf0fc318ae)

Title: Re: Canon 40D
Post by: domasa on October 31, 2019, 02:33:13 PM
Image missing..
Title: Re: Canon 40D
Post by: heder on October 31, 2019, 03:22:15 PM
Now the image should be viewable
Title: Re: Canon 40D
Post by: domasa on October 31, 2019, 08:33:10 PM
Now is visible. Incredibly  8)
Title: Re: Canon 40D
Post by: heder on November 07, 2019, 04:58:39 PM
Still working, current status ... 

(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FPShr1oEKYe1bl0x7U9Rq1WJjlKQL5BDQ5i3GCiRFXfjWqpZAfsjidv5AT4Ou79S9IqYsav2zdH3-Ig8AvusFlTV4SxKlRCd-tmJMxLa0Q7yq99tLyFg8GAtkWuB94EA8jN6GuWdH3uEbRaNLjnv_L8N6mXQkJV8UTK-v-aEqvOnWvLaUj1OO77oqqUq_N5W1ApKSFlU1uiXr6uup22rNFMWjEwQh-X3k9vP6BVNS4KreX7WvowbLQIH-A2UmKvxCmAd87SyEEwCWmy2_hiBEOKpBcYTaYi1vY44axemT8fA-M_Bot_4BLMAtwuCafxlxIHRsGnB6wh_gLgO-uvEnN4nRJmZtvEEI4zS5g5laFAHQTip2tyvxsmxFPLF6oBQUPixIb9JzzGoraiCAYbpvYTjCm7d2AmHv_Yr1MyO24qZcTZyIFhQhHx0P-GaDr24KV2NhV791TZKztUOsmpugjIFCzMJOJfu3RSPoIemljjFsaTLHkwRktOd91L1roy75cqfES415-J_MfFDO7Cd15nwt3Ol5OvHWyKChSjpZjmXWUL4BVz1mpyg9Oof529eX6drF07sM91qbgoKpuhkEap65uw7n1Bxa05AACezQ9WD6jqvWAr-f3_YNzVApgYr-8e8be6j2pyXU2viOkWNc-TRbSmUHFNUE5bKmE-UbNLZIe_XfxmrtpNVnNbQ1dcleKPxBRZyVHPgG5WvRxGiRBHexZS1omIrUPKSOGSwWtE3wKhoq%3Dw906-h543-no&hash=fe04c451cef0c2bb688214e2870468eb)
Title: Re: Canon 40D
Post by: heder on November 12, 2019, 12:05:00 PM
I'm stuck at the moment  :(. My issue in inside LiveView with the HD buffers.

When the camera is started in liveView the HD buffers are correct, and my histogram is correct and it shows the histogram of LiveView.
When I capture a image in LiveView, the HD buffer seems to be locked to the image taken and thus the histogram is locked to the image taken.
So when I return to Live View, the HD buffer is locked to the captured image and does no longer show the histogram of LiveView. When I take
another image the HD buffer gets updated to this new image, and the histogram is changed. The buffer returned to me is not HD buffer with
LiveView content but the image buffer of the last captured image.

I'm going to make screenshot work for 40D (yuv mode) so I can dump correct images and then I guess I need to run the 40D FW in QEMU
with breakpoints in the firmware. There is a function "lvGetResources" that prints out the correct LiveView YUV buffer address in the log, but
ghidra fails to decode which function(s) call lvGetResources. I would like to get that call tree.
Title: Re: Canon 40D
Post by: srsa on November 12, 2019, 07:56:05 PM
I would like to get that call tree.
In case qemu can't get that far, you could also try using cache hacks (src/cache_hacks.h) on the camera.
Title: Re: Canon 40D
Post by: heder on November 12, 2019, 10:10:45 PM
YES thanks, good idea, I just need to intercept the call using cache hacks and read the LR register, then I can  find the return address of the caller
Title: Re: Canon 40D
Post by: heder on November 20, 2019, 10:53:24 PM
I'm having trouble, I hoped I could get a version before xmas, but it looks badly. It's a simple requirement I thought was allready done, but its not : The position of the HD vram buffers are not static.

I havent found the caller of lvGetResources yet, QEMU/gdb won't break, and cache hacks won't do the trick in the real camera either, I'v had troubles in the past with cache hacks on 40D, like I can't use cache hacks on the canon debugmsg function, this does however work in QEMU. My last try is going to use cache hack in QEMU (next week) - This should work.


Scenarios tested:

1. Live Mode

-> Start camera
-> goto LiveMode
-> save all HD buffer 1,2,3.
Result : All three images is Live HD images  :)

2. Live Mode + image capture
-> Start camera
-> goto LiveMode
-> capture image (take photo)
-> re-enter LiveMode
-> save all HD buffer 1,2,3.
Result : All three images is the captured photo - NOT live mode images  :(

3. Photo Mode
-> Start camera
-> Capture image (take photo)
-> Goto Live Mode
-> save all HD buffer 1,2,3.
Result : All three images is noise  :(

.. back to basics ..

Title: Re: Canon 40D
Post by: srsa on November 22, 2019, 07:31:48 PM
I'v had troubles in the past with cache hacks on 40D
I've had similar experience on PowerShots.
I found that the firmware's (and CHDK's) cache manipulation functions counter-act cache hacks. The locked part of cache remained locked, but the content vanished from time to time.
The real solution (IMHO) would be a rewrite of all offending cache manipulation functions, so that they don't touch the locked part. A less reliable way would be re-adding the hacks at the end of each such function.
I chose an even less reliable solution: I re-added the hacks every 10ms, using a task that cycles once every 10ms. It was good enough for doing research.

As far as I know, some ML ports and modules rely on cache hacks - I have no idea how they get away without experiencing similar issues.

One more tip: If I see it correctly, lvGetResource only has data references (no b or bl targets it directly). You could get away just by patching those references using the data cache.
Title: Re: Canon 40D
Post by: heder on November 27, 2019, 09:26:17 AM
Srsa .. You are right about cache hacks. The QEMU "Digic" processor works better in some cases, but on LvGetResources I ran out of luck. Ghidra shows no direct reference to lvGetResource, but alot of function is'nt called directly but indirectly just like lvGetResource, but in most cases I am able to find a pointer to the function, being passed as a argument to another function, but again with lvGetResource I ran out of luck. Ghidra is really good, but in all cases is does'nt understand functions that does'nt start with a stmdb, like if there a mov before the stmdb ghidra get confused, and having to manually make these function is waste of time, and I have a feeling that the pointer to the function or direct call is hidden somewhere.

I wanted was to find the memory (struct) that points to the LV buffers, as this is the very last task before making a beta build.

For now in working in a different direction, I'm have dump'ed the 256 MB ram and have disected this into images as green(rgb),grey,luma(YUV422),chroma(YUV422) in 8 different sizes (512,720,864,972,1024,1944,3888), which resulted im over 6000 images I need to review, which was converted into a movie using ffmpeg, which I need to watch :). If the LiveView buffers are there, I should beable to find them.

if this failed I might try your to 10 ms re-adding hack cache method.

Title: Re: Canon 40D
Post by: srsa on November 27, 2019, 06:57:55 PM
Ghidra shows no direct reference to lvGetResource, but alot of function is'nt called directly but indirectly just like lvGetResource, but in most cases I am able to find a pointer to the function, being passed as a argument to another function, but again with lvGetResource I ran out of luck.
Assuming lvGetResource is the function that references the "[LV] lvGetResource 0x%lX (0x%lX)" string, there are 4 data references pointing to it (= the function's address appears 4 times). These references are a few kBytes "above" the function. It looks like Ghidra doesn't automatically notice references like that. I found them by placing the cursor to the function's first instruction and choosing "Search" -> "For direct references" in the CodeBrowser's menu. I then had to turn those bytes into pointers (P button). The references all appear to be part of a huge struct, and that struct is referenced from a function. I'm not familiar with this style of code as PowerShots implement state machines differently.
Title: Re: Canon 40D
Post by: heder on November 27, 2019, 11:51:13 PM
Assuming lvGetResource is the function that references the "[LV] lvGetResource 0x%lX (0x%lX)" string, there are 4 data references pointing to it (= the function's address appears 4 times). These references are a few kBytes "above" the function. It looks like Ghidra doesn't automatically notice references like that. I found them by placing the cursor to the function's first instruction and choosing "Search" -> "For direct references" in the CodeBrowser's menu. I then had to turn those bytes into pointers (P button). The references all appear to be part of a huge struct, and that struct is referenced from a function. I'm not familiar with this style of code as PowerShots implement state machines differently.

Oh yes, I see it clearly now. Huge struct, that will take some time to dig into that. I never learned the "Search" -> "For direct references" until now, thank you for pointing that one out.
Title: Re: Canon 40D
Post by: heder on November 29, 2019, 07:18:22 AM
I have located LiveView, but they're not at a fixed address.

I dumped the ram and converted into different size and formats 512,720,864,972,1024,1080,1944,3888 versus grey,green (rgb),luma(Y422),chroma(Y422),chroma(YUV411) and finally converted them into a movie with ffmpeg, that way I analyzed around 10000 images. Quite effective. This method took some time but it's really nice. I found multiple images in different sizes all over the place, and I found what I was looking for the LiveView buffer. The images I found (smaller size) was:

1. HD buffers
Numbers    : 32
Size          : 1024 x 680
Address    : Dynamic (changes when a image is taken)
Encoding   : YUV422

2. LiveView buffers
Numbers    : 2
Size       : 720 x 214
Address    : Dynamic (changes when a image is taken)
Encoding   : YUV411

3. Miniature (NOT LV image)
Numbers    : 1
Size       : 180 x 320
Address    : Dynamic (changes when a image is taken)
Encoding   : YUV422

Next step is to locate the memory that references these images - or finding the pointers passed to lvGetResources .. seems to be same issue  ???.
Title: Re: Canon 40D
Post by: heder on December 09, 2019, 09:09:58 PM
Finally I made some progress again :). I had to ditch the previous attempt and re-read the disassembled code in order to hunt the correct HD images, this was a pretty good idea. A function called within lvGetResources actually stored the main input parameter (first argument to lvGetResources) at 0x1c804. This pointer is static allocated and points to structure in memory (possibly allocated), at offset 0x94 in this struct is a pointer to one of the current YUV HD images. The image pointer is always correct and is updated after each shot. Now I can shoot images in livemode with correct histogram and vectorscope.

Title: Re: Canon 40D
Post by: heder on December 13, 2019, 12:57:05 PM
I'm working on the bootloader, using the recovery branch.

My main issue is that the old bootloader does not work everytime as expected - it too much a hack, so I need to remake it the right way.

It seems that Call("") on 40D supports : 

"EnableFirmware"
"DisableFirmware"
"EnableBootDisk"
"DisableBootDisk"
"EnableMainFirm"
"DisableMainFirm"

Any one tryed these out on other cameras ? or have clues to which one to use inorder to make autoexec.bin being loaded ?
Title: Re: Canon 40D
Post by: heder on January 11, 2020, 10:59:25 AM
Started working again, it's rainly constantly here in denmark, so no time for astrophotography.

Digged into FPS override mode and finally got it working (low light mode only). It turns out there is no shadow memory area on Canon
40D, so a lot of peripheral registers can't be read. The solution was to create virtual (fake) registers for fps register A and B which is
used in fps override. 

Can't do above 30 fps, only below.

Live Mode buffer images : Upper image is standard live mode in "M" mode (30 fps) with the settings that gave me the brightess image. Lower image is 1 fps with
exposure lock (ISO 3200 "H") and approx 1 second imtegration.  Hot pixels are present :)

(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FHyBjQjL-_DfQ8PT7q71RZDcSt9m5aiZUS7s1xVyL6Z9g7x-I8mHTW3SE7j2Km6o8ksB-M82_1wImgM8oSYri7BFc2AmWRHfo-WCNidPPkg1wKlNoVWysgOvKHaGcXrT0AZIyuupuhTu55ZpTz30v2G9MPcv9KA56k3bfhZ-BwW7saxI04ug22ZffFUu-fCN57HQE20TKP0vpT5qSzFPunpoVZgk0viEVJ_C65QlZLp7Mguah4Q_jhlaSN8hNkwCH1EdFB0IR6H1fAvBh2c3aqYR36k62_brQAXQBsrmF1CWc11tZ2pXhWOx6PxK1jB7x6Jo9cxf_GMbCjf8T8SYxfpbeqOZ3Vws5EMxSPl_AYBnidNvSJtTeS4Cf3XBMGH8twxeJZ0FplBsek3ttFwY7NRyC-t4KNjaXVFSlMZpVvn6JrfE3RLv0TqhlzwE4CbfwTtagk1qfCu58WbzsNyjhqiV4vEVEr8J5wd7-6bDx09CdUrlyNbk1S4GeO_Ar_jYVrmkGZ6oxj8mWehsZl4-xjQPfwrGxRNMrS13LPlxbDEWt5LDmvfjJUBLpx9BEkZf2uEJeUQXE4ErBU3v6XdXZp6pZllSYlAZ0iPdzR1NJA7Eoc6qC4msOxOAepx63Lm9IYpJ8l6jEVeuzH0Yi0j0VaeUiJwpyjpw4IQ4fH-NaeiF2I57dy7-1MJfgu8f-8A4_SXS4C7i_ZjKsePikfN3BrkTeF0LV_UCjHKkC-zOoEL_i3bYB%3Dw1024-h680-no&hash=cafd7bedfa41fb15de7d17e553ca390d)

(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FoXA-Nd3n5tVShGRblpk110ARgmmN9PLQtgCT647uhAPzmSjpgbxyqQH3vOLXOZQk_Y8lV3fUGyvSWPwNp822VCvj7KKwnGfaB9_HonUR-gSZIF5OiMC7750w4zdKG9VaaaPoeERLUjiZL-G0UpC7L4_IVCIaVWwy2rmmG8gMXo0uKrB8D-hPW_hknuZcbh6aNjUmqmcKwCpjIVKLqr-c_3XL820ukTf8wJdKSyEgO3kvdLVW4c08gst85e8bq5aDKOZil5pJuaPoe0zhcEfmhILN4226F3QA3uehMjCGxx2OzT3FMZ6n0jhYrqg3aZSEoVGxZjmmoQXIu4tP2OJeRb_ruOXeUx_dy6iMERP-qYjzP6ur_T5Lwvs6lkAsKUqHKARkQkjku1_LGayw_O0UW5GSWQvHqrg2I36ywCWGOoM-QTFH7ezBkGgX9TYR8-4CwmP4orhtnaIOfBax1y0J5vyw2ItwG74Waw_MoxX88OOcYBJjtuSaMS1Tdq83IZ-Na74p9fo4jGHeKFkb0_Xaumyotw6gDiyia_FYxWio809iJ4_a6CQ6HQLwbvtG56EFy4bbYJ9lbQFFl40kfGumbKK41pV76OFLJVB22Zl02hSP58X7CQ1rsidwJpZecyV3DfoeCXebU2dHhgjojBYrtXQtiqIOHnlH3TW4YxF8ivFZOvB41oJe1Gic3te4NzZKJ7D4pWfhXMhwgxZaW6SyKJl1fhb75e9CqqMl3gaqtJjQMbXx%3Dw1024-h680-no&hash=02381b9293bc4a91868452addf3424cf)
Title: Re: Canon 40D
Post by: Dezmond2 on January 14, 2020, 03:02:40 PM
Where download current version for install and testing ?
Title: Re: Canon 40D
Post by: heder on January 20, 2020, 11:41:21 AM
Hi Dezmond2

I'm working on the bootloader, that the last thing needed.

I have a basic working bootloader for 40D (abit similar to 450D and 5D classic bootloaders), but it's not perfect, and I wish to have a bootloader that cannot be activated on the wrong cameras or wrong 40D versions, as this might brick the camera. I have no idea when it done, but my hope is within the next 3-4 weeks.

I will post the complete packages here in this thread.
Title: Re: Canon 40D
Post by: heder on January 22, 2020, 03:37:27 PM
Notes on jpeg recording

The jpeg in live mode 1024x680 (no zoom) has maximum size 330.8k. The header is hardcoded (and so are the jpeg-edmac channels), but the actual file can vary in length, and is typically smaller. I can't not find the true lenght of the jpeg unless I search the entire 330.8k block for the jpeg end container, easy solution is just to save the entire 330.8k block.  Inorder to have a efficient recording system, these images must be copied using edmac into larger buffers, which can be saved. Larger buffers increase the write speed to the CF card, small buffers lower the bandwidth. The FIO file system used dma.  The big issue there is not the size - the jpeg is small, but it the fact that there are no "free" edmac avilable on the DIGIC III, (free = not used by firmware). All edmac are used (no wonder that the DIGIC4 have many more of these). The firmware even seems to be using some edmac for multiple operations. So stealing a edmac is gonna be difficult- but I guess not impossible. The jpeg-edmac channels used for encoding and tranfering the jpeg image is used in approx 5ms per frame, so in the remaining time they seems to be unused. At 24 fps I have around 36 ms for tranfering the image to another location, before the jpeg-edmac is used again, this should be possible.

Minimum CF bandwidth needed at 24 fps = 24 * 330.8k  ~ 8 mb/s. 

These bandwidth requirements are also below the capabilities of the CF system, the bandwidth limit is around 14 mb/s and overclocked around 20 mb/s, so this should also be possible, and higher fps should also be possible. I could also "just" try to hijack a simple function which is called just after jpeg tranfering completes, then save the frame directly, but this requires that the CF system is capable of 8 mb/s in small blocks and that the LV system can cope with the additional code overhead. Also, even more interessing, the Live Mode jpeg is 1024x680, but the raw image is larger 1334x872, and in zoom x5 mode, the raw size is close to HD = 1872x1066 pixels.
Title: Re: Canon 40D
Post by: heder on January 24, 2020, 04:28:02 PM
Hurray ! it's beta release day for 40D

This is the first public release series of  ML for 40D. Please take notice that this is a strictly experimental version, there are no guarantees - if it breaks, you get to keep both pieces. If you find bugs, please let me know, in this thread. If you try this build out, please keep in mind that I have strictly focused on getting main features supported, while spending little time on minor issues. Features/Modules that crashed the camera was removed, but nothing more. "If it aint broke dont fix it". There are options and menus that does not work, but nor crashes the camera. Most modules were removed. The complete package is larger than normal ML packages, as I don't have a efficient bootloader encryptor, but just an old inefficient version.

Latest version: "1.0.2" (4 april 2020)
Features: Basic ML support with exposure control, intervalometer and live mode functionality
Important: Trashcan button to enter Magic Lantern. The Q button on 40D is "picture" button.
Important: If the camera crashes, please remove the battery.
Canon FW: 1.1.1
Branch: https://bitbucket.org/jmheder/magic-lantern/branch/vxworks
Compiler used: gcc-arm-none-eabi-4_7-2014q2-20140408-linux.tar.bz2
Download (1.0.2): https://bitbucket.org/jmheder/magic-lantern/downloads/magiclantern-Nightly.2020Apr04.40D111.zip

Older version:
Download (1.0.1): https://bitbucket.org/jmheder/magic-lantern/downloads/magiclantern-Nightly.2020Mar03.40D111.zip
Download (1.0.0): https://bitbucket.org/jmheder/magic-lantern/downloads/magiclantern-Nightly.2020Jan24.40D111.zip

The main features

Bootloader and installation
See the video in the next reply.

Exposure control
Basic exposure time, F ratio, ISO, color temperature, Av,Tv,ISO lock is available, but I haven't tested them all, so I expect additional issues here. If you wish to use exposure simulation, enable this in the canon menu - and enable it in the ML menu aswell. Issues regarding exposure is C, I and J.

Live Mode
Live Mode is working and supported in ML, Upper and lower info bars are working (with all information). When opening menus inside LiveMode, use joystick instead of scrollwheel. Some overlays are supported (histogram, vector scope, box), see issue K for triple info bars. The framerate override in Live Mode can be changed downwards from 30 fps, use "low light mode". AF Focusing in Live Mode will produce a temporary corrupted green screen, it not serious, it's just annoying and will go away automatically. Remember to enable live mode in (canon menu), also enable focusing in Live Mode (canon menu), see issues see D.

Intervalometer.
Intervalometer with or without bulb is supported, but there are of issue to keep in mind issue F, G, H, I, J. Practice and you will learn. Easy solution: turn off review time and keep one seconds delay between each shot.

Astrophotography
For those into astrophotography, the camera with this ML build is a great combination, the intervalometer with bulb is working, and Live Mode plus low fps and a large exposure time will enable you focus on stars, a great tool for fine adjustment of the focus. 


List of known minor issues

A. --
B. --
C. Exposure simulation. Don't change ExpSim in exposure control, ML always think it's enabled (remember to enable it via canon menu)   
   also you can use "info" button in Live Mode to verify that canon's own function to verify exposure simulation is within tolerances.
D. LiveMode. When AF focusing in Live Mode a corrupted green screen will occur, it's not important, just annoying.
E. --
F. Intervalometer, this ML version think image review time is fixed to 3(?) sec (you might see incorrect warnings in lower screen)
G. Intervalometer, Shutter half press is never detected and any "shutter half press" features will not work, use
   one of the two other methodes to start the intervalometer.
H. Intervalometer, in bulb mode keep exposure time below "take pic every sec" + review time, if you set review time
   in canon menu to zero, you should be able to do "crazy pic" if needed.
I. Exposure. Exposure times above 15 ?(20?) seconds is not correctly recognized by ML in exposure menu.
J. Bulb. Bulb mode can not be set via ML menus, must be set via camera dial. When using bulb  strictly verify the "BULB" is
   seen as text in the exposure control tab, otherwise magic lantern bulb mode won't work.
K. Live Mode. To have a nice Live Mode (with bars) the internally view aspect ratio is changed, a few times you
   might see the bar positions incorrectly. To remove triple bars either exit and enter Live Mode or press the AF focus
   button.     
M. --
N. Canon Menu. Really odd colors in canon menu can be caused by a previous crash (after crash : console is on). Enable console and 
   disable it again to resolve this issue.
O. Color Temperature. ML recognized some color temperature as names like "Sunny", if the temperature was set from Canon menu / dials.
   When changing the color temperature within ML you only get to see the temperature as a number
P. Menu. Some options does not work, but nor crashes the camera.
Q. Preferences. Under the config file menu, DON'T use "Restore ML default". It will delete ML firmware. Instead delete the ini file via pc.
Title: Re: Canon 40D
Post by: heder on January 24, 2020, 04:28:19 PM
Additional info - Source code repository details & future:

Branch: https://bitbucket.org/jmheder/magic-lantern/branch/vxworks

I have merged unified into vxworks and updated the code the 40D platform code, thus this vxworks repository includes more or the lastest unified code (end 2019), which is great news!. The downside is that the 40D is a digic III processor and quite different from digic 4/5..., and this can be seen in the code. No shadow memory, low resolution display, few edmac, fewer PROP's, address space is different and so on.I had to create a simulation layer to keep the code somewhat clean. So I don't think 40D will be included into mainstream "unified", it will take to much time. I will however keep my focus on supporting the  40D with bug fixes and possibly more features, like modules and even try to get mjpeg stream recording up and running.
Title: Re: Canon 40D
Post by: heder on January 24, 2020, 04:28:52 PM
Installation on 40D

The build include is a simple "bootflag flipper" bootloader, like the 5Dc,400D's. Update the camera with ML-SETUP.FIR, this will take some seconds. After the screen goes black, a few seconds will pass, then bootloader will run. When the bootloader is running the follow led pattern can be seen:

very fast blue led blinking   = bootloader is running (this will allways occur at first)
solid blue led                     = camera bootflag was enabled, please remove the battery
very slow blue led blinking  = camera bootflag was disabled, please remove the battery
solid red led                       = Incorrect firmware version (use Canon 40D FW = 1.1.1), please remove the battery

You will also need EOSCard to make the CF card bootable, see the video

Quick Video

Small mistake around 1:50,  "Bootloader is running, bootloader is on". I should have said  "Bootloader is running, camera bootflag is on"

Title: Re: Canon 40D
Post by: ilex on January 24, 2020, 06:54:34 PM
Congrats!!! Up with the great work!!Thanks
Title: Re: Canon 40D
Post by: ilex on January 25, 2020, 11:25:55 PM
Hi Heder
I've tried to install your ML in the Eos 40D FW 1.1.1.
When doing so the blue LED does what you say, it flashes fast about 20 times, then solid and then slow.
I remove the battery and switch the camera back on and it remains without changing the FW and does not charge the ML.
How can I run it?
What am I doing wrong?

Excuse my poor English.

Greetings
Title: Re: Canon 40D
Post by: heder on January 26, 2020, 10:16:01 AM
Hi ilex.

It would be a good idea to read the installation guide. https://wiki.magiclantern.fm/install

But ... a quick introduction. The bootloader (the one you installed) will enable the camera to boot magic lantern firmware from the card ... but ONLY if the CF card is prepared correctly.  You forgot to make the bootflag in the CF-card partition table set true and set the volumen label to be "EOS_DEVELOP". You can use EOS_Tool.exe to do that.

1. Upgrade the Canon 40D with the FIR file and make sure that the BLUE led is solid at the end (solid blue = camera bootflag enabled).
2. Put your CF into your CF card reader.
3. Download https://pel.hu/down/EOScard.exe and run it. Press the EOS_DEVELOP and bootdisk button and then save
4. Make sure you have autoexec.bin (magic lantern) on the CF card.
Title: Re: Canon 40D
Post by: ilex on January 26, 2020, 11:38:04 AM
Hi heder,
Thanks for your quick answer.
I used ML on an EOS 50D until two years ago and I currently have it installed on an EOS M and neither had this problem with the boot up.
I will try to install it during the day according to your advice and the ML installation page.
Thanks for your great work to port ML to this old EOS 40D, which will help to give it a new life.
Greetings
Title: Re: Canon 40D
Post by: heder on January 26, 2020, 12:46:55 PM
Hi
My 40d bootloader does not charge the CF card, like other bootloaders. You Will have to use Eos-Tool. Maybe later in 2020 i Will change the bootloader to work like all others.
Title: Re: Canon 40D
Post by: Walter Schulz on January 26, 2020, 12:58:07 PM
@ilex: He is referring to EOScard (https://pel.hu/eoscard) utlity.

On Windows:
Run EOScard
Delete all content from card
Copy heder's extracted build to card.

On macOS:
Run Macboot (https://www.zenoshrdlu.com/macboot/macboot.html)
Copy heder's extracted build to card.

Or use makeboot.sh
Title: Re: Canon 40D
Post by: ilex on January 26, 2020, 09:08:30 PM
@heder,
thanks for the information...I'm trying, without success yet.
Title: Re: Canon 40D
Post by: ilex on January 26, 2020, 09:13:04 PM
Thank you, @Walter,
I'm trying to follow your instructions and those of @heder, and the only thing I get is that the bootloader loads, the blue led remains fixed, I remove the battery, I try again to update the FW and again the blue led changes to blink...and I can't get past that loop.
Title: Re: Canon 40D
Post by: Walter Schulz on January 26, 2020, 09:26:38 PM
Looks like you are actually toggling Cam's bootflag. Works as designed.

After status "solid" the Cam's bootflag is enabled and - after reboot - ML should start from bootable card.

You haven't described what you actually did with the card. "Followed the instructions" can mean anything.

Describe and be precise!
Title: Re: Canon 40D
Post by: heder on January 26, 2020, 10:13:20 PM
Should I male a Short video and post it later this week, to rule out misunderstandings ?
Title: Re: Canon 40D
Post by: Walter Schulz on January 26, 2020, 10:24:43 PM
Wait a while. No info about OS, yet.
Title: Re: Canon 40D
Post by: ilex on January 26, 2020, 10:44:13 PM
@Walter

My PC has Windows10

This is what I did step by step

1 Format the card in the camera
2 Run Eos card activating EOS_DEVELOP and BOOTDISK
3 Delete all content from card
4 Copy heder's extracted build to card.
5 After status "solid" the Cam's bootflag is enabled and - after reboot - ML don't  start from bootable card.

@heder "Should I male a Short video and post it later this week, to rule out misunderstandings ?"It would be a great help for me, who don't have much knowledge of informatics.

Title: Re: Canon 40D
Post by: Walter Schulz on January 26, 2020, 10:51:02 PM
Just to be sure: You pressed trashcan button after cam started and Canon's screen apperared?

Card size?
Title: Re: Canon 40D
Post by: ilex on January 26, 2020, 11:37:20 PM
@Walter
The card I use is a Kingston elite pro 133X 8GB. This card rules perfectly ML in my old 50D.
In the heder's ML  the Q button on 40D is "picture" button, not the trashcan one.
I pressed both, but no one make run ML.
Regards and thanks for your interest with me.
Title: Re: Canon 40D
Post by: Walter Schulz on January 26, 2020, 11:50:55 PM
Try this:
Rename autoexec.bin to autoexec.bak
Insert card into cam and try to startup.
If cam is not starting up correctly:
Verified that Cam's bootflag is set and card is bootable.

If cam runs plain Canon: Either Cam's bootflag isn't set or card is not bootable.
Toggle/flip Cam's bootflag once and retest.
Title: Re: Canon 40D
Post by: heder on January 27, 2020, 10:44:54 AM
Ilex, I can't figure the issue, so here is a early morning video ..

Small mistake around 1:50,  "Bootloader is running, bootloader is on". I should have said  "Bootloader is running, camera bootflag is on"

Title: Re: Canon 40D
Post by: ilex on January 27, 2020, 07:49:28 PM
@heder
Thank you very much!!
Now ML is running.
My mistake was to interpret the picture button as you said in your post "The Q button on 40D is "picture" button" instead of the trash button.
Now I'll start testing the new features.

@Walter

Thanks for yor help an interest.
Title: Re: Canon 40D
Post by: heder on January 28, 2020, 08:55:32 AM
Glad to hear its working!.

Updated the posts about the firmware and installation, making it easier to understand incl. the installation video.

https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594
Title: Re: Canon 40D
Post by: heder on February 04, 2020, 09:28:18 AM
Engine DMA controller is up and running, using the edmac module. This morning I also tested the edmac  module while LiveView was running and everything seems to work, this is an important step towards mjpeg recording.
 
* EDMAC HW engine seems the same
* EDMAC SW functions seems the same
* I can read the edmac address directly
* All other edmac registers can not be read (not directly nor shadow read)
* The way to use/lock resources is the same (except we have fewer channels,connections)
* ResLock struct is different (first char* name is missing), but we don't interface with the struct, so it's not important

EDMAC "memcpy" speed in "offline mode (only screen active)"  was 345 MB/S with the flags below. In LiveMode (no zoom) the speed dropped to 322 MB/S.

R:4 W:2 bytes per transfer. flags R:0x60000000, W:0x40000000
R:4 W:2 bytes per transfer. flags R:0x60000000, W:0x40001000
R:4 W:4 bytes per transfer. flags R:0x60000000, W:0x60000000
R:4 W:4 bytes per transfer. flags R:0x60000000, W:0x60001000
R:4 W:2 bytes per transfer. flags R:0x60001000, W:0x40000000
R:4 W:2 bytes per transfer. flags R:0x60001000, W:0x40001000
R:4 W:4 bytes per transfer. flags R:0x60001000, W:0x60000000
R:4 W:4 bytes per transfer. flags R:0x60001000, W:0x60001000

Next step it to verify which channels can be used in LiveMode, I have looked into the gihdra decompiled source and written a list https://magiclantern.fandom.com/wiki/Register_Map/40D, but I need to verify atleast a couple of them.
Title: Re: Canon 40D
Post by: heder on February 19, 2020, 07:25:31 PM
Still working in the "engine-room" dma-memcpy seems to be working fine, when it's done at the right time. Now working on a hal-layer which will make the digic 3 system act like a digic 4 processor, as this will allow me to use the unified code "as is". 

Also sucessfully got the cache_tricks fully to work. Calling cache_lock and cache_fake does work as intended. Cache_fake calls need to be done prettly later afte the cache_lock call (seconds later ?), no idea why. I'm now doing these inside LiveMode because thats were I need these.

Then I sucessfully hijacked EngDrvOut and engio_write so I could dump all registers in LiveMode to disk. Also sucessfully hijacked a function to perform lv_vsynconization (for lv recording later)

Currently stuck in finding adgt/cmos read/write function as they're not the same as the digic4 and newer platforms. Working on finding the correct pgio and io addresses for those
Title: Re: Canon 40D
Post by: Ant123 on February 25, 2020, 05:54:11 PM
Currently stuck in finding adgt/cmos read/write function as they're not the same as the digic4 and newer platforms.

What about function names registered in sub_FFB24D68 (40D111) ?
Title: Re: Canon 40D
Post by: heder on February 27, 2020, 10:53:07 AM
What about function names registered in sub_FFB24D68 (40D111) ?

Yes you are right, there are function with the right names, but in a odd spot. I have been digging around there for a long time. The function at ffb24d68 stores/registers alot of function (ad)tg,dfe,cmos,head,iso and others). All or most groups have three function - read,write and show. But the function interfaces are odd and most takes no arguments, and the functions do not write anything directly to any gpio's.

I did however to call most of the "show" function which dumped alot alot of files which gave me some clues and data to search for.  Using the data from the "show" function finally realized that the function I was looking for was exceptionly badly decompiled using gihdra. It failed to decode around 80% of the sio read/write function

TG File, first value is some kind of property value, second value is bytes in table. All other files are similar

Code: [Select]
00010000
000003dc
01008000
01101047
0120303c
0130000c
01700011
02100000
02201100
02500000
02600707
02700707
02800707
02900030
02a00000
02b00010
02c0000f
04000002
04100028
04200002
04300028
04400004
04500012
04a00012
04b00002
04e0000e
04f00234
058000f0
05900136
05a00234
05b00294
06000002
06100028
062000ee
06300230
06a00002
06b00028
06c00078
06d000e0
07600002
07700070
08a00236
08b0023c
09000236
0910023a
09200236
0930023a
09400238
09500238
09800246
0990024a
09a00246
09b0024a
09c0025e
09d0025e
09e00056
09f0005e
0a200234
0a300002
0a400002
0a50023c
0a600250
0a8000e8
0a900136
10102802
10205830
10305038
1140020e
11502234
11602028
1170204e
11800002
11900028
11a02056
11b0207e
11c0205e
11d02076
11e00082
11f016c6
14600002
14700709
1480000a
1490000a
14a00a3e
14b00001
15300003
15400a3f
15500a40
15a00a3e
15b00a3f
15c00a40
15d00002
20000008
20100003
30000101
3010061f
30200019
30300713
3040202c
30500000
34005555
34105555
34205555
34305554
34404555
34505555
34605555
34705555
34805554
04800236
0490023e
0520000e
05300234
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
02600606
02700606
02800606
09c0025e
09d0025e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01008000
ffffffff
0100a002
ffffffff
01000003
ffffffff
01008004
ffffffff
01700111
08a00236
08b0023c
09000236
0910023a
09200236
0930023a
09400238
09500238
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01700111
08a0024c
08b00252
0900024c
09100250
0920024c
09300250
0940024e
0950024e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01700111
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01700011
ffffffff
01203131
01700111
ffffffff
01203031
01700000
ffffffff
01000018
ffffffff
01000001
ffffffff
01000007
ffffffff
01100047
02b00000
0980025a
0990025e
09a0025a
09b0025e
14e00004
15000a3e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
09800246
0990024a
09a00246
09b0024a
14a00010
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
09800246
0990024a
09a00246
09b0024a
14a00a3e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
09800246
0990024e
09a00246
09b0024e
14a00a3e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
0980025a
0990025e
09a0025a
09b0025e
14a00a3e
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
ffffffff
01000000
ffffffff

On the 40D I have located 3 low level sio function which performs the actual writing. These are the once that gihdra fails to decompile properly

ffff9cf4(uint32*t)   :  sio write Function A; write 32 bits data to SIO (channel 0)
ffff7268(uint32*t)  :  sio write Function B; write 16 bits data to SIO (channel 1)
ffc2e2a8(uint32*t) :  sio write Function C; write 32 bits data to SIO (channel 0)

Function A writes to SIO channel 0 but this function is only called with data static. The function is also rather simple, no readback, checks or anything. I also search for direct references (aka. pointers to this function) but found none in ROM. This function writes 32 bits data.
 
Function B writes to SIO channel 1 this function is also called with data static. The function is also simple, bit I did found two references to this function in memory in ROM. This function writes 16 bits data.

Function C
Seems to be the real function, and reminds me of the adtg write function on 550D. It writes to channel 0. This function writes 32 bits data. I had to decompile it by hand. Has a message inside, [CAP]SIO0_STATUS_READ_ERROR, and this function is also called by another function with the message "[TG] IMG_POWDET NG !!". Setup the SIO0 on each call, check for busy - and will perform 100 retries is it fails to write properly. This function is called alot of places with static data, but also alot of places with dynamic allocated data. The input data value between Function A and Function C corresponds ok, and seems to be reg16bit|value16bit like newer cameras.

I tried to recode the adtg_gui with the interface to ffc2e2a8(uint32_t*) but my camera goes constant black.

The data written to channel 0 does not correspond with any known adtg values from newer cameras
Title: Re: Canon 40D
Post by: heder on February 27, 2020, 10:24:51 PM
I need some help rearding button control.

When I press the trashcan button after the camera is booted I get into ML correctly, menu opens and everything is ok.

But when I get into LiveMode (by pressing the SET button) and then pressing the trashcan button nothing happens - no menu, I can't figureout why and the gui files/structure is pretty confusing.

Any suggestions are welcome.
Title: Re: Canon 40D
Post by: heder on March 03, 2020, 04:36:49 PM
Updated open beta to 1.0.1

https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594

Fixes =
Exposure Menu. Fixed "RAW:0" message, camera reads shutter upon startup.
Debug Menu. Memory allocation (nearly) completed, currently ~54 MB is now avilable atm. 

Title: Re: Canon 40D
Post by: heder on March 11, 2020, 02:55:24 PM
(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FcV4loszCy_UG4rFLzoCdgDlvnV9LnrATHlEyYW_UNI3cV8UlqYPH8Tg8S6ZE3Ig3fEpyzYPF0gm6cvAnBmJH2mCSx8nep7KBBWHqAuwEVT1KTp0EwtuH1g6JWZKqRjRSnLMETTiArmUzpZIR3qLFbTJVPCIVStKuGKrz3arUQRyxO5YM6cx9PbMjWq4OW79haMElTNQgcBVeNNDZFuUNfxfoTuJr8kKz4HHqVa8H40EgWZhwSKLfHuhx_JMZhdhpdFli8OuOoYlS4L4w26fMgJg8zRRxPJyCgRACvfhgpx1dX7FsnE9jB6KHiegF68Pays9rYxeoGuQlEaqFV18XBcPPBwj4-qTJg4USYUiOIfDikOt-i0DBZKdDtMQoNWGmE3OmYyWcI2BwFQvbCxAwEaU5DDSyJL4UbGIi4ZlZZrJZMfsx028fTKZDLKLixIYiLhaMXKincX74HZjjKJTHyCRWMhKJu7RAyYdVZ43uES3xZofgH4CMKE3LIzWeFv76Sy49gl-3S7LpjnXYZdGktSYSE01H6-5E0HjJzHBXjWec4DalHR2QgkJ8o06GOFLmAIuS-xkzBe-AHv_ZZg8laxQyM0OKUp_664SZX-cQq9MIq54AnWEc_8j3aKjFBryAm3QFPlYsWH_Iy7nwwUWfVgOnvxfxcEEFarl3e_vKdRkQhNpOz0798OuRrs5FK_vwxpj772lat2VBnt4TZ-J0BsYasZxiM_Pg2Sj9_s_IszaXHsZG%3Dw1329-h677-no&hash=51fa523a7e3e6a964319c39ad7ca5461)

abit of documentation on my current approch, (sorry for my bad english)
Title: Re: Canon 40D
Post by: heder on March 18, 2020, 09:56:54 AM
After hijkacing engio_write,EngDrvOut and EngDrvOuts, and reading the output I have finally tracked down RAW_LV_EDMAC to edmac channel 4,
and with shamem_read nearly completed, next step in a week or two is to tryout CONFIG_RAW_LIVEVIEW.

Code: [Select]
********************************************************************************************************
Section liveview generic start ... 

engio_write start/end = engio_write
EngDrvOuts      = EngDrvOuts
All others are  = EngDrvOut
First value     = some timer tick counter

********************************************************************************************************

-99030 : Read  Addr: 0xc0f04008, Data: 0x3ffffffe [16383 65534] DMA 0 REG dst
-99029 : Read  Addr: 0xc0f04108, Data: 0x34913f4a [13457 16202] DMA 1 REG dst
-99028 : Read  Addr: 0xc0f04208, Data: 0x38002ade [14336 10974] DMA 2 REG dst
-99027 : Read  Addr: 0xc0f04308, Data: 0x3bf404a8 [15348  1192] DMA 3 REG dst
-95190 : Read  Addr: 0xc0f04408, Data: 0x3e34587e [15924 22654] DMA 4 REG dst
-95189 : Read  Addr: 0xc0f04508, Data: 0x3ea8f27e [16040 62078] DMA 5 REG dst
-95188 : Read  Addr: 0xc0f04608, Data: 0x34a96fe8 [13481 28648] DMA 6 REG dst
-95187 : Read  Addr: 0xc0f04708, Data: 0x       0 [    0     0] DMA 7 REG dst
-91450 : Read  Addr: 0xc0f04808, Data: 0x3ba65e1e [15270 24094] DMA 8 REG dst
-91448 : Read  Addr: 0xc0f04908, Data: 0x1d2e4a48 [ 7470 19016] DMA 9 REG dst
-91448 : Read  Addr: 0xc0f04a08, Data: 0x3e25122e [15909  4654] DMA 10 REG dst
-91446 : Read  Addr: 0xc0f04b08, Data: 0x39e1dbce [14817 56270] DMA 11 REG dst
-87680 : Read  Addr: 0xc0f04c08, Data: 0x35a051be [13728 20926] DMA 12 REG dst
-87679 : Read  Addr: 0xc0f04d08, Data: 0x291b4efe [10523 20222] DMA 13 REG dst
-87678 : Read  Addr: 0xc0f04e08, Data: 0x       0 [    0     0] DMA 14 REG dst
-87677 : Read  Addr: 0xc0f04f08, Data: 0x       0 [    0     0] DMA 15 REG dst
-43209 : Write Addr: 0xc0f14080, Data: 0x  fc0000 [  252     0] LiveView
-43207 : Write Addr: 0xc0f14084, Data: 0x 346de7f [  838 56959] LiveView
-43206 : Write Addr: 0xc0f14088, Data: 0x 36dcba1 [  877 52129] LiveView
-43205 : Write Addr: 0xc0f1408c, Data: 0x 31a66ea [  794 26346] LiveView
-43204 : Write Addr: 0xc0f14090, Data: 0x 3a42280 [  932  8832] LiveView
-43202 : Write Addr: 0xc0f14094, Data: 0x 3604377 [  864 17271] LiveView
-43201 : Write Addr: 0xc0f14098, Data: 0x 3cf9a16 [  975 39446] LiveView
-43200 : Write Addr: 0xc0f1409c, Data: 0x 393b94b [  915 47435] LiveView
-43199 : Write Addr: 0xc0f140a0, Data: 0x       0 [    0     0] LiveView
-43198 : Write Addr: 0xc0f140a4, Data: 0x 3000000 [  768     0] LiveView
-43197 : Write Addr: 0xc0f140a8, Data: 0x 3190000 [  793     0] LiveView
-43195 : Write Addr: 0xc0f140ac, Data: 0x 33a0000 [  826     0] LiveView
-43194 : Write Addr: 0xc0f140b0, Data: 0x 3750000 [  885     0] LiveView
-43193 : Write Addr: 0xc0f140b4, Data: 0x 39c0000 [  924     0] LiveView
-43192 : Write Addr: 0xc0f140b8, Data: 0x 3c30000 [  963     0] LiveView
-43191 : Write Addr: 0xc0f140bc, Data: 0x 3eb0000 [ 1003     0] LiveView
-43189 : Write Addr: 0xc0f14078, Data: 0x       1 [    0     1] LiveView
-68927 : Write Addr: 0xc0f14080, Data: 0x  fc0000 [  252     0] LiveView
-68926 : Write Addr: 0xc0f14084, Data: 0x 346de7f [  838 56959] LiveView
-68924 : Write Addr: 0xc0f14088, Data: 0x 36dcba1 [  877 52129] LiveView
-68923 : Write Addr: 0xc0f1408c, Data: 0x 31a66ea [  794 26346] LiveView
-68922 : Write Addr: 0xc0f14090, Data: 0x 3a42280 [  932  8832] LiveView
-68921 : Write Addr: 0xc0f14094, Data: 0x 3604377 [  864 17271] LiveView
-68920 : Write Addr: 0xc0f14098, Data: 0x 3cf9a16 [  975 39446] LiveView
-68918 : Write Addr: 0xc0f1409c, Data: 0x 393b94b [  915 47435] LiveView
-68917 : Write Addr: 0xc0f140a0, Data: 0x       0 [    0     0] LiveView
-68916 : Write Addr: 0xc0f140a4, Data: 0x 3000000 [  768     0] LiveView
-68915 : Write Addr: 0xc0f140a8, Data: 0x 3190000 [  793     0] LiveView
-68914 : Write Addr: 0xc0f140ac, Data: 0x 33a0000 [  826     0] LiveView
-68913 : Write Addr: 0xc0f140b0, Data: 0x 3750000 [  885     0] LiveView
-68912 : Write Addr: 0xc0f140b4, Data: 0x 39c0000 [  924     0] LiveView
-68910 : Write Addr: 0xc0f140b8, Data: 0x 3c30000 [  963     0] LiveView
-68909 : Write Addr: 0xc0f140bc, Data: 0x 3eb0000 [ 1003     0] LiveView
-68908 : Write Addr: 0xc0f14078, Data: 0x       1 [    0     1] LiveView

Multiple ClockOuts

-58341 : Write Addr: 0xc0f0b000, Data: 0x       0 [    0     0]
engio_write start
-58338 : Write Addr: 0xc0f03030, Data: 0x80010000 [32769     0]
-58334 : Write Addr: 0xc0f03068, Data: 0x80010004 [32769     4]
-58333 : Write Addr: 0xc0f03070, Data: 0x80010007 [32769     7]
-58332 : Write Addr: 0xc0f0b008, Data: 0x       0 [    0     0]
engio_write end
-58272 : Write Addr: 0xc0f0b000, Data: 0x       1 [    0     1]

Multiple ClockOuts

engio_write start
-57672 : Write Addr: 0xc0f18000, Data: 0x       2 [    0     2]
-57669 : Write Addr: 0xc0f18004, Data: 0x 3fff000 [ 1023 61440]
-57668 : Write Addr: 0xc0f18008, Data: 0x       0 [    0     0]
-57666 : Write Addr: 0xc0f1800c, Data: 0x  1c7f00 [   28 32512]
-57665 : Write Addr: 0xc0f18010, Data: 0x       0 [    0     0]
-57664 : Write Addr: 0xc0f06004, Data: 0x       0 [    0     0] Videotiming - standby
-57662 : Write Addr: 0xc0f06008, Data: 0x 5490549 [ 1353  1353] Videotiming - T0(0)
-57661 : Write Addr: 0xc0f0600c, Data: 0x 5490549 [ 1353  1353] Videotiming - T0(1)
-57659 : Write Addr: 0xc0f06010, Data: 0x     549 [    0  1353] Videotiming - T0(2)
-57658 : Write Addr: 0xc0f06018, Data: 0x      20 [    0    32] Videotiming - ?
-57657 : Write Addr: 0xc0f0601c, Data: 0x       0 [    0     0] Videotiming - ?
-57655 : Write Addr: 0xc0f06020, Data: 0x       2 [    0     2] Videotiming - ?
-57654 : Write Addr: 0xc0f06024, Data: 0x       0 [    0     0] Videotiming - ?
-57652 : Write Addr: 0xc0f06028, Data: 0x       0 [    0     0] Videotiming - ?
-57651 : Write Addr: 0xc0f0602c, Data: 0x       0 [    0     0] Videotiming - ?
-57649 : Write Addr: 0xc0f06030, Data: 0x       0 [    0     0] Videotiming - ?
-57648 : Write Addr: 0xc0f06034, Data: 0x       0 [    0     0] Videotiming - ?
-57647 : Write Addr: 0xc0f06038, Data: 0x       0 [    0     0] Videotiming - ?
-57645 : Write Addr: 0xc0f0603c, Data: 0x       0 [    0     0] Videotiming - ?
-57644 : Write Addr: 0xc0f06040, Data: 0x       0 [    0     0] Videotiming - ?
-57642 : Write Addr: 0xc0f06044, Data: 0x       0 [    0     0] Videotiming - ?
-57641 : Write Addr: 0xc0f06048, Data: 0x       0 [    0     0] Videotiming - ?
-57640 : Write Addr: 0xc0f0604c, Data: 0x       0 [    0     0] Videotiming - ?
-57638 : Write Addr: 0xc0f06050, Data: 0x       0 [    0     0] Videotiming - ?
-57637 : Write Addr: 0xc0f06054, Data: 0x       0 [    0     0] Videotiming - ?
-57635 : Write Addr: 0xc0f06058, Data: 0x       0 [    0     0] Videotiming - ?
-57634 : Write Addr: 0xc0f0605c, Data: 0x       0 [    0     0] Videotiming - ?
-57632 : Write Addr: 0xc0f06060, Data: 0x       0 [    0     0] Videotiming - ?
-57631 : Write Addr: 0xc0f06064, Data: 0x       0 [    0     0] Videotiming - ?
-57630 : Write Addr: 0xc0f06068, Data: 0x       0 [    0     0] Videotiming - ?
-57628 : Write Addr: 0xc0f0606c, Data: 0x       0 [    0     0] Videotiming - ?
-57627 : Write Addr: 0xc0f06070, Data: 0x       0 [    0     0] Videotiming - ?
-57625 : Write Addr: 0xc0f06074, Data: 0x       0 [    0     0] Videotiming - ?
-57624 : Write Addr: 0xc0f06078, Data: 0x       0 [    0     0] Videotiming - ?
-57623 : Write Addr: 0xc0f0607c, Data: 0x       0 [    0     0] Videotiming - ?
-57621 : Write Addr: 0xc0f060e8, Data: 0x    1fff [    0  8191] Videotiming - ?
-57620 : Write Addr: 0xc0f06080, Data: 0x       0 [    0     0] Videotiming - ?
-57619 : Write Addr: 0xc0f06084, Data: 0x   20271 [    2   625] Videotiming - raw first line & coloum
-57617 : Write Addr: 0xc0f06088, Data: 0x 369050d [  873  1293] Videotiming - raw last line & coloum
-57615 : Write Addr: 0xc0f0608c, Data: 0x3fff3fff [16383 16383] Videotiming - ?
-57614 : Write Addr: 0xc0f06090, Data: 0x3fff3fff [16383 16383] Videotiming - ?
-57612 : Write Addr: 0xc0f06094, Data: 0x3fff3fff [16383 16383] Videotiming - ?
-57611 : Write Addr: 0xc0f06098, Data: 0x3fff3fff [16383 16383] Videotiming - ?
-57610 : Write Addr: 0xc0f0609c, Data: 0x 2222200 [  546  8704] Videotiming - ?
-57608 : Write Addr: 0xc0f060a0, Data: 0x       0 [    0     0] Videotiming - ?
-57607 : Write Addr: 0xc0f060a8, Data: 0x       0 [    0     0] Videotiming - ?
-57606 : Write Addr: 0xc0f060ac, Data: 0x       0 [    0     0] Videotiming - ?
-57604 : Write Addr: 0xc0f060b0, Data: 0x       0 [    0     0] Videotiming - ?
-57603 : Write Addr: 0xc0f060b4, Data: 0x       0 [    0     0] Videotiming - ?
-57601 : Write Addr: 0xc0f060cc, Data: 0x       0 [    0     0] Videotiming - ?
-57600 : Write Addr: 0xc0f060d0, Data: 0x       0 [    0     0] Videotiming - ?
-57598 : Write Addr: 0xc0f060d4, Data: 0x       0 [    0     0] Videotiming - ?
-57597 : Write Addr: 0xc0f060d8, Data: 0x       0 [    0     0] Videotiming - ?
-57596 : Write Addr: 0xc0f060dc, Data: 0x      10 [    0    16] Videotiming - ?
-57594 : Write Addr: 0xc0f060e0, Data: 0x       0 [    0     0] Videotiming - ?
-57593 : Write Addr: 0xc0f060e4, Data: 0x       0 [    0     0] Videotiming - ?
-57592 : Write Addr: 0xc0f06000, Data: 0x       1 [    0     1] Videotiming - trig
-57590 : Write Addr: 0xc0f07008, Data: 0x       1 [    0     1] HEAD timer
-57589 : Write Addr: 0xc0f07010, Data: 0x    3fff [    0 16383] HEAD timer
-57587 : Write Addr: 0xc0f07014, Data: 0x      63 [    0    99] HEAD timer
-57586 : Write Addr: 0xc0f07018, Data: 0x      1c [    0    28] HEAD timer
-57585 : Write Addr: 0xc0f0701c, Data: 0x       0 [    0     0] HEAD timer
-57583 : Write Addr: 0xc0f0707c, Data: 0x       0 [    0     0] HEAD timer
-57582 : Write Addr: 0xc0f071ac, Data: 0x      10 [    0    16] HEAD timer
-57580 : Write Addr: 0xc0f07004, Data: 0x       1 [    0     1] HEAD timer
-57579 : Write Addr: 0xc0f0700c, Data: 0x       1 [    0     1] HEAD timer
-57578 : Write Addr: 0xc0f07020, Data: 0x       0 [    0     0] HEAD timer
-57576 : Write Addr: 0xc0f07024, Data: 0x       0 [    0     0] HEAD timer
-57575 : Write Addr: 0xc0f07028, Data: 0x    1000 [    0  4096] HEAD timer
-57573 : Write Addr: 0xc0f0702c, Data: 0x       0 [    0     0] HEAD timer
-57572 : Write Addr: 0xc0f07038, Data: 0x      40 [    0    64] HEAD timer
-57571 : Write Addr: 0xc0f07048, Data: 0x       0 [    0     0] HEAD timer
-57569 : Write Addr: 0xc0f0704c, Data: 0x       0 [    0     0] HEAD timer
-57568 : Write Addr: 0xc0f07050, Data: 0x       0 [    0     0] HEAD timer
-57567 : Write Addr: 0xc0f0705c, Data: 0x       0 [    0     0] HEAD timer
-57565 : Write Addr: 0xc0f07060, Data: 0x       0 [    0     0] HEAD timer
-57564 : Write Addr: 0xc0f07064, Data: 0x       0 [    0     0] HEAD timer
-57562 : Write Addr: 0xc0f07134, Data: 0x       0 [    0     0] HEAD timer
-57561 : Write Addr: 0xc0f07138, Data: 0x       0 [    0     0] HEAD timer
-57559 : Write Addr: 0xc0f0713c, Data: 0x       0 [    0     0] HEAD timer
-57558 : Write Addr: 0xc0f07148, Data: 0x       0 [    0     0] HEAD timer
-57557 : Write Addr: 0xc0f0714c, Data: 0x       0 [    0     0] HEAD timer
-57555 : Write Addr: 0xc0f07150, Data: 0x       0 [    0     0] HEAD timer
-57554 : Write Addr: 0xc0f07068, Data: 0x       0 [    0     0] HEAD timer
-57552 : Write Addr: 0xc0f0706c, Data: 0x       0 [    0     0] HEAD timer
-57551 : Write Addr: 0xc0f07070, Data: 0x       0 [    0     0] HEAD timer
-57550 : Write Addr: 0xc0f07078, Data: 0x       0 [    0     0] HEAD timer
-57548 : Write Addr: 0xc0f0708c, Data: 0x       0 [    0     0] HEAD timer
-57547 : Write Addr: 0xc0f07090, Data: 0x       0 [    0     0] HEAD timer
-57546 : Write Addr: 0xc0f07094, Data: 0x       0 [    0     0] HEAD timer
-57544 : Write Addr: 0xc0f07098, Data: 0x       0 [    0     0] HEAD timer
-57543 : Write Addr: 0xc0f0709c, Data: 0x       0 [    0     0] HEAD timer
-57541 : Write Addr: 0xc0f070a0, Data: 0x       0 [    0     0] HEAD timer
-57540 : Write Addr: 0xc0f070a4, Data: 0x       0 [    0     0] HEAD timer
-57539 : Write Addr: 0xc0f070b4, Data: 0x       0 [    0     0] HEAD timer
-57537 : Write Addr: 0xc0f070b8, Data: 0x   10020 [    1    32] HEAD timer
-57535 : Write Addr: 0xc0f070bc, Data: 0x       0 [    0     0] HEAD timer
-57534 : Write Addr: 0xc0f070c0, Data: 0x     411 [    0  1041] HEAD timer
-57533 : Write Addr: 0xc0f070c4, Data: 0x 1101000 [  272  4096] HEAD timer
-57531 : Write Addr: 0xc0f070cc, Data: 0x       0 [    0     0] HEAD timer
-57530 : Write Addr: 0xc0f070d0, Data: 0x       0 [    0     0] HEAD timer
-57529 : Write Addr: 0xc0f070d4, Data: 0x       0 [    0     0] HEAD timer
-57527 : Write Addr: 0xc0f070e0, Data: 0x       4 [    0     4] HEAD timer
-57526 : Write Addr: 0xc0f070e4, Data: 0x       4 [    0     4] HEAD timer
-57524 : Write Addr: 0xc0f070e8, Data: 0x       8 [    0     8] HEAD timer
-57523 : Write Addr: 0xc0f070ec, Data: 0x       8 [    0     8] HEAD timer
-57522 : Write Addr: 0xc0f070f0, Data: 0x      10 [    0    16] HEAD timer
-57520 : Write Addr: 0xc0f070f4, Data: 0x      10 [    0    16] HEAD timer
-57519 : Write Addr: 0xc0f070f8, Data: 0x       0 [    0     0] HEAD timer
-57517 : Write Addr: 0xc0f070fc, Data: 0x       1 [    0     1] HEAD timer
-57516 : Write Addr: 0xc0f07100, Data: 0x       0 [    0     0] HEAD timer
-57515 : Write Addr: 0xc0f07104, Data: 0x       0 [    0     0] HEAD timer
-57513 : Write Addr: 0xc0f07108, Data: 0x     211 [    0   529] HEAD timer
-57512 : Write Addr: 0xc0f0710c, Data: 0x     500 [    0  1280] HEAD timer
-57511 : Write Addr: 0xc0f07110, Data: 0x       0 [    0     0] HEAD timer
-57509 : Write Addr: 0xc0f07114, Data: 0x       0 [    0     0] HEAD timer
-57508 : Write Addr: 0xc0f07000, Data: 0x       0 [    0     0] HEAD timer
engio_write end
engio_write start
-57499 : Write Addr: 0xc0f06008, Data: 0x 5490549 [ 1353  1353] Videotiming - T0(0)
-57497 : Write Addr: 0xc0f0600c, Data: 0x 5490549 [ 1353  1353] Videotiming - T0(1)
-57496 : Write Addr: 0xc0f06010, Data: 0x     549 [    0  1353] Videotiming - T0(2)
-57494 : Write Addr: 0xc0f06084, Data: 0x   20271 [    2   625] Videotiming - raw first line & coloum
-57493 : Write Addr: 0xc0f06088, Data: 0x 369050d [  873  1293] Videotiming - raw last line & coloum
-57492 : Write Addr: 0xc0f06000, Data: 0x       1 [    0     1] Videotiming - trig
engio_write end
engio_write start
-57483 : Write Addr: 0xc0f06014, Data: 0x     218 [    0   536] Videotiming - T1
-57482 : Write Addr: 0xc0f06000, Data: 0x       1 [    0     1] Videotiming - trig
engio_write end

Multiple ClockOuts

-56996 : Write Addr: 0xc0f05004, Data: 0x       6 [    0     6] edmac connection
-56994 : Write Addr: 0xc0f05038, Data: 0x       1 [    0     1] edmac connection
EngDrvOuts start
-56981 : Write Addr: 0xc0f0410c, Data: 0x       2 [    0     2] DMA 1 REG yn | xn
-56980 : Write Addr: 0xc0f04110, Data: 0x ca70080 [ 3239   128] DMA 1 REG yb | xb
-56979 : Write Addr: 0xc0f04114, Data: 0x      80 [    0   128] DMA 1 REG ya | xa
-56978 : Write Addr: 0xc0f04118, Data: 0x       0 [    0     0] DMA 1 REG off1
-56977 : Write Addr: 0xc0f0411c, Data: 0x       0 [    0     0] DMA 1 REG off2b
-56976 : Write Addr: 0xc0f04120, Data: 0x       0 [    0     0] DMA 1 REG off1a
-56974 : Write Addr: 0xc0f04124, Data: 0x       0 [    0     0] DMA 1 REG off2a
-56973 : Write Addr: 0xc0f04128, Data: 0x       0 [    0     0] DMA 1 REG off3
EngDrvOuts end
-56969 : Write Addr: 0xc0f04104, Data: 0x60000000 [24576     0] DMA 1 REG flags
-56967 : Write Addr: 0xc0f04108, Data: 0x1dbc0064 [ 7612   100] DMA 1 REG dst
EngDrvOuts start
-56961 : Write Addr: 0xc0f0490c, Data: 0x       2 [    0     2] DMA 9 REG yn | xn
-56960 : Write Addr: 0xc0f04910, Data: 0x ca70080 [ 3239   128] DMA 9 REG yb | xb
-56959 : Write Addr: 0xc0f04914, Data: 0x      80 [    0   128] DMA 9 REG ya | xa
-56958 : Write Addr: 0xc0f04918, Data: 0x   1ff80 [    1 65408] DMA 9 REG off1
-56957 : Write Addr: 0xc0f0491c, Data: 0x fffff80 [ 4095 65408] DMA 9 REG off2b
-56956 : Write Addr: 0xc0f04920, Data: 0x   1ff80 [    1 65408] DMA 9 REG off1a
-56955 : Write Addr: 0xc0f04924, Data: 0x       0 [    0     0] DMA 9 REG off2a
-56954 : Write Addr: 0xc0f04928, Data: 0x       0 [    0     0] DMA 9 REG off3
EngDrvOuts end
-56951 : Write Addr: 0xc0f04904, Data: 0x40000001 [16384     1] DMA 9 REG flags
-56950 : Write Addr: 0xc0f04908, Data: 0x1078bbf8 [ 4216 48120] DMA 9 REG dst
-56943 : Write Addr: 0xc0f04104, Data: 0x60000000 [24576     0] DMA 1 REG flags
-56942 : Write Addr: 0xc0f04100, Data: 0x       1 [    0     1] DMA 1 REG ctrl
-56941 : Write Addr: 0xc0f04904, Data: 0x40010001 [16385     1] DMA 9 REG flags
-56940 : Write Addr: 0xc0f04900, Data: 0x       1 [    0     1] DMA 9 REG ctrl
-50079 : Read  Addr: 0xc0f04130, Data: 0x       2 [    0     2] DMA 1 REG intr
-50067 : Write Addr: 0xc0f04104, Data: 0x       0 [    0     0] DMA 1 REG flags
-50064 : Write Addr: 0xc0f04100, Data: 0x       4 [    0     4] DMA 1 REG ctrl
-49995 : Read  Addr: 0xc0f04930, Data: 0x       1 [    0     1] DMA 9 REG intr
-49986 : Write Addr: 0xc0f04904, Data: 0x       0 [    0     0] DMA 9 REG flags
-49985 : Write Addr: 0xc0f04900, Data: 0x       4 [    0     4] DMA 9 REG ctrl
-49886 : Read  Addr: 0xc0f01004, Data: 0x    3045 [    0 12357] PowerCtrl
-49883 : Read  Addr: 0xc0f01000, Data: 0x    b045 [    0 45125] PowerCtrl
-49878 : Write Addr: 0xc0f01004, Data: 0x    3045 [    0 12357] PowerCtrl
-49877 : Write Addr: 0xc0f01000, Data: 0x    b045 [    0 45125] PowerCtrl

Multiple ClockOuts


engio_write start
-48732 : Write Addr: 0xc0f08100, Data: 0x       0 [    0     0] PreProc
-48730 : Write Addr: 0xc0f082dc, Data: 0x       1 [    0     1] PreProc
-48729 : Write Addr: 0xc0f0810c, Data: 0x       0 [    0     0] PreProc
-48728 : Write Addr: 0xc0f08394, Data: 0x       0 [    0     0] PreProc
-48725 : Write Addr: 0xc0f08108, Data: 0x       3 [    0     3] PreProc
-48724 : Write Addr: 0xc0f08390, Data: 0x       0 [    0     0] PreProc
-48723 : Write Addr: 0xc0f08264, Data: 0x       0 [    0     0] PreProc
-48721 : Write Addr: 0xc0f08130, Data: 0x80000000 [32768     0] PreProc
-48719 : Write Addr: 0xc0f08134, Data: 0x       1 [    0     1] PreProc
-48718 : Write Addr: 0xc0f08138, Data: 0x      10 [    0    16] PreProc
-48716 : Write Addr: 0xc0f0814c, Data: 0x       6 [    0     6] PreProc
-48715 : Write Addr: 0xc0f08158, Data: 0x       0 [    0     0] PreProc
-48713 : Write Addr: 0xc0f08154, Data: 0x       8 [    0     8] PreProc
-48711 : Write Addr: 0xc0f08140, Data: 0x       0 [    0     0] PreProc
-48710 : Write Addr: 0xc0f08150, Data: 0x     fff [    0  4095] PreProc
-48708 : Write Addr: 0xc0f0815c, Data: 0x       2 [    0     2] PreProc
-48706 : Write Addr: 0xc0f08160, Data: 0x    3fff [    0 16383] PreProc
-48705 : Write Addr: 0xc0f0826c, Data: 0x       0 [    0     0] PreProc
-48703 : Write Addr: 0xc0f08180, Data: 0x80000000 [32768     0] PreProc
-48702 : Write Addr: 0xc0f08420, Data: 0x     200 [    0   512] PreProc
-48700 : Write Addr: 0xc0f08428, Data: 0x     111 [    0   273] PreProc
-48699 : Write Addr: 0xc0f0842c, Data: 0x       0 [    0     0] PreProc
-48697 : Write Addr: 0xc0f08430, Data: 0x       0 [    0     0] PreProc
-48696 : Write Addr: 0xc0f08218, Data: 0x       8 [    0     8] PreProc
-48694 : Write Addr: 0xc0f08214, Data: 0x       0 [    0     0] PreProc
-48692 : Write Addr: 0xc0f08184, Data: 0x     367 [    0   871] PreProc
-48691 : Write Addr: 0xc0f08188, Data: 0x     537 [    0  1335] PreProc
-48689 : Write Addr: 0xc0f0819c, Data: 0x     400 [    0  1024] PreProc
-48687 : Write Addr: 0xc0f0818c, Data: 0x       0 [    0     0] PreProc
-48686 : Write Addr: 0xc0f08190, Data: 0x       0 [    0     0] PreProc
-48684 : Write Addr: 0xc0f08194, Data: 0x     537 [    0  1335] PreProc
-48683 : Write Addr: 0xc0f08198, Data: 0x     537 [    0  1335] PreProc
-48681 : Write Addr: 0xc0f081c4, Data: 0x       0 [    0     0] PreProc
-48679 : Write Addr: 0xc0f081c8, Data: 0x       0 [    0     0] PreProc
-48678 : Write Addr: 0xc0f081cc, Data: 0x       0 [    0     0] PreProc
-48677 : Write Addr: 0xc0f081d0, Data: 0x       0 [    0     0] PreProc
-48675 : Write Addr: 0xc0f081d4, Data: 0x       0 [    0     0] PreProc
-48673 : Write Addr: 0xc0f081d8, Data: 0x       0 [    0     0] PreProc
-48672 : Write Addr: 0xc0f081dc, Data: 0x       0 [    0     0] PreProc
-48670 : Write Addr: 0xc0f081e0, Data: 0x       0 [    0     0] PreProc
-48668 : Write Addr: 0xc0f081e4, Data: 0x       1 [    0     1] PreProc
-48667 : Write Addr: 0xc0f081e8, Data: 0x       1 [    0     1] PreProc
-48665 : Write Addr: 0xc0f081ec, Data: 0x       0 [    0     0] PreProc
-48664 : Write Addr: 0xc0f081f0, Data: 0x       0 [    0     0] PreProc
-48662 : Write Addr: 0xc0f081f4, Data: 0x       0 [    0     0] PreProc
-48660 : Write Addr: 0xc0f081a4, Data: 0x       0 [    0     0] PreProc
-48659 : Write Addr: 0xc0f081a8, Data: 0x       1 [    0     1] PreProc
-48658 : Write Addr: 0xc0f081ac, Data: 0x       1 [    0     1] PreProc
-48655 : Write Addr: 0xc0f081b0, Data: 0x       0 [    0     0] PreProc
-48654 : Write Addr: 0xc0f081b4, Data: 0x       0 [    0     0] PreProc
-48653 : Write Addr: 0xc0f082c4, Data: 0x       1 [    0     1] PreProc
-48651 : Write Addr: 0xc0f08180, Data: 0x       0 [    0     0] PreProc
-48649 : Write Addr: 0xc0f0820c, Data: 0x 29b0000 [  667     0] PreProc
-48648 : Write Addr: 0xc0f08208, Data: 0x      11 [    0    17] PreProc
-48646 : Write Addr: 0xc0f08020, Data: 0x80000000 [32768     0] Preproc REG SHAD ctrl
-48645 : Write Addr: 0xc0f08024, Data: 0x    1008 [    0  4104] Preproc REG SHAD mode
-48643 : Write Addr: 0xc0f08028, Data: 0x       0 [    0     0] Preproc REG SHAD pre
-48641 : Write Addr: 0xc0f0802c, Data: 0x       0 [    0     0] Preproc REG SHAD post
-48640 : Write Addr: 0xc0f08030, Data: 0x    1000 [    0  4096] Preproc REG SHAD gain
-48639 : Write Addr: 0xc0f08034, Data: 0x    1c00 [    0  7168] Preproc REG SHAD pre2
-48636 : Write Addr: 0xc0f08038, Data: 0x     400 [    0  1024] Preproc REG SHAD post2
-48635 : Write Addr: 0xc0f08280, Data: 0x       0 [    0     0] PreProc
-48634 : Write Addr: 0xc0f08284, Data: 0x       0 [    0     0] PreProc
-48632 : Write Addr: 0xc0f08288, Data: 0x       0 [    0     0] PreProc
-48630 : Write Addr: 0xc0f0828c, Data: 0x       1 [    0     1] PreProc
-48629 : Write Addr: 0xc0f08290, Data: 0x       0 [    0     0] PreProc
-48627 : Write Addr: 0xc0f082a8, Data: 0x       1 [    0     1] PreProc
-48626 : Write Addr: 0xc0f080a0, Data: 0x80000000 [32768     0] PreProc
-48624 : Write Addr: 0xc0f080a4, Data: 0x       0 [    0     0] PreProc
-48622 : Write Addr: 0xc0f080a8, Data: 0x     103 [    0   259] PreProc
-48621 : Write Addr: 0xc0f080ac, Data: 0x       0 [    0     0] PreProc
-48620 : Write Addr: 0xc0f080b0, Data: 0x 3670537 [  871  1335] PreProc
-48617 : Write Addr: 0xc0f080b4, Data: 0x       0 [    0     0] PreProc
-48616 : Write Addr: 0xc0f080bc, Data: 0x       0 [    0     0] PreProc
-48615 : Write Addr: 0xc0f080d0, Data: 0x       0 [    0     0] PreProc
-48613 : Write Addr: 0xc0f080d4, Data: 0x       1 [    0     1] PreProc
-48611 : Write Addr: 0xc0f08270, Data: 0x       0 [    0     0] PreProc
-48610 : Write Addr: 0xc0f082b4, Data: 0x       1 [    0     1] PreProc
-48608 : Write Addr: 0xc0f08114, Data: 0x       a [    0    10] PreProc
-48607 : Write Addr: 0xc0f08398, Data: 0x       0 [    0     0] PreProc
-48605 : Write Addr: 0xc0f082d4, Data: 0x       0 [    0     0] PreProc
-48603 : Write Addr: 0xc0f08090, Data: 0x80000000 [32768     0] PreProc
-48602 : Write Addr: 0xc0f08094, Data: 0x      20 [    0    32] PreProc
-48601 : Write Addr: 0xc0f08268, Data: 0x       0 [    0     0] PreProc
-48598 : Write Addr: 0xc0f0d000, Data: 0x80000000 [32768     0]
-48597 : Write Addr: 0xc0f0d004, Data: 0x       0 [    0     0]
-48596 : Write Addr: 0xc0f0d008, Data: 0x77772222 [30583  8738]
-48594 : Write Addr: 0xc0f0d00c, Data: 0x       0 [    0     0]
-48592 : Write Addr: 0xc0f0d010, Data: 0x       0 [    0     0]
-48591 : Write Addr: 0xc0f0d014, Data: 0x 3670538 [  871  1336]
-48589 : Write Addr: 0xc0f0d018, Data: 0x     583 [    0  1411]
-48588 : Write Addr: 0xc0f0d01c, Data: 0x       0 [    0     0]
-48586 : Write Addr: 0xc0f0d020, Data: 0x       0 [    0     0]
-48584 : Write Addr: 0xc0f0d024, Data: 0x       0 [    0     0]
-48583 : Write Addr: 0xc0f0d028, Data: 0x       0 [    0     0]
-48582 : Write Addr: 0xc0f0d02c, Data: 0x       0 [    0     0]
-48579 : Write Addr: 0xc0f0d030, Data: 0x       0 [    0     0]
-48578 : Write Addr: 0xc0f0d038, Data: 0x      20 [    0    32]
-48577 : Write Addr: 0xc0f0d03c, Data: 0x       0 [    0     0]
-48575 : Write Addr: 0xc0f0d040, Data: 0x       0 [    0     0]
-48573 : Write Addr: 0xc0f0d044, Data: 0x       0 [    0     0]
-48572 : Write Addr: 0xc0f0d048, Data: 0x       0 [    0     0]
-48570 : Write Addr: 0xc0f0d04c, Data: 0x       0 [    0     0]
-48569 : Write Addr: 0xc0f0d050, Data: 0x       0 [    0     0]
-48567 : Write Addr: 0xc0f0d054, Data: 0x       0 [    0     0]
-48565 : Write Addr: 0xc0f0d058, Data: 0x       0 [    0     0]
-48564 : Write Addr: 0xc0f0d05c, Data: 0x       0 [    0     0]
-48563 : Write Addr: 0xc0f0d060, Data: 0x       0 [    0     0]
-48560 : Write Addr: 0xc0f0d064, Data: 0x       0 [    0     0]
-48559 : Write Addr: 0xc0f0d070, Data: 0x       1 [    0     1]
-48558 : Write Addr: 0xc0f0d074, Data: 0x     103 [    0   259]
-48556 : Write Addr: 0xc0f0d078, Data: 0x       1 [    0     1]
-48554 : Write Addr: 0xc0f0d07c, Data: 0x       0 [    0     0]
-48553 : Write Addr: 0xc0f0d080, Data: 0x       0 [    0     0]
-48551 : Write Addr: 0xc0f0d084, Data: 0x       0 [    0     0]
-48550 : Write Addr: 0xc0f0d088, Data: 0x       0 [    0     0]
-48548 : Write Addr: 0xc0f0d094, Data: 0x       0 [    0     0]
-48546 : Write Addr: 0xc0f0d02c, Data: 0x       0 [    0     0]
-48545 : Write Addr: 0xc0f0d040, Data: 0x   b0076 [   11   118]
-48544 : Write Addr: 0xc0f0d044, Data: 0x 367057e [  871  1406]
-48541 : Write Addr: 0xc0f11004, Data: 0x       0 [    0     0] Resample ?
-48540 : Write Addr: 0xc0f1108c, Data: 0x       3 [    0     3] Resample ?
-48539 : Write Addr: 0xc0f112c0, Data: 0x       1 [    0     1] Resample ?
-48537 : Write Addr: 0xc0f11300, Data: 0x       1 [    0     1] Resample ?
-48535 : Write Addr: 0xc0f11108, Data: 0x       1 [    0     1] Resample ?
-48534 : Write Addr: 0xc0f111c0, Data: 0x       1 [    0     1] Resample ?
-48532 : Write Addr: 0xc0f110c4, Data: 0x       4 [    0     4] Resample ?
-48531 : Write Addr: 0xc0f11280, Data: 0x       1 [    0     1] Resample ?
-48529 : Write Addr: 0xc0f11284, Data: 0x       0 [    0     0] Resample ?
-48527 : Write Addr: 0xc0f11580, Data: 0x       1 [    0     1] Resample ?
-48526 : Write Addr: 0xc0f11584, Data: 0x       0 [    0     0] Resample ?
-48525 : Write Addr: 0xc0f11100, Data: 0x       5 [    0     5] Resample ?
-48522 : Write Addr: 0xc0f11170, Data: 0x       1 [    0     1] Resample ?
-48521 : Write Addr: 0xc0f11440, Data: 0x       1 [    0     1] Resample ?
-48520 : Write Addr: 0xc0f11444, Data: 0x       0 [    0     0] Resample ?
-48518 : Write Addr: 0xc0f11144, Data: 0x       7 [    0     7] Resample ?
-48516 : Write Addr: 0xc0f11110, Data: 0x       1 [    0     1] Resample ?
-48515 : Write Addr: 0xc0f11500, Data: 0x       1 [    0     1] Resample ?
-48513 : Write Addr: 0xc0f11504, Data: 0x       0 [    0     0] Resample ?
-48512 : Write Addr: 0xc0f11508, Data: 0x       0 [    0     0] Resample ?
-48510 : Write Addr: 0xc0f1150c, Data: 0x  8000a1 [  128   161] Resample ?
-48508 : Write Addr: 0xc0f11510, Data: 0x   60200 [    6   512] Resample ?
-48507 : Write Addr: 0xc0f11514, Data: 0x       0 [    0     0] Resample ?
-48506 : Write Addr: 0xc0f11518, Data: 0x     3ff [    0  1023] Resample ?
-48503 : Write Addr: 0xc0f1151c, Data: 0x 35b0507 [  859  1287] Resample ?
-48502 : Write Addr: 0xc0f11520, Data: 0x       0 [    0     0] Resample ?
-48501 : Write Addr: 0xc0f11524, Data: 0x       0 [    0     0] Resample ?
-48499 : Write Addr: 0xc0f11114, Data: 0x       b [    0    11] Resample ?
-48497 : Write Addr: 0xc0f11540, Data: 0x       1 [    0     1] Resample ?
-48496 : Write Addr: 0xc0f11544, Data: 0x       0 [    0     0] Resample ?
-48494 : Write Addr: 0xc0f11548, Data: 0x       0 [    0     0] Resample ?
-48493 : Write Addr: 0xc0f1154c, Data: 0x  22002b [   34    43] Resample ?
-48491 : Write Addr: 0xc0f11550, Data: 0x   503c4 [    5   964] Resample ?
-48489 : Write Addr: 0xc0f11554, Data: 0x       0 [    0     0] Resample ?
-48488 : Write Addr: 0xc0f11558, Data: 0x     2a7 [    0   679] Resample ?
-48486 : Write Addr: 0xc0f1155c, Data: 0x 35b03ff [  859  1023] Resample ?
-48484 : Write Addr: 0xc0f11560, Data: 0x       0 [    0     0] Resample ?
-48483 : Write Addr: 0xc0f11564, Data: 0x       0 [    0     0] Resample ?
-48482 : Write Addr: 0xc0f11158, Data: 0x       c [    0    12] Resample ?
-48480 : Write Addr: 0xc0f11050, Data: 0x       0 [    0     0] Resample ?
-48478 : Write Addr: 0xc0f1e000, Data: 0x80000000 [32768     0]
-48477 : Write Addr: 0xc0f1e004, Data: 0x       2 [    0     2]
-48475 : Write Addr: 0xc0f1e008, Data: 0x   1007f [    1   127]
-48474 : Write Addr: 0xc0f1e00c, Data: 0x   10001 [    1     1]
-48472 : Write Addr: 0xc0f1e010, Data: 0x       0 [    0     0]
-48470 : Write Addr: 0xc0f1e014, Data: 0x       0 [    0     0]
-48469 : Write Addr: 0xc0f1e018, Data: 0x       0 [    0     0]
-48467 : Write Addr: 0xc0f1e01c, Data: 0x       0 [    0     0]
-48465 : Write Addr: 0xc0f03034, Data: 0x80050000 [32773     0]
-48464 : Write Addr: 0xc0f03038, Data: 0x80050004 [32773     4]
-48462 : Write Addr: 0xc0f03024, Data: 0x80020000 [32770     0]
-48461 : Write Addr: 0xc0f03064, Data: 0x80020002 [32770     2]
-48459 : Write Addr: 0xc0f0306c, Data: 0x80020005 [32770     5]
-48457 : Write Addr: 0xc0f03000, Data: 0x80040000 [32772     0]
-48456 : Write Addr: 0xc0f03004, Data: 0x80040002 [32772     2]
-48455 : Write Addr: 0xc0f03008, Data: 0x80040004 [32772     4]
-48453 : Write Addr: 0xc0f0300c, Data: 0x80040006 [32772     6]
-48451 : Write Addr: 0xc0f03020, Data: 0x80070000 [32775     0]
-48450 : Write Addr: 0xc0f03028, Data: 0x80070002 [32775     2]
-48448 : Write Addr: 0xc0f0302c, Data: 0x80070005 [32775     5]
-48446 : Write Addr: 0xc0f03018, Data: 0x800c0000 [32780     0]
-48445 : Write Addr: 0xc0f0301c, Data: 0x800d0000 [32781     0]
-48443 : Write Addr: 0xc0f03090, Data: 0x       1 [    0     1]
-48442 : Write Addr: 0xc0f04f10, Data: 0x       1 [    0     1] DMA 15 REG yb | xb
-48440 : Write Addr: 0xc0f03054, Data: 0x       0 [    0     0]
engio_write end
engio_write start
-48433 : Write Addr: 0xc0f112c4, Data: 0x   10010 [    1    16] Resample ?
-48431 : Write Addr: 0xc0f112c8, Data: 0x   25aa1 [    2 23201] Resample ?
-48430 : Write Addr: 0xc0f112cc, Data: 0x       0 [    0     0] Resample ?
-48429 : Write Addr: 0xc0f112d0, Data: 0x     2cf [    0   719] Resample ?
-48426 : Write Addr: 0xc0f112d4, Data: 0x 35b0508 [  859  1288] Resample ?
-48425 : Write Addr: 0xc0f112d8, Data: 0x       0 [    0     0] Resample ?
-48424 : Write Addr: 0xc0f112dc, Data: 0x       0 [    0     0] Resample ?
-48422 : Write Addr: 0xc0f11304, Data: 0x      10 [    0    16] Resample ?
-48420 : Write Addr: 0xc0f11308, Data: 0x   1d6d7 [    1 54999] Resample ?
-48419 : Write Addr: 0xc0f1130c, Data: 0x       0 [    0     0] Resample ?
-48417 : Write Addr: 0xc0f11310, Data: 0x 3570000 [  855     0] Resample ?
-48416 : Write Addr: 0xc0f11314, Data: 0x 35b02cf [  859   719] Resample ?
-48414 : Write Addr: 0xc0f11318, Data: 0x       0 [    0     0] Resample ?
-48412 : Write Addr: 0xc0f1131c, Data: 0x       0 [    0     0] Resample ?
-48411 : Write Addr: 0xc0f1133c, Data: 0x     1bb [    0   443] Resample ?
-48410 : Write Addr: 0xc0f111c4, Data: 0x       0 [    0     0] Resample ?
-48407 : Write Addr: 0xc0f111c8, Data: 0x       0 [    0     0] Resample ?
-48406 : Write Addr: 0xc0f11588, Data: 0x       3 [    0     3] Resample ?
-48405 : Write Addr: 0xc0f1158c, Data: 0x       0 [    0     0] Resample ?
-48403 : Write Addr: 0xc0f11590, Data: 0x  d502cf [  213   719] Resample ?
-48401 : Write Addr: 0xc0f11594, Data: 0x       0 [    0     0] Resample ?
-48400 : Write Addr: 0xc0f11448, Data: 0x       0 [    0     0] Resample ?
-48398 : Write Addr: 0xc0f1144c, Data: 0x       0 [    0     0] Resample ?
-48397 : Write Addr: 0xc0f11450, Data: 0x  d502cf [  213   719] Resample ?
-48395 : Write Addr: 0xc0f11454, Data: 0x       0 [    0     0] Resample ?
engio_write end
-48391 : Write Addr: 0xc0f05040, Data: 0x       0 [    0     0] edmac connection
-48381 : Write Addr: 0xc0f05004, Data: 0x       4 [    0     4] edmac connection
-48379 : Write Addr: 0xc0f05010, Data: 0x       0 [    0     0] edmac connection => this is DMA 4 connected to 0
-48377 : Write Addr: 0xc0f05000, Data: 0x      15 [    0    21] edmac connection



********************************************************************************************************
Section: one frame of i/o ..

engio_write start/end = engio_write
EngDrvOuts      = EngDrvOuts
All others are  = EngDrvOut
First value     = some timer tick counter
********************************************************************************************************


**************** [DPATH] LV_JPG STOP ---

engio_write start
-61593 : Write Addr: 0xc0f03010, Data: 0x       0 [    0     0]
-61591 : Write Addr: 0xc0f03014, Data: 0x       0 [    0     0]
-61590 : Write Addr: 0xc0f0305c, Data: 0x       0 [    0     0]
-61588 : Write Addr: 0xc0f03060, Data: 0x       0 [    0     0]
-61586 : Write Addr: 0xc0f113c4, Data: 0x       0 [    0     0] Resample ?
-61585 : Write Addr: 0xc0f113c0, Data: 0x       1 [    0     1] Resample ?
-61583 : Write Addr: 0xc0f11008, Data: 0x       0 [    0     0] Resample ?
-61581 : Write Addr: 0xc0f11180, Data: 0x       1 [    0     1] Resample ?
-61580 : Write Addr: 0xc0f11404, Data: 0x       0 [    0     0] Resample ?
-61578 : Write Addr: 0xc0f11400, Data: 0x       1 [    0     1] Resample ?
-61576 : Write Addr: 0xc0f11040, Data: 0x       0 [    0     0] Resample ?
-61575 : Write Addr: 0xc0f13000, Data: 0x80000000 [32768     0]
engio_write end

multiple masterclocks (clockout)

-60655 : Write Addr: 0xc0f0500c, Data: 0x       3 [    0     3] edmac connection
-60652 : Write Addr: 0xc0f0502c, Data: 0x       2 [    0     2] edmac connection
-60638 : Write Addr: 0xc0f04304, Data: 0x20000000 [ 8192     0] DMA 3 - flags
-60636 : Write Addr: 0xc0f04308, Data: 0x107a9408 [ 4218 37896] DMA 3 - dst
-60629 : Write Addr: 0xc0f04a04, Data: 0x20000000 [ 8192     0] DMA 10 - flags
-60628 : Write Addr: 0xc0f04a08, Data: 0x1079947c [ 4217 38012] DMA 10 - dst
-60626 : Read  Addr: 0xc0f04a08, Data: 0x1079947c [ 4217 38012] DMA 10 - dst
-60624 : Read  Addr: 0xc0f04308, Data: 0x107a9408 [ 4218 37896] DMA 3 - dst
engio_write start
-60532 : Write Addr: 0xc0f113c4, Data: 0x       0 [    0     0] Resample ?
-60529 : Write Addr: 0xc0f113c0, Data: 0x       1 [    0     1] Resample ?
-60527 : Write Addr: 0xc0f11008, Data: 0x       0 [    0     0] Resample ?
-60526 : Write Addr: 0xc0f11340, Data: 0x       1 [    0     1] Resample ?
-60524 : Write Addr: 0xc0f11380, Data: 0x       1 [    0     1] Resample ?
-60522 : Write Addr: 0xc0f11180, Data: 0x       1 [    0     1] Resample ?
-60521 : Write Addr: 0xc0f11404, Data: 0x       0 [    0     0] Resample ?
-60519 : Write Addr: 0xc0f11400, Data: 0x       1 [    0     1] Resample ?
-60517 : Write Addr: 0xc0f04f10, Data: 0x       1 [    0     1] DMA 15 - yb | xb
-60516 : Write Addr: 0xc0f04a0c, Data: 0x       0 [    0     0] DMA 10 - yn | xn
-60514 : Write Addr: 0xc0f04a10, Data: 0x 2a70030 [  679    48] DMA 10 - yb | xb => 680 * 48 = 32640
-60512 : Write Addr: 0xc0f04a14, Data: 0x       0 [    0     0] DMA 10 - ya | xa
-60510 : Write Addr: 0xc0f04a18, Data: 0x       0 [    0     0] DMA 10 - off1
-60509 : Write Addr: 0xc0f04a1c, Data: 0x       0 [    0     0] DMA 10 - off2b
-60507 : Write Addr: 0xc0f04a20, Data: 0x       0 [    0     0] DMA 10 - off1a
-60505 : Write Addr: 0xc0f04a24, Data: 0x       0 [    0     0] DMA 10 - off2a
-60504 : Write Addr: 0xc0f04a28, Data: 0x       0 [    0     0] DMA 10 - off3
-60502 : Write Addr: 0xc0f11084, Data: 0x       1 [    0     1] Resample ?
-60500 : Write Addr: 0xc0f113c8, Data: 0x     400 [    0  1024] Resample ?
-60499 : Write Addr: 0xc0f113cc, Data: 0x       0 [    0     0] Resample ?
-60497 : Write Addr: 0xc0f113d0, Data: 0x 2a7001f [  679    31] Resample ?
-60495 : Write Addr: 0xc0f113d4, Data: 0x       0 [    0     0] Resample ?
-60494 : Write Addr: 0xc0f11090, Data: 0x       0 [    0     0] Resample ?
-60492 : Write Addr: 0xc0f1110c, Data: 0x       2 [    0     2] Resample ?
-60490 : Write Addr: 0xc0f11344, Data: 0x   10100 [    1   256] Resample ?
-60489 : Write Addr: 0xc0f11348, Data: 0x       0 [    0     0] Resample ?
-60487 : Write Addr: 0xc0f1134c, Data: 0x       0 [    0     0] Resample ?
-60486 : Write Addr: 0xc0f11350, Data: 0x       0 [    0     0] Resample ?
-60484 : Write Addr: 0xc0f11354, Data: 0x       0 [    0     0] Resample ?
-60482 : Write Addr: 0xc0f11358, Data: 0x       0 [    0     0] Resample ?
-60481 : Write Addr: 0xc0f1135c, Data: 0x       0 [    0     0] Resample ?
-60479 : Write Addr: 0xc0f11388, Data: 0x       0 [    0     0] Resample ?
-60477 : Write Addr: 0xc0f1138c, Data: 0x       0 [    0     0] Resample ?
-60476 : Write Addr: 0xc0f11394, Data: 0x       0 [    0     0] Resample ?
-60474 : Write Addr: 0xc0f1139c, Data: 0x       0 [    0     0] Resample ?
-60472 : Write Addr: 0xc0f113bc, Data: 0x       3 [    0     3] Resample ?
-60471 : Write Addr: 0xc0f110c0, Data: 0x       5 [    0     5] Resample ?
-60469 : Write Addr: 0xc0f11184, Data: 0x      1f [    0    31] Resample ?
-60467 : Write Addr: 0xc0f11188, Data: 0x10000778 [ 4096  1912] Resample ?
-60466 : Write Addr: 0xc0f11140, Data: 0x       4 [    0     4] Resample ?
-60464 : Write Addr: 0xc0f11408, Data: 0x     800 [    0  2048] Resample ?
-60463 : Write Addr: 0xc0f1140c, Data: 0x       0 [    0     0] Resample ?
-60461 : Write Addr: 0xc0f11410, Data: 0x     2a7 [    0   679] Resample ?
-60459 : Write Addr: 0xc0f11414, Data: 0x       0 [    0     0] Resample ?
-60458 : Write Addr: 0xc0f0430c, Data: 0x       0 [    0     0] DMA 3 - yn | xn
-60456 : Write Addr: 0xc0f04310, Data: 0x     2a8 [    0   680] DMA 3 - yb | xb
-60454 : Write Addr: 0xc0f04314, Data: 0x       0 [    0     0] DMA 3 - ya | xa
-60452 : Write Addr: 0xc0f04318, Data: 0x       0 [    0     0] DMA 3 - off1
-60451 : Write Addr: 0xc0f0431c, Data: 0x       0 [    0     0] DMA 3 - off2b
-60449 : Write Addr: 0xc0f04320, Data: 0x       0 [    0     0] DMA 3 - off1a
-60447 : Write Addr: 0xc0f04324, Data: 0x       0 [    0     0] DMA 3 - off2a
-60445 : Write Addr: 0xc0f04328, Data: 0x       0 [    0     0] DMA 3 - off3
engio_write end
-60434 : Write Addr: 0xc0f04304, Data: 0x20000000 [ 8192     0] DMA 3 - flags
-60433 : Write Addr: 0xc0f04300, Data: 0x       1 [    0     1] DMA 3 - ctrl
engio_write start
-60430 : Write Addr: 0xc0f11400, Data: 0x       0 [    0     0] Resample ?
-60429 : Write Addr: 0xc0f11404, Data: 0x       1 [    0     1] Resample ?
-60427 : Write Addr: 0xc0f11180, Data: 0x       0 [    0     0] Resample ?
-60425 : Write Addr: 0xc0f11340, Data: 0x       0 [    0     0] Resample ?
-60424 : Write Addr: 0xc0f11380, Data: 0x       0 [    0     0] Resample ?
-60422 : Write Addr: 0xc0f11008, Data: 0x       1 [    0     1] Resample ?
-60421 : Write Addr: 0xc0f113c0, Data: 0x       0 [    0     0] Resample ?
-60419 : Write Addr: 0xc0f113c4, Data: 0x       1 [    0     1] Resample ?
engio_write end
-60416 : Write Addr: 0xc0f04a04, Data: 0x20030000 [ 8195     0] DMA 10 - flags
-60415 : Write Addr: 0xc0f04a00, Data: 0x       1 [    0     1] DMA 10 - ctrl
-60205 : Read  Addr: 0xc0f04330, Data: 0x       2 [    0     2] DMA 3 - intr
-60197 : Write Addr: 0xc0f04304, Data: 0x       0 [    0     0] DMA 3 - flags
-60196 : Write Addr: 0xc0f04300, Data: 0x       4 [    0     4] DMA 3 - ctrl
-60093 : Read  Addr: 0xc0f04a30, Data: 0x       2 [    0     2] DMA 10 - intr
-60084 : Write Addr: 0xc0f04a04, Data: 0x       0 [    0     0] DMA 10 - flags
-60083 : Write Addr: 0xc0f04a00, Data: 0x       4 [    0     4] DMA 10 - ctrl
-60018 : Read  Addr: 0xc0f04a08, Data: 0x107a13fc [ 4218  5116] DMA 10 - dst
-60017 : Read  Addr: 0xc0f04308, Data: 0x107a96b0 [ 4218 38576] DMA 3 - dst
engio_write start
-59928 : Write Addr: 0xc0f113c4, Data: 0x       0 [    0     0] Resample ?
-59924 : Write Addr: 0xc0f113c0, Data: 0x       1 [    0     1] Resample ?
-59922 : Write Addr: 0xc0f11008, Data: 0x       0 [    0     0] Resample ?
-59920 : Write Addr: 0xc0f11340, Data: 0x       1 [    0     1] Resample ?
-59918 : Write Addr: 0xc0f11380, Data: 0x       1 [    0     1] Resample ?
-59917 : Write Addr: 0xc0f11180, Data: 0x       1 [    0     1] Resample ?
-59915 : Write Addr: 0xc0f11404, Data: 0x       0 [    0     0] Resample ?
-59913 : Write Addr: 0xc0f11400, Data: 0x       1 [    0     1] Resample ?
engio_write end

mltiple masterclocks (clockout)

engio_write start
-57709 : Write Addr: 0xc0f07148, Data: 0x       4 [    0     4] HEAD timer
engio_write end
engio_write start
-57507 : Write Addr: 0xc0f0714c, Data: 0x       0 [    0     0] HEAD timer
-57503 : Write Addr: 0xc0f07148, Data: 0x       4 [    0     4] HEAD timer
engio_write end
engio_write start
-56684 : Write Addr: 0xc0f08180, Data: 0x       0 [    0     0] PreProc
-56679 : Write Addr: 0xc0f0820c, Data: 0x 29b0000 [  667     0] PreProc
-56677 : Write Addr: 0xc0f08208, Data: 0x      11 [    0    17] PreProc
engio_write end
EngDrvOuts start
-56662 : Write Addr: 0xc0f0490c, Data: 0x       0 [    0     0] DMA 9 - yn | xn
-56661 : Write Addr: 0xc0f04910, Data: 0x  a60020 [  166    32] DMA 9 - yb | xb 167 * 32 = 5344
-56660 : Write Addr: 0xc0f04914, Data: 0x       0 [    0     0] DMA 9 - ya | xa
-56659 : Write Addr: 0xc0f04918, Data: 0x       0 [    0     0] DMA 9 - off1
-56658 : Write Addr: 0xc0f0491c, Data: 0x       0 [    0     0] DMA 9 - off2b
-56657 : Write Addr: 0xc0f04920, Data: 0x       0 [    0     0] DMA 9 - off1a
-56656 : Write Addr: 0xc0f04924, Data: 0x       0 [    0     0] DMA 9 - off2a
-56655 : Write Addr: 0xc0f04928, Data: 0x       0 [    0     0] DMA 9 - off3
EngDrvOuts end
-56651 : Write Addr: 0xc0f04904, Data: 0x40000000 [16384     0] DMA 9 - flags
-56649 : Write Addr: 0xc0f04908, Data: 0x102b1f2c [ 4139  7980] DMA 9 - dst
-56643 : Write Addr: 0xc0f0505c, Data: 0x       1 [    0     1] edmac connection
-56634 : Write Addr: 0xc0f04904, Data: 0x40010000 [16385     0] DMA 9 - flags
-56633 : Write Addr: 0xc0f04900, Data: 0x       1 [    0     1] DMA 9 - ctrl
EngDrvOuts start
-56614 : Write Addr: 0xc0f0410c, Data: 0x       0 [    0     0] DMA 1 - yn | xn
-56612 : Write Addr: 0xc0f04110, Data: 0x  d50438 [  213  1080] DMA 1 - yb | xb 214 * 1080 = 231120
-56611 : Write Addr: 0xc0f04114, Data: 0x       0 [    0     0] DMA 1 - ya | xa
-56610 : Write Addr: 0xc0f04118, Data: 0x       0 [    0     0] DMA 1 - off1
-56608 : Write Addr: 0xc0f0411c, Data: 0x       0 [    0     0] DMA 1 - off2b
-56607 : Write Addr: 0xc0f04120, Data: 0x       0 [    0     0] DMA 1 - off1a
-56592 : Read  Addr: 0xc0f04930, Data: 0x       2 [    0     2] DMA 9 - intr
-56586 : Write Addr: 0xc0f04904, Data: 0x       0 [    0     0] DMA 9 - flags
-56585 : Write Addr: 0xc0f04900, Data: 0x       4 [    0     4] DMA 9 - ctrl
-56569 : Write Addr: 0xc0f04124, Data: 0x       0 [    0     0] DMA 1 - off2a
-56567 : Write Addr: 0xc0f04128, Data: 0x       0 [    0     0] DMA 1 - off3
EngDrvOuts end
-56564 : Write Addr: 0xc0f04104, Data: 0x20000000 [ 8192     0] DMA 1 - flags
-56562 : Write Addr: 0xc0f04108, Data: 0x1dbc0064 [ 7612   100] DMA 1 - dst LiveView Image address
-56558 : Write Addr: 0xc0f04104, Data: 0x20000000 [ 8192     0] DMA 1 - flags
-56557 : Write Addr: 0xc0f04100, Data: 0x       1 [    0     1] DMA 1 - ctrl
EngDrvOuts start
-56552 : Write Addr: 0xc0f0400c, Data: 0x       0 [    0     0] DMA 0 - yn | xn
-56551 : Write Addr: 0xc0f04010, Data: 0x 2a70800 [  679  2048] DMA 0 - yb | xb LiveView Image YUV (680 * 1024 * 2) = 1392640
-56550 : Write Addr: 0xc0f04014, Data: 0x       0 [    0     0] DMA 0 - ya | xa
-56549 : Write Addr: 0xc0f04018, Data: 0x       0 [    0     0] DMA 0 - off1
-56548 : Write Addr: 0xc0f0401c, Data: 0x       0 [    0     0] DMA 0 - off2b
-56547 : Write Addr: 0xc0f04020, Data: 0x       0 [    0     0] DMA 0 - off1a
-56546 : Write Addr: 0xc0f04024, Data: 0x       0 [    0     0] DMA 0 - off2a
-56545 : Write Addr: 0xc0f04028, Data: 0x       0 [    0     0] DMA 0 - off3
EngDrvOuts end
-56543 : Write Addr: 0xc0f04004, Data: 0x20000000 [ 8192     0] DMA 0 - flags
-56542 : Write Addr: 0xc0f04008, Data: 0x1de43c64 [ 7652 15460] DMA 0 - dst
-56540 : Write Addr: 0xc0f04004, Data: 0x20000000 [ 8192     0] DMA 0 - flags
-56539 : Write Addr: 0xc0f04000, Data: 0x       1 [    0     1] DMA 0 - ctrl
engio_write start
-56534 : Write Addr: 0xc0f08114, Data: 0x       1 [    0     1] PreProc
engio_write end
EngDrvOuts start
-56527 : Write Addr: 0xc0f0440c, Data: 0x       0 [    0     0] DMA 4 - yn | xn
-56526 : Write Addr: 0xc0f04410, Data: 0x 3670922 [  871  2338] DMA 4 - yb | xb Bayer raw image 872 * 1336 * (14/8) = 2038736
-56525 : Write Addr: 0xc0f04414, Data: 0x       0 [    0     0] DMA 4 - ya | xa
-56524 : Write Addr: 0xc0f04418, Data: 0x       0 [    0     0] DMA 4 - off1
-56523 : Write Addr: 0xc0f0441c, Data: 0x       0 [    0     0] DMA 4 - off2b
-56522 : Write Addr: 0xc0f04420, Data: 0x       0 [    0     0] DMA 4 - off1a
-56521 : Write Addr: 0xc0f04424, Data: 0x       0 [    0     0] DMA 4 - off2a
-56520 : Write Addr: 0xc0f04428, Data: 0x       0 [    0     0] DMA 4 - off3
EngDrvOuts end
-56518 : Write Addr: 0xc0f04404, Data: 0x20000000 [ 8192     0] DMA 4 - flags
-56517 : Write Addr: 0xc0f04408, Data: 0x1df97c6c [ 7673 31852] DMA 4 - dst
-56515 : Write Addr: 0xc0f04404, Data: 0x20000080 [ 8192   128] DMA 4 - flags
-56513 : Write Addr: 0xc0f04400, Data: 0x       1 [    0     1] DMA 4 - ctrl
-56511 : Write Addr: 0xc0f08030, Data: 0x    1e00 [    0  7680] Preproc - SHAD gain
engio_write start
-56507 : Write Addr: 0xc0f1108c, Data: 0x       3 [    0     3] Resample ?
engio_write end
EngDrvOuts start
-56503 : Write Addr: 0xc0f0480c, Data: 0x       0 [    0     0] DMA 8 - yn | xn
-56502 : Write Addr: 0xc0f04810, Data: 0x 4e10020 [ 1249    32] DMA 8 - yb | xb 1250 * 32 = 40000
-56501 : Write Addr: 0xc0f04814, Data: 0x       0 [    0     0] DMA 8 - ya | xa
-56500 : Write Addr: 0xc0f04818, Data: 0x       0 [    0     0] DMA 8 - off1
-56499 : Write Addr: 0xc0f0481c, Data: 0x       0 [    0     0] DMA 8 - off2b
-56498 : Write Addr: 0xc0f04820, Data: 0x       0 [    0     0] DMA 8 - off1a
-56497 : Write Addr: 0xc0f04824, Data: 0x       0 [    0     0] DMA 8 - off2a
-56496 : Write Addr: 0xc0f04828, Data: 0x       0 [    0     0] DMA 8 - off3
EngDrvOuts end
-56494 : Write Addr: 0xc0f04804, Data: 0x40000000 [16384     0] DMA 8 - flags
-56493 : Write Addr: 0xc0f04808, Data: 0x10283268 [ 4136 12904] DMA 8 - dst
engio_write start
-56491 : Write Addr: 0xc0f03048, Data: 0x       2 [    0     2]
-56489 : Write Addr: 0xc0f03048, Data: 0x       0 [    0     0]
-56487 : Write Addr: 0xc0f03050, Data: 0x       2 [    0     2]
-56486 : Write Addr: 0xc0f03050, Data: 0x       0 [    0     0]
-56484 : Write Addr: 0xc0f03074, Data: 0x       2 [    0     2]
-56483 : Write Addr: 0xc0f03074, Data: 0x       0 [    0     0]
-56481 : Write Addr: 0xc0f03088, Data: 0x       0 [    0     0]
-56479 : Write Addr: 0xc0f0308c, Data: 0x       0 [    0     0]
-56478 : Write Addr: 0xc0f11050, Data: 0x       1 [    0     1] Resample ?
-56477 : Write Addr: 0xc0f1e000, Data: 0x       1 [    0     1]
-56474 : Write Addr: 0xc0f11540, Data: 0x       0 [    0     0] Resample ?
-56473 : Write Addr: 0xc0f11544, Data: 0x       1 [    0     1] Resample ?
-56472 : Write Addr: 0xc0f11500, Data: 0x       0 [    0     0] Resample ?
-56470 : Write Addr: 0xc0f11504, Data: 0x       1 [    0     1] Resample ?
-56468 : Write Addr: 0xc0f11440, Data: 0x       0 [    0     0] Resample ?
-56467 : Write Addr: 0xc0f11444, Data: 0x       1 [    0     1] Resample ?
-56465 : Write Addr: 0xc0f11580, Data: 0x       0 [    0     0] Resample ?
-56464 : Write Addr: 0xc0f11584, Data: 0x       1 [    0     1] Resample ?
-56462 : Write Addr: 0xc0f111c0, Data: 0x       0 [    0     0] Resample ?
-56460 : Write Addr: 0xc0f112c0, Data: 0x       0 [    0     0] Resample ?
-56459 : Write Addr: 0xc0f11300, Data: 0x       0 [    0     0] Resample ?
-56458 : Write Addr: 0xc0f11004, Data: 0x       1 [    0     1] Resample ?
-56455 : Write Addr: 0xc0f0d000, Data: 0x       1 [    0     1]
-56454 : Write Addr: 0xc0f08090, Data: 0x       1 [    0     1] PreProc
-56453 : Write Addr: 0xc0f080a0, Data: 0x       1 [    0     1] PreProc
-56451 : Write Addr: 0xc0f08020, Data: 0x       1 [    0     1] Preproc - SHAD ctrl
-56449 : Write Addr: 0xc0f08208, Data: 0x      10 [    0    16] PreProc
-56448 : Write Addr: 0xc0f08208, Data: 0x       0 [    0     0] PreProc
-56446 : Write Addr: 0xc0f08180, Data: 0x       1 [    0     1] PreProc
-56445 : Write Addr: 0xc0f08130, Data: 0x       1 [    0     1] PreProc
engio_write end
-56441 : Write Addr: 0xc0f04804, Data: 0x40010000 [16385     0] DMA 8 - flags
-56440 : Write Addr: 0xc0f04800, Data: 0x       1 [    0     1] DMA 8 - ctrl
engio_write start
-52761 : Write Addr: 0xc0f07048, Data: 0x       4 [    0     4] HEAD timer
engio_write end
engio_write start
-52552 : Write Addr: 0xc0f0713c, Data: 0x     370 [    0   880] HEAD timer
-52548 : Write Addr: 0xc0f07134, Data: 0x       4 [    0     4] HEAD timer
-52546 : Write Addr: 0xc0f07138, Data: 0x       c [    0    12] HEAD timer
engio_write end
engio_write start
-52528 : Write Addr: 0xc0f07150, Data: 0x     59c [    0  1436] HEAD timer
-52526 : Write Addr: 0xc0f07148, Data: 0x       4 [    0     4] HEAD timer
-52525 : Write Addr: 0xc0f0714c, Data: 0x       c [    0    12] HEAD timer
engio_write end
-28634 : Read  Addr: 0xc0f04530, Data: 0x       2 [    0     2] DMA 5 - intr
-28622 : Write Addr: 0xc0f04504, Data: 0x       0 [    0     0] DMA 5 - flags
-28620 : Write Addr: 0xc0f04500, Data: 0x       4 [    0     4] DMA 5 - ctrl
-28507 : Write Addr: 0xc0f0b0c4, Data: 0x       0 [    0     0]
-28505 : Read  Addr: 0xc0f0c804, Data: 0x       0 [    0     0]
-28503 : Write Addr: 0xc0f0b0c4, Data: 0x       1 [    0     1]
engio_write start
-28500 : Write Addr: 0xc0f09000, Data: 0x80000000 [32768     0]
-28498 : Write Addr: 0xc0f0b000, Data: 0x       1 [    0     1]
-28497 : Write Addr: 0xc0f0b004, Data: 0x       0 [    0     0]
engio_write end
-28164 : Read  Addr: 0xc0f04030, Data: 0x       2 [    0     2] DMA 0 - intr
-28161 : Write Addr: 0xc0f04004, Data: 0x       0 [    0     0] DMA 0 - flags
-28160 : Write Addr: 0xc0f04000, Data: 0x       4 [    0     4] DMA 0 - ctrl
-28148 : Read  Addr: 0xc0f04130, Data: 0x       2 [    0     2] DMA 1 - intr
-28147 : Write Addr: 0xc0f04104, Data: 0x       0 [    0     0] DMA 1 - flags
-28146 : Write Addr: 0xc0f04100, Data: 0x       4 [    0     4] DMA 1 - ctrl
-28134 : Read  Addr: 0xc0f04430, Data: 0x       2 [    0     2] DMA 4 - intr
-28133 : Write Addr: 0xc0f04404, Data: 0x       0 [    0     0] DMA 4 - flags
-28132 : Write Addr: 0xc0f04400, Data: 0x       4 [    0     4] DMA 4 - ctrl
engio_write start
-27968 : Write Addr: 0xc0f07134, Data: 0x       4 [    0     4] HEAD timer
engio_write end
engio_write start
-27735 : Write Addr: 0xc0f07138, Data: 0x       0 [    0     0] HEAD timer
-27733 : Write Addr: 0xc0f07134, Data: 0x       4 [    0     4] HEAD timer
engio_write end
engio_write start
-27463 : Write Addr: 0xc0f08130, Data: 0x80000000 [32768     0] PreProc
-27460 : Write Addr: 0xc0f08180, Data: 0x80000000 [32768     0] PreProc
-27459 : Write Addr: 0xc0f08020, Data: 0x80000000 [32768     0] Preproc - SHAD ctrl
-27456 : Write Addr: 0xc0f080a0, Data: 0x80000000 [32768     0] PreProc
-27455 : Write Addr: 0xc0f08090, Data: 0x80000000 [32768     0] PreProc
-27453 : Write Addr: 0xc0f08114, Data: 0x       a [    0    10] PreProc
-27452 : Write Addr: 0xc0f0d000, Data: 0x80000000 [32768     0]
-27449 : Write Addr: 0xc0f11004, Data: 0x       0 [    0     0] Resample ?
-27447 : Write Addr: 0xc0f112c0, Data: 0x       1 [    0     1] Resample ?
-27446 : Write Addr: 0xc0f11300, Data: 0x       1 [    0     1] Resample ?
-27444 : Write Addr: 0xc0f111c0, Data: 0x       1 [    0     1] Resample ?
-27442 : Write Addr: 0xc0f11280, Data: 0x       1 [    0     1] Resample ?
-27440 : Write Addr: 0xc0f11284, Data: 0x       0 [    0     0] Resample ?
-27439 : Write Addr: 0xc0f11440, Data: 0x       1 [    0     1] Resample ?
-27437 : Write Addr: 0xc0f11444, Data: 0x       0 [    0     0] Resample ?
-27434 : Write Addr: 0xc0f11500, Data: 0x       1 [    0     1] Resample ?
-27433 : Write Addr: 0xc0f11504, Data: 0x       0 [    0     0] Resample ?
-27431 : Write Addr: 0xc0f11540, Data: 0x       1 [    0     1] Resample ?
-27430 : Write Addr: 0xc0f11544, Data: 0x       0 [    0     0] Resample ?
-27427 : Write Addr: 0xc0f1e000, Data: 0x80000000 [32768     0]
engio_write end
-27418 : Write Addr: 0xc0f04834, Data: 0x       3 [    0     3] DMA 8 - abort
-27409 : Read  Addr: 0xc0f04830, Data: 0x       0 [    0     0] DMA 8 - intr
-27399 : Write Addr: 0xc0f04804, Data: 0x       0 [    0     0] DMA 8 - flags
-27398 : Write Addr: 0xc0f04834, Data: 0x       0 [    0     0] DMA 8 - abort
-27396 : Write Addr: 0xc0f04800, Data: 0x       4 [    0     4] DMA 8 - ctrl
-26240 : Write Addr: 0xc0f1a000, Data: 0x       1 [    0     1]
-26238 : Write Addr: 0xc0f1a004, Data: 0x       0 [    0     0]

multiple masterclocks (clockout)

-23710 : Read  Addr: 0xc0e00000, Data: 0x 1010000 [  257     0] JPEG
-23707 : Read  Addr: 0xc0e00030, Data: 0xffffffff [65535 65535] JPEG
-23646 : Write Addr: 0xc0f0500c, Data: 0x       5 [    0     5] edmac connection
-23645 : Write Addr: 0xc0f05008, Data: 0x       3 [    0     3] edmac connection
-23643 : Write Addr: 0xc0f0502c, Data: 0x       2 [    0     2] edmac connection
EngDrvOuts start
-23574 : Write Addr: 0xc0f0430c, Data: 0x       0 [    0     0] DMA 3 - yn | xn
-23572 : Write Addr: 0xc0f04310, Data: 0x fff01fe [ 4095   510] DMA 3 - yb | xb 4096 * 510 = 2088960
-23571 : Write Addr: 0xc0f04314, Data: 0x       0 [    0     0] DMA 3 - ya | xa
-23570 : Write Addr: 0xc0f04318, Data: 0x       0 [    0     0] DMA 3 - off1
-23569 : Write Addr: 0xc0f0431c, Data: 0x       0 [    0     0] DMA 3 - off2b
-23568 : Write Addr: 0xc0f04320, Data: 0x       0 [    0     0] DMA 3 - off1a
-23567 : Write Addr: 0xc0f04324, Data: 0x       0 [    0     0] DMA 3 - off2a
-23566 : Write Addr: 0xc0f04328, Data: 0x       0 [    0     0] DMA 3 - off3
EngDrvOuts end
-23562 : Write Addr: 0xc0f04304, Data: 0x20000001 [ 8192     1] DMA 3 - flags
-23560 : Write Addr: 0xc0f04308, Data: 0x1ca700c8 [ 7335   200] DMA 3 - dst
-23543 : Write Addr: 0xc0f04204, Data: 0x20000000 [ 8192     0] DMA 2 - flags
-23542 : Write Addr: 0xc0f04208, Data: 0x1079947c [ 4217 38012] DMA 2 - dst
-23540 : Write Addr: 0xc0f04a04, Data: 0x20000000 [ 8192     0] DMA 10 - flags
-23539 : Write Addr: 0xc0f04a08, Data: 0x1de43c64 [ 7652 15460] DMA 10 - dst
-23535 : Read  Addr: 0xc0f04a08, Data: 0x1de43c64 [ 7652 15460] DMA 10 - dst
-23534 : Read  Addr: 0xc0f04308, Data: 0x1ca700c8 [ 7335   200] DMA 3 - dst
-23533 : Read  Addr: 0xc0f04208, Data: 0x1079947c [ 4217 38012] DMA 2 - dst

********* [DPATH] LV_JPG ....


engio_write start
-23413 : Write Addr: 0xc0f113c4, Data: 0x       0 [    0     0] Resample ?
-23410 : Write Addr: 0xc0f113c0, Data: 0x       1 [    0     1] Resample ?
-23409 : Write Addr: 0xc0f11008, Data: 0x       0 [    0     0] Resample ?
-23407 : Write Addr: 0xc0f11180, Data: 0x       1 [    0     1] Resample ?
-23405 : Write Addr: 0xc0f11040, Data: 0x       0 [    0     0] Resample ?
-23404 : Write Addr: 0xc0f11404, Data: 0x       0 [    0     0] Resample ?
-23402 : Write Addr: 0xc0f11400, Data: 0x       1 [    0     1] Resample ?
-23401 : Write Addr: 0xc0f13000, Data: 0x80000000 [32768     0]
-23399 : Write Addr: 0xc0f03010, Data: 0x80000000 [32768     0]
-23397 : Write Addr: 0xc0f03014, Data: 0x80000002 [32768     2]
-23396 : Write Addr: 0xc0f0305c, Data: 0x80000004 [32768     4]
-23394 : Write Addr: 0xc0f03060, Data: 0x80000006 [32768     6]
-23392 : Write Addr: 0xc0f03090, Data: 0x       1 [    0     1]
-23391 : Write Addr: 0xc0f04f10, Data: 0x       1 [    0     1] DMA 15 - yb | xb
-23389 : Write Addr: 0xc0f04a0c, Data: 0x  540003 [   84     3] DMA 10 - yn | xn
-23387 : Write Addr: 0xc0f04a10, Data: 0x   70200 [    7   512] DMA 10 - yb | xb =
-23385 : Write Addr: 0xc0f04a14, Data: 0x   70200 [    7   512] DMA 10 - ya | xa
-23384 : Write Addr: 0xc0f04a18, Data: 0x     600 [    0  1536] DMA 10 - off1
-23382 : Write Addr: 0xc0f04a1c, Data: 0x fffc800 [ 4095 51200] DMA 10 - off2b
-23380 : Write Addr: 0xc0f04a20, Data: 0x     600 [    0  1536] DMA 10 - off1a
-23379 : Write Addr: 0xc0f04a24, Data: 0x fffc800 [ 4095 51200] DMA 10 - off2a
-23377 : Write Addr: 0xc0f04a28, Data: 0x       0 [    0     0] DMA 10 - off3
-23375 : Write Addr: 0xc0f11084, Data: 0x       1 [    0     1] Resample ?
-23374 : Write Addr: 0xc0f113c8, Data: 0x    1000 [    0  4096] Resample ?
-23372 : Write Addr: 0xc0f113cc, Data: 0x  540003 [   84     3] Resample ?
-23370 : Write Addr: 0xc0f113d0, Data: 0x   700ff [    7   255] Resample ?
-23369 : Write Addr: 0xc0f113d4, Data: 0x   700ff [    7   255] Resample ?
-23367 : Write Addr: 0xc0f11090, Data: 0x       0 [    0     0] Resample ?
-23365 : Write Addr: 0xc0f11148, Data: 0x       2 [    0     2] Resample ?
-23364 : Write Addr: 0xc0f13008, Data: 0x     101 [    0   257]
-23362 : Write Addr: 0xc0f1300c, Data: 0x     400 [    0  1024]
-23361 : Write Addr: 0xc0f13010, Data: 0x     600 [    0  1536]
-23359 : Write Addr: 0xc0f13014, Data: 0x       3 [    0     3]
-23357 : Write Addr: 0xc0f13018, Data: 0x 2a700ff [  679   255]
-23356 : Write Addr: 0xc0f1301c, Data: 0x      ff [    0   255]
-23354 : Write Addr: 0xc0f13020, Data: 0x       1 [    0     1]
-23352 : Write Addr: 0xc0f13050, Data: 0x       0 [    0     0]
-23351 : Write Addr: 0xc0f13054, Data: 0x       0 [    0     0]
-23349 : Write Addr: 0xc0f110c0, Data: 0x       2 [    0     2] Resample ?
-23347 : Write Addr: 0xc0f11184, Data: 0x      1f [    0    31] Resample ?
-23346 : Write Addr: 0xc0f11188, Data: 0x10000778 [ 4096  1912] Resample ?
-23344 : Write Addr: 0xc0f11140, Data: 0x       4 [    0     4] Resample ?
-23343 : Write Addr: 0xc0f11408, Data: 0x       0 [    0     0] Resample ?
-23341 : Write Addr: 0xc0f1140c, Data: 0x  540003 [   84     3] Resample ?
-23339 : Write Addr: 0xc0f11410, Data: 0x   70007 [    7     7] Resample ?
-23338 : Write Addr: 0xc0f11414, Data: 0x   70007 [    7     7] Resample ?
-23336 : Write Addr: 0xc0f0420c, Data: 0x  540003 [   84     3] DMA 2 - yn | xn
-23334 : Write Addr: 0xc0f04210, Data: 0x   7000c [    7    12] DMA 2 - yb | xb
-23333 : Write Addr: 0xc0f04214, Data: 0x   7000c [    7    12] DMA 2 - ya | xa
-23331 : Write Addr: 0xc0f04218, Data: 0x      24 [    0    36] DMA 2 - off1
-23329 : Write Addr: 0xc0f0421c, Data: 0x ffffeb0 [ 4095 65200] DMA 2 - off2b
-23327 : Write Addr: 0xc0f04220, Data: 0x      24 [    0    36] DMA 2 - off1a
-23326 : Write Addr: 0xc0f04224, Data: 0x ffffeb0 [ 4095 65200] DMA 2 - off2a
-23324 : Write Addr: 0xc0f04228, Data: 0x       0 [    0     0] DMA 2 - off3
engio_write end
-23311 : Write Addr: 0xc0f04304, Data: 0x20000001 [ 8192     1] DMA 3 - flags
-23310 : Write Addr: 0xc0f04300, Data: 0x       1 [    0     1] DMA 3 - ctrl
-23306 : Write Addr: 0xc0f04204, Data: 0x20000000 [ 8192     0] DMA 2 - flags
-23305 : Write Addr: 0xc0f04200, Data: 0x       1 [    0     1] DMA 2 - ctrl
engio_write start
-23303 : Write Addr: 0xc0f03040, Data: 0x       2 [    0     2]
-23301 : Write Addr: 0xc0f03040, Data: 0x       0 [    0     0]
-23299 : Write Addr: 0xc0f13000, Data: 0x       0 [    0     0]
engio_write end
-23296 : Write Addr: 0xc0f13000, Data: 0x       0 [    0     0]
-23294 : Write Addr: 0xc0f13048, Data: 0x       3 [    0     3]
-23293 : Write Addr: 0xc0f1304c, Data: 0x       0 [    0     0]
-23291 : Write Addr: 0xc0f13004, Data: 0x       1 [    0     1]
-23283 : Read  Addr: 0xc0e00000, Data: 0x 1010000 [  257     0] JPEG
-23280 : Read  Addr: 0xc0e00030, Data: 0xffffffff [65535 65535] JPEG
-23277 : Read  Addr: 0xc0e00000, Data: 0x 1010000 [  257     0] JPEG
engio_write start
-23273 : Write Addr: 0xc0f11040, Data: 0x       1 [    0     1] Resample ?
-23270 : Write Addr: 0xc0f11400, Data: 0x       0 [    0     0] Resample ?
-23268 : Write Addr: 0xc0f11404, Data: 0x       1 [    0     1] Resample ?
-23267 : Write Addr: 0xc0f11180, Data: 0x       0 [    0     0] Resample ?
-23265 : Write Addr: 0xc0f11008, Data: 0x       1 [    0     1] Resample ?
-23263 : Write Addr: 0xc0f113c0, Data: 0x       0 [    0     0] Resample ?
-23261 : Write Addr: 0xc0f113c4, Data: 0x       1 [    0     1] Resample ?
engio_write end
-23257 : Write Addr: 0xc0f04a04, Data: 0x20030000 [ 8195     0] DMA 10 - flags
-23256 : Write Addr: 0xc0f04a00, Data: 0x       1 [    0     1] DMA 10 - ctrl
-16661 : Read  Addr: 0xc0f04230, Data: 0x       2 [    0     2] DMA 2 - intr
-16648 : Write Addr: 0xc0f04204, Data: 0x       0 [    0     0] DMA 2 - flags
-16646 : Write Addr: 0xc0f04200, Data: 0x       4 [    0     4] DMA 2 - ctrl
-16583 : Read  Addr: 0xc0f04a30, Data: 0x       2 [    0     2] DMA 10 - intr
-16576 : Write Addr: 0xc0f04a04, Data: 0x       0 [    0     0] DMA 10 - flags
-16575 : Write Addr: 0xc0f04a00, Data: 0x       4 [    0     4] DMA 10 - ctrl
-16539 : Read  Addr: 0xc0e00044, Data: 0x     400 [    0  1024] JPEG
-16533 : Read  Addr: 0xc0e00024, Data: 0x   4aa36 [    4 43574] JPEG
-16399 : Write Addr: 0xc0f04304, Data: 0x20000006 [ 8192     6] DMA 3 - flags
-16381 : Read  Addr: 0xc0f04330, Data: 0x       4 [    0     4] DMA 3 - intr
-16376 : Write Addr: 0xc0f04304, Data: 0x       2 [    0     2] DMA 3 - flags
-16374 : Write Addr: 0xc0f04300, Data: 0x       4 [    0     4] DMA 3 - ctrl
-16372 : Write Addr: 0xc0f04304, Data: 0x       0 [    0     0] DMA 3 - flags
-16276 : Read  Addr: 0xc0f04a08, Data: 0x1df97c64 [ 7673 31844] DMA 10 - dst
-16275 : Read  Addr: 0xc0f04308, Data: 0x1cabaafe [ 7339 43774] DMA 3 - dst
-16273 : Read  Addr: 0xc0f04208, Data: 0x107a13fc [ 4218  5116] DMA 2 - dst
-16009 : Write Addr: 0xc0f13048, Data: 0x       0 [    0     0]
-16008 : Write Addr: 0xc0f1304c, Data: 0x       0 [    0     0]
-16006 : Write Addr: 0xc0f13000, Data: 0x80000000 [32768     0]

************** [DPATH] LV_JPG STOP ....
Title: Re: Canon 40D
Post by: ilex on March 20, 2020, 12:50:33 AM
Thanks for your big effort!!!
Up with the great job!!
Title: Re: Canon 40D
Post by: heder on March 21, 2020, 09:46:28 AM
Thanks ilex, theses days are really wierd, working from home with the kids running around me all days long (im in Denmark), they've been out of school since thursday, our goverment locked down all schools last week. Quite difficult to get real work done when I'v got to be teacher and programmer at the same time.

But with regards to Magic lantern we will see raw video on the 40D, it just a matter of time now. Iv got 3 other issue to fix before I can work on mlv-lite module, too bad the CF card is only 20 MB/second, that ruins the raw performance, but getting raw video working is a step towards mjpeg streaming which will be the prime feature of this camera. If im lucky we will see raw video within the next 10 days.
Title: Re: Canon 40D
Post by: Danne on March 21, 2020, 10:18:27 AM
Nice work! How close are you to mjpeg stream? How would that work in practice? mv1080p compressed into mjpeg? Recorded as single images? Curious.
Title: Re: Canon 40D
Post by: reddeercity on March 22, 2020, 12:30:47 AM
Great Job @heder , I've been watching your progress with great interest  :D
One of my long term goals in to have Mjpeg compression -> .avi (4.2.2 8bit)
I know the stream is there but was unable to fully understand it to be implemented in d4 cams
this something that All ML cams can use specially the older d4 e.g. 500d etc. ...

On the CF card write speed , your saying you only get around 20MB/s ?
Is this on a type 1 or type 2 CF card ? spec. say it can use either one .
There is a branch that has to do with CF bus clocking or overclocking ,
I've been looking in to this for the 5d2 & 50d .
Some useful link from previous conversation's about CF card speed
https://www.magiclantern.fm/forum/index.php?topic=12862.msg206010#msg206010
https://www.magiclantern.fm/forum/index.php?topic=12862.msg206011#msg206011
https://www.magiclantern.fm/forum/index.php?topic=19336.msg206067#msg206067
.....
@reddeercity: more details after I'll get a new card (it *is* possible to overclock the 5D2 CF interface).

https://bitbucket.org/hudson/magic-lantern/branch/hdparm
Might be useful for overclocking, too.
etc. .....
Title: Re: Canon 40D
Post by: Walter Schulz on March 22, 2020, 12:40:54 AM
On the CF card write speed , your saying you only get around 20MB/s ?
Is this on a type 1 or type 2 CF card ?

"Type" = Physical dimension (thickness) of a CF-card. Type II is thicker (5 mm) and was used for rotational media (as in harddisks, see MicroDrive).
Here is some info about CF modes
Quote
Explanations
The CF interface is derived from the ATA Interface. The CF 2.0 specification allowed PIO-4 mode that has a theoretical limit of about 15.9MB/s. CF 3.0 introduced two additional PIO modes that are not part of the original ATA specification: PIO-5 and PIO-6, where PIO-6 has a theoretical limit of about 23.8MB/s. Most CF cards with speed ratings from 80x to 166x use PIO-6 to achieve this speed. However, there is currently no FireWire reader with support for PIO-5 or PIO-6. This means that PIO-6 cards run in the slower PIO-4 mode, and therefore run slower than with current USB 2.0 readers. Support for MDMA modes is most likely not that popular, but you can't really tell the difference between PIO-4 and MDMA-2 when a card reader is used, because PIO only occupies the card reader controller, not the host CPU. CF 3.0 also introduced two additional MDMA modes, MDMA-3 and MDMA-4 using the same timing as PIO-5 and PIO-6.
CF 1.0: Max. PIO-2 (240ns), 7.95MB/s.
CF 2.0: Max. PIO-4 (120ns), 15.89MB/s.
CF 3.0: The new CF PIO modes PIO-5 and PIO-6 and the ATA UDMA modes UDMA-0 to UDMA-4 were introduced, offering a theoretical limit of about 63MB/s for UDMA-4.
CF 4.0: The remaining ATA UDMA modes UDMA-5 and UDMA-6 were added, allowing up to about 127MB/s.
CF 5.0: 48-bit commands were added. This command set allows a transfer block size of up to 32MB compared to 128kB with the previous command set. This will allow actual transfer rates to come closer to the theoretical limit.
CF 6.0: The new CF UDMA mode UDMA-7 (24ns/166M) was added, allowing up to about 158MB/s transfer rate.

In case you have plans on using CF cards as regular ATA device: For all timings of 100ns or faster (UDMA-5, UDMA-6 and UDMA-7), the CompactFlash specification only allows one device per bus with a maximum distance of 0.15m (6in) from the card connector to the host controller, at 3.3V supply voltage! In addition to that, 80-wire cables must be used for all UDMA modes.

Current UDMA CF Cards and UDMA CF readers support UDMA-5 or UDMA-6, with real-world transfer rates of more than 80MB/s. This is already beyond the theoretical transfer rate of UDMA-4. Current USB 2.0 UDMA CF readers are maxed out at about 32MB/s, less than 40% of the actual card performance.
Source: Late and lamented http://www.hjreggel.net/cardspeed/index.html (Current = Years and years ago)
Title: Re: Canon 40D
Post by: heder on March 22, 2020, 10:13:51 AM
Nice work! How close are you to mjpeg stream? How would that work in practice? mv1080p compressed into mjpeg? Recorded as single images? Curious.

Danne, Atleast the older cameras like 40d,450d,1000d were built with jpeg streaming capabilities, were each images is downsampled, mjpeg compressed and finally tranfered to the pc. We can utilize this in magic lantern and save each mjpeg into a file, which will result in a motion-jpeg stream. A tool like ffmpeg supports this non-standard format. The interessing features is that each frame is a full image.


Great Job @heder , I've been watching your progress with great interest  :D
One of my long term goals in to have Mjpeg compression -> .avi (4.2.2 8bit)
I know the stream is there but was unable to fully understand it to be implemented in d4 cams
this something that All ML cams can use specially the older d4 e.g. 500d etc. ...

On the CF card write speed , your saying you only get around 20MB/s ?
Is this on a type 1 or type 2 CF card ? spec. say it can use either one .
There is a branch that has to do with CF bus clocking or overclocking ,
I've been looking in to this for the 5d2 & 50d .
Some useful link from previous conversation's about CF card speed
https://www.magiclantern.fm/forum/index.php?topic=12862.msg206010#msg206010
https://www.magiclantern.fm/forum/index.php?topic=12862.msg206011#msg206011
https://www.magiclantern.fm/forum/index.php?topic=19336.msg206067#msg206067etc. .....


eddeercity, as far as I can tell the 40d only support pio-6 mode but seems to be underclocked (14 mb/s), I wasted alot of time digging into the firmware code looking for UDMA, without success, I used 4 different new card from sandisk, kingstons, transcend (ranging from 866x down to 166x). I did alot of blackbox testing with the timing and ended with approx 20 mb/s which the pio-6 specification support. These are approx 3mm cards so I guess CF-1. The firmware supports CompactFlash Specification Revision 3.0 (found "CFA3.0" strings in firmware) http://rumkin.com/reference/aquapad/media/cfspc3_0.pdf (http://rumkin.com/reference/aquapad/media/cfspc3_0.pdf)

I documented some of my finding here https://magiclantern.fandom.com/wiki/Register_Map/40D
---

Theoretically: the sensor was a readout rate of 96Mpixel/sec, thats 4004004 pixels per second at 23.976 or ~9 fps at full sensor size. Both should be doable with the CF limited bandwidth (jpeg compression), but there is along list of issue to be solved. I need to understand the yuv-mjpeg livemode "chain" inorder to beable to change the width and height of the images and many many other issues. The yuv-mjpeg chains seem to be is abit more complex that "raw video", this one really needs alot of cache hijacking.
Title: Re: Canon 40D
Post by: Danne on March 22, 2020, 12:58:36 PM
Danne, Atleast the older cameras like 40d,450d,1000d were built with jpeg streaming capabilities, were each images is downsampled, mjpeg compressed and finally tranfered to the pc. We can utilize this in magic lantern and save each mjpeg into a file, which will result in a motion-jpeg stream. A tool like ffmpeg supports this non-standard format. The interessing features is that each frame is a full image.
Sounds like a game changer to me :).
Title: Re: Canon 40D
Post by: Ant123 on March 22, 2020, 07:07:40 PM
We can utilize this in magic lantern and save each mjpeg into a file, which will result in a motion-jpeg stream.

https://www.magiclantern.fm/forum/index.php?topic=8119.msg212429#msg212429 (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212429#msg212429)
Title: Re: Canon 40D
Post by: heder on March 22, 2020, 07:48:43 PM
https://www.magiclantern.fm/forum/index.php?topic=8119.msg212429#msg212429 (https://www.magiclantern.fm/forum/index.php?topic=8119.msg212429#msg212429)
Yes exatly.

The JPEG buffer is is populated *and* freed in lvcdevResourceGet, so... that's pretty much the only place for a hook, if you want to reuse Canon's approach. You could place a hook (patchmgr: patch_hook_function) directly into 0xFFAD5870, but that won't solve much (the hook code will only execute when needed, so it will be a bit cleaner). You should also speed up the copying process with either dma_memcpy (HPCopy) or edmac_memcpy; that should get rid of dropped frames.

On newer models (DIGIC 5, IIRC also 60D and newer DIGIC 4), this function no longer runs automagically while in LiveView, so this approach is only valid for older models.

There is another drawback of this JPEG stream: it's not using the full LiveView resolution. On 450D, CR2 resolution is 4312x2876 (with dcraw), so I'd expect something close to 1436x958 in LiveView. On 5D2, CR2 resolution is 5634x3753, LiveView resolution is 1880x1248, LV-JPEG resolution is 1024x680. I'm pretty sure the hardware can deliver MJPEG at full LiveView resolution; "just" need to figure out how to how to request a full-size YUV buffer (most Canons do this while recording H.264) and how to call the JPEG encoder on an arbitrarily-sized YUV buffer (likely very similar to the lossless encoder).

BTW - disabling this JPEG stream on old models could be useful for reducing power consumption. Nothing measured; just theory.

This is the real challenge
Title: Re: Canon 40D
Post by: heder on March 24, 2020, 08:46:11 PM
When running with call("lv_save_raw",1) the raw EDMAC channel has the following sizes

LiveView x1  = raw bayer format = 1336 x 872
LiveView x5  = raw bayer format = 1952 x 814
LiveView x10 = raw bayer format = 1952 x 814
Title: Re: Canon 40D
Post by: Ant123 on March 25, 2020, 04:49:50 PM
Did you manage to get the image using "lv_save_raw" ?
Title: Re: Canon 40D
Post by: heder on March 26, 2020, 08:00:09 PM
No, i didnt borther yet, i just analysed the RAW edmac register values.

Im stuck in gui stuff, menus in liveview isnt working, which is needed for raw video.
Title: Re: Canon 40D
Post by: heder on March 31, 2020, 11:02:36 AM
* Menus in livemode is now working  :)

* mlv_lite framework is up and running  :D
  - modules vsync is called from my own 40d vsync task (hmm, should use the commonm vsync func, but ok for now)
  - module version structs "VERS" in output header turns into alot of garbage => disabled for now.
  - small hacks set to 0
  - SRM_job set to 0
  - Maximum memory set to 40MB
  - edmac_copy_rectangle_cbr_start fails for now ...  :(
 
The camera save correctly and mlv_dump accepts the and decodes the output file correctly  8) (if I skips dmac_copy_rectangle_cbr_start and just put in dummy data using memset), so I need to get dmac_copy_rectangle_cbr_start verified.

 
 
Title: Re: Canon 40D
Post by: heder on April 02, 2020, 03:19:47 PM
Yay .. finally a nice looking raw recorded frame from mlv_lite ! ..  (without edmac support).

1 fps at 1312x872 (x1 mode) using memcpy(), approx each 20th frame is ok. Had to use memcpy to copy line of line. I need to hack the raw edmac system more before I can use it. My current hijacked vsync function is in the wrong spot, and the 40d contnuesly writes the raw edmac destionation register before performing the raw tranfers, and that pointer changes. mlv_lite overwrites this pointer, but without proper timing the camera just overwrites mlv_lites address again, stupid 40d, surrender.

(https://www.magiclantern.fm/forum/proxy.php?request=https%3A%2F%2Flh3.googleusercontent.com%2FfDmLlRVcxHdGCBkqe8Klc4nBTzqlvOItH6dRb0hUpWeG8zacnaDZPykaz_zVrLtQAhOjrbtc3y6YVmtCE_NnbRWftO1H5SueNlXXEQwPAUi1dgBA8Ps1fl5mF7OMbJJNApCxaZZLREPvIGm6JK4LY78BlIdn5ak7GC7rdJ1fsrOFzprNGXmprqFA1GT7MutTsr6np7NYKoLh50G_ZDZCupFmCJUeCjUM9VzS-nBcXpuy0ZdRInplUEOrjNmx4V3pdSJzJY2q09OItU_0AfjNhBiJV9pzJlKfOZaskk2CR32W_lCvE0d8uzOZWoLlimzbDOXmojSCIM8f4zJ3jNep973fYyQZLQKE9IZ6-cPwzPEjPdMnLH90akO0emDLojOo4XLEwWGW1pnae9aM7SNNERTmspCNNQH5wzWgj51WFMTly-qtVhwP7pst5JL1KUHqwdiq3LYMGGfFh-HbWr7DspOFEJrw0Rx5NQDfoRSpeov5Y4koIJiReOsAPs9AOq1Z6oYss5Cpw6SGI52WLSnRw5kwMPU6QKqRCEqDiRABebVMIyNP92ZJWz9ErxlExOpboSrwGZzcQgpAY64w7SHWPl0VFtjd8ajNUWhbJajXA0LbZR-f2jhBS0X21pApldo2O1cxCgHyam0gsq9ZpNkHcaAMAdiiieu5OMtm6BgiN7IdVPzR_ftlRO9QGNPwfGLEjFDcp2JWBVenR4q9VUDJolFI_fhNI0Z2rC4-WZkx-5rIXrayeNaY9IA%3Dw1312-h872-no&hash=0004316bd49e65178e68430ce362ff2b)
Title: Re: Canon 40D
Post by: kitor on April 03, 2020, 10:46:33 PM
MLV on 40D  8) Even if that's single frame, congrats. I'll check it just for fun, after whole covid crap ends (dad has pristine 40D with only ~10k frames).
Wish I had enough knowledge to move R forward, but with time that I can spent, I'll maybe finally upgrade my cam to latest FW and update the stubs...
Title: Re: Canon 40D
Post by: heder on April 04, 2020, 07:50:57 AM
Updated open beta to 1.0.2

https://www.magiclantern.fm/forum/index.php?topic=1452.msg224594#msg224594

Fixes =
Menu's are now working in LiveMode (use joystick instead of scrollwheel)

I'll be "out of office" for the next 10 days, corona is driving the kids nuts, easter vaccation  @ home. mlv_lite will take some more time, its abit more complex than I thought.