Magic Lantern Forum
Magic Lantern Releases => Camera-specific discussion => Topic started by: dichterDichter on July 18, 2012, 08:55:06 AM
-
wow. I have a 40D and i think the 5Dc and the 40D are both VxWorks. Am i right? So would it work on a 40D?
It would be awsome to be able to record movies with the 40D.
nice work.
-
In theory, you have the foundation for running user code on 40D and most other VxWorks cameras.
In practice, there should also be a developer who must have this camera, skills and lots of time to work on it.
-
thank you.
ok... i have that camera, skills : hmmm, lots of time : doh!
but why not. maybe as a winter project.
Is it the current release or is there a special fork?
-
It's in the current source tree.
-
ok, lets see what happens when i start that on my 40D this evening.
-
Don't run that code blindly, first understand how it works. It has zero chances to work on 40D unmodified, and can be dangerous.
http://magiclantern.wikia.com/wiki/Other_dslr
http://magiclantern.wikia.com/wiki/For_Developers
First get a firmware dump, find out LED address and try blinking it.
-
yes, right. i will start with little steps. Thank you.
-
I suggest you look at my initial project for the 5dc:
www.bitbucket.org/coutts/5dplus (http://www.bitbucket.org/coutts/5dplus)
Everything starts in entry.S. First use a dumper tool to extract the firmware image from a canon firmware update file (see the build_scripts/eos_tools_v11 folder in that project linked above). Use decrypt_fw and then dissect_fw to split the FIR up. See this wiki page for more details:
http://magiclantern.wikia.com/wiki/Packing_FIR_Files (http://magiclantern.wikia.com/wiki/Packing_FIR_Files)
After you analyze the firmware dump using a program like IDA Pro (or the free ARM Console (http://magiclantern.wikia.com/wiki/GPL_Tools/ARM_console) created by Alex) to see how the camera boots/works, then attempt to boot a custom FIR file running user code. Use the assemble_fw perl script in the eos_tools directory to assemble a new FIR file with your usercode (compiled autoexec.bin) instead of canon's payload. The final step is to run decrypt_fw again on this fir to sign it for the camera to accept it. (Note: this step may or may not be necessary, depends on the camera. Try both if one doesn't work). Start by just blinking an LED or something basic to know your code runs. You don't need to boot the main firmware to blink an LED.
If 40d is similar to the 5dc, then you won't be able to run any practical code from a FIR (including calling the EnableBootDisk function or booting the firmware/camera) so you will need to write some code that scans the bootloader area (0xFFFF0000-0xFFFFFFFF) for function signatures to identify the read/write bootflag functions. This will allow you to set the camera's bootflag, to boot an autoexec.bin file with a prepared card, and development takes off from there (you will be able to boot the firmware and do anything from autoexec). I created this bootdisk code from the 350d method, using the 400d bootloader to find the signatures I needed. Only modification you will need is to change are the references to these:
read_bootflag = (ft_read_bootflag)0xFFFF8AE0;
write_bootflag = (ft_write_bootflag)0xFFFF89F0;
https://bitbucket.org/coutts/5dplus/src/e486f2e53796/bootdisk.c (https://bitbucket.org/coutts/5dplus/src/e486f2e53796/bootdisk.c)
The 5dc took me many hours to get going, I dumped many memory addresses through LED blinks in binary, you should be prepared to do the same. Here is some code that you can use to blink out the contents of a memory address if you know the red/blue LED addresses:
https://bitbucket.org/coutts/5dplus/src/a1cc964de4af/init.c
You can use this to write code to search for specific signatures of the read_bootflag and write_bootflag functions. Some signatures would be instructions like:
MOVEQ R7, #0xF8000000
which is assembled and looks like this in memory:
0x03A0733E
Use the 5dc bootloader (I can send you it) to know what signatures you're looking for (unique instructions that would only appear in the read/write bootflag functions). After you find a signature and have a match at some spot in the BL area (0xFFFF0000-0xFFFFFFFF), use this address and search in reverse (going backwards in memory to lower addresses) until you find the nearest PUSH (STMFD) instruction, this will be the address of the start of the function so that you can call it / use it.
I'll just tell you the signatures to find.
First, for write_bootflag. Here is a small snippet from that function, the first 5 instructions:
ROM:FFFF89F0 STMFD SP!, {R4-R8,LR}
ROM:FFFF89F4 MOV R5, R1
ROM:FFFF89F8 MOV R4, #0
ROM:FFFF89FC CMP R0, #0
ROM:FFFF8A00 MOVNE R7, #0xF8000000
If you were scanning memory, these 5 instructions would look like this(starting at 0xFFFF89F0 on the left and ending on 0xFFFF8A00 on the right):
0xE92D41F0 0xE1A05001 0xE3A04000 0xE3500000 0x13A0733E
So, look for the signature for the MOVNE R7, #0xF8000000 instruction, then once you find it, search backwards for the STMFD (push) instruction signature, and you will have located write_bootflag in the 40d bootloader. Chances are the functions will probably be identical, but take caution to verify at least 3 times that you have located the correct function and it seems the same / similar to the 5dc one (remember we are working blind here).
Now, read_bootflag. First 5 instructions look like:
ROM:FFFF8AE0 STR LR, [SP,#var_4]!
ROM:FFFF8AE4 CMP R0, #0
ROM:FFFF8AE8 MOVNE R3, #0xF8000000
ROM:FFFF8AEC ADDNE R3, R3, #0x2000
ROM:FFFF8AF0 MOVNE R2, #0x40
And in memory would look like this (same thing as before, starting at 0xFFFF8AE0 on left and ending at 0xFFFF8AF0 on the right):
0xE52DE004 0xE3500000 0x3E33A013 0x12833A02 0x13A02040
Note: there isn't a STMFD (push) instruction in read_bootflag. The 400d bootloader is like this too, so chances are the 40d is as well.
NOTE: you may need to reverse endianness of the assembled instructions above to see them in memory, but maybe not, I can't remember :P
So, once you have located read_bootflag() and write_bootflag(), you will be able to really start developing. :) This may seem confusing, and I'm sorry, but I hope you will see how valuable this information is (I had to figure it all out on my own). The 350d people dumped the bootloader using a photo diode and the LED to blink the code in binary to a computer, I couldn't figure that out so I did it this way. Let me know if you have any questions, I can probably help a lot. Do you use gmail?
-
Argh, first i have to repair my camera... broken release.
Thats really annoying.
-
coutts, thats some very helpful information and should probably go into the wiki!
-
coutts, thats some very helpful information and should probably go into the wiki!
should be more than enough to get any port started :)
-
There are plenty of Canon 40d users like me waiting to use MagicLantern on their 40d. Please! Make it happen. I am not a developer.....all can I do is to pray for your success :)
-
Finally some good news! I am enjoying the ML. I thank all who have worked on this project. I hope one day to use the ML with a 40D. I hope to give my contribution to make this possible.
I think the work done by Coutts to 5DC will be useful for even the 40D and 400D.
-
I'm thinking start doing the first tests.
I know it's a bit risky. Certainly, I will need your help.
Firstly, I will begin by installing and configuring ubuntu to compile the project. When I can, I will test the tools specified by Coutts.
-
Hi,
I still have nothing to work but I have spent many hours reading the forums CHDK / ML.
I'm learning, have some patience with me. This still seems very complicated. Sorry if the questions are basic.
I got the firmware version 40d1.1.1. With application dissect_fw3_2, I got the unencrypted header and body. I've compiled a small application to try to find the addresses of the red and blue LED, but I've got a problem. I do not know how to encrypt the new firmware to be able to use on my machine. I read a lot about it but I could not understand the steps that have to follow.
If I can correctly encrypt my firmware I can proceed with my tests.
Since I've been searching for some string in the firmware files and I could see some interesting things. I found the string EnableBootDisk.
After seeing the flashing LEDs, I'll try to do a DUMP the firmware.
When I succeed in the previous tests, I proceed to the discovery of the function EnableBootDisk addresses.
Someone can help me create my own firmware for the 40D?
-
I have a 40D with version 1.1.1. After much reading and testing I was able to flash both LEDs.
-
I used the information provided by Coutts to flash both LEDs.
See the examples:
1_1000D LED Finder (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/1_1000D%20LED%20Finder/)
2_1000D LED-Dumper (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/2_1000D%20LED-Dumper)
These are the addresses of blue and red LEDs:
LED_RED 0xC02200E0
LED_BLUE 0xC02200E8
-
I used the information provided by Coutts to flash both LEDs.
See the examples:
1_1000D LED Finder (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/1_1000D%20LED%20Finder/)
2_1000D LED-Dumper (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/2_1000D%20LED-Dumper)
These are the addresses of blue and red LEDs:
LED_RED 0xC02200E0
LED_BLUE 0xC02200E8
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.
For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus
-
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.
For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus
Coutts,
yes I am currently reading your posts in CHDK.
In 2008 there were major developments, but for some unknown reason you moved away from this project. Made great advances that have helped future ports to other cameras but 40D & 450D were forgotten! Why?! ...
Their progress in the port 1000D can give a great help! I think the cameras 1000D, 450D, 40D have many similarities. This can be an advantage.
Thank you for providing the code :
https://bitbucket.org/coutts/1000d_dev
-
I really want to install the Magic Lantern in my camera and give my modest contribution to the community but,
without your precious help will not go away.
You have done an excellent job over the years.
Congratulations.
-
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.
For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus
Many will read this and get to thinking that an easy task! ;)
-
Has anyone done a dump of the ROM and BL fir v 1.1.1.?
-
I read a lot and follow the tips and suggestions from Coutts.
I analyzed the 5DC BL code and found the signatures of functions and read_bootflag write_bootflag.
Later, I created a small program to find them in my 40d fir 1.1.1.
I still do not know the original values of bootflags but I have called the function read_bootflags.
Not yet confirmed, but I believe that the addresses are:
read_bootflag -> 0xffff 63a8
write_bootflag -> 0xffff 62b8
-
Someone can explain me how to operate the boot flags?
-
The original values of bootflags are:
F8000000 = 0
F8000004 = 0
F8000008 = -1
F800000C = -1
-
I have good news.
The autoboot already works!!!
I used the addresses of functions and LEDs that I presented to you earlier.
I used some test applications of Coutts, and made the necessary changes.
The second obstacle has been overcome.
I level up but, the game becomes more complicated and risky.
Wish me luck! ;)
-
My next steps are:
1) find the addresses of the functions Open, Write and Close;
2) create BL & ROM dumps.
-
My next steps are:
1) find the addresses of the functions Open, Write and Close;
2) create BL & ROM dumps.
you must boot the firmware first. you cannot call file i/o until it has been initialized by VxWorks. now that you can run autoexec.bin, you can boot the firmware :)
-
I've been reading the forums and ML CHDK and found some examples to dump the ROM and BL.
http://chdk.setepontos.com/index.php?topic=1651.45 (http://chdk.setepontos.com/index.php?topic=1651.45)
I found one that allowed you to dump the 40D FW 1.0.8.
They called on four functions in the code of the flasher.
The 'ASalina' made ??the dump from earlier versions.
I now want to do with version 1.1.1.
They found these features in version 1.0.8:
/ / 40d - flasher v1.0.8
open = (ft_open) 0x00989a34;
create = (ft_creat) 0x00989a44;
write = (ft_write) 0x00989534;
close = (ft_close) 0x009896a0;
I've been researching the same functions in version 1.1.1:
/ / 40d - flasher v1.1.1
open = (ft_open) 0x00989a3c;
create = (ft_creat) 0x00989a4c
write = (ft_write) 0x0098953c;
close = (ft_close) 0x009896a8;
I've thought maybe it was not possible to call these functions before starting VxWorks.
I got confused with anything ...
The flasher code calls functions of the ROM?! ...
I still can not understand well the memory map and this is making me lose some time and let me crazy :)
Someone can give me some tips? Maybe you Coutts ... ;) Again ...
-
you must boot the firmware first. you cannot call file i/o until it has been initialized by VxWorks. now that you can run autoexec.bin, you can boot the firmware :)
Coutts I understand but how do I boot VxWorks?! ...
My apologies if the question is basic! ;)
I've been to see the entry.S 5DC but still seems to me very complicated.
How do you know the sequence of function calls to boot.
I studied multitasking, but on the VxWorks I only know the name: (
How do I use AUTOEXEC.BIN to start the VxWorks?! ...
Can I use the functions DEBUGMSG and dump before starting VxWorks?
-
Coutts I understand but how do I boot VxWorks?! ...
My apologies if the question is basic! ;)
I've been to see the entry.S 5DC but still seems to me very complicated.
How do you know the sequence of function calls to boot.
I studied multitasking, but on the VxWorks I only know the name: (
How do I use AUTOEXEC.BIN to start the VxWorks?! ...
Can I use the functions DEBUGMSG and dump before starting VxWorks?
Those functions you listed earlier sound like they are bootloader functions but they are being called from RAM, so I wouldn't call those (not sure if the functions are copied there or not). I've been looking for file i/o in the bootloader for a while but haven't found it, if you have found these functions in the BL, then that is huge progress! It will help new ports a lot.
Now for booting VxWorks, what I mean is you must copy/paste the boot code starting at 0xFF810000 far enough to where you can spawn your own task. We need to hook ourselves into VxWorks. Once we have started our one task, we can hand execution back to canon and boot the camera like normal.
So, I used some bootcode from chuchin but it is literally copy/pasted line for line from the ROM (at FF810000). As a test, see if you can make your entry.S jump execution to FF810000 and see if the camera boots like normal.
Then begin tracing the boot process to know how much code needs to be re-written. You only need to write until the part where it calls CreateTask on the startup task. We can hook our task in here.
-
As a test, see if you can make your entry.S jump execution to FF810000 and see if the camera boots like normal.
I'll test it ...
-
I'm working on it ...
I already have the dump of the ROM. I've also got the boot flag active.
The Coutts and Cucho have given me a great help ..
They have been fantastic.
The Nano has sent me a file entry.S.
I'll be a little busy, but soon I hope to present you some results.
Does anyone else want to help me?! ... Any help is welcome.
-
I have good news ...
I already have a tread running ... flashing blue LED!
The LED turns off when the TFT is turned off but with the MENU button it lights up again.
I already found the address of some functions but there is still much work ahead to be able to integrate my code with ML.
-
Hi guys,
I keep working on this project and I having some successes
Now I can write logs on the card.
I've been analyzing the logs and found some messages that can help me identify the VRAM.
Then I present some:
304: 591.053 < GUI Lock > InitializeGUILock (PUB)
305: 592.017 [GUI] MasterResultCBR
306: 592.224 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
307: 593.033 [GUI] -> handleGuiInit
308: 598.963 [DispCon] InitializeDisplayDeviceController (PUB)
309: 600.121 [IMP] (PUB) InitializeImagePlayer 1113
310: 601.818 [CERES] RegisterAdapterStatusCallback
311: 607.638 [Graphics] GuiStartGraphics (PUB)
312: 608.057 [IMP] (PUB) StartImagePlayer(mode=0) 1189
313: 608.094 [IMP] CreateVram 665
330: 684.874 [Graphics] GuiClearImage
331: 684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
332: 684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
333: 685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644
334: 685.052 [IMP] GetVramNumber 580
335: 685.072 [IMP] GetVramNumber 580
336: 716.486 [IMP] (PUB) RefreshImageVram 1597
337: 716.519 [IMP] GetVramNumber 580
338: 716.765 [IMP] GetVramNumber 580
339: 716.791 [IMP] GetVramNumber 580
340: 716.823 [GUI] StopDateTimer
341: 716.852 [GUI] ClearColorPalette (0)
342: 716.924 [GUI] GUI_RegisterPropertySlave
343: 724.367 [GUI] MasterResultCBR_AvailableMyMenuList(0x79594c)
344: 724.618 [GUI] MasterResultCBR_ErrBattery(0x79599c)
345: 725.033 [DP]Dp_GetGlbRegisterCbrTAdr()
346: 725.182 [DP]Dp_GetGlbRegisterCbrTAdr()
347: 725.645 [GUI] GUI_SetLanguage (15)
-
Sounds good.
Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.
Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
-
Now I'm trying to change the logging level.
I hope to see something else, but I'm not having great success.
I have to confirm my stubs ... I must be doing something wrong.
I changed the amount of logging that is written but there is something wrong.
I have to understand what is happening.
I wanted to make sure that those are the addresses of VRAM.
I'm going to dump the VRAM (1M) but I still do not know what to do with it... :(
-
Sounds good.
Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.
Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
These EDMAC registers are also valid in the DIGIC III?
-
You can post them here.
I have no idea what's inside DIGIC III.
-
Thanks Alex, I'll analyze the problem better
-
One way to find vram:
All vram buffers are like structures, with off_0x00 pointing to a string in the ROM that says "Vram Instance". There's a few of these so you'll have to check for all of them. But, you can dump say the first 0x10000 bytes of ram and look for these pointers. Tip for dumping: you might need to do what I have to do with the 5dc (which I learned from 0xAF with the 400d) and dump using a buffer.
For whatever reason, I can't seem to dump very much without using a buffer. simple code:
//~ dump memory 64kb at a time using a buffer.
void dump_with_buffer(int addr, int len, char* filename)
{
FIO_RemoveFile(filename);
FILE* f = FIO_CreateFile(filename);
if (f!=-1)
{
int address = addr;
while (address<addr+len)
{
char buf[0x10000];
memcpy(buf, (void*)address, 0x10000);
FIO_WriteFile(f, buf, 0x10000);
address += 0x10000;
}
FIO_CloseFile(f);
}
}
-
when I found the 5dc vram, I did it a bit oddly. I used img.py (http://magiclantern.wikia.com/wiki/VRAM/550D#How_to_find_segments[/url]). You should look into this. You already know the dimensions of the buffer (same as 5dc): 720x240 with a pitch of 360 I believe. so, dump an area of memory and run it all through img.py to see if you can see the menu or whatever screen you dumped the ram at.
-
Coutts, once again thank you for your help.
I already knew that page. I've also ran this section of your code.
I've done dump part of RAM, but I have not had time to test this python script. Once I have the opportunity I will do this test.
However, I've spent a few hours looking at the 40D firmware. I identified many functions on my camera.
I think there are too many in your 5DC. If you want I send you my stubs for 40D v1.1.1.
I try to read all your posts. You have written some things that I have been very useful for my port.
Soon I will try to present some results. I've been working on it a little every day.
-
I have found many functions in 40D firmware.
These are the ones that create the state objects (I still do not know if missing some function)
NSTUB(0xFFD4F17C, CreateTaskClass);
NSTUB(0xFFD4EE48, CreateStateObject);
NSTUB(0xFFB04634, DpImgEditState_CreateStateObject);
NSTUB(0xFFB06DC4, DpState_CreateStateObject);
NSTUB(0xFFBB0A2C, TOMState_CreateStateObject);
NSTUB(0xFFC7F9E0, USBC20State_CreateStateObject);
NSTUB(0xFFBB7DFC, CeresState_CreateStateObject);
NSTUB(0xFFB72BEC, PtpDpsState_CreateStateObject);
NSTUB(0xFF84BD74, RMTState_CreateStateObject);
NSTUB(0xFFB57FC4, FSSState_CreateStateObject);
NSTUB(0xFFC86AFC, PropState_CreateStateObject);
NSTUB(0xFFB618B8, RDState_CreateStateObject);
NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject);
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject);
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject);
NSTUB(0xFFB32CB8, LVState_CreateStateObject);
NSTUB(0xFFBFDB18, FWState_CreateStateObject);
NSTUB(0xFFBFB9A8, FRState_CreateStateObject);
NSTUB(0xFFBF0B6C, MrkState_CreateStateObject);
NSTUB(0xFFB56580, FCSState_CreateStateObject);
NSTUB(0xFFBAE9D8, SdioTskState_CreateStateObject);
NSTUB(0xFFBD5564, FMNormalState_CreateStateObject);
NSTUB(0xFFD5CEA4, DMState_CreateStateObject);
-
Yay!
http://a1ex.bitbucket.org/ML/states/40D-alt/index.html
Some functions named automatically with my scripts: http://a1ex.magiclantern.fm/bleeding-edge/40D.111.idc
Try to dump from MEM(0x7768), size MEM(0x7764), while you are in LiveView. If successful, we can record MJPEG video :)
-
Alex,
Thanks for your help.
I'll do this test ..
-
Yay!
http://a1ex.bitbucket.org/ML/states/40D-alt/index.html
Some functions named automatically with my scripts: http://a1ex.magiclantern.fm/bleeding-edge/40D.111.idc
Try to dump from MEM(0x7768), size MEM(0x7764), while you are in LiveView. If successful, we can record MJPEG video :)
----------------------------------------
Alex,
I want to know which of your script made this excellent work. I have little experience in the use of your tools. I saw nothing that did that.
I found hundreds of methods in firmware but it took me many hours looking at the assembly.
And how did you get those addresses? ...
Thanks in advance ...
-
How is this going on? :)
-
This one:
1) guessfunc.run(dump) in arm console
2) run -i namefuncx.py
http://a1ex.magiclantern.fm/name_funcx.py
-
IT'S WORKING !!! IT'S WORKING !!! IT'S WORKING !!!
Alex, thanks for the tip
Finally, I got a little time I did the test and it worked!!
I got the JPEG successfully.
-
LV - JPEG
1024 x 680
-----
LCD
mode : w x h
0 : 720 x 240
1 : 704 x 480
2 : 720 x 576
-
51722: 13249.867 [DispCon] TurnOnDisplay (PUB)
51723: 13266.642 [LV] lvSetPsave 0x0
51724: 13267.371 [LV] LV_GetPtpZoomWindowArea IX=1560(16384), IY=1038(0)
51725: 13267.404 [LV] LV_GetPtpZoomWindowArea CX=0, CY=0
51726: 13268.004 [LV] lvSetWbIntegRegisterForAe 1
51727: 13268.045 [LV] StartLiveViewWbPass
51728: 13268.920 [LVCDEV]->lvcdevStartDev
51729: 13270.190 [LV] lvResetPsave
51730: 13270.396 [LV] WB 1974 1151 1151 2533(1377)
51731: 13270.503 [LV] lvResetPsave(1) 0x5A 0x454 0x49E
51732: 13270.528 [LV] lvResetPsave(2) 0x0 0x0 0x0
51733: 13271.801 [LVCDEV]->lvcdevResourceGet(0,1)
[b]51734: 13272.366 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0[/b]
51735: 13275.198 [LV] lvVDInterrupt
51736: 13275.363 [LV] WB 1974 1151 1151 2533(1158)
51737: 13279.334 [DEV] LV_JPG YuvWriteCompleteCBR
51738: 13279.373 [DEV] LV_JPG YUVReadCompleteCBR
51739: 13279.499 [DEV] LV_JPG JpCoreCompleteCBR( 0x2e1c6 )
51740: 13279.553 [DEV] LV_JPG JpegPopCompleteCBR
[b] 51741: 13279.672 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1ca9e28e Y411:0x107a0e20[/b]
51742: 13280.277 [LVCDEV]->PD(VF:0x107927ec,MS:0x485540)
[b] 51743: 13282.818 [LV] lvReturnVram[/b]
51744: 13282.851 < GUI Lock > GUILock_PermitPowerLock (PUB)
51745: 13283.134 < GUI Lock > GUILockTask 1
-
In 2008 dataghost teased the world be getting video from his 40d. Now it looks like it might just happen for other 40d users. Congratulation on your hard work!!!
-
Yay!
I think this is a lot better than Dataghost obtained (I've followed the thread back then). If all goes well, we will have MJPEG 422 at 1024x680.
Sure, we need to have a working port first. If you share the current status and code, I can help with this.
-
Congrats you have done marvelous job...........eagerly waiting to use it on my 40d :)
-
Thank you all, but this would not have been possible without your help.
The Coutts, Chucho and the A1ex helped me a lot.
I have to thank also to the guys of CHDK. In the past they did an excellent job.
Without this work and without tools Alex would be very complicated.
I have spent many hours on it. I'm a little tired. Once you have a little time, I'll share with you my code.
My next steps will be to change the boot process.
I want to do something similar to what exists for other cameras.
I've read some things and did not seem very complex. With time and with your help will be easy.
-
Take it easy. This low-level stuff can take a lot of time, even for experienced people.
-
'Vram Instance' : 0xFF9B943C
-
That's the same LV resolution as the 50D, what about frame rates though?
-
Some strings from 40dv111 ...
s vram
[b]ffca0178: '[IMP] CreateVram %d' [/b]
ffca0930: '[IMP] CompleteVramSyncroClearCBR err:%d'
ffca0d48: '[IMP] (PUB) SetVramInformation(w:%ld h:%ld) %d'
[b]ffca7528: '[IMPV] MakeHDVram %d' [/b]
ffca0e9c: '[IMP] DrawImageToVram GetJpegInfo():%d'
ffca1298: '[IMP] (PUB) RefreshImageVram %d'
ffca12b8: '[IMP] RefreshImageVram : VramNo not found'
ffca15a8: '[IMP] (PUB) AbortDrawImageToVram %d'
[b]ffca648c: '[IMPV] SetVramImageInfo %d' [/b]
ffca2c04: '[IMP] (PUB) SyncroClearImagePlayVram %d'
ffca089c: '[IMP] ImageVramCompleteCBR err:%d'
ffca349c: '[IMP] (PUB) SetVisibleImageVramOffset %d'
ffca3518: '[IMP] pVramImagePositionY %d'
ffcaff38: 'Not Exist Bitmap Vram!!'
[b]ffca32fc: '[IMP] (PUB) GetVramImageInfo %d' [/b]
[b]ffca0ec4: '[IMP] ERROR DrawImageToVram %s, %d' [/b]
ffca644c: '[IMPV] Complete MakeHDVram Error(%d)\n'
[b] ffca64a8: '[IMPV] SetVramImageInfo x:%ld y:%ld w:%ld h:%ld' [/b]
ff906cd4: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramWidth(%d)'
ff906d88: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramHeight(%d)'
ffca087c: '[IMP] ImageVramCompleteCBR %d'
[b]ffca12e4: '[IMP] RefreshImageVram VramAdd:0x%lX' [/b]
[b]ffca7b8c: '[IMPV] MakeHDVramFromJpeg Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7f74: '[IMPV] (PUB) MakeHDVramCheck %d' [/b]
[b]ffca8254: '[IMPV] GetVramImagePosAndSize s:%ld y:%ld w:%ld h:%ld' [/b]
[b]ffca01b4: '[IMP] Vram%d:0x%lX' [/b]
ffca34f8: '[IMP] pVramImagePositionX %d'
[b]ffcb16fc: '[BmpDDev] RefreshPhysicalVram (PUB)' [/b]
ffca7c84: '[IMPV] MakeHDVram Error!'
ffca02a8: '[IMP] DeleteVram %d'
ffca02bc: '[IMP] CopyCurrentDisplayVramToIdleVram %d'
ffca08c0: '[IMP] CompleteVramSyncroCopyCBR %d'
[b]ffcb0290: '[BmpDDev] CreatePhysicalVram (PUB)' [/b]
[b]ffb2d1d0: 'lv_vram_dump' [/b]
ffca7bd8: '[IMPV] WorkAdd:0x%lX VramAdd:0x%lX RotWork:0x%lX'
[b]ffca7b68: '[IMPV] (PUB) MakeHDVramFromJpeg %d' [/b]
ffca7c50: '[IMPV] VramWork basew:%ld x:%ld y:%ld w:%ld h:%ld'
[b]ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d' [/b]
ffca2984: '[IMP] ERR: Not Found Display Vram'
ffcb03b4: '[BmpDDev] DeletePhysicalVram (PUB)'
ffca822c: '[IMPV] (PUB) GetVramImagePosAndSize %d'
ffcb1ba8: '[ImgDDev] WARNING Divide Zero Vram Width (%d)'
ffca2ff8: '[IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine %d'
ff9122a4: '[GUI] CalcLvVramSize VramSize X(%d) Y(%d) W(%d) H(%d)'
[b]ffb32b30: '[LV] lvReturnVram' [/b]
ffcb3204: 'Already Vram For Adjust!!'
ff8b30ac: '[GUI] PlayModel.c DrawAspectFrame VramSize X(%d) Y(%d) W(%d) H(%d)'
ffca331c: '[IMP] GetVramImageInfo x:%ld y:%ld w:%ld h:%ld'
ffca334c: '[IMP] (STUB) SetImageVramColorMode(color:%ld) %d'
ffcb3530: 'Not Exist Vram For Adjust!!'
ffb34d94: '[LV] WriteEDmacVramCompleteCBR_x5'
[b]ffca3810: '[IMP] (PUB) GetVramInformation %d' [/b]
ffca08e4: '[IMP] CompleteVramSyncroCopyCBR err:%d'
ffca090c: '[IMP] CompleteVramSyncroClearCBR %d'
ffb361c4: '[LV] WriteEDmacVramCompleteCBR_x10'
ff883b18: '[TestEndDrawToVram] dwErrCode = %d'
ffcb8b6c: '[DispCon] GetVramSize (PUB)'
ffb39140: '[LV] WriteEDmacVramCompleteCBR_x1'
[b]ff9b943c: 'Vram Instance' [/b]
ff9b9558: 'pVram->Image.pPaletteIndex != NULL'
ff9b9594: '!IS_ERROR(pVram->hSemaphore)'
ff9b96b0: 'pVram->Mode == LOGICAL_VRAM'
ffca2e4c: '[IMP] (PUB) SyncroAllClearImagePlayIdleVramWithoutEngine %d'
ffca2e88: '[IMP] ERROR : Vram State'
ffca0e6c: '[IMP] (PUB) DrawImageToVram(rot:%d cb:0x%lX) %d'
ffca0d88: '[IMP] (PUB) SetCopyVramMode(mode=%d) %d'
ff87ece8: ' [Graphics] EndDrawToVram (PRI), err %d'
ffcaa8bc: '[IMP][PBFEN] Fencing_StartVRAMMode'
ffca0e0c: 'SetImageVramParameter x:%ld y:%ld w:%ld h:%ld/* Aspect:%d*/'
ffc9ff6c: '[IMP] GetVramNumber %d'
ffc9ffa0: '[IMP] SetVramImageParameter %d'
ffc9ffc0: '[IMP] SetVramImageParameter add:0x%lX BaseW:%ld'
s 411
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffc492c0: '[DPATH] LV_YPACK START Y411:%#lx YPACK:%#lx'
ffc492ec: '[DPATH] LV_YPACK STOP Y411:%#lx YPACK:%#lx'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc46e00: '[DPATH] LV_JPG START Y:%#lx J:%#lx Y411:%#lx'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffc46fbc: '[DPATH] LV_JPG STOP Y:%#lx J:%#lx Y411:%#lx'
ffc96db0: '[IMP][PBRSZ] GetCnv411Mode %d'
s 422
ffc96d90: '[IMP][PBRSZ] GetCnv422Mode %d'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'
s YUV
ffc95578: '<RESIZE> SetParameterResizeYuv Abort End Before Lock'
ffc955fc: '[IMP][PBRSZ] RequestResizeYuv RdAdr:%#lx, WrAdr:%#lx'
ffcb56b8: 'gyuv'
ffb301f8: '[LV] YuvAddress = 0x%08lX'
ffb00db8: 'Dp_ReduceImageData_Yuv()'
ffc498dc: 'PonyYuvPath'
ffc95810: '[IMP][PBRSZ] RegisterCBROfCompleteResizeYuv %d'
ffb01094: 'Dp_AdobeRgbToSRgb_Yuv()'
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffb013c0: 'Dp_ClearWidth_Yuv()'
ffc959b8: '[IMP][PBRSZ] Zoom:%d InYuv:%d OutYuv:%d'
ffafaf14: 'Dp_ExecuteYuvRotatingCBR() ErrorCode [0x%08x]'
ffc49f7c: '[DEV] Pony YuvWriteCompleteCBR'
ffca6754: '[IMPV] Yuv:%d Add:0x%lX BaseW:%ld'
ffb02720: 'Dp_CopyImageData_Yuv()'
ffb02738: 'pDstYuvDataAddress [%d]'
ffb02750: 'pSrcYuvDataAddress [%d]'
ffc45c34: 'FactoryYuvPath'
ffc444b8: '[DEV] JPG_EN YuvWriteCompleteCBR'
ffaf9fa8: 'Dp_YuvToYuv()'
ffca47a8: '[IMPL] Yuv:%d Add:0x%lX BaseW:%ld'
ffca4c1c: '[IMPL] (PUB) CalculateYuvResizeParameter %d'
ffb36258: '[LV] WriteEDmacYuvCompleteCBR_x10'
ffc988b0: '<ROTATE> RequestRotationYuv Before Lock'
ffca5294: '[IMPL]_CalcResizeSizeForRotZoom InYuv:%d OutYuv:%d Aspect:%d'
ff84534c: '[FA] FA_YuvDevelopTestImage'
ffca580c: '[IMPL] _CalcResizeSize InYuv:%d OutYuv:%d Aspect:%d'
ffc4604c: '[DEV] FactoryYuvPath_ChangeCBR(ID=%#lx)'
ffca630c: '[IMPV] GetAjustUnitYUV %d'
ffb018bc: 'Dp_CutImageWidth_Yuv()'
ffca6dec: '[IMPV] YuvMode:%d'
ffc47068: '[DEV] LV_JPG YuvWriteCompleteCBR'
ffca72e0: '[IMPV] YuvMode:%d BaseAdd:0x%lX BaseW:%ld'
ffca730c: '[IMPV] YuvMode:%d BaseAdd:0x%lX BaseW:%ld'
ffcadf00: '[IMP][DECWIN] SetNQDecParam adr:0x%08lX yuv:%d'
ffb01438: 'Dp_ExpandImageWidth_Yuv()'
ffb01490: 'Dp_ShiftYuvRotationData_Yuv()'
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
ffc49c90: '[DPATH] Pony2 START YUV1:%#lx YUV2:%#lx'
ffc9c32c: '[IMPD] (PUB) ExecuteYuvRotating %d'
ffcb6ddc: '[DispCon] Err Factory Adjust For DisplayYUVGain'
ffc49ae4: '[DPATH] Pony1 START C:%#lx YUV:%#lx'
ffc49c2c: '[DPATH] Pony1 STOP C:%#lx YUV:%#lx'
ffc458c0: '[DEV] YuvWriteCompleteCBR'
ffc47048: '[DEV] LV_JPG YUVReadCompleteCBR'
ffb01b2c: 'Dp_AdjustCroppingSize_Yuv()'
ffc49e94: '[DPATH] Pony2 ReStartPonyYuvPath2'
ffb0134c: 'Dp_ClearHeight_Yuv()'
ffc49eb8: '[DPATH] Pony2 STOP YUV1:%#lx YUV2:%#lx'
ffc99db0: '[IMPD] YuvMode:%d'
ffc99de4: '[IMPD] StartYuvResizing Comp'
[b]ffb2d1e0: 'lv_yuv_dump' [/b]
ffcad330: '[IMP][DECWIN] SetResizeParam OutYuv:%d InputSel:%d'
ffcada9c: '[IMP][DECWIN] SetWinResDecParam adr:0x%08lX yuv:%d base:%ld'
ffcb15fc: '[BmpDDev] GetYUVPaletteFromDisplayDevice (PUB)'
ffb02798: 'Dp_ShiftImageHeight_Yuv()'
ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d'
ffc8f344: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc8f3a0: '[IMP][PBLOT] RequestRotationYuv Before Lock'
ffcb0608: '[BmpDDev] SetYUVPaletteToDisplayDeviceh (PUB)'
ffad0f50: 'YuvMode[%d]'
ffad0fd0: 'YuvMode[%d] BaseAddress[%d]'
ffafa738: 'ResizeYuvT Input nYuvMode [%d]'
ffb391d4: '[LV] WriteEDmacYuvCompleteCBR_x1'
ffc98708: '[IMP][PBROT] OUTPUT --- Yuv:%d Add:0x%lX Base:%ld'
ffca6d94: '[IMPV] ZoomMode:%d YuvMode:%d'
ffb0ff6c: 'Dp_YuvToJpeg [0x%08x]'
ffcadfa0: '[IMP][DECWIN] pYuvAddress:%#lx'
ffb02004: 'Dp_AdjustFrameWithWhite_Yuv()'
ffb34e28: '[LV] WriteEDmacYuvCompleteCBR_x5'
ffca5dd0: '[IMPL] rot:%d zoom:%d inYUV:%d outYUV:%d'
ffcb8d9c: '[DispCon] GetYUVGain'
ffc95520: '[IMP][PBRSZ] SetParameterResizeYuvForMovie %d'
ffc95634: '<RESIZE> RequestResizeYuv Abort End Before Lock'
ffc95664: '[IMP][PBRSZ] ERROR pResizeYuvCompleteCBR is NULL'
ffc95698: '[IMP][PBRSZ] CancelResizeYuv %d'
ffc95840: '[IMP][PBRSZ] UnregisterCBROfCompleteResizeYuv %d'
ffc95874: '[IMP][PBRSZ] AbortResizeYuv %d'
ffc96334: '[IMP][PBRSZ] Input:%ld Output:%ld InYuv_f:%ld OutYuv_f:%ld'
ffc46030: '[DEV] YuvWriteCompleteCBR'
ffc4937c: '[DEV] LV_YPACK YuvReadCompleteCBR'
ffb0ff5c: 'Dp_YuvToJpeg()'
ffcb7564: "[DispCon] Warning: YUV Gain Don't Adjust"
ffb17f6c: '[GYO]Dp_YUVDustReduction'
ffc98684: '[IMP][PBROT] SetParameterRotationYuv %d'
ffc986ac: '[IMP][PBROT] INPUT --- Yuv:%d Add:0x%lX Base:%ld'
ffc98838: '[IMP][PBROT] RequestRotationYuv %d'
ffc9885c: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc98cc0: '[IMP][PBROT] CancelRotationYuv %d'
ffc98ce4: '[IMP][PBROT] RegisterCBROfCompleteRotationYuv %d'
ffc98d18: '[IMP][PBROT] UnregisterCBROfCompleteRotationYuv %d'
ffaf9720: 'Dp_JpegToYuvNew() Layout[0x%08x]'
ffaf97a4: 'Dp_JpegToYuvNew [0x%08x]'
ffcad788: '[IMP][DECWIN] SetResWinParam yuv:%d InputSel:%d'
ffb01160: 'YuvBaseAddress [0x%08x]'
ffc99dc4: '[IMPD] StartYuvResizing TIMEOUT'
ffc9a150: '[IMPD] StartYuvRotating Comp'
ffafa4cc: 'Not Executed Dp_YuvToYuvHalf()'
ffafa6a8: 'Dp_YuvToYuvCopy()'
ffafa6d8: 'Dp_YuvToYuvReduce()'
ffafa720: 'Dp_ExecuteYuvResizing()'
ffafa758: 'ResizeYuvT Output nYuvMode [%d]'
ffafa998: 'Dp_ExecuteYuvResizingCBR() ErrorCode [0x%08x]'
ffafa9dc: 'Dp_YuvRotation() Rotate:%d'
ffc8f1c8: 'EvenSize >= YuvUnit'
ffc9f1e0: ' < IMD > ERR: YUV mode'
ffafaf44: 'ExecuteYuvRotation'
ffc99d44: '[IMPD] StartYuvResizing %d'
ffc955d0: '<RESIZE> SetParameterResizeYuv Before Lock'
ffc99d78: '[IMPD] ZoomMode:%d YuvMode:%d'
ffc99e04: '[IMPD] ResizeYuv:%d'
ffc9b9d8: '[IMPD] ERROR Dpx_ExecuteYuvAngleAdjust %d'
ffc49f9c: '[DEV] PonyYuvPath_ChangeCBR(ID=%#lx)'
ffc9c308: '[IMPD] (PUB) ExecuteYuvResizing %d'
ffc9a0f0: '[IMPD] StartYuvRotating %d'
ffcaf664: ' [BmpDDev] ConvertYUVPaletteToPBPalette (PRI)'
ffc44d70: '[DPATH] DCF_EN START DCF:%#lx YUV:%#lx'
ffc44f24: '[DPATH] DCF_EN STOP DCF:%#lx YUV:%#lx'
ffafa4b8: 'Dp_YuvToYuvHalf()'
ffc9c350: '[IMPD] (PUB) ExecuteYuvRotatingFor2Buffer %d'
ffafa68c: 'Dp_YuvToYuv64up() W:%d H:%d'
ff83e778: 'FA_YuvDevelopTestImage'
ff83e844: 'FA_GetYuvImage'
ffb151a8: 'YUV-Control Done'
ffca62f4: '[IMPV] SetUnitYUV %d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'
ffafa9c8: 'ExecuteYuvResize'
ff845488: '[FA] FA_GetYuvImage'
ffca0e48: '[IMP] (PUB) SetYuvColorParameter %d'
ffc95550: '[IMP][PBRSZ] SetParameterResizeYuv %d'
-
something interesting... mbm29lv2mx16
ROM:FFD5D808 aAssertionFai_0 DCB "Assertion failed: (char*)WriteDataInFastModeOnRam > (char*)Erasi"
ROM:FFD5D808 ; DATA XREF: sub_FFD5DE00+28o
ROM:FFD5D808 ; ROM:off_FFD5DE80o
ROM:FFD5D808 DCB "ngMethodOnRam, file ../MTD/mbm29lv2mx16/mbm29lv2mx16.c, line 86",0xA
-
some more addresses : 0xC0F1407C , 0xC0F14074
In [12]: r 0xC0F1407C
str:[DispCon]_TurnOnDisplay_PUB+172:
str:[DispCon]_ShowBitmap_PUB+60:
str:[DispCon]_HideBitmap_PUB+60:
str:[DispCon]_SetDisplayType_PUB+372:
In [13]: r 0xC0F14074
str:[DispCon]_ShowImage_PUB+60:
str:[DispCon]_HideImage_PUB+60:
str:[DispCon]_SetDisplayType_PUB+356:
str:[DispCon]_TurnOnDisplay_PUB+156:
-
GetDisplayType_FFCB8668
return *0xBEA0
--------------------------------------------------------------------------------
GetDisplayWidth_FFCB6CAC
if *0xBEA4 == 0 /*EQ*/:
return 720
return 704
--------------------------------------------------------------------------------
GetDisplayHeight_FFCB8B04
if *0xBEA4 == 0 /*EQ*/:
return 240
if *0xBEA4 == 1 /*EQ*/:
return 480
return 576
--------------------------------------------------------------------------------
Display Resolution/Mode (maybe):
0 : w = 720, h = 240
1 : w = 704, h = 480
2 : w = 704, h = 576
--------------------------------------------------------------------------------
0x5B74 : unknown
0x5B78 : unknown
0x5BB8 : unknown
0x5BF8 : Vram Instance (maybe)
0x5BFC : unknown
0x5C00 : unknown
0x5C04 : unknown
0x5C08 : unknown
0x5C0C : unknown
0xB854 : unknown
0xBEA0 : DISPLAY TYPE
0xBEA4 : DISPLAY MODE (maybe)
0x1E004 : VRAM SEMAPHORE (maybe)
0x1E010 : VRAM INFORMATION
0x1E0A8 : unknown
0x1E100 : VRAM PARAMETERS // 0x1E0A8 + 0x58 = 0x1E100
-
302: 589.004 [GUI] MasterResultCBR
303: 589.210 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
304: 589.992 [GUI] -> handleGuiInit
305: 595.929 [DispCon] InitializeDisplayDeviceController (PUB)
306: 597.086 [IMP] (PUB) InitializeImagePlayer 1113
307: 598.805 [CERES] RegisterAdapterStatusCallback
308: 604.642 [Graphics] GuiStartGraphics (PUB)
309: 605.045 [IMP] (PUB) StartImagePlayer(mode=0) 1189
310: 605.096 [IMP] CreateVram 665
311: 605.252 [IMP] Vram0:0x1065BE00
312: 605.354 [IMP] Vram1:0x106F3C8C
...
858: 10003.647 myTaskDumpf:80: [MY_TEST] VRAM INFO:
859: 10003.702 myTaskDumpf:84: [MY_TEST] Show ImageVramParameter : x:0 y:24 w:720 h:216
861: 10118.505 [IMP] (PUB) GetVramInformation 3766
862: 10118.608 myTaskDumpf:101: [MY_TEST] GetVramInformation : arg0=1065BE00 ; Vram0
863: 10118.642 myTaskDumpf:102: [MY_TEST] GetVramInformation : arg1=00000000
864: 10118.683 myTaskDumpf:103: [MY_TEST] GetVramInformation : arg2=106F3C8C ; Vram1
865: 10118.708 myTaskDumpf:104: [MY_TEST] GetVramInformation : arg3=00000002
866: 10118.739 myTaskDumpf:105: [MY_TEST] GetVramInformation : arg4=000002D0 ; 720
867: 10118.768 myTaskDumpf:106: [MY_TEST] GetVramInformation : arg5=000002D0 ; 720
868: 10118.798 myTaskDumpf:107: [MY_TEST] GetVramInformation : arg6=000000F0 ; 240
0x1E010+0x00 -> arg0
0x1E010+0x04 -> arg4
0x1E010+0x08 -> arg5
0x1E010+0x0C -> arg6
0x1E010+0x10 -> arg1
0x1E010+0x14 -> arg2
0x1E010+0x24 -> arg3
-
Some more stubs :
NSTUB(0xFFCB02B4, CreatePhysicalVram)
NSTUB(0xFFCA01C8, CreateVram)
NSTUB(0xFFCA75C4, MakeHDVram)
NSTUB(0xFFB32EA0, LV_lvReturnVram)
NSTUB(0xFFCA130C, RefreshImageVram)
NSTUB(0xFFCA38DC, SetVramInformation)
NSTUB(0xFFCA432C, GetVramInformation)
NSTUB(0xFFCA3AA0, SetImageVramParameter)
NSTUB(0xFFCA6520, SetVramImageInfo)
NSTUB(0xFFCA3EC4, GetVramImageInfo)
NSTUB(0xFFCA8498, GetVramImagePosAndSize)
NSTUB(0xFFCA35D0, GetWorkImageLengthAndPosition)
-
I did dump some state-objects and found that the structure appears to be the same as 5DC.
NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject); // Mem 0x7770 / state matrix : 0xFFB3C9D4
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject); // Mem 0x7748 / state matrix : 0xFFB3B540
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject); // Mem 0x7738 / state matrix : 0xFFB39F5C
NSTUB(0xFFB32CB8, LVState_CreateStateObject); // Mem 0x7628 / state matrix : 0xFFB2EDC4
NSTUB(0xFFD5CEA4, DMState_CreateStateObject); // Mem 0xEFDC / state matrix : 0xFFD5CD84
973: 11003.762 logMemory:24: DUMP DMState:
974: 11003.815 logMemory:30: MEM(0x00201AD8) = 0xFFD4EE3C : type - "StateObject"
975: 11003.861 logMemory:30: MEM(0x00201ADC) = 0xFFD5CD7C : name - "DMState"
976: 11003.890 logMemory:30: MEM(0x00201AE0) = 0x00000000 : auto_sequence
977: 11003.935 logMemory:30: MEM(0x00201AE4) = 0xFFD4F018 : StateTransition_maybe
978: 11003.980 logMemory:30: MEM(0x00201AE8) = 0xFFD5CD84 : state_matrix
979: 11004.009 logMemory:30: MEM(0x00201AEC) = 0x0000000E : max_inputs
980: 11004.039 logMemory:30: MEM(0x00201AF0) = 0x00000002 : max_states
981: 11004.069 logMemory:30: MEM(0x00201AF4) = 0x00000000 : current_state
983: 11004.124 logMemory:24: DUMP LVState:
984: 11004.169 logMemory:30: MEM(0x00797940) = 0xFFD4EE3C
985: 11004.214 logMemory:30: MEM(0x00797944) = 0xFFB2F454
986: 11004.244 logMemory:30: MEM(0x00797948) = 0x00000000
987: 11004.289 logMemory:30: MEM(0x0079794C) = 0xFFD4F018
988: 11004.335 logMemory:30: MEM(0x00797950) = 0xFFB2EDC4
989: 11004.366 logMemory:30: MEM(0x00797954) = 0x0000000F
990: 11004.396 logMemory:30: MEM(0x00797958) = 0x0000000E
991: 11004.426 logMemory:30: MEM(0x0079795C) = 0x00000000
993: 11004.483 logMemory:24: DUMP LVCAEState:
994: 11004.528 logMemory:30: MEM(0x00796FB4) = 0xFFD4EE3C
995: 11004.573 logMemory:30: MEM(0x00796FB8) = 0xFFB39F50
996: 11004.603 logMemory:30: MEM(0x00796FBC) = 0x00000000
997: 11004.648 logMemory:30: MEM(0x00796FC0) = 0xFFD4F018
998: 11004.693 logMemory:30: MEM(0x00796FC4) = 0xFFB39F5C
999: 11004.724 logMemory:30: MEM(0x00796FC8) = 0x0000000A
1000: 11004.754 logMemory:30: MEM(0x00796FCC) = 0x00000006
1001: 11004.784 logMemory:30: MEM(0x00796FD0) = 0x00000002
1003: 11004.841 logMemory:24: DUMP LVCAFState:
1004: 11004.887 logMemory:30: MEM(0x0079742C) = 0xFFD4EE3C
1005: 11004.932 logMemory:30: MEM(0x00797430) = 0xFFB3B534
1006: 11004.962 logMemory:30: MEM(0x00797434) = 0x00000000
1007: 11005.007 logMemory:30: MEM(0x00797438) = 0xFFD4F018
1008: 11005.052 logMemory:30: MEM(0x0079743C) = 0xFFB3B540
1009: 11005.082 logMemory:30: MEM(0x00797440) = 0x0000000C
1010: 11005.112 logMemory:30: MEM(0x00797444) = 0x00000009
1011: 11005.143 logMemory:30: MEM(0x00797448) = 0x00000001
1013: 11005.199 logMemory:24: DUMP LVCDEVState:
1014: 11005.245 logMemory:30: MEM(0x0079754C) = 0xFFD4EE3C
1015: 11005.290 logMemory:30: MEM(0x00797550) = 0xFFB3C9C8
1016: 11005.320 logMemory:30: MEM(0x00797554) = 0x00000000
1017: 11005.365 logMemory:30: MEM(0x00797558) = 0xFFD4F018
1018: 11005.410 logMemory:30: MEM(0x0079755C) = 0xFFB3C9D4
1019: 11005.440 logMemory:30: MEM(0x00797560) = 0x00000008
1020: 11005.471 logMemory:30: MEM(0x00797564) = 0x00000003
1021: 11005.501 logMemory:30: MEM(0x00797568) = 0x00000001
-
DUMP FROM MEMORY ADDRESS 0x0001E000:
MEM(0x0001E000) = 0x00000000 (0) // unknown parameter
MEM(0x0001E004) = 0x0011C1B0 (1163696) // VRAM SEMAPHORE (maybe)
MEM(0x0001E008) = 0x0011C18C (1163660) // maybe another semaphore
MEM(0x0001E00C) = 0x00000000 (0) // unknown parameter
MEM(0x0001E010) = 0x1065BE00 (275103232) // Vram0 address - (GetVramInformation - arg 0)
MEM(0x0001E014) = 0x000002D0 (720) // Vram0 width (maybe) - (GetVramInformation - arg 4)
MEM(0x0001E018) = 0x000002D0 (720) // Vram0 pitch (maybe) - (GetVramInformation - arg 5)
MEM(0x0001E01C) = 0x000000F0 (240) // Vram0 height (maybe) - (GetVramInformation - arg 6)
MEM(0x0001E020) = 0x00000000 (0) // unknown parameter - (GetVramInformation - arg 1)
MEM(0x0001E024) = 0x106F3C8C (275725452) // Vram1 address - (GetVramInformation - arg 2)
MEM(0x0001E028) = 0x000002D0 (720) // Vram1 width (maybe)
MEM(0x0001E02C) = 0x000002D0 (720) // Vram1 pitch (maybe)
MEM(0x0001E030) = 0x000000F0 (240) // Vram1 height (maybe)
MEM(0x0001E034) = 0x00000002 (2) // unknown parameter - (GetVramInformation - arg 3)
MEM(0x0001E038) = 0x1DBC0064 (498860132) // Some Video memory
MEM(0x0001E03C) = 0x00000798 (1944) // RAW (w / 2) - SRAW ???
MEM(0x0001E040) = 0x00000798 (1944) // RAW (w / 2) - SRAW ???
MEM(0x0001E044) = 0x00000510 (1296) // RAW (h / 2) - SRAW ???
MEM(0x0001E048) = 0x00000798 (1944) // WorkImageSize - w
MEM(0x0001E04C) = 0x00000510 (1296) // WorkImageSize - h
MEM(0x0001E050) = 0x00000000 (0)
MEM(0x0001E054) = 0x00000000 (0)
MEM(0x0001E058) = 0x00000000 (0)
MEM(0x0001E05C) = 0x00000000 (0)
MEM(0x0001E060) = 0x00000000 (0)
MEM(0x0001E064) = 0x00000000 (0)
MEM(0x0001E068) = 0x00000000 (0)
MEM(0x0001E06C) = 0x00000000 (0)
MEM(0x0001E070) = 0x00000000 (0)
MEM(0x0001E074) = 0x00000000 (0)
MEM(0x0001E078) = 0x00000000 (0)
MEM(0x0001E07C) = 0x00000000 (0)
MEM(0x0001E080) = 0x00000000 (0)
MEM(0x0001E084) = 0x00000000 (0)
MEM(0x0001E088) = 0x00484E5C (4738652)
MEM(0x0001E08C) = 0x00400000 (4194304)
MEM(0x0001E090) = 0x00000001 (1)
MEM(0x0001E094) = 0x00000F30 (3888) // JpegSize - w
MEM(0x0001E098) = 0x00000A20 (2592) // JpegSize - h
MEM(0x0001E09C) = 0x00001D40 (7488) // EffectiveSizeOfJpeg - w
MEM(0x0001E0A0) = 0x00001380 (4992) // EffectiveSizeOfJpeg - h
MEM(0x0001E0A4) = 0x00000000 (0)
MEM(0x0001E0A8) = 0x00000001 (1) // star of some structure - unknown parameter ???
MEM(0x0001E0AC) = 0x00000000 (0)
MEM(0x0001E0B0) = 0x00000000 (0)
MEM(0x0001E0B4) = 0x1DBC0064 (498860132) // SetImageWorkMemory - 1
MEM(0x0001E0B8) = 0x1E26F264 (505868900) // SetImageWorkMemory - 2
MEM(0x0001E0BC) = 0x106F3C8C (275725452) // Vram1 address
MEM(0x0001E0C0) = 0x00000000 (0)
MEM(0x0001E0C4) = 0x00484E5C (4738652)
MEM(0x0001E0C8) = 0x00400000 (4194304)
MEM(0x0001E0CC) = 0x00000000 (0)
MEM(0x0001E0D0) = 0x00000000 (0)
MEM(0x0001E0D4) = 0x00000F30 (3888) // RAW w
MEM(0x0001E0D8) = 0x00000A20 (2592) // RAW h
MEM(0x0001E0DC) = 0x000009C0 (2496) // SetImageWorkMaxPixel - w
MEM(0x0001E0E0) = 0x00000750 (1872) // SetImageWorkMaxPixel - h
MEM(0x0001E0E4) = 0x00000000 (0)
MEM(0x0001E0E8) = 0x00000000 (0)
MEM(0x0001E0EC) = 0x00000000 (0)
MEM(0x0001E0F0) = 0x00000000 (0)
MEM(0x0001E0F4) = 0x000002D0 (720)
MEM(0x0001E0F8) = 0x000001E0 (480)
MEM(0x0001E0FC) = 0x000002D0 (720)
================================================================
DUMP FROM MEMORY ADDRESS 0x0001E100:
MEM(0x0001E100) = 0x00000000 (0) // pVramImagePositionX - ImageVramParameter
MEM(0x0001E104) = 0x00000018 (24) // pVramImagePositionY - ImageVramParameter
MEM(0x0001E108) = 0x000002D0 (720) // WholeWidth - ImageVramParameter
MEM(0x0001E10C) = 0x000000D8 (216) // WholeHeigh - ImageVramParameter
MEM(0x0001E110) = 0x0001DC00 (121856) // Aspect - ImageVramParameter ???
MEM(0x0001E114) = 0x00000000 (0)
MEM(0x0001E118) = 0x00000000 (0)
MEM(0x0001E11C) = 0x00000000 (0)
MEM(0x0001E120) = 0x00000000 (0)
MEM(0x0001E124) = 0x00000000 (0)
MEM(0x0001E128) = 0x00000000 (0)
MEM(0x0001E12C) = 0x00000000 (0)
MEM(0x0001E130) = 0x00000000 (0)
MEM(0x0001E134) = 0x00000000 (0)
MEM(0x0001E138) = 0x00000000 (0)
MEM(0x0001E13C) = 0x00000000 (0)
MEM(0x0001E140) = 0x005E5558 (6182232)
MEM(0x0001E144) = 0x00000000 (0)
MEM(0x0001E148) = 0x0001DB90 (121744)
MEM(0x0001E14C) = 0x00000000 (0)
MEM(0x0001E150) = 0xFF8851E4 (-7843356)
MEM(0x0001E154) = 0x00012D6C (77164)
MEM(0x0001E158) = 0x00000000 (0)
MEM(0x0001E15C) = 0x00000000 (0)
MEM(0x0001E160) = 0xFFCA415C (-3522212)
MEM(0x0001E164) = 0x00000000 (0)
MEM(0x0001E168) = 0x00000000 (0)
MEM(0x0001E16C) = 0x00000000 (0)
MEM(0x0001E170) = 0x00000000 (0)
MEM(0x0001E174) = 0x00000000 (0) // SetVramImageInfo - x
MEM(0x0001E178) = 0x00000018 (24) // SetVramImageInfo - y
MEM(0x0001E17C) = 0x000002D0 (720) // SetVramImageInfo - w
MEM(0x0001E180) = 0x000000D8 (216) // SetVramImageInfo - h
MEM(0x0001E184) = 0x00000000 (0)
MEM(0x0001E188) = 0x00000000 (0)
MEM(0x0001E18C) = 0x106F3C8C (275725452) // Vram1 address
MEM(0x0001E190) = 0x000002D0 (720)
MEM(0x0001E194) = 0x000000F0 (240)
MEM(0x0001E198) = 0x00000000 (0)
MEM(0x0001E19C) = 0x00000018 (24)
MEM(0x0001E1A0) = 0x000002D0 (720)
MEM(0x0001E1A4) = 0x000000D8 (216)
MEM(0x0001E1A8) = 0x00000000 (0)
MEM(0x0001E1AC) = 0x00000000 (0)
MEM(0x0001E1B0) = 0x00000000 (0)
MEM(0x0001E1B4) = 0x00000000 (0)
MEM(0x0001E1B8) = 0x00000000 (0)
MEM(0x0001E1BC) = 0x00000000 (0)
MEM(0x0001E1C0) = 0x00000000 (0)
MEM(0x0001E1C4) = 0x00000000 (0)
MEM(0x0001E1C8) = 0x00000000 (0)
MEM(0x0001E1CC) = 0x00000000 (0)
MEM(0x0001E1D0) = 0x00000000 (0)
MEM(0x0001E1D4) = 0x00000000 (0)
MEM(0x0001E1D8) = 0x00000000 (0)
MEM(0x0001E1DC) = 0x00000000 (0)
MEM(0x0001E1E0) = 0x00000000 (0)
MEM(0x0001E1E4) = 0x00000000 (0)
MEM(0x0001E1E8) = 0x00000000 (0)
MEM(0x0001E1EC) = 0x00000000 (0)
MEM(0x0001E1F0) = 0x00000000 (0)
MEM(0x0001E1F4) = 0x00000000 (0)
MEM(0x0001E1F8) = 0x00000000 (0)
MEM(0x0001E1FC) = 0x00000000 (0)
Vram0:0x1065BE00
Vram1:0x106F3C8C
-
698: 3711.532 [GUI] StartPlayMain
699: 3718.551 [Graphics] CreateSharedBuffer !!!
700: 3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
701: 3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200
702: 3719.292 [Graphics] GuiGraphicsNormalMode (PUB)
ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264
0x1dbc0064 + 0x6af200 = 0x1e26f264
0x6af200 size (maybe)
Maybe YUV422 VRAM - Playback Image
-
I found four 'Vram Instance' strings in memory.
I believe that is the beginning of the structure vram_object.
I think two of them should be cacheable version and the other two uncacheable version.
0x00400B84
0x00800B84
0x10400B84
0x10800B84
-
I found a service menu on the 40D.
I ran the function at 0xFF8170D4 and appeared to me an error in the CMOS camera's LCD.
NSTUB(test_servicemenu_maybe, 0xFF8170D4) at v1.1.1
757: 59388.950 [GUI] DlgMnMainTabHeader.c PRESS_MLT_LEFT_BUTTON
758: 59403.149 [GUI] DlgMnMainPlay1 GOT_TOP_OF_CONTROL
760: 60043.684 [GUI_E] GUI_Control:60 0x0
761: 60044.247 [GUI] IDLEHandler SERVICE_MENU
762: 60044.300 [GUI] SetGUIRequestMode(25)
763: 60044.324 [GUI] NotifyGUIEvent(1)
---------------------------------------------
ERR 123 123 123 025 032
REL 11709
CMOS J0369547
---------------------------------------------
-
Be careful what you call, some things can do permanent damage.
-
Thank you Alex. I'll be careful. I am aware that there is dangerous.
-
no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them
-
For a first port, take a look at 7D changeset, once you find the stubs it's probably a good starting point.
-
Ok, i'll do that...
Thank you
-
no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them
I appreciate your advice. I've been through some of these stubs and thought the same.
I hope not to make any serious mistake ... I really want to have the ML in my precious camera.
Thank you
-
40D v 1.1.1 - StateObjects List
NSTUB(0x62B4, DpImgEditState);
NSTUB(0x5D88, DpState);
NSTUB(0x7E38, TOMState);
//NSTUB(, USBC20State_1);
//NSTUB(, USBC20State_2);
//NSTUB(, USBC20State_3);
//NSTUB(, USBC20State_4);
NSTUB(0x7E60, CeresStateState);
NSTUB(0x1AF60, PtpDpsStateState);
NSTUB(0x1AF64, PtpEvtListAccsSem);
NSTUB(0x1D34, RMTState);
NSTUB(0x7824, FSSState);
//NSTUB(0xB710, PropState); // maybe
NSTUB(0x7840, RDState);
NSTUB(0x7770, LVCDEVState);
NSTUB(0x7748, LVCAFState);
NSTUB(0x7738, LVCAEState);
NSTUB(0x7628, LVState);
//NSTUB(???, FWState);
//NSTUB(???, FRState);
NSTUB(0x834C, MrkState);
NSTUB(0x781C, FCSState);
NSTUB(0x7E10, SdioTskState);
NSTUB(0x82CC, FMNormalState);
NSTUB(0xEFDC, DMState);
-
Dump from 0x00007600 to 0x00008000, when camera menu is showed and mode equal to M :
MEM(0x00007600) = 0xFFB2BDA4 (-5063260)
MEM(0x00007604) = 0xFFB2C4A0 (-5061472)
MEM(0x00007608) = 0x00000000 (0)
MEM(0x0000760C) = 0x00000000 (0)
MEM(0x00007610) = 0x1024F09C (270856348)
MEM(0x00007614) = 0x00000001 (1)
MEM(0x00007618) = 0x10206DC0 (270560704)
MEM(0x0000761C) = 0x10252520 (270869792)
MEM(0x00007620) = 0x10223820 (270678048)
MEM(0x00007624) = 0x007975F4 (7960052)
MEM(0x00007628) = 0x00797940 (7960896)
MEM(0x0000762C) = 0x00000000 (0)
MEM(0x00007630) = 0xC0F03030 (-1058000848)
MEM(0x00007634) = 0x80010000 (-2147418112)
MEM(0x00007638) = 0xC0F03068 (-1058000792)
MEM(0x0000763C) = 0x80010004 (-2147418108)
MEM(0x00007640) = 0xC0F03070 (-1058000784)
MEM(0x00007644) = 0x80010007 (-2147418105)
MEM(0x00007648) = 0xC0F0B008 (-1057968120)
MEM(0x0000764C) = 0x00000000 (0)
MEM(0x00007650) = 0xFFFFFFFF (-1)
MEM(0x00007654) = 0xFFFFFFFF (-1)
MEM(0x00007658) = 0xC0F03044 (-1058000828)
MEM(0x0000765C) = 0x00000002 (2)
MEM(0x00007660) = 0xC0F03044 (-1058000828)
MEM(0x00007664) = 0x00000000 (0)
MEM(0x00007668) = 0xC0F0B000 (-1057968128)
MEM(0x0000766C) = 0x00000000 (0)
MEM(0x00007670) = 0xC0F0B004 (-1057968124)
MEM(0x00007674) = 0x00000001 (1)
MEM(0x00007678) = 0xC0F09000 (-1057976320)
MEM(0x0000767C) = 0x00000001 (1)
MEM(0x00007680) = 0xFFFFFFFF (-1)
MEM(0x00007684) = 0xFFFFFFFF (-1)
MEM(0x00007688) = 0xC0F09000 (-1057976320)
MEM(0x0000768C) = 0x80000000 (-
MEM(0x00007690) = 0xC0F0B000 (-1057968128)
MEM(0x00007694) = 0x00000001 (1)
MEM(0x00007698) = 0xC0F0B004 (-1057968124)
MEM(0x0000769C) = 0x00000000 (0)
MEM(0x000076A0) = 0xFFFFFFFF (-1)
MEM(0x000076A4) = 0xFFFFFFFF (-1)
MEM(0x000076A8) = 0xC0F03030 (-1058000848)
MEM(0x000076AC) = 0x00000000 (0)
MEM(0x000076B0) = 0xC0F03068 (-1058000792)
MEM(0x000076B4) = 0x00000000 (0)
MEM(0x000076B8) = 0xC0F03070 (-1058000784)
MEM(0x000076BC) = 0x00000000 (0)
MEM(0x000076C0) = 0xFFFFFFFF (-1)
MEM(0x000076C4) = 0xFFFFFFFF (-1)
MEM(0x000076C8) = 0xC0F0851C (-1057979108)
MEM(0x000076CC) = 0x00060258 (393816)
MEM(0x000076D0) = 0xC0F08520 (-1057979104)
MEM(0x000076D4) = 0x032C0568 (53216616)
MEM(0x000076D8) = 0xC0F11250 (-1057942960)
MEM(0x000076DC) = 0x00900000 (9437184)
MEM(0x000076E0) = 0xC0F11254 (-1057942956)
MEM(0x000076E4) = 0x028F02FF (42926847)
MEM(0x000076E8) = 0xFFFFFFFF (-1)
MEM(0x000076EC) = 0xFFFFFFFF (-1)
MEM(0x000076F0) = 0xC0F0851C (-1057979108)
MEM(0x000076F4) = 0x00060258 (393816)
MEM(0x000076F8) = 0xC0F08520 (-1057979104)
MEM(0x000076FC) = 0x032C0568 (53216616)
MEM(0x00007700) = 0xC0F11250 (-1057942960)
MEM(0x00007704) = 0x011000C0 (17825984)
MEM(0x00007708) = 0xC0F11254 (-1057942956)
MEM(0x0000770C) = 0x020F0241 (34538049)
MEM(0x00007710) = 0xFFFFFFFF (-1)
MEM(0x00007714) = 0xFFFFFFFF (-1)
MEM(0x00007718) = 0x00000000 (0)
MEM(0x0000771C) = 0x00000006 (6)
MEM(0x00007720) = 0xFFB38304 (-5012732)
MEM(0x00007724) = 0x00000000 (0)
MEM(0x00007728) = 0x00796F74 (7958388)
MEM(0x0000772C) = 0x00000000 (0)
MEM(0x00007730) = 0x00000000 (0)
MEM(0x00007734) = 0x00000000 (0)
MEM(0x00007738) = 0x00796FB4 (7958452)
MEM(0x0000773C) = 0x00000000 (0)
MEM(0x00007740) = 0x007973EC (7959532)
MEM(0x00007744) = 0x10202438 (270541880)
MEM(0x00007748) = 0x0079742C (7959596)
MEM(0x0000774C) = 0x00000000 (0)
MEM(0x00007750) = 0x00000000 (0)
MEM(0x00007754) = 0x0079750C (7959820)
MEM(0x00007758) = 0x00000000 (0)
MEM(0x0000775C) = 0x00000005 (5)
MEM(0x00007760) = 0x00000000 (0)
MEM(0x00007764) = 0x00000000 (0)
MEM(0x00007768) = 0x00000000 (0)
MEM(0x0000776C) = 0x00000000 (0)
MEM(0x00007770) = 0x0079754C (7959884)
MEM(0x00007774) = 0x00000000 (0)
MEM(0x00007778) = 0x00010339 (66361)
MEM(0x0000777C) = 0xFFFF0000 (-65536)
MEM(0x00007780) = 0x00040002 (262146)
MEM(0x00007784) = 0x00080004 (524292)
MEM(0x00007788) = 0x009000A4 (9437348)
MEM(0x0000778C) = 0x00200010 (2097168)
MEM(0x00007790) = 0x00FA0020 (16384032)
MEM(0x00007794) = 0x0015FF06 (1441542)
MEM(0x00007798) = 0xFFE80000 (-1572864)
MEM(0x0000779C) = 0x00100040 (1048640)
MEM(0x000077A0) = 0x0018000E (1572878)
MEM(0x000077A4) = 0x00480078 (4718712)
MEM(0x000077A8) = 0x00000010 (16)
MEM(0x000077AC) = 0x00000098 (152)
MEM(0x000077B0) = 0x00000060 (96)
MEM(0x000077B4) = 0x00000088 (136)
MEM(0x000077B8) = 0x0000006F (111)
MEM(0x000077BC) = 0x00000048 (72)
MEM(0x000077C0) = 0x00000058 (88)
MEM(0x000077C4) = 0x00000056 (86)
MEM(0x000077C8) = 0x00000100 (256)
MEM(0x000077CC) = 0x00000080 (128)
MEM(0x000077D0) = 0x00000000 (0)
MEM(0x000077D4) = 0x00000000 (0)
MEM(0x000077D8) = 0x00000000 (0)
MEM(0x000077DC) = 0x00000000 (0)
MEM(0x000077E0) = 0x00000000 (0)
MEM(0x000077E4) = 0x00000000 (0)
MEM(0x000077E8) = 0x00000000 (0)
MEM(0x000077EC) = 0x00000001 (1)
MEM(0x000077F0) = 0x00000000 (0)
MEM(0x000077F4) = 0x00000000 (0)
MEM(0x000077F8) = 0x00000004 (4)
MEM(0x000077FC) = 0x00000000 (0)
MEM(0x00007648) = 0xC0F0B008 (-1057968120)
-
Sounds good.
Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.
Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
These are the values I got ...
EDMAC Registers (maybe)
MEM(0xC0F04008) = 0x3FBFFFF6
MEM(0xC0F04108) = 0x3695B69E
MEM(0xC0F04208) = 0x3F802DFC
MEM(0xC0F04308) = 0x1BB044CA
MEM(0xC0F04408) = 0x3E04583E
MEM(0xC0F04508) = 0x3A91B07C
MEM(0xC0F04608) = 0x1EA3FFCC
MEM(0xC0F04708) = 0x00000000
MEM(0xC0F04808) = 0x3A6F3EDE
MEM(0xC0F04908) = 0x3F20DE9E
MEM(0xC0F04A08) = 0x3D701EFE
MEM(0xC0F04B08) = 0x194F3D52
MEM(0xC0F04C08) = 0x34794AD6
MEM(0xC0F04D08) = 0x2A674EDE
MEM(0xC0F04E08) = 0x00000000
MEM(0xC0F04F08) = 0x00000000
at 0xFFCF8184 : MOV R3, 0xC0F04008
NSTUB(0xFFCF8184, GetEDmacAddress)
-
Doesn't look like anything known, so it's probably not edmac.
-
I also did not like the results.
-
I found several LV functions that are registered, so they can be invoked by name.
FW v 1.1.1
NSTUB(0xFFB2E208, lv_start)
NSTUB(0xFFB2E244, lv_stop)
NSTUB(0xFFB2E280, lv_vram_dump)
NSTUB(0xFFB2E308, lv_yuv_dump)
NSTUB(0xFFB2E38C, lv_fps)
NSTUB(0xFFB2E3FC, lv_psave_on)
NSTUB(0xFFB2E46C, lv_psave_off)
NSTUB(0xFFB2DB54, lv_debug_ae)
NSTUB(0xFFB2DCF4, lv_debug_wb)
NSTUB(0xFFB2E4DC, lv_debug_af)
NSTUB(0xFFB2E5F8, lv_ae)
NSTUB(0xFFB2E668, lv_wb)
NSTUB(0xFFB2E6D8, lv_af_raw)
NSTUB(0xFFB2E748, lv_debug_flag)
NSTUB(0xFFB2E588, lv_data_count)
NSTUB(0xFFB2E82C, lv_eshutter)
NSTUB(0xFFB2E97C, lv_tvaf_start)
NSTUB(0xFFB2E89C, lv_magnify)
NSTUB(0xFFB2E90C, lv_save_raw)
-
Hi,
I'm new here and anxious to see the 40D to be used with ML:)
This is very very techy-stuff and hard for me to understand - so I'd just like to know, if there is a lantern at the end of the tunnel;)
Is there any way to support you?
Kind regards
Uwe
-
Hi,
I'm new here and anxious to see the 40D to be used with ML:)
This is very very techy-stuff and hard for me to understand - so I'd just like to know,
if there is a lantern at the end of the tunnel;)
Is there any way to support you?
Kind regards
Uwe
I'm also very anxious to see the ML working for the first time ... and on my camera :)
I am new at this but I'm motivated ... soon I hope to ignite that light ...
for now i just lit the blue and red LED :)
I never received anything for my work, but donations are welcome.
They are the fuel needed to be able to see the light ... My God! :)
-
I found the location of the structure 'vram_info'.
/** VRAM info in the BSS.
*
* Pixels are in an YUV 422 format.
* This points to the image VRAM, not the bitmap vram
*/
struct vram_info
{
uint8_t * vram; // off 0x00
uint32_t width; // maybe off 0x04
uint32_t pitch; // maybe off 0x08
uint32_t height; // off 0x0c
uint32_t vram_number; // off 0x10
};
SIZE_CHECK_STRUCT( vram_info, 0x14 );
extern struct vram_info vram_info[2];
NSTUB(0x0001E010, vram_info)
MEM(0x0001E010) = 0x1065BE00 (275103232)
MEM(0x0001E014) = 0x000002D0 (720)
MEM(0x0001E018) = 0x000002D0 (720)
MEM(0x0001E01C) = 0x000000F0 (240)
MEM(0x0001E020) = 0x00000002 (2)
MEM(0x0001E024) = 0x106F3C8C (275725452)
MEM(0x0001E028) = 0x000002D0 (720)
MEM(0x0001E02C) = 0x000002D0 (720)
MEM(0x0001E030) = 0x000000F0 (240)
MEM(0x0001E034) = 0x00000000 (0)
-
Having the 40D record video would be excellent. The resolution of 1024 x 680 is plenty for web video.
People do have to realize that the 40D was never intended to shoot video so it doesn't have a microphone or audio circuitry built into it. You will have to capture audio separately or lay down a background track of something like music.
But having the other ML still image features would greatly increase the use of the 40D for things like time-lapse photography and other applications.
-
Having the 40D record video would be excellent. The resolution of 1024 x 680 is plenty for web video.
People do have to realize that the 40D was never intended to shoot video so it doesn't have a microphone or audio circuitry built into it. You will have to capture audio separately or lay down a background track of something like music.
But having the other ML still image features would greatly increase the use of the 40D for things like time-lapse photography and other applications.
I have spent many hours with my camera, but I've done a few shots. I can not say when will release the first version for testing. I believe there are many users around the world who have this camera. I started this project because I feel a little revolted. The canon has never released a version with AF microadjustment. Many of us bought high quality lenses that would greatly benefit from this functionality. We gave billions of profit to Canon. I think they should respect us more and remember living of our money. I know the camera was discontinued but I did not let being a customer paying for a quality service. I may be a drop in the ocean with sharks but many, donald duck got rich collecting small coins. This is my response to the canon. If things go the way I want in a few months you can all enjoy my work without being forced to pay a penny.
-
I found some more interesting things:
strings -t x 40d.111.ROMF1.0xFF800000.bin | perl renumber.pl 0xFF800000 > 40d.111.ROMF1.0xFF800000.string
grep 40d.111.ROMF1.0xFF800000.strings -e "Mgr$"
ffacff30 DpMgr
ffb04078 DpImgEditMgr
ffb2d10c LiveViewMgr
ffbaee34 TOMgr
ffbc55a0 FileMgr
ffc49060 DDDMgr
ffc877fc PropMgr
ffd17614 CardServiceMgr
ffd4c084 DbgMgr
ffd5a30c PowerMgr
With this simple command is simple filter many of the file names of the source code.
Sometimes it may be useful to help find some things in the dump.
grep 40d.111.ROMF1.0xFF800000.strings -e ".*\.c" > 40d.111.ROMF1.0xFF800000.files
-
Some memory address at firmware:
ffff1c6c Write Address : 0x00000000
ffff1c8c Write Address : 0x04000000
ffff2714 4.Erase TORNADO and Command area (0x%x -> 0x%x)
ffff2748 5.Erase Program area (0xF8010000 -> 0xF862FFFF)
ffff3578 Is flg written(Y=ON(0xFFFFFFFF)/N=OFF(0x00000000))? :
ffff3608 Is flg written(Y=ON(0x00000000)/N=OFF(0xFFFFFFFF))? :
ffff3774 ERASE [ROM1][0x00000000]
ffff39e4 Input start_address (ram 0x00000000 -> 0x40000000) :
ffff3a1c Input end_address (ram 0x00000000 -> 0x40000000) :
ffff3a54 Input address (rom 0xf8000000 -> 0xf87FE000) :
ffff5914 FROM Check Sum is 0x%08x
ffff5930 ( 0xF8010000 - 0xF85FFFFF )
-
grep 40d.111.ROMF1.0xFF800000.strings -e ".*[GUI].*StartMn" | awk -F' ' '{ print $3 }' | sort | uniq -u
StartMnActiveSweepApp
StartMnActiveSweepAutoApp
StartMnBrightnessApp
StartMnBusyApp
StartMnBusyKeepEventBtnApp()
StartMnCameraClearApp
StartMnCameraRegApp
StartMnCameraRegConfirmApp
StartMnCameraUnRegApp
StartMnCameraUnRegConfirmApp
StartMnCameraUnRegSelectApp
StartMnCardExtensionApp
StartMnCardFormatBeginAp
StartMnCardFormatexcuteApp
StartMnCopyBusyApp()
StartMnCopyConfirmApp
StartMnCopyMsgApp(
StartMnCopyResultApp(
StartMnCustomFnApp(%d)(%d)
StartMnCustomFnClearApp
StartMnDustOffDataApp
StartMnDustOffDataCompleteApp
StartMnDustOffDataExcuteApp
StartMnEraseImageApp
StartMnEraseImageBusyApp
StartMnEraseImageConfirmApp
StartMnEraseImageDummyApp
StartMnHandWorkSweepApp
StartMnImageZoneQualityApp
StartMnLanguageApp
StartMnLiveViewApp
StartMnMainCustomFuncApp()
StartMnMainMyMenuApp()
StartMnMainPlay1App()
StartMnMainPlay2App()
StartMnMainRec1App()
StartMnMainRec2App()
StartMnMainSetup1App()
StartMnMainSetup2App()
StartMnMainSetup3App()
StartMnMainStudioApp()
StartMnMmMessageApp(
StartMnMwbImageConfirmApp
StartMnMWBWarningApp
StartMnMyMenuDeleteApp()
StartMnMyMenuPreRearrange(
StartMnMyMenuRearrange(
StartMnMyMenuSelect()
StartMnMyMenuSetting()
StartMnPictureStyleDetailApp
StartMnPictureStyleMain
StartMnPictureUserDetail
StartMnQualityApp
StartMnQualityDivideApp
StartMnQualityDivideSelectApp
StartMnSensorCleanApp
StartMnStroboBuiltInSettingApp
StartMnStroboControlApp
StartMnStroboCustomFnApp
StartMnStroboCustomFnClearApp
StartMnStroboErrorApp
StartMnStroboFnSettingApp
StartMnStroboFnSettingClearApp
StartMnStroboFnSettingHeaderApp()
StartMnStroboOldOutSettingApp
StartMnStroboWirelessApp
StartMnStudioModeChangeConfirmApp
StartMnWBApp
StartMnWbBktApp
With this command we can get the list of menus available in firmware. This command can be useful for finding the code some functionality that is available in the original firmware.
-
Some more strings...
grep -e "libc" 40d.111.ROMF1.0xFF800000.strings
ffcb9150 ../libcsvg/svg_canvas.c
ffcbd930 gfff../libcsvg/svg_paint.c
ffcbe118 ../libcsvg/svg_render.c
ffcbeb48 ../libcsvg/dom/dom.c
ffcbfc5c ../libcsvg/dom/dom_common.c
ffcc22e4 ../libcsvg/dom/dom_trait.c
ffcc629c ../libcsvg/core/attrib_core.c
ffcc6a88 ../libcsvg/core/attrib_graphics.c
ffcc733c ../libcsvg/core/attrib_paint.c
ffcca84c ../libcsvg/core/elem_anim.c
ffcd3138 ../libcsvg/core/elem_path.c
ffcd5b54 ../libcsvg/core/elem_shape.c
ffcd8354 ../libcsvg/core/elem_struct.c
ffcda5fc ../libcsvg/core/render_path.c
ffcdb054 ../libcsvg/core/render_shape.c
ffcdda64 ../libcsvg/core/stack_canvas.c
ffcddba4 ../libcsvg/core/stack_common.c
ffcddd38 ../libcsvg/core/stack_coordinate.c
ffcddedc ../libcsvg/core/stack_core.c
ffcde000 ../libcsvg/core/stack_element.c
ffcdebf8 ../libcsvg/core/stack_transform.c
ffce0f44 ../libcsvg/common/hash.c
ffce1274 ../libcsvg/common/id_table.c
ffce15b0 ../libcsvg/common/queue.c
ffce3a1c ../libcsvg/common/utils.c
ffce5bd8 ../libcucs/ucs.c
ffce9b34 ../libcsvg/common/uriref.c
ffcea324 ../libcsvg/svg_path.c
ffcef4e0 ../libcsvg/core/attrib_animtiming.c
ffcf09f4 ../libcsvg/core/datatype_preserveaspectratio.c
ffcf1568 ../libcsvg/core/render_anim.c
-
Those Start***App sometimes can be started, but it's not a clean method for using them IMO. These calls may bring the correct dialog, but they do not setup the keys (guimode) and probably other things.
There is a SVG library inside, but nobody figured out how to use it.
-
I keep looking for the addresses of VRAM ... My next goal is to write on the LCD.
Unfortunately I have not got great results ... soon, I hope to get this my goal.
I know there are many similarities between the 5DC and 40D cameras.
So I decided to look some things coutts already found in your 5DC.
from magic lantern source code...
/** Canon data structure containing BMP VRAM address.
*
* LCD: it points to a 720x480 cropped area, but the image buffer is actually 960x540.
* HDMI: it points to the full image buffer.
*
* ML alters this pointer to always indicate the 720x480 cropped area
* (to avoid the possibility of buffer overflow due to race conditions when changing display modes).
*/
struct bmp_vram_info
{
uint8_t * vram0;
uint32_t off_0x04;
uint8_t * vram2;
};
extern struct bmp_vram_info bmp_vram_info[];
from 5DC.111 firmware...
NSTUB(0x29448, bmp_vram_info)
MakeName(0xFFB0A95C, "str:[BmpDDev]_SelectParameter");
MakeName(0xFFB0B174, "str:[BmpDDev]_DisplayPhysicalScreen");
REAL BMP VRAM : 0x29320+8 =0x29328
REAL BMP VRAM : 0x29330+8 =0x29338
REAL BMP VRAM : 0x29350+8 =0x29358
from 40D.111 firmware...
NSTUB(0x1E450, bmp_vram_info)
MakeName(0xFFCAFAE0, "str:[BmpDDev]_SelectParameter");
MakeName(0xFFCB0468, "str:[BmpDDev]_DisplayPhysicalScreen");
REAL BMP VRAM : 0x1E328+8 = 1E330
REAL BMP VRAM : 0x1E338+8 = 1E340
REAL BMP VRAM : 0x1E358+8 = 1E360
Here are some of the logs generated by my tests ...
667: 10003.609 myTaskDumpf:204: [JP] VRAM INFO:
668: 10003.670 printVramInfo:25: [JP] VRAM_INFO: vram address = 0x1065BE00
669: 10003.698 printVramInfo:26: [JP] VRAM_INFO: width = 720
670: 10003.722 printVramInfo:27: [JP] VRAM_INFO: pitch = 720
671: 10003.746 printVramInfo:28: [JP] VRAM_INFO: height = 240
672: 10003.767 printVramInfo:29: [JP] VRAM_INFO: vram_number = 0
673: 10003.806 printVramInfo:25: [JP] VRAM_INFO: vram address = 0x106F3C8C
674: 10003.830 printVramInfo:26: [JP] VRAM_INFO: width = 720
675: 10003.853 printVramInfo:27: [JP] VRAM_INFO: pitch = 720
676: 10003.876 printVramInfo:28: [JP] VRAM_INFO: height = 240
677: 10003.897 printVramInfo:29: [JP] VRAM_INFO: vram_number = 2
678: 10003.921 printBmpVramInfo:45: [JP] BMP_VRAM_INFO: i = 0x00
679: 10003.961 printBmpVramInfo:46: [JP] BMP_VRAM_INFO: vram0 address = 0x10631714
680: 10003.988 printBmpVramInfo:47: [JP] BMP_VRAM_INFO: off_0x04 address = 0x00000000
681: 10004.027 printBmpVramInfo:48: [JP] BMP_VRAM_INFO: vram2 address = 0x48544F00
687: 11143.643 myTaskDumpf:230: [JP] MEM(0x0001E330) = 0x10631714 // vram0 address
688: 11143.707 myTaskDumpf:231: [JP] MEM(0x0001E340) = 0x10631714 // vram0 address
689: 11143.741 myTaskDumpf:232: [JP] MEM(0x0001E360) = 0x00000000
690: 11143.773 myTaskDumpf:234: [JP] MEM(0x0000BEA0) = 0x00000000 // DisplayType
691: 11143.802 myTaskDumpf:235: [JP] MEM(0x0000BEA4) = 0x00000000 // W x H = 720x240
692: 11143.832 myTaskDumpf:236: [JP] MEM(0x0000B854) = 0x00000002
-
These stubs are very important for our work so I decided to put them here ... require confirmation ...
I have not tested them all. I have used them to make some memory dumps.
40d v 1.1.1
NSTUB(0xFFC39AE4, FIO_RemoveFile)
NSTUB(0xFFD1682C, FIO_OpenFile)
NSTUB(0xFFD168F8, FIO_CreateFile)
NSTUB(0xFFD16A80, FIO_ReadFile)
NSTUB(0xFFD16BF0, FIO_WriteFile)
NSTUB(0xFFD16CA8, FIO_CloseFile)
NSTUB(0xFFD16D5C, FIO_GetFileSize)
NSTUB(0xFFD17244, FIO_GetDeviceName)
NSTUB(0xFFD7A968, FIO_FindNextEx)
-
Can you dump around 200K from each VRAM address?
Use the cacheable addresses if you can't (remove the first 1).
-
Can you dump around 200K from each VRAM address?
Use the cacheable addresses if you can't (remove the first 1).
Yes, I will do that ..
-
Yes, I will do that ..
A simple test to see if you found the vram is to try and paint on the screen, write something like 64kb of 1s to the buffer and you should see a colored square on the screen.
great to see your progress!!
-
A simple test to see if you found the vram is to try and paint on the screen, write something like 64kb of 1s to the buffer and you should see a colored square on the screen.
great to see your progress!!
Cloutts, thank you for this suggestion ... more I had thought about doing something similar but I am afraid to write to memory before I was sure it matches the VRAM.
-
Hi guys
I did some more tests today ...
I finally got the memory address of LV_VRAM.
I made a small application that writes into log file the addresses of LV_VRAM.
I put the camera in LV mode, and every 40ms, I wrote in the log file, the address and size of the LV_VRAM.
I repeated the process twice, and got the following data:
Address : 0x1CA700C8 / Average Size : ??????????
Address : 0x1CEAE304 / Average Size : 0x0003D068
I've also downloaded the JPEG. I had done before but did not know the memory address.
The JPEG has 1024x680 pixels and has a size of 213446 bytes
Some logs...
45578: 63053.752 [LVCDEV]->lvcdevResourceGet(0,1)
45579: 63054.313 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0
45580: 63057.331 [LV] lvVDInterrupt
45581: 63057.493 [LV] WB 1926 1135 1135 2454(1158)
45582: 63059.349 [LV] lvReturnVram
45583: 63059.379 < GUI Lock > GUILock_PermitPowerLock (PUB)
45584: 63059.666 < GUI Lock > GUILockTask 1
45585: 63059.735 [DispCon] TurnOnDisplay (PUB)
45586: 63061.319 [DEV] LV_JPG YuvWriteCompleteCBR
45587: 63061.365 [DEV] LV_JPG YUVReadCompleteCBR
45588: 63061.498 [DEV] LV_JPG JpCoreCompleteCBR( 0x4af66 )
45589: 63061.558 [DEV] LV_JPG JpegPopCompleteCBR
45590: 63061.701 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1cabb02e Y411:0x107a0e20
45591: 63062.313 [LVCDEV]->PD(VF:0x1078d7e8,MS:0x485540)
45592: 63081.284 [LV] WriteEDmacWbIntegCompleteCBR
45579: 63054.313 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0
45590: 63061.701 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1cabb02e Y411:0x107a0e20
-
I managed to blur the image of the LCD. I now have to know the coordinates valid in order to draw a rectangle.
I used this STUB, and wrote somewhere in vram0.
NSTUB(0x1E450, bmp_vram_info)
In the coming days, I'll want to have a bmp_printf(...) function to write text on the display.
Once you get it, I want to improve the boot process.
-
Some additional information:
http://en.wikipedia.org/wiki/Canon_EOS_40D (http://en.wikipedia.org/wiki/Canon_EOS_40D)
-
I managed to blur the image of the LCD. I now have to know the coordinates valid in order to draw a rectangle.
I used this STUB, and wrote somewhere in vram0.
NSTUB(0x1E450, bmp_vram_info)
In the coming days, I'll want to have a bmp_printf(...) function to write text on the display.
Once you get it, I want to improve the boot process.
you should start porting ML to the 40d, clone the latest repo and look for CONFIG_5DC, maybe add #define CONFIG_5DC CONFIG_40D and copy the same diretory structure / entry.S of the 5dc. All of the changes for the 5dc in menu.c should be valid for the 40d too.
-
Thanks Coutts ... I'm working on it :)
-
Good news ...
In recent days, me and Alex, we can give a good progress in 40D port.
Finally, we have a "Hello World" working ...
soon I'll post a picture here ...
-
Awsome. My Camera is still broken and im trying to repair it.
-
Me and many others are silently waiting for Good news
-
With a little time and patience, one day will come true ...
The Coutts and Alex have done an excellent job with 5DC.
I think that much of this work can be useful for the 40D.
-
Some more stubs
40D v1.1.1
NSTUB(0x1E458, LCD_Palette)
NSTUB(0x1E498, RGB_Palette)
NSTUB(0x1E388, PB_Palette)
NSTUB(0xFFCB0B6C, SetRGBPaletteToDisplayDevice)
NSTUB(0xFF867AA8, ChangeColorPalette)
NSTUB(0xFFCAFA0C, SetParameterToBitmapDisplayDevice)
NSTUB(0xFFCB7EBC, EnableBitmapVBufferForPlayBackAndWaiting)
NSTUB(0xFFCB9078, BmpDDev_give_semaphore);
NSTUB(0xFFCB9028, BmpDDev_take_semaphore);
NSTUB(0xFF8156F8, bindGUISwitchCBR)
Alex... I'm working on it :)
-
3878: 23394.264 [MC] M:1,ID:B(29)
3879: 23394.303 [BIND] Switch (11, 5)
3880: 23394.345 [GUI_E] GUI_Control:25 0x0
3881: 23394.537 [JP] (50/3) my_gui_main_task:85: EVT 246[0]: p=19 *o=0x0/0x0/0x0 a=0
3884: 23426.474 [JP] (50/3) my_gui_main_task:85: EVT 247[4]: p=0 *o=0x80030014/0x96/0x0 a=0
3887: 23445.017 [MC] M:1,ID:B(30)
3888: 23445.059 [BIND] Switch (11, 3)
3889: 23445.092 [GUI_E] GUI_Control:23 0x0
3890: 23458.398 [JP] (50/3) my_gui_main_task:85: EVT 248[0]: p=17 *o=0x0/0x0/0x0 a=0
3893: 23489.950 [GUI] DlgPlayMain.c PRESS_MLT_RIGHT_BUTTON
3894: 23490.172 [DispCon] SetTempForBackLight Temp 150
3895: 23490.318 [GUI] DlgPlayMain.c PRESS_MLT_RIGHTUP_BUTTON
3896: 23495.865 [MC] M:1,ID:B(31)
3897: 23495.904 [BIND] Switch (11, 2)
3898: 23495.941 [GUI_E] GUI_Control:22 0x0
3899: 23496.137 [JP] (50/3) my_gui_main_task:85: EVT 249[0]: p=16 *o=0x0/0x0/0x0 a=0
3902: 23527.803 [GUI] DlgPlayMain.c PRESS_MLT_UP_BUTTON
3903: 23546.781 [MC] M:1,ID:B(32)
3904: 23546.821 [BIND] Switch (11, 4)
3905: 23546.853 [GUI_E] GUI_Control:24 0x0
3906: 23547.040 [JP] (50/3) my_gui_main_task:85: EVT 250[0]: p=18 *o=0x0/0x0/0x0 a=0
3909: 23578.686 [GUI] DlgPlayMain.c PRESS_MLT_LEFTUP_BUTTON
3910: 23589.717 [MC] M:1,ID:B(0)
3911: 23589.753 [BIND] Switch (11, 6)
3912: 23589.790 [GUI_E] GUI_Control:26 0x0
3913: 23589.970 [JP] (50/3) my_gui_main_task:85: EVT 251[0]: p=1a *o=0x0/0x0/0x0 a=0
3916: 23621.610 [GUI] DlgPlayMain.c PRESS_MLT_LEFT_BUTTON
3917: 23640.641 [MC] M:1,ID:B(1)
3918: 23640.683 [BIND] Switch (11, 8)
3919: 23640.721 [GUI_E] GUI_Control:28 0x0
3920: 23640.907 [JP] (50/3) my_gui_main_task:85: EVT 252[0]: p=1c *o=0x0/0x0/0x0 a=0
3923: 23672.516 [GUI] DlgPlayMain.c PRESS_MLT_LEFTDOWN_BUTTON
3924: 23691.575 [MC] M:1,ID:B(2)
3925: 23691.617 [BIND] Switch (11, 9)
3926: 23691.655 [GUI_E] GUI_Control:29 0x0
3927: 23691.839 [JP] (50/3) my_gui_main_task:85: EVT 253[0]: p=1d *o=0x0/0x0/0x0 a=0
3930: 23723.499 [GUI] DlgPlayMain.c PRESS_MLT_DOWN_BUTTON
3931: 23793.658 [MC] M:1,ID:B(3)
3932: 23793.698 [BIND] Switch (11, 5)
3933: 23793.737 [GUI_E] GUI_Control:25 0x0
3934: 23793.937 [JP] (50/3) my_gui_main_task:85: EVT 254[0]: p=19 *o=0x0/0x0/0x0 a=0
3937: 23825.534 [GUI] DlgPlayMain.c PRESS_MLT_RIGHT_BUTTON
3938: 23844.343 [MC] M:1,ID:B(4)
3939: 23844.384 [BIND] Switch (11, 3)
3940: 23844.420 [GUI_E] GUI_Control:23 0x0
3941: 23844.610 [JP] (50/3) my_gui_main_task:85: EVT 255[0]: p=17 *o=0x0/0x0/0x0 a=0
3944: 23876.253 [GUI] DlgPlayMain.c PRESS_MLT_RIGHTUP_BUTTON
3945: 23895.276 [MC] M:1,ID:B(5)
3946: 23895.315 [BIND] Switch (11, 0)
3947: 23895.350 [GUI_E] GUI_Control:21 0x0
3948: 23895.543 [JP] (50/3) my_gui_main_task:85: EVT 256[0]: p=15 *o=0x0/0x0/0x0 a=0
3951: 23945.275 [MC] M:1,ID:B(6)
3952: 23945.317 [BIND] Switch (11, 6)
3953: 23945.354 [GUI_E] GUI_Control:26 0x0
3954: 23945.559 [JP] (50/3) my_gui_main_task:85: EVT 257[0]: p=1a *o=0x0/0x0/0x0 EVT 257 a=0
3957: 23977.234 [GUI] DlgPlayMain.c PRESS_MLT_LEFT_BUTTON
-
Do you have a fork with your 40D work on bitbucket? I'd like to "follow" it
-
Do you have a fork with your 40D work on bitbucket? I'd like to "follow" it
Nanomad. I haven't shared my code in this repository.
I sent my initial developments to Alex's email.
After that, he then began to integrate it into the ML.
We've been working together a few hours.
I loved working with him on this project, but we had little time.
Right now, I have a problem displaying the menus on the LCD.
I suspect there is a problem of any competition in memory access, calculations wrong, wrong resolutions or access buffers that were allocated dynamically and are already invalid.
Yes, I am thinking to create a repository on bitbucket
I also hope to have their precious help ;)
BR
-
Hi guys
My 40D camera now say :
"Magic Lantern is up and running...3 tasks started."
... but has serious problems on the LCD. I still can not see the menu of ML :(
I can only see messages like "Hello World!" and sometimes appears at the top of the image a green rectangle,
a little blurred with pixels of other colors. I think is the menu! And sometimes the entire screen flashes.
It seems that, we switch the color palette. This is something very strange happens.
I'll have to ask someone for help ... I still can not fully understand the code of VRAM.
We should be using buffers invalid or the wrong dimensions. If I can I do some tests for next week
Guys? Someone can help me on this? ... Maybe you Alex ... ;)
Thank you in advance!
I'll keep you updated with the latest news ...
-
I identified some errors ...
618: 1078.659 [JP] (50/3) read_entire_file:889: File 'A:/ML/DATA/FONTS.DAT' size 32744 by
619: 1091.459 [FR] readsize = 0x20000
620: 1110.717 [FR] readsize = 0x20000
621: 1124.497 [FR] readsize = 0x20000
622: 1141.060 [FR] readsize = 0x20000
623: 1155.195 [FR] readsize = 0x20000
624: 1172.910 [FR] readsize = 0x1f000
625: 1187.773 [FR] A:/DCIM/100CANON/IMG_1685.JPG read done (8288KB/S)
626: 1187.961 [GUI] SetPlInfoPLAYMode(100_1685)
627: 1188.080 [IMP] (PUB) SetDpRotationAngle 2845(0)
628: 1188.119 [IMP] (PUB) SetColorConvertTable 2832( 0x0 )
629: 1188.137 [Graphics] GuiDrawOneImage (PUB)
630: 1188.180 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
631: 1188.208 [IMP] (PUB) SyncroClearImagePlayVram 2569
632: 1188.226 [IMP] GetVramNumber 580
633: 1188.246 [IMP] GetVramNumber 580
634: 1189.050 <RECTCOLOR> RequestRectangleColor Before Lock
635: 1189.432 [FW] fwSetUnitSize (0x200000)
636: 1191.298 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
637: 1191.367 [IMP] (PUB) SetImageAspect 3683
638: 1191.451 SetImageVramParameter x:48 y:24 w:340 h:102/* Aspect:976264*/
639: 1191.489 [IMP] (PUB) SetImageFileParameter 1348
640: 1191.567 [IMP] (PUB) DrawImageToVram(rot:0 cb:0xFF8851E4) 1393
641: 1191.593 [IMP] GetJpegInfo 750
642: 1192.330 <DJP> RequestDecodeJpeg Before Lock
643: 1214.231 [IMP] SetRotationAngle 616
644: 1214.264 [IMP] SetVramImageParameter 640
645: 1214.294 [IMP] GetVramNumber 580
646: 1215.508 <DJP> RequestDecodeJpeg Before Lock
647: 1242.982 [JP] (50/3) Calling init_func ../../src/bmp.c (b807f4)
648: 1247.041 [JP] (50/3) Calling init_func ../../src/font-dyn.c (b82aa8)
649: 1247.089 [JP] (50/3) Calling init_func debug (b87f68)
650: 1247.193 [JP] (50/3) Calling init_func ../../src/property.c (b8b020)
651: 1248.238 [PROPAD] ERROR GetPropertyData ID = 0x0205000E
652: 1248.373 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0205000E L:874
653: 1248.839 [JP] (50/3) _prop_handler_PROP_LAST_JOB_STATE:1781: job state: 0
654: 1249.631 [PROPAD] ERROR GetPropertyData ID = 0x0206001E
655: 1249.745 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0206001E L:874
656: 1249.901 [PROPAD] ERROR GetPropertyData ID = 0x0204000D
657: 1249.983 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0204000D L:874
658: 1250.579 [JP] (50/3) Calling init_func ../../src/tweaks.c (b8bf38)
659: 1251.006 [JP] (50/3) Calling init_func lens (b8f1f8)
660: 1251.151 [JP] (50/3) Calling init_func ../../src/zebra.c (b93e00)
661: 1251.681 [JP] (50/3) Calling init_func shoot (b9f87c)
662: 1252.387 [JP] (50/3) Calling init_func ../../src/movtweaks.c (ba7b30)
663: 1252.554 [JP] (50/3) Calling init_func help_menu (ba8fbc)
664: 1252.724 [JP] (50/3) Calling init_func ../../src/focus.c (ba97c0)
665: 1253.079 [JP] (50/3) Calling init_func ../../src/notify_box.c (bab220)
1381: 1791.326 < GUI Lock > GUILock_TurnOnDisplay (PUB)
1382: 1791.488 < GUI Lock > GUILockTask 1
1383: 1791.527 [DispCon] TurnOnDisplay (PUB)
1384: 1791.555 [DispCon] TFT_POWDET Low Wait
1385: 1792.743 [DispCon] TFT_POWDET Low Wait
1386: 2262.465 [CFS] Mini Info. (0x1000000e)
1387: 2262.552 [JP] (50/3) read_entire_file:910: failed
-
The my_gui_main_task seems to be working... ;)
5938: 15903.631 [MC] M:1,ID:E(1)
5939: 15903.676 [BIND] Switch (14, 1)
5940: 15903.714 [GUI_E] GUI_Control:1 0x0
5941: 15903.898 [JP] (50/3) my_gui_main_task:85: EVT 372[0]: p=1
5942: 15903.942 [JP] (50/3) my_gui_main_task:90: EVT 372 *o=0x0/0x0/0x0
5943: 15903.973 [JP] (50/3) my_gui_main_task:93: EVT 372 a=0
5944: 15935.627 [GUI] DlgPlayMain.c ROTATE_ELECTRONIC_SUB_DIAL_RIGHT
5945: 15935.719 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5946: 15935.804 [FC] _FC_GetDriveObject (1,1)
5947: 15935.884 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5948: 15935.999 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5949: 15936.053 [FC] _FC_GetDriveObject (1,1)
5950: 15936.104 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5951: 15936.160 [GUI] ChangeMultiCurrentPositionForMove hOldFile(0x51906950)
5952: 15936.213 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5953: 15936.253 [FC] _FC_GetDriveObject (1,1)
5954: 15936.297 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5955: 15936.334 [FC] _FC_GetFirstFileHandle
5956: 15936.368 [FC] ctgFileGetFirstFileHandle (1, 0, 0, 0)
5957: 15936.958 [JP] (50/3) my_gui_main_task:85: EVT 373[4]: p=0
5958: 15937.035 [JP] (50/3) my_gui_main_task:90: EVT 373 *o=0x2050000/0x7f3c2c/0x6c
5959: 15937.070 [JP] (50/3) my_gui_main_task:93: EVT 373 a=0
5960: 15968.951 [JP] (50/3) my_gui_main_task:85: EVT 374[4]: p=0
5961: 15969.028 [JP] (50/3) my_gui_main_task:90: EVT 374 *o=0x2050000/0x7f3d24/0x6c
5962: 15969.061 [JP] (50/3) my_gui_main_task:93: EVT 374 a=0
5963: 16000.466 [GUI] GUI_SetFileIndexInDrive(1)
5964: 16000.993 [JP] (50/3) my_gui_main_task:85: EVT 375[4]: p=0
5965: 16001.076 [JP] (50/3) my_gui_main_task:90: EVT 375 *o=0x2050000/0x7f3e1c/0x6c
5966: 16001.115 [JP] (50/3) my_gui_main_task:93: EVT 375 a=0
5967: 16032.895 [JP] (50/3) my_gui_main_task:85: EVT 376[4]: p=0
5968: 16032.969 [JP] (50/3) my_gui_main_task:90: EVT 376 *o=0x2050000/0x7f3f14/0x6c
5969: 16033.003 [JP] (50/3) my_gui_main_task:93: EVT 376 a=0
5970: 16064.777 [JP] (50/3) my_gui_main_task:85: EVT 377[4]: p=0
5971: 16064.855 [JP] (50/3) my_gui_main_task:90: EVT 377 *o=0x2050000/0x7f400c/0x6c
5972: 16064.890 [JP] (50/3) my_gui_main_task:93: EVT 377 a=0
5973: 16096.291 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
I think that once the problem of LCD is resolved, we can say that we have the ML running on 40D :)
Be patience, ... we still have much work ahead!
-
The my_gui_main_task seems to be working... ;)
5938: 15903.631 [MC] M:1,ID:E(1)
5939: 15903.676 [BIND] Switch (14, 1)
5940: 15903.714 [GUI_E] GUI_Control:1 0x0
5941: 15903.898 [JP] (50/3) my_gui_main_task:85: EVT 372[0]: p=1
5942: 15903.942 [JP] (50/3) my_gui_main_task:90: EVT 372 *o=0x0/0x0/0x0
5943: 15903.973 [JP] (50/3) my_gui_main_task:93: EVT 372 a=0
5944: 15935.627 [GUI] DlgPlayMain.c ROTATE_ELECTRONIC_SUB_DIAL_RIGHT
5945: 15935.719 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5946: 15935.804 [FC] _FC_GetDriveObject (1,1)
5947: 15935.884 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5948: 15935.999 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5949: 15936.053 [FC] _FC_GetDriveObject (1,1)
5950: 15936.104 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5951: 15936.160 [GUI] ChangeMultiCurrentPositionForMove hOldFile(0x51906950)
5952: 15936.213 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
5953: 15936.253 [FC] _FC_GetDriveObject (1,1)
5954: 15936.297 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
5955: 15936.334 [FC] _FC_GetFirstFileHandle
5956: 15936.368 [FC] ctgFileGetFirstFileHandle (1, 0, 0, 0)
5957: 15936.958 [JP] (50/3) my_gui_main_task:85: EVT 373[4]: p=0
5958: 15937.035 [JP] (50/3) my_gui_main_task:90: EVT 373 *o=0x2050000/0x7f3c2c/0x6c
5959: 15937.070 [JP] (50/3) my_gui_main_task:93: EVT 373 a=0
5960: 15968.951 [JP] (50/3) my_gui_main_task:85: EVT 374[4]: p=0
5961: 15969.028 [JP] (50/3) my_gui_main_task:90: EVT 374 *o=0x2050000/0x7f3d24/0x6c
5962: 15969.061 [JP] (50/3) my_gui_main_task:93: EVT 374 a=0
5963: 16000.466 [GUI] GUI_SetFileIndexInDrive(1)
5964: 16000.993 [JP] (50/3) my_gui_main_task:85: EVT 375[4]: p=0
5965: 16001.076 [JP] (50/3) my_gui_main_task:90: EVT 375 *o=0x2050000/0x7f3e1c/0x6c
5966: 16001.115 [JP] (50/3) my_gui_main_task:93: EVT 375 a=0
5967: 16032.895 [JP] (50/3) my_gui_main_task:85: EVT 376[4]: p=0
5968: 16032.969 [JP] (50/3) my_gui_main_task:90: EVT 376 *o=0x2050000/0x7f3f14/0x6c
5969: 16033.003 [JP] (50/3) my_gui_main_task:93: EVT 376 a=0
5970: 16064.777 [JP] (50/3) my_gui_main_task:85: EVT 377[4]: p=0
5971: 16064.855 [JP] (50/3) my_gui_main_task:90: EVT 377 *o=0x2050000/0x7f400c/0x6c
5972: 16064.890 [JP] (50/3) my_gui_main_task:93: EVT 377 a=0
5973: 16096.291 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
I think that once the problem of LCD is resolved, we can say that we have the ML running on 40D :)
Be patience, ... we still have much work ahead!
Good job. I am waiting.
-
Jplxpto,
First: impressive progress for your first port!
if you could publish your code (bitbucket fork?) we can better help you...
for example see missing stubs/consts
Indy
-
Jplxpto,
First: impressive progress for your first port!
if you could publish your code (bitbucket fork?) we can better help you...
for example see missing stubs/consts
Indy
Hi Indy
Will I have a great honor to also have your help.
You have given me a fantastic help. I am very grateful to you all.
My current code is all in hudson repository of ML.
For more details we can exchange some PM.
BR
-
Sounds good.
Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.
Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
I found this :
MEM(0x00007648) = 0xC0F0B008
http://www.magiclantern.fm/forum/index.php?topic=1452.msg12152#msg12152
-
I found three 40D v 1.1.1 fonts:
I used the script find_fnt.py but I changed it a bit.
...
print 'Find bitmap fonts in Canon DSLR firmwares'
print 'Arm.Indy. based on work by Pel, Trammel Hudson and A1ex\n'
off = 0
while off < len(m) and off <> -1:
off = m.find('FNT\0', off)
if off <> -1:
val = getShortLE(m, off+4)
if val==0xffd8 or val==0xffe2 or val==0xffec:
parseFont(m, off, base)
off = off + 4
...
python ../../../../find_fnt.py 40d.111.ROMF1.0xFF800000.bin 0xFF800000
Find bitmap fonts in Canon DSLR firmwares
Arm.Indy. based on work by Pel, Trammel Hudson and A1ex
0xff9ed2e4: FNT
0xff9ed2e8: (+0x04) 0xffec
0xff9ed2ea: (+0x06) font_width = 20
0xff9ed2ec: (+0x08) charmap_offset = 0x24
0xff9ed2f0: (+0x0c) charmap_size = 0x21f0
0xff9ed2f4: (+0x10) bitmap_size = 0x36858
0xff9ed2f8: (+0x14) font name = 'HCanonGothic'
0xff9ed308: (+0x24) char_codes[]. 2172 chars
0xff9ef4f8: (+0x2214) offsets[]. Last offset value = 0x367ea
0xff9f16e8: (+0x4404) bitmaps[]
0xffa27ed2: (+0x3abee) last bitmap
+0x00: bitmap width = 36
+0x02: bitmap height = 36
+0x04: char width = 36
+0x06: X offset = 0
+0x08: Y offset = 0
bitmap size = 0xb4
0xffa27f40: FNT
0xffa27f44: (+0x04) 0xffe2
0xffa27f46: (+0x06) font_width = 30
0xffa27f48: (+0x08) charmap_offset = 0x24
0xffa27f4c: (+0x0c) charmap_size = 0x170
0xffa27f50: (+0x10) bitmap_size = 0x2eb8
0xffa27f54: (+0x14) font name = 'HCanonGothic'
0xffa27f64: (+0x24) char_codes[]. 92 chars
0xffa280d4: (+0x194) offsets[]. Last offset value = 0x2e36
0xffa28244: (+0x304) bitmaps[]
0xffa2b07a: (+0x313a) last bitmap
+0x00: bitmap width = 30
+0x02: bitmap height = 30
+0x04: char width = 30
+0x06: X offset = 0
+0x08: Y offset = 0
bitmap size = 0x78
0xffa2b0fc: FNT
0xffa2b100: (+0x04) 0xffe2
0xffa2b102: (+0x06) font_width = 36
0xffa2b104: (+0x08) charmap_offset = 0x24
0xffa2b108: (+0x0c) charmap_size = 0x170
0xffa2b10c: (+0x10) bitmap_size = 0x4448
0xffa2b110: (+0x14) font name = 'HCanonGothic'
0xffa2b120: (+0x24) char_codes[]. 92 chars
0xffa2b290: (+0x194) offsets[]. Last offset value = 0x438a
0xffa2b400: (+0x304) bitmaps[]
0xffa2f78a: (+0x468e) last bitmap
+0x00: bitmap width = 36
+0x02: bitmap height = 36
+0x04: char width = 36
+0x06: X offset = 0
+0x08: Y offset = 0
bitmap size = 0xb4
-
Sounds good.
On 5Dc, ML changes the palette, so it's probably normal. Can you post some screenshots?
You can map the button codes, and once this is done, menu should be usable.
-
At least someone else is using this script ;-) maybe I should put them on bitbucket...
@jplxpto
your files on bitbucket are one week old and comments are "not tested"
- what is working/not working ?
- what are missing / working stubs and consts values ?
Indy
-
At least someone else is using this script ;-) maybe I should put them on bitbucket...
@jplxpto
your files on bitbucket are one week old and comments are "not tested"
- what is working/not working ?
- what are missing / working stubs and consts values ?
Indy
Indy, you're right files have one week ... in the last days I had little time to work on it.
I was just looking for some stubs and clarify my doubts with other forum members.
Yes I used your script and it was useful to confirm the addresses of fonts.
I have enabled the bootflags and dump the ROM dump.
Last week, me and Alex located the HD & BMP VRAM, but I still do not know the address of the LV VRAM.
I already have some ML threads running but, still could not see any menu. Is there any problem in presenting the image on the LCD.
I should have solved this, but my lack of time and knowledge has not allowed me to resolve this issue.
There is also a problem in the image display on the LCD.
The can.on menus are constantly changing color. The problem must be related to the color palette.
I already found the addresses of color palettes and some stubs used by Alex in 5DC. I did not upload but did post here.
-
Some more stubs
40D v1.1.1
NSTUB(0xFFD4F338, TryPostEvent)
NSTUB(0xFFD4F398, TryPostEvent_end)
NSTUB(0xFFD56470, TryPostStageEvent)
NSTUB(0xFFD564FC, TryPostStageEvent_end) // PendStageEvent
NSTUB(0xFFD6A1C8, get_current_task) // 0x22E00
NSTUB(0xFFD69F8C, get_task_info)
NSTUB(0xFFD6B8B0, get_active_task_list)
-
I commented out the calls to the set_ml_palette and set_ml_palette_if_dirty functions and,
now the colors are presented as they were before.
I have not created my repository to share my changes with you, but I hope to do that later this week.
After upgrading my project with the latest version of ML available,
I checked that the code does not compile.
Some more stubs are needed to 40D. I however able find what was missing.
I'm now using changeset a53eef8d1c7d.
NSTUB(0xFFD6A1C8, get_current_task) // 0x22E00
NSTUB(0xFFD69F8C, get_task_info)
NSTUB(0xFFD6B8B0, get_active_task_list)
My next step is to draw a rectangle on the screen to see if I understand what is happening with the VRAM. Later, I'll validate events. The ML is already processing some events but I have to review all the constants.
-
For drawing, use bmp_fill and bmp_draw_rect (they both have the same syntax, so rectangles drawn with those two functions should overlap).
-
jplxpto,
As long as you're a way to progress, it sounds good. That's not easy after all...
How about audio threshold (there is a script for that :-) and stubs ?
maybe I could help here...
Indy
-
For drawing, use bmp_fill and bmp_draw_rect (they both have the same syntax, so rectangles drawn with those two functions should overlap).
Thanks, I'll test it soon ...
-
jplxpto,
As long as you're a way to progress, it sounds good. That's not easy after all...
How about audio threshold (there is a script for that :-) and stubs ?
maybe I could help here...
Indy
"How about audio threshold (there is a script for that :-) " ...
I'm sorry but I did not understand what you mean.
Why tell me in audio?
-
Dear Jplxpto,
sorry I was not clear.
do you have all audio stubs ? and the address of audio threshold ?
Indy
-
"How about audio threshold (there is a script for that :-) " ...
I'm sorry but I did not understand what you mean.
Why tell me in audio?
Sorry, I also do not explained well
I think the 40D has no audio.
-
Well.. the 40D doesn't record video normally, but will do so with Magic Lantern. We already have the ingredients :)
-
Today I had a big scare. I was trying to get all the constants of the buttons and my camera blocked. Moments later I realized that it was not possible to navigate the menus of the canon. Only the icons appeared, but the items were not presented. After a few tries, remove card, remove battery, put battery, remove the lens, place the lens, changes ... so, disconnect, connect, etc, etc ... I was scared but I can resurrect my camera. After a few attempts, I managed to solve the problem because I was able to open the 'My Menu' ... (Mode C1 + Menu + SET) ... this sequence showed me the items of 'My Menu' and I registered the function that cleans the camera settigns, and I enabled this custom menu. After I accept the changes, the camera is working again normally. It seemed a miracle!!!! Huufff
I have not given up yet, I'll start having more careful ... I'll analyze the firmware to obtain the constants of a safer way. I think the code that writes the LCD acceded to an invalid memory area. I still have problems with the VRAM. Solving this problem is now a top priority.
-
There are a few other features that write to RAM (e.g. magic zoom writing on LV buffer, fast zoom in play mode altering the current zoom value, exposure override, SET+MainDial changing the image buffers). Look through consts.h to see how each thing is used - and if you are not sure about that constant, and it's used for writing, don't enable that feature.
For menu, you should start only the two menu-related tasks and some button/event handlers.
-
Hello Alex,
I think almost everything is disabled. How can I check the tasks/features are being launched?
I checked that some of the listed buttons are wrong.
I was trying to solve this problem. I just enabled the hijack of the events and removed the comment from end_gui_...
How can I force automatic presentation of the menu at system startup.
I've done some tests with bmp_fill, bmp_draw_rec, draw_palette.
Soon I will send you a picture with the palette drawn on the LCD.
Thank you
-
The source from ML repo only starts 3 tasks (debug, menu, menu_redraw) => it's OK. There are a few features that run from button handlers too (e.g. histogram in playback mode, which you showed me).
To start the menu... give_semaphore(gui_sem).
Edit: if you use the 5DC method for task hijacking (which you probably should, I don't know a better one), leave the gui_init commented (Canon code already did it).
-
Alex, thanks for your clarification. I'll see it better.
-
Finally I had a little time to create my repository ...
https://bitbucket.org/jplxpto/magic-lantern
-
Some more constants (gui.h)
#define BGMT_WHEEL_UP 0x00
#define BGMT_WHEEL_DOWN 0x01
#define BGMT_WHEEL_LEFT 0x02
#define BGMT_WHEEL_RIGHT 0x03
#define BGMT_PRESS_SET 0x04
#define BGMT_MENU 0x05
#define BGMT_INFO 0x06
#define BGMT_JUMP 0x07
#define BGMT_PLAY 0x08
#define BGMT_TRASH 0x09
#define BGMT_PICSTYLE 0x13
#define BGMT_PRESS_ZOOMIN_MAYBE 0x0a
#define BGMT_UNPRESS_ZOOMIN_MAYBE 0x0b
#define BGMT_PRESS_ZOOMOUT_MAYBE 0x0c
#define BGMT_UNPRESS_ZOOMOUT_MAYBE 0x0d
#define BGMT_PRESS_DIRECT_PRINT 0x0e
//#define BGMT_UNPRESS_DIRECT_PRINT_ 0x0f WRONG MAYBE
//~ happens anytime joy stick is unpressed from any position
#define BGMT_UNPRESS_UDLR 0x15
#define BGMT_PRESS_UP 0x16
#define BGMT_PRESS_UP_RIGHT 0x17
#define BGMT_PRESS_UP_LEFT 0x18
#define BGMT_PRESS_RIGHT 0x19
#define BGMT_PRESS_LEFT 0x1a
#define BGMT_PRESS_DOWN_RIGHT 0x1b
#define BGMT_PRESS_DOWN_LEFT 0x1c
#define BGMT_PRESS_DOWN 0x1d
#define BGMT_PRESS_CENTER 0x1e
// dummy
#define BGMT_PRESS_HALFSHUTTER 0x0b
//#define BGMT_UNPRESS_HALFSHUTTER -12345
#define BGMT_UNPRESS_SET -123456789
#define GMT_GUICMD_OPEN_SLOT_COVER 0x28
#define GMT_GUICMD_START_AS_CHECK -12345678
#define GMT_GUICMD_LOCK_OFF -12345678
#define BGMT_Q BGMT_PRESS_DIRECT_PRINT
#define BGMT_LV BGMT_JUMP
#define BTN_ZEBRAS_FOR_PLAYBACK BGMT_JUMP
#define GMT_OLC_INFO_CHANGED -12344
-
Same button codes as the 50D.
What about unpress_set though? Does the camera correct the unpress correctly?
-
Same button codes as the 50D.
What about unpress_set though? Does the camera correct the unpress correctly?
Sorry but I still do not know!
-
Hello guys,
I keep working on this project and A1ex has helped me a lot.
Now I'm trying to open the ML menu.
Again ... thanks Alex
-
Hi Guys,
I've got to see the menus of ML. But I still have some problems ... DOUBLE_BUFFERING with 1 not working.
The menus are constantly flashing. The keys work almost all.
-
Hi guys,
After a few hours of work and an excellent help from Alex,
I could finally see the menus of ML. This is a modest contribution but I'm happy.
The port of ML for 40D was not planned and I donated a few hours of my work and
dedication to one day also be a user of this wonderful sofware.
I'm still new to this project and I have a lot to learn but motivated to continue so that one day all
40D owners can also take advantage of ML.
Today, I made my first Pull Requests into hudson repository.
If you are interested can follow my development at:
https://bitbucket.org/jplxpto/magic-lantern (https://bitbucket.org/jplxpto/magic-lantern)
-
Thumbs up and thanks for the effort.
The family is getting bigger as time passes.
:)
-
Thumbs up and thanks for the effort.
The family is getting bigger as time passes.
:)
Thank you!
-
Don't click me! ;)
https://bitbucket.org/jplxpto/magic-lantern/changeset/6c64a92b94bbd81619a6b128c9e2d24d01660bd3 (https://bitbucket.org/jplxpto/magic-lantern/changeset/6c64a92b94bbd81619a6b128c9e2d24d01660bd3)
-
Your ptp_register_handler function is correct
-
Your ptp_register_handler function is correct
For me this is a good and bad news ... : (
I can't connect to the camera with --chdk switch and i don´t know why...
I see the logs of the camera again ... perhaps there is some hint
Thank you!!!
-
Created account just to state that we are more people that eagerly and happily follow your progression. ;)
-
I'm happy to know there are more people interested in this project.
I and other developers have been working on this project almost every day.
The Coutts, the Chochin the A1ex, the Nanomad and G3gg0 and Indy have helped me.
Thanks to all of them ...
-
In recent days I and G3gg0 have invested some time trying to change the boot process.
The idea is to do something similar to what has already been done for other cameras.
The G3gg0 have helped me a lot ... it also has many technical skills and is an excellent 'colleague';)
Thank you G3gg0.
-
I've done some testing in order to use PTP to transfer ML for my camera.
To perform the tests sometimes need to constantly insert and remove the card ...
I've done it dozens or hundreds of times.
I want to make this task easier and increase the life of the CF connector of my camera.
-
I want to make this task easier and increase the life of the CF connector of my camera.
It isn't easier, but have you thought about an SD to CF converter? I know they exist, but not sure how they would work with ML. http://forums.dpreview.com/forums/post/29819778 (http://forums.dpreview.com/forums/post/29819778) looks a little suspicious in terms of 40D, but that was in 2008... If it worked it would at least remove the strain on your CF connector.
-
It isn't easier, but have you thought about an SD to CF converter? I know they exist, but not sure how they would work with ML. http://forums.dpreview.com/forums/post/29819778 (http://forums.dpreview.com/forums/post/29819778) looks a little suspicious in terms of 40D, but that was in 2008... If it worked it would at least remove the strain on your CF connector.
I'll see that...
Thank you
-
n/p, you are welcome ;)
check your mail, i sent you a new version.
-
n/p, you are welcome ;)
check your mail, i sent you a new version.
Thank you G3 ...
-
More some stubs for 40d v1.1.1 :
NSTUB(0xFFD427B0, register_interrupt)
NSTUB(0xFFC8DF90, SIO3_ISR)
NSTUB(0xFFC8DEC8, MREQ_ISR)
-
Hello everybody.
I come here today to inform you that I finally able change the boot process in 40D.
Now I use the cache_hacks.
I have to thank once again the A1ex and G3gg0.
They have many skills and have helped me a lot.
If you wish you can see my changes in:
https://bitbucket.org/jplxpto/magic-lantern/changeset/af731ecd17a42f0714f0f9f4d13383ba073a604f (https://bitbucket.org/jplxpto/magic-lantern/changeset/af731ecd17a42f0714f0f9f4d13383ba073a604f)
-
you got it working? nice, good job!
-
I own a 40D, and I look forward to seeing this! I also own a Rebel T3i with Magic Lantern installed, and it works great. I'm eager to see what this port has to offer! ;D
-
you got it working? nice, good job!
Without your valuable help I would never have succeeded.
Thank you.
-
Hi
I'm just another guy who is keeping fingers crossed for this port.
I have 40D with firmware 1.0.8. (not updated yet) so if any testing on this firmware is needed you can sign me in.
-
Hi
I'm just another guy who is keeping fingers crossed for this port.
I have 40D with firmware 1.0.8. (not updated yet) so if any testing on this firmware is needed you can sign me in.
I'm working with the latest version available ... 1.1.1. I advise you to update the firmware of your camera. see page of the canon ... is simple and fast.
-
And, unless I'm mistaken, you can always roll-back to an older fw version
-
And, unless I'm mistaken, you can always roll-back to an older fw version
I already did rollback to version 1.0.8 just to create a dump :)
-
Some more progress ... now with PTP ;)
http://www.magiclantern.fm/forum/index.php?topic=1512.msg16147#msg16147
-
hi, 40D owner here :)
i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..
i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!
i hope to hear some good news soon!
Good Luck :)
-
hi, 40D owner here :)
i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..
i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!
i hope to hear some good news soon!
Good Luck :)
A donation will be a good gesture of support.
-
hi, 40D owner here :)
i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..
i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!
i hope to hear some good news soon!
Good Luck :)
Thanks for your eulogy.
My friend, everything in life has its risks. Currently, I just got this camera. If you ever want to try ML in your camera will have to take the risk. They may be very low, but there will always be a risk associated with it.
-
A donation will be a good gesture of support.
I'm perfectly in accordance with your comment.
-
Hi,
My work on this project continues. I've made some progress.
I have been trying to use the PTP and GDB in 40D.
1) With the help of g3gg0 and their fantastic cache hacks I managed to change the boot of the 40D. This may solve some legal problems.
2) I've able register the operations of ML & CHDK but this subject is not yet closed. I still have some unresolved issues.
I've done some tests but still can not debug with GDB. I'm trying the GDB Stubs created by g3gg0. This task is not a priority but soon I hope to get back to doing some tests and be successful.
3) In the last days, I spent some time with the overlays.
I'm trying to use the code developed for 5DC.
With Alex's help I managed to display some overlays in play mode.
-
Hi all,
have you considered to integrate the additional menus of the WFT-E3 and the GPS Menu? Maybe this is disturbing a little bit the ability to read out all the parameters and set the values. The screen flashing because of nulls/values missing??
I think it's the most complicated part of the menu-structure! Lots of menus where you can really get lost...
I could shoot some pics with my iPhone and mail them, if you are interested.
Kind regards
Uwe
-
@LensPainter
Hi,
I just had a chance to answer it now.
I appreciate your suggestion, but I do not know if this is possible.
I do not own any of these devices, so I never saw these menus.
I know they exist because I've seen some strings in the firmware.
I would love to see these photos. I'm waiting ... Thank you.
-
@jplxpto
Hi,
I think I need your email-address - there are 98 pictures so far...
Kind regards
Uwe
-
Thank you!
-
Hi Pedro - and your welcome - de nada (is that right?)
Hope it helps!
Kind regards
Uwe
-
Some screenshots:
(http://i.imgur.com/fSV5U.jpg)
(http://i.imgur.com/cX2od.jpg)
(http://i.imgur.com/0T3EJ.jpg)
(http://i.imgur.com/Nq8le.jpg)
(http://i.imgur.com/M0NeM.jpg)
(http://i.imgur.com/2AIC3.jpg)
-
I think, finally found a buffer of LVRAM.
I had seen the address of a memory dumps I made with the help of ptpcam.
With the help of Alex and his img.py file. I can guess the width and height of the image as well as the pitch.
I intercepted the PRINT key event and did two dumps of RAM starting at address 0x10000000 and a size of 256M.
I followed the instructions described on the following page
http://magiclantern.wikia.com/wiki/VRAM/550D
ipython
run -i img.py
a = readsampled("./VRAM_01.DAT")
b = readsampled("./VRAM_02.DAT")
d = array(a) - array(b)
d[d != 0] = 1
plot(d); show()
After reviewing the chart and repeat the test a few times, I identified the pitch.
guessed pitch = 2916
width = pitch / 2 = 1458
height = 1458 / (3/2) = 972
With the help of graphic and addresses that I found when I did a dump to address 0x1e000.
I suspected that the address 0x1dbc0064 is an address VRAM.
I subtract the address of the beginning of my dump and got the following value:
0x1dbc0064 - 0x10000000 = 0xdbc0064 = 230424676
x = 230424676
gw = 1458
gh = 972
gp = 2916
gx = x + gp * (0)
gs = gp * gh
s = readseg("./VRAM_02.DAT", gx, gs)
imgseq(s, gp)
hex(gx)
In the end I visualized the images generated and to my surprise
I finally had my picture in perfect condition (black and white).
The best picture was the 000-odd.png
MEM(0x1e020 + 0x18) = MEM(0x1E038) = 0x1dbc0064
MEM(0x1e0a0 + 0x14) = MEM(0x1E0B4) = 0x1dbc0064
<conn> w 0x1e000 512
0001e000 00000000 0013a2dc 0013a2b8 00000000 10687248 000002d0 000002d0 000000f0
0001e020 00000000 1071f0d4 000002d0 000002d0 000000f0 00000002 1dbc0064 00000798
0001e040 00000798 00000510 00000798 00000510 00000000 00000000 00000000 00000000
0001e060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e080 00000000 00000000 00484e5c 001ee400 00000001 00000f30 00000a20 00001d40
0001e0a0 00001380 00000000 00000001 00000000 00000000 1dbc0064 1e26f264 1071f0d4
0001e0c0 00000000 00484e5c 001ee400 00000000 00000000 00000f30 00000a20 000009c0
0001e0e0 00000750 00000000 00000000 00000000 00000000 000002d0 000001e0 000002d0
0001e100 00000000 00000018 000002d0 000000d8 0001dc00 00000000 00000000 00000000
0001e120 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e140 0080478c 00000000 0001db90 00000000 ff8851e4 00012d6c 00000000 00000000
0001e160 ffca415c 00000000 00000000 00000000 00000000 00000000 00000018 000002d0
0001e180 000000d8 00000000 00000000 1071f0d4 000002d0 000000f0 00000000 00000018
0001e1a0 000002d0 000000d8 00000000 00000000 00000000 00000000 00000000 00000000
0001e1c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e1e0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
-
(http://i.imgur.com/csh1y.png)
-
Wow, really great to see this progress!
Is it possible to extend highiso to 12.800?
What about AF-microadjust?
If this could be added, we could name this cam 45D ^^
-
LV buffer is the one used for LiveView display, it's extremely unlikely to have higher resolution than 720x480.
If you alter the data in the LV buffer, the changes should be visible on the display (that's how magic zoom works).
What you found seems to be a buffer used to decode the images in playback (before downsampling it for display), and probably the zoom operations are based on that buffer. It's not used in LiveView (otherwise 40D would be the first Canon dslr that can record 2K). 5Dc has one too.
Check repo.
-
Hi,
good progress Jplxpto !
maybe by enable debug on these functions we can find LVRAM addresses (offsets in firmware in the 1st column) :
4a0290 [BmpDDev] CreatePhysicalVram (PUB)
4a03b4 [BmpDDev] DeletePhysicalVram (PUB)
in 40d 1.1.1 it seems there are function to monitor the MPU=TX19A
32fa8 MonOpen
32fb0 MonClose
32fbc MonRead
32fc4 MonReadAndGetData
32fd8 MonWrite
32fe4 MonCall
32fec FA_TestMonRead
32ffc FA_TestMonCall
3300c FA_TestMonReadAndWrite
33130 m_hSemaphoreDataComp
33148 ../MpuMonitor.c
Indy
-
Wow, really great to see this progress!
Is it possible to extend highiso to 12.800?
What about AF-microadjust?
If this could be added, we could name this cam 45D ^^
Welcome to our forum.
Thank you for your nice words.
Remember, we can add great features in ML but still can not transform an old black & white TV to a color TV with a feature like HD and 3D.
For now, I just think support the features that already exist in other cameras, If I ever get that it will be a big win for me :)
When I reach that goal, I hope to have your help to test the result of my work.
BR
-
Hi,
good progress Jplxpto !
maybe by enable debug on these functions we can find LVRAM addresses (offsets in firmware in the 1st column) :
4a0290 [BmpDDev] CreatePhysicalVram (PUB)
4a03b4 [BmpDDev] DeletePhysicalVram (PUB)
in 40d 1.1.1 it seems there are function to monitor the MPU=TX19A
32fa8 MonOpen
32fb0 MonClose
32fbc MonRead
32fc4 MonReadAndGetData
32fd8 MonWrite
32fe4 MonCall
32fec FA_TestMonRead
32ffc FA_TestMonCall
3300c FA_TestMonReadAndWrite
33130 m_hSemaphoreDataComp
33148 ../MpuMonitor.c
Indy
Hi, Indy.
I hope you're well.
To be honest I had met some of these stubs 'Mon' but I did not know its purpose.
I still do not know what is in them. I no longer have to availability or knowledge to explore these stubs.
Maybe you are one of the people with the capacity to accomplish this task.
I had already looked at the [BmpDDev] CreatePhysicalVram and [BmpDDev] DeletePhysicalVram but
I did not know how to intercept the calls to these functions.
I think I saw something in your post about the 500D or 550D.
I'll follow your suggestion ...
Thank you.
NSTUB(0xFF8448B4, FA_TestMonCall)
NSTUB(0xFF8446EC, FA_TestMonReadAndWrite)
NSTUB(0xFF8445AC, FA_TestMonRead)
NSTUB(0xFF844528, MonCall)
NSTUB(0xFF844284, MonClose)
NSTUB(0xFF84425C, MonOpen)
NSTUB(0xFF844354, MonReadAndGetData)
NSTUB(0xFF8442AC, MonRead)
NSTUB(0xFF844480, MonWrite)
NSTUB(0xFFB27438, mon)
NSTUB(0xFF843024, mon_funcs_table)
grep -i mon 40d.111.ROMF1.0xFF800000.strings
ffb44014 (Called->MoveFocusLensForPcMon)
ffb44038 Err:MoveFocusLensForPcMon, Unexpected PC_MON_MF_MODE = %d
ffb44074 MoveFocusLensForPcMon LatestStep=%d
ffb46c38 Err:HaveLensError, Mounting MonitorTool
ffb47a28 Err:CalcMovingStepForPcMon, Unexpected Coeff = %d
ffb47a5c Err:CalcMovingStepForPcMon, Result step is over 2bytes
-
Here is the result of my first analysis to function BmpDDev_CreatePhysicalVram.
NSTUB(0xFFCB02B4, BmpDDev_CreatePhysicalVram);
extern int BmpDDev_CreatePhysicalVram(int *pWidth, int *pHeight, int *pPitch, int **pVRamAddress);
int width;
int height;
int pitch;
int *vRamAddress;
int result;
result = BmpDDev_CreatePhysicalVram(&width, &height, &pitch, &vRamAddres);
result is :
0 when : The parameters are all valid and was allocated a block of 0x15184 bytes
3 when :(pWidth == NULL || pHeight == NULL || pPitch == NULL || pVRamAddress == NULL)
5 when : Could not allocate memory (pVRamAddress != NULL && *pVRamAddress == NULL)
width is 0x2D0 (720)
height is 0x0F0 (240)
pitch is 0x2D0 (720)
*pRamAddress is the vram address allocated by DMA a filled with zeros.
block size = 0x15180+4 = 86404 d = 360 * 240 bytes
I think, it takes 4 bits per pixel or 2 pixels per byte...
then the resolution should be: 720 * 240
313: 608.094 [IMP] CreateVram 665
330: 684.874 [Graphics] GuiClearImage
331: 684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
332: 684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
333: 685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644
I will explore the mechanisms of debug, developed by g3gg0 and try to get the list of function parameters.
-
I think, there is another memory location (temporary?) in memory address 0x1e26f264.
0001e0a0 00001380 00000000 00000001 00000000 00000000 1dbc0064 1e26f264 1071f0d4
698: 3711.532 [GUI] StartPlayMain
699: 3718.551 [Graphics] CreateSharedBuffer !!!
700: 3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
701: 3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200
702: 3719.292 [Graphics] GuiGraphicsNormalMode (PUB)
ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264
0x1dbc0064 + 0x6af200 = 0x1e26f264
0x6af200 size (maybe)
Seems I actually found two memory locations that I had seen in the past.
ImageWorkMemory 1 & 2. They are YUV 411. W:2496, H:1872 and size: 0x6af200 (>6,68MB)
-
LV buffer is the one used for LiveView display, it's extremely unlikely to have higher resolution than 720x480.
If you alter the data in the LV buffer, the changes should be visible on the display (that's how magic zoom works).
What you found seems to be a buffer used to decode the images in playback (before downsampling it for display), and probably the zoom operations are based on that buffer. It's not used in LiveView (otherwise 40D would be the first Canon dslr that can record 2K). 5Dc has one too.
Check repo.
"otherwise 40D would be the first Canon dslr that can record 2K" ... that would be fantastic, a miracle! :)
Thank you
-
I found these stubs for testing :
NSTUB(0xFF83EE50, FA_CaptureTestImage)
NSTUB(0xFF8473B4, FA_CreateTestImage)
NSTUB(0xFF83F1C4, FA_DefectsTestImag)
NSTUB(0xFF847538, FA_DeleteTestImage)
NSTUB(0xFF840880, FA_DetectDefTestImage)
NSTUB(0xFF83FF80, FA_FA_ProjectionTestImage)
NSTUB(0xFF840060, FA_FA_ShadingTestImage)
NSTUB(0xFF84037C, FA_ObIntegTestImage)
NSTUB(0xFF840C78, FA_ShadingTestImageForLV)
NSTUB(0xFF83F084, FA_SubtractTestImage)
NSTUB(0xFF8448B4, FA_TestMonCall)
NSTUB(0xFF8446EC, FA_TestMonReadAndWrite)
NSTUB(0xFF8445AC, FA_TestMonRead)
NSTUB(0xFF84144C, FA_VProjectionTestImage)
NSTUB(0xFF845380, FA_YuvDevelopTestImage)
NSTUB(0xFF8841E4, GuiTestOneImage)
NSTUB(0xFFB64954, LVTest)
-
I checked that there are several functions that use the memory address registered in memory location
MEM(0x1e020 + 0x18) = MEM(0x1E038) = 0x1dbc0064. (SetImageWorkMemory 1)
For example, in the function IMP_PUB_DrawImageToVram the following happens:
FFCA110C : R0=0x1E038
...
FFCA1120 call IMPV_PUB_MakeHDVramFromYuv_FFCA7D48
I think that in this case the address 0x1E038 is the parameter of the function IMPV_PUB_MakeHDVramFromYuv
NSTUB(0xFFCA0EE8, IMP_PUB_DrawImageToVram)
NSTUB(0xFFCA7D48, IMPV_PUB_MakeHDVramFromYuv)
-
I think that the memory allocated by BmpDDev_CreatePhysicalVram is stored at (*0x5C00)->off_0x4.
You can see that at FF9B9510 (sub_FF9B944C).
Today, I no longer have time to test ... tests are for another day!
-
When I reach that goal, I hope to have your help to test the result of my work.
For sure :)
I can't wait to see this happen to the good old 40D!
-
Hello people...
I have good news...
As I told you before, I don't have much time to dedicate myself to this project but,
I have devoted some time to understand code and read some documentation.
I have talked to other ML developers and they have helped me a lot.
They have been fantastic ... I think we have a team motivated, united and well organized.
Yesterday I have dedicated some time to test autofocus patterns (AF POINTS)
I can now choose the focus points.
-
Thanks from an Italian fan for the job that is doing, also I possess a canon 40D is I wait for good news! ;)
-
Thanks from an Italian fan for the job that is doing, also I possess a canon 40D is I wait for good news! ;)
You're welcome!
-
40D owner here. Been eying the T4i for a while. If I could get video out of this 40D (atleast 480p) I'd be holding off getting the T4i for now.
Thanks for the time that's already been put towards this and the efort that's currently being invested.
And thanks jplxpto!
-
40D owner here. Been eying the T4i for a while. If I could get video out of this 40D (atleast 480p) I'd be holding off getting the T4i for now.
Thanks for the time that's already been put towards this and the efort that's currently being invested.
And thanks jplxpto!
The work is advancing slowly ... in the last days were made many changes to the code of ML.
I'm now trying to recover what has been working.
The g3gg0 needed to make changes to the boot process and the camera stopped doing boot.
He is helping me solve this problem.
-
I have to find STUB PtpPropSetUILock.
The Coutts used to unlock the UI when the PTP is connected. I need to do the same.
40d 111
ffb66f7c %s PtpPropSetUILock [%x][%x]
STUB(0xFFB67014, PtpPropSetUILock__maybe);
https://bitbucket.org/hudson/magic-lantern/commits/f85b386a2d61c369050edf490fa324da17794e40
-
Here is the result of my first analysis to function BmpDDev_CreatePhysicalVram.
NSTUB(0xFFCB02B4, BmpDDev_CreatePhysicalVram);
extern int BmpDDev_CreatePhysicalVram(int *pWidth, int *pHeight, int *pPitch, int **pVRamAddress);
int width;
int height;
int pitch;
int *vRamAddress;
int result;
result = BmpDDev_CreatePhysicalVram(&width, &height, &pitch, &vRamAddres);
result is :
0 when : The parameters are all valid and was allocated a block of 0x15184 bytes
3 when :(pWidth == NULL || pHeight == NULL || pPitch == NULL || pVRamAddress == NULL)
5 when : Could not allocate memory (pVRamAddress != NULL && *pVRamAddress == NULL)
width is 0x2D0 (720)
height is 0x0F0 (240)
pitch is 0x2D0 (720)
*pRamAddress is the vram address allocated by DMA a filled with zeros.
block size = 0x15180+4 = 86404 d = 360 * 240 bytes
I think, it takes 4 bits per pixel or 2 pixels per byte...
then the resolution should be: 720 * 240
313: 608.094 [IMP] CreateVram 665
330: 684.874 [Graphics] GuiClearImage
331: 684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
332: 684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
333: 685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644
I will explore the mechanisms of debug, developed by g3gg0 and try to get the list of function parameters.
I think that the memory allocated by BmpDDev_CreatePhysicalVram is stored at (*0x5C00)->off_0x4.
You can see that at FF9B9510 (sub_FF9B944C).
Today, I no longer have time to test ... tests are for another day!
MEM(0x5BF8) = 0xff9b943c
MEM(ff9b943c) = 'Vram Instance' (0x6D617256 0x736E4920 0x636E6174 0x00000065)
00005be0 aaaaaa7f bbbbbb7f cccccc7f dddddd7f eeeeee7f ffffff7f ff9b91e4 ff9b943c
00005c00 0065cae4 000002d0 000000f0 00000001 00000001 00000000 006301dc 0062ffcc
00005c20 0065cae4 00671d2c 000002d0 000001e0 00000000 00000000 007c417c 00687104
00005c40 ff9c1918 000ea508 00000007 00000001 00000000 00000000 00000000 00000000
00005c60 ff9c3540 0065bbec 0065bcb0 0065c28c 0065c424 0065c1ec 0065bf0c ff9caf40
00005c80 ff9caf50 ff9caf68 0062e8d8 00000000 ff9ed2bc ffa2f848 ffa913e4 ff9d1368
0065cae0 00000038 ff9b943c 000002d0 000002d0 000000f0 10671da4 000ea52c 00000000
0065cb00 00000000 00000000 000002d0 000000f0 0065cad8 00671d20 00015210 22f586fa
0065cb20 50bf205e 0c2f13f7 407d0aff 12fa6ff5 05f758ff 08f70afa 00df0aed 81f92c25
0065cb40 409fe0ff 00fe3dff 01bc04df 027f0d1f 84fe20fc 017db0e5 08fd08cf 22222222
MEM(0x5BFC) = 0xff9b943c ; pointer to 'Vram Instance'
MEM(0x5c00) = 0x0065cae4 ; VRAM Address (maybe)
MEM(0x5c04) = 0x000002d0 ; width (720)
MEM(0x5c08) = 0x000000f0 ; height(240)
MEM(0x5c0C) = 0x00000001 ; ???
MEM(0x5c24) = 0x00671d2c ; VRAM Address (maybe)
MEM(0x5c28) = 0x000002d0 ; width (720)
MEM(0x5c2c) = 0x000001e0 ; height(480)
MEM(0x5c3f) = 0x00000000 ; ???
MEM(0x0065cae4) = 0xff9b943c ; pointer to 'Vram Instance'
MEM(0x0065cae8) = 0x000002d0 ; width (720)
MEM(0x0065caec) = 0x000002d0 ; pitch (720)
MEM(0x0065caf0) = 0x000000f0 ; height (240)
MEM(0x0065caf4) = 0x1065cb5c ; ???
MEM(0x00671d2c) = 0xff9b943c ; pointer to 'Vram Instance'
MEM(0x00671d30) = 0x000002d1 ; width (721) ???
MEM(0x00671d34) = 0x000002d0 ; pitch (720)
MEM(0x00671d38) = 0x000000f0 ; height (240)
MEM(0x00671d3C) = 0x10671da4 ; ???
size = 0x15180 bytes ( 720 / 2 * 240 )
-
In search of lost VRAM of 40D111...
MEM(ff9b943c) = 'Vram Instance' (0x6D617256 0x736E4920 0x636E6174 0x00000065)
hexdump -C DUMP_RAM_0x0_0x100000.bin | grep "3c 94 9b ff"
00005bf0 7f ee ee ee 7f ff ff ff e4 91 9b ff 3c 94 9b ff |............<...|
000ea4e0 12 00 00 00 02 00 00 00 3c 94 9b ff 01 00 00 00 |........<.......|
000ea530 3c 94 9b ff 01 00 00 00 38 a5 0e 00 38 a5 0e 00 |<.......8...8...|
0065cae0 38 00 00 00 3c 94 9b ff d0 02 00 00 d0 02 00 00 |8...<...........|
00671d20 10 cb 65 00 58 1d 67 00 38 00 00 00 3c 94 9b ff |..e.X.g.8...<...|
MEM(0x00005BF0) = 0xFF9B943C
MEM(0x000EA4E8) = 0xFF9B943C (LV VRAM 1) maybe
MEM(0x000EA530) = 0xFF9B943C (LV VRAM 2) maybe
MEM(0x0065CAE4) = 0xFF9B943C (BMP VRAM 1) maybe
MEM(0x00671D2C) = 0xFF9B943C (BMP VRAM 2) maybe
-
I've got 2 x 40D, therefore following this development with a smile :-)
-
I've got 2 x 40D, therefore following this development with a smile :-)
Thank you!
When there is life there is hope ... do not give up.
Sometimes dreams do come true. If not I give you this, others will certainly do it!
-
I crossed the T4i off my Christmas list. Still holding on to my 40D :)
-
I crossed the T4i off my Christmas list. Still holding on to my 40D :)
Unfortunately, I've been a little tired and busy with other tasks. Soon I hope to dedicate myself more time to this port. The good news I have to give you is that in principle we have more developers to work with me on this port. We have verified that there are still very users interested in having ML this camera so, you'll spend more time. This of course depends on our available time.
-
Unfortunately I just sold my 40D! But I root for your success! Nice work.
-
Unfortunately I just sold my 40D! But I root for your success! Nice work.
Thank you and good Christmas
-
newbie developer on the block and willing to help, just had my toolchain setup and looking for a place to start :)
I have a 40D and i'm more than willing to help with the porting effort.
-
newbie developer on the block and willing to help, just had my toolchain setup and looking for a place to start :)
I have a 40D and i'm more than willing to help with the porting effort.
You are welcome to our team.
http://www.magiclantern.fm/develop
"
Become developer
Our development capacity is limited. A lot of time goes into bugfixing and working towards a stable version.
If you'd like to help, here are the steps for getting started:
Step 1. Get the source code
hg clone -r unified https://bitbucket.org/hudson/magic-lantern
Step 2. Setup the compiler
http://magiclantern.wikia.com/wiki/Build_instructions/Unified
Step 3. Start hacking
http://magiclantern.wikia.com/wiki/For_Developers
If you get stuck, ask here.
"
You can do: make clean; make 40D
There are some methods to launch ML but have not yet been published. You need to activate the bootflag.
I suggest you start with me to spend a few hours reading documentation. And I did that and still did not stop.
You can also look at the source code.
Thou shalt also read:
http://wiki.magiclantern.fm/install
http://wiki.magiclantern.fm/userguide
You should know that you can turn your camera into a brick. We take great care with the development but we are not free from danger.
We CAN NOT be responsible for something bad to happen to your camera.
Good Luck
-
@moodoki
Some more links
http://magiclantern.wikia.com/wiki/Developing_info
http://magiclantern.wikia.com/wiki/Special:AllPages
http://www.magiclantern.fm/forum/index.php?topic=3267.msg20369#msg20369
-
I found a stub with an interesting name (BugDetect).
One of two ... or Canon admits may have bugs in the firmware, or they implemented some functionality to help take pictures of wildlife :)
40d111
NSTUB(0xFFD3E2FC, BugDetect)
-
@jplxpto
thanks for all the links:)
got everything setup correctly (hopefully) and managed to build a version and have it run successfully on a borrowed 550D.
Now to get working on 40D..
-
@jplxpto
thanks for all the links:)
got everything setup correctly (hopefully) and managed to build a version and have it run successfully on a borrowed 550D.
Now to get working on 40D..
You have to check if your camera has installed the FIR version 1.1.1
Good Luck
-
Nice work jplxpto and associates! I'm so happy to see the amazing job you guys have done so far! I'll be following with great interest!! :)
-
Keep it up!
As much as I want new features on the 40d I have to admit the largest problem with taking nice shots is the head behind the camera. ::)
-
Thank you!
Our team likes to know that you value our work and support us. Your words are always welcome lovable.
I'm a little busy but I still work in this port. In recent days I devoted some time to the forum and other matters of our development team. Soon I hope to have time and can get the intervalometer working. I've invested some time in this feature.
It is with pleasure that I announce you that we have another developer in the team.The 0xAF from 400dplus.
He has already started working on the port of 5DC.
There is much in common between the 40D and 5DC.
I will work in partnership with him. He is a good developer and already has much experience in this type of projects.
I hope to soon have the collaboration of Chucho.
He helped me a lot earlier this port. I hope your life, possible to devote a little more to this project.
-
Sounds good. Now more developers will be jumping in to explore the world of 40D ML and help to make our dream come true one day. I will not be selling my 40D definitely. I may be able to get $300 for the selling of it but keeping the camera and keep coming back to this thread everyday is like waiting for the birth of my baby and it's a lot of joy and fun.
Thank you guys.
-
Sounds good. Now more developers will be jumping in to explore the world of 40D ML and help to make our dream come true one day. I will not be selling my 40D definitely. I may be able to get $300 for the selling of it but keeping the camera and keep coming back to this thread everyday is like waiting for the birth of my baby and it's a lot of joy and fun.
Thank you guys.
Hi
Thank you for your kind words.
I have the same dream and that is why I have registered in this forum.
I never thought of creating an application to run on my little princess.
I almost killed my little baby, but little by little it grows and and gaining some maturity.
I started this project by insistence.
Everyone told me that this camera has VxWorks and this made it almost impossible one day ML support this equipment.
I've always been hurt by this statement.
I thought ... why my camera need be excluded from this wonderful world that is ML.
I wanted to learn a bit more and one day be able to have ML on my camera that I decided to start learning about ML. Past few days I've registered in the forum I was admitted as a developer for this fantastic team. I'm very grateful, they all welcomed me in the best way. Until today, always helped me whenever I needed. My free time is not much but I have learned a lot. I hope one day give you this happiness. Do not worry, I'm hoping to achieve ... if not me, another member will do it for me. Keep on dreaming ... maybe one day wake up and have a surprise in our forum :)
jp
-
I was examining some stubs that allow register, search and call functions by name.
I already knew them almost all but this time I found one that sounded interesting.
Some time ago I wanted to, at runtime, get the list of all registered functions.
I intend to write code that creates in the memory card, a file (registered_stubs.S) with all stubs registered by name.
I found the stub GetListOfName which I believe to be part of the tasks necessary to accomplish this goal.
When I have an opportunity I will analyze the firmware in more detail the firmware and do some testing.
40D111
NSTUB(0xFFD45DE0, GetListOfName)
NSTUB(0xFFD3E320, call);
NSTUB(0xFFD45CB8, FindName)
NSTUB(0xFFD4ECC0, Register_Func_with_Name)
NSTUB(0xFFD3E45C, Register_Func_with_Name_sub_1)
-
As I mentioned in a previous post, I'm trying to put the intervalometer working.
I've been examining the firmware and found some strings that can help me find the STUB that take photos.
I suspect the FA_Release stub is that I need to take pictures.
Once I have the opportunity I will try.
NSTUB(0xFF84768C, FA_Release)
ff811130 FA_Release
ff83ebc8 FA_Release
ff83ebd4 FA_ClearReleaseModeForLV
ff83ebf0 FA_SetReleaseModeForLV
ff83edec [FA] FA_CaptureTestImage
ff8478fc Remote
ff847a58 this
ff847a60 ../Remote.c
ff847a6c rmtRelease
ff847a78 rmtSaveToPC
ff84c148 RssRemoteReleaseQue
ff84c15c [RSS]FAReleaseExecute:%lx,%lx,%lx
ff84c180 [RSS]rssFAReleaseEnd:%lx
ff84c19c FA_RemoteRelease
ff84c1b0 FA_FinishRemoteRelease
ffb64a38 PtpDpsRmtReleaseEventFlag
The strings rmtRelease and rmtSaveToPC should be used to make the registration by name but i still unknown where on the registration is done. Maybe a solution is to list all the functions that are registered by name at runtime. Maybe.....
-
I was examining some stubs that allow register, search and call functions by name.
In 400d most of these registered (by name) functions are only for eventproc stuff and the internal console (the shell) stuff.
Not all functions are registered there, and I believe that they wont help you.
In 400d there is a list with strings for the functions,
let's say for example "Function1, Function2, Function3, ..."
These strings are pointing to the real functions which are:
eventproc_Function1, eventproc_Function2, eventproc_Function3, ...
So finding this list with pointers, may only help you to name the real functions (if you haven't done it so far).
But if you need to call suck function, you can directly call the eventproc_Function1(), instead of call_function("Function1");
-
In 400d most of these registered (by name) functions are only for eventproc stuff and the internal console (the shell) stuff.
Not all functions are registered there, and I believe that they wont help you.
In 400d there is a list with strings for the functions,
let's say for example "Function1, Function2, Function3, ..."
These strings are pointing to the real functions which are:
eventproc_Function1, eventproc_Function2, eventproc_Function3, ...
So finding this list with pointers, may only help you to name the real functions (if you haven't done it so far).
But if you need to call suck function, you can directly call the eventproc_Function1(), instead of call_function("Function1");
Thank you
-
I used a button to call the stub FA_Release.
I could take pictures inside and outside the LV mode but it always opens and closes the shutter and this should not be proper operation for the intervalometer.
-
I used a button to call the stub FA_Release.
I could take pictures inside and outside the LV mode but it always opens and closes the shutter and this should not be proper operation for the intervalometer.
I'm not sure how it works on LV cameras, but in 400d it is always moving the mirror, even when MLU (Mirror Lock Up) is set. This is expected behavior.
Perhaps what you want to do is not calling the "Release". Which is basically the shutter button press. Perhaps you wanted to take snapshot of the LV screen, but then you wont have the resolution you need ?
-
I'm not sure how it works on LV cameras, but in 400d it is always moving the mirror, even when MLU (Mirror Lock Up) is set. This is expected behavior.
Perhaps what you want to do is not calling the "Release". Which is basically the shutter button press. Perhaps you wanted to take snapshot of the LV screen, but then you wont have the resolution you need ?
You are right. After writing this post I read a bit more and this seems to be the expected behavior.
-
I have news.
After a few days away from development ... I came back to dedicate a few hours to the 40D port.
I managed to carry one more feature. The intervalometer is already working on my 40D.
I still can not decide which will be the new feature, maybe start by getting a list of all properties (or more important).
-
Hello jplxpto ! Focus assist will be work in ML for 40D ? I need it very much !
Thank You !
-
Hello jplxpto ! Focus assist will be work in ML for 40D ? I need it very much !
Thank You !
I hope so, but first I'll have to solve some problems with overlays.
-
I'm starting to identify some necessary properties for future functionality.
I've been testing two additional features that seem to be working well:
Expo/Aperture
Expo/Shutter
I will not be already available features because they change the values of properties and can turn the camera on a brick :)
I first got to have more trust in changes.
Once I have some free time, I'll try to change the value of the ISO and the program.
I'll try to provide all the features that are on the menu Expo.
-
Here is a list with the names of the properties. Regular expressions are not my specialty. :)
grep ".*[[:space:]]PROP_" 40d.111.ROMF1.0xFF800000.bin.strings | sed -e "s|.*[[:space:]]PROP_|PROP_|g" | sed -e "s|[[:space:]].*$||g" | sed -e "s|[\:\=\[\(].*$||g" | sort | uniq > 40d111_properties.txt
cat 40d111_properties.txt
PROP_ABORT
PROP_ACCESS_REMAIN
PROP_ACTIVE_SWEEP_ACTIVATE_CONDITION
PROP_ACTIVE_SWEEP_MODE
PROP_ACTIVE_SWEEP_STATUS
PROP_AEB
PROP_AFPOINT
PROP_AUTO_POWEROFF_TIME
PROP_AUTO_ROTATE
PROP_BATTERY_CHECK
PROP_BATTERY_REPORT
PROP_BEEP
PROP_BODY_ID
PROP_BUILTIN_STROBO_SETTING
PROP_CARD1_CLUSTER_SIZE
PROP_CARD1_EXIST
PROP_CARD1_FILE_NUMBER
PROP_CARD1_FOLDER_NUMBER
PROP_CARD1_FREE_SIZE
PROP_CARD1_IMAGE_FORMAT
PROP_CARD1_IMAGE_QUALITY
PROP_CARD1_IMAGE_SIZE
PROP_CARD1_NEXT_FOLDER_NUMBER
PROP_CARD1_RECORD
PROP_CARD1_STATUS
PROP_CARD2_CLUSTER_SIZE
PROP_CARD2_EXIST
PROP_CARD2_FILE_NUMBER
PROP_CARD2_FOLDER_NUMBER
PROP_CARD2_FREE_SIZE
PROP_CARD2_NEXT_FOLDER_NUMBER
PROP_CARD2_RECORD
PROP_CARD2_STATUS
PROP_CARD3_CLUSTER_SIZE
PROP_CARD3_EXIST
PROP_CARD3_FILE_NUMBER
PROP_CARD3_FOLDER_NUMBER
PROP_CARD3_FREE_SIZE
PROP_CARD3_IMAGE_FORMAT
PROP_CARD3_IMAGE_QUALITY
PROP_CARD3_IMAGE_SIZE
PROP_CARD3_NEXT_FOLDER_NUMBER
PROP_CARD3_RECORD
PROP_CARD3_STATUS
PROP_CARD_EXTENSION
PROP_CARD_IMAGE_FORMAT
PROP_CARD_IMAGE_QUALITY
PROP_CARD_IMAGE_SIZE
PROP_CARD?_STATUS
PROP_CFN_TAB3
PROP_CFN_TAB4
PROP_COLOR_SPACE
PROP_COMP
PROP_COMPRESSION_L
PROP_COMPRESSION_M1
PROP_COMPRESSION_M2
PROP_CONNECT_TARGET
PROP_CONNECT_TARGET_WFT
PROP_CURRENT_MEDIA
PROP_CUSTOM_WB
PROP_DATA_INPUT_TRANSMISSION
PROP_DATE_DISPLAY_FORMAT
PROP_DEFAULT_OBWBREG
PROP_DIR_SUFFIX
PROP_DISPLAY_AF_POINTS
PROP_DP_DPOF_PARAM
PROP_DP_EXT_OPTION_PARAM
PROP_DP_STANDARD_PARAM
PROP_DSDEFINE
PROP_DUST_DELETE_DATA
PROP_ELECTRIC_SHUTTER_MODE
PROP_ERROR_FOR_DISPLAY
PROP_FILE_NUMBERING_MODE
PROP_FILE_PREFIX
PROP_FIRM_VERSION
PROP_FIXED_VERSION
PROP_FLAVOR_BW
PROP_FLAVOR_FAITHFUL
PROP_FLAVOR_LANDSCAPE
PROP_FLAVOR_MODE
PROP_FLAVOR_NEUTRAL
PROP_FLAVOR_PORTRAIT
PROP_FLAVOR_STANDARD
PROP_FLAVOR_USER1
PROP_FLAVOR_USER2
PROP_FLAVOR_USER3
PROP_FLAVOR_XXXX
PROP_GPS_STATUS
PROP_GUI_STATE
PROP_HDD_DCIM_PATH
PROP_HIGHLIGHT_ALERT
PROP_HISTOGRAM
PROP_ICU_AUTO_POWEROFF
PROP_ICU_UILOCK
PROP_Initialize
PROP_LANGUAGE
PROP_LAST_JOBID
PROP_LAST_JOB_STATE
PROP_LCD_BRIGHTNESS
PROP_LCD_STATE
PROP_LENS
PROP_LIVE_VIEW_GRID
PROP_LIVE_VIEW_VALID
PROP_LOGICAL_CONNECT
PROP_LOGICAL_CONNECT_WFT
PROP_LV_AF_RESULT
PROP_LV_AVAILABLE_AREA
PROP_LV_EXPOSURE_MODE
PROP_LV_HISTOGRAM
PROP_LV_OUTPUT_DEVICE
PROP_LV_SPDN_BTN_STATUS
PROP_LV_TEST_REMOTE_RELEASE
PROP_MENU_POSITION
PROP_METERING_MODE
PROP_METERING_TIMER_FOR_LV
PROP_MWB
PROP_MWB1
PROP_MYMENU_LIST
PROP_NO_CARD_RELEASE
PROP_NUMBER_OF_CONTINUOUS_MODE
PROP_PC_FLAVOR1_PARAM
PROP_PC_FLAVOR2_PARAM
PROP_PC_FLAVOR3_PARAM
PROP_PC_FREE_SIZE
PROP_PC_WB1
PROP_PC_WB2
PROP_PC_WB3
PROP_PC_WB4
PROP_PC_WB5
PROP_PERMIT_ICU_EVENT
PROP_PHOTO_STUDIO_ENABLE_ISOCOMP
PROP_PHOTO_STUDIO_ISOCOMP
PROP_PHOTO_STUDIO_MODE
PROP_PHOTO_STUDIO_MODE_CHANGE_AUTO_PASSWORD_KEY
PROP_PHOTO_STUDIO_MODE_CHANGE_MANUAL_PASSWORD
PROP_PHOTO_STUDIO_SETUP_PASSWORD
PROP_PHYSICAL_CONNECT
PROP_QUICKREVIEW
PROP_QUICKREVIEW_MODE
PROP_RED_EYE_REDUCTION
PROP_REMOTE_BULB_RELEASE_END
PROP_REMOTE_BULB_RELEASE_START
PROP_REMOTE_RELEASE
PROP_SAVE_MODE
PROP_SaveMpuDebugData
PROP_SDIO_PHYSICAL_CONNECT
PROP_SDIO_PHYSICAL_CONNECT_START
PROP_SELECTED_FILE_PREFIX
PROP_SET_TV
PROP_SHOOTING_TYPE
PROP_SHUTTER_COUNTER
PROP_SPECIAL_OPTION
PROP_STARTUP_CONDITION
PROP_STROBO_CFN
PROP_STROBO_SETTING
PROP_STROBO_WIRELESS_SETTING
PROP_TEMP_STATUS
PROP_TRANS_METHOD_WFT
PROP_TUNING_FLAG
PROP_USBDEVICE_CONNECT
PROP_USER_FILE_PREFIX
PROP_USER_FILE_PREFIX2
PROP_VIDEO_PHYSICAL_CONNECT
PROP_VIDEO_SYSTEM
PROP_WBB_BA
PROP_WBB_GM
PROP_WB_MODE
PROP_WBS_BA
PROP_WBS_GM
PROP_WFT_ADAPTERINFO
PROP_WFT_CAPTION
PROP_WFT_DELIMITER_STATUS
PROP_WFT_DONGLE
PROP_WFT_FTP
PROP_WFT_HOSTINFO
PROP_WFT_HTTP
PROP_WFT_IMAGE_TRANS
PROP_WFT_LOCK
PROP_WFT_SYSTEM
PROP_WFT_TCPIP
PROP_WFT_TRANSMISSION
PROP_WFT_WIRED
PROP_WFT_WIRELESS
PROP_WIZARD_WFT
I think it is not missing any. If you detect any problems let me know. Thank you.
-
I think that 40D only allows MF on LV mode. What is the purpose of this property? ...
PROP_LV_AF_RESULT
-
I think that 40D only allows MF on LV mode. What is the purpose of this property? ...
PROP_LV_AF_RESULT
Hi guys, glad to see an active develop thread on the 40D.
My 2 cents: 40D can indeed autofocus in LV, via C. Fn. III-6. Please check http://photography-on-the.net/forum/showthread.php?t=428535, so PROP_LV_AF_RESULT is probably related to it.
Regards
-
Hi Thank you for registering at our forum. You are welcome to this community.
I appreciate your link. I learn a little more. Glad to hear that works with a 40D.
I hope one day to enhance your camera.
BR
-
I'm sure you will.
Thank you very much!
-
waiting waiting waiting :)
Just tried ML on a friend's 400d and now waiting aggressively for 40d version.......JPL really nice work and dedication.......
-
waiting waiting waiting :)
Just tried ML on a friend's 400d and now waiting aggressively for 40d version.......JPL really nice work and dedication.......
There's no ML for the 400D. It's a different project altogether called 400plus. We do share some code and ideas though
-
Thanks ......I thought it was ML. 400plus is a good project. I am waiting for 40d ML. It good to see you people working on this project
-
News??? :)
-
Is there any progress? Any idea (days or months) when we will be able to run ML on our 40d? Please! Do something we are waiting waiting waiting.
-
Is there any progress? Any idea (days or months) when we will be able to run ML on our 40d? Please! Do something we are waiting waiting waiting.
I can't answer that question.
I work on this project whenever I have time and disposition.
I'm busy finishing a project and I have many issues to deal with in my life.
I hope soon to be able to continue with this port.
I started making the discovery of most properties.
Many of them are critical to continue the port but this task takes a long time.
In recent days I have devoted some time to the 650D.
I have a camera with me and I'll start doing some tests with ML.
-
JPLXPTO........i am a big fan of your work. It was you who started working on this port. I am hopeful you will make 40d ML very soon.
-
Thank you!
-
I just wanted to say I remember sitting in the earlier days of ML, hoping a 40D patch would come, then hearing not, and I don't know how I missed this thread...
Anway, just going to give some moral support, and when I get a little time see if I can assist further (I do own a 40D, and am happy to help where I can).
PS I am really impressed by the work of the developers and the talented people using ML.
-
Took time following the fantastic work they are doing you, and just wanted to congratulate you for it.
I also give my moral support to this project, because as j-Veitch said I too have been waiting for the arrival of the patch to the 40D.
I think we all know how hard it must be to create this, and I also believe strongly that the EOS 40D ML deserves.
I hope to be helpful at some point and I apologize for my bad English.
A greeting.
-
news???
-
I have just registered just to post here and give you a thumbs up.
Great effort, I have been long waiting for somebody to port ML to my 40D.
It would be great to be able to record video and many of the ML features in photography, like focus peaking, advance bracketing, focus bracketing, etc.
I am seeking for any news about it.
Please keep trying and thanks for your efforts.
I will pay for the firmware as soon as there is an early versión.
-
I have just registered just to post here and give you a thumbs up.
Great effort, I have been long waiting for somebody to port ML to my 40D.
It would be great to be able to record video and many of the ML features in photography, like focus peaking, advance bracketing, focus bracketing, etc.
I am seeking for any news about it.
Please keep trying and thanks for your efforts.
I will pay for the firmware as soon as there is an early versión.
I am afraid you will be disappointed. Come back in six months and see if I am wrong.
-
Well, firmware is new to me. And I am reading what I can in the time I have. i did get round to dl'ing the ubuntu vm... And one o the devs at my work has at least used vxworks amd arm in the past. But, really not sure where to go from here. Anyway, i haven't given up hope yet.
-
I have several Eos cameras, however the 40D has the best sharpness per pixel performance. Just look at DP preview's review of 50D and how it compared to the 40D 10mp sensor. So if someone are able to fix ML for the 40D, it think it will be one of the sharpest video enabled DSLR.
-
I will also pay something if I get HD video properties to 40D! Would be great to utilize the old camera!!
-
We all are desperately waiting for 40d Magiclantern version. But I think 40d is not on priority list of ML.
Please! I request that If 40d port is possible than keep this thread alive in other case close this thread and say 40d port is not possible due to all new camera portings. It will close the case forever. I am not disappointed or emotional but I am trying to convey feelings of several 40d users who are anxiously waiting for 40d version. But there is no development priority for this.
-
The dveloper does not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.
Of course this is not probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.
-
I'M LIVE :)
Sorry ... I have spent many days with health problems and hard work.
My life has been a bit complicated but I hope to get back to work on this project a few days from now.
I'll need to read some posts. I am now a bit outdated.
I think the developers have done an excellent job.
I promise appear shortly.
BR
-
The dveloper does not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.
Of course this is not probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.
YES!!! You are right! Thank you for your kindness.
You may not believe but I finally went and uncle have not photographed the child with a DSLR. :(
I love to shoot a little of everything but children are at the top of my list. And now I have a new reason to shoot.
BR
-
The dveloper does not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.
Of course this is not probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.
I still have some outstanding issues to resolve but I will endeavor to return soon.
-
I have several eos cameras, the 40D however produses very sharp and clean images for it's size (10Mp). Take a look at DP's (Digital preview) review of the 50D where the older 40D at delivered the same image quality as the 50D when magnefied, even if the 50D has a 15.1 Mp sensor.
I think a Magic Lantern converted 40D camera would be one of the best and sharpest film cameras, and to a fair price. ;)
-
YES!!! You are right! Thank you for your kindness.
You may not believe but I finally went and uncle have not photographed the child with a DSLR. :(
I love to shoot a little of everything but children are at the top of my list. And now I have a new reason to shoot.
BR
Well come back and many thanks for your efforts. Glad to hear from you.
Hope your personal troubles and your health issues have been solved.
Programming is a very time consuming task, and this kind of programming Is even more demanding.
Hope you find the time to complete the task, but even if you cannot complete it, we should be gratefully for your efforts and time.
I come often to the thread to read about the progress. I would like to test ml in my 40d and test video in a DSLR.
May be in the near future, when the price lowers more, I will buy a 7d as my video camera is dead, but I am not sure that a DSLR is an alternative to a consumer video camera.
Anyway there are many interesting g things in ml for photography too.
-
jplxpto，I found some information for you
1.http://valexvir.narod.ru/ -----from Russian，for 40D, 50D, 5D Mark II и 1Ds Mark III - record video 1024x680 with a pc.
2.DIGIC III - (VxWorks OS) from CHDK http://chdk.wikia.com/wiki/For_Developers
3.one chinese cracked the firmware of 40D，found out the “factory menu”；ISO 50-6400；AF CK;but he stoped （write text.bin），
http://bbs.fengniao.com/forum/1397306_8.html
http://bbs.fengniao.com/forum/1397306_9.html
-
jplxpto，I found some information for you
1.http://valexvir.narod.ru/ -----from Russian，for 40D, 50D, 5D Mark II и 1Ds Mark III - record video 1024x680 with a pc.
2.DIGIC III - (VxWorks OS) from CHDK http://chdk.wikia.com/wiki/For_Developers
3.one chinese cracked the firmware of 40D，found out the “factory menu”；ISO 50-6400；AF CK;but he stoped （write text.bin），
Thank you!
-
My dear friends,
Finally, I got some time to update my repositories and make the necessary changes to make the build of ML for 40D.
My next task will be to fix the menus.
Many changes were made to the menu system and now some things are not well presented. For example, icons appear with double the size.
I think, users of 5DC will have the same problem.
I made small fixes that should have an impact on 5DC but I do not have this camera for testing.
https://bitbucket.org/hudson/magic-lantern/pull-request/71/some-change-to-build-ml-for-vxworks/diff
-
Just want to say, thanks for all your efforts so far. I just never seem to have the time to look further myself... It is quite a learning curve for me.
-
Some screenshots:
http://i.imgur.com/qfFlm6w.jpg
http://i.imgur.com/cqslQ9x.jpg
http://i.imgur.com/eRVDcgb.jpg
http://i.imgur.com/X0YpUVX.jpg
-
This are great news ;D
-
Great to see progress.
I really would like to help, so if some alpha-testing is necessary ^^
Do you already have an idea if a iso expansion would work?
-
It does already, use Lightroom.
;)
-
Thats the standard answer ;)
But it's a bit easier and better to handle to select a iso value instead of underexposure.
It's just the standard workflow with the cam - for me ;)
-
Created an account to show support for this project. I'll also throw my camera up for grabs for testing if needed.
-
Hello! I have created account too, just to show my support. I already follow this thread unregistered, from the its begining and just because of maybe incoming Magic Lantern for 40D, I still keep my three 40D's.
Many many thanks to the developers of Magic Lantern! When I watch what you guys do, it seems to my like a rocket science. Really unbeliveable...
If you successfuly finish this project, you will receive a donation from me, for your big success.
Big thanks in advance and I will stay tuned to the new happening.... :)
-
Thank you!
-
I too have created account, to congratulate you all, for trying. My 40D is wainting to test ML.
-
I did the same thing as anyone else :) i made an account just to say good work and keep it going! i would love to make my 40d take short clips but i have one thing to ask, would it be hard to add the timelaps feature in the 40d magic lantern? becouse i would loe to take some timelaps without the 200$+ remote :o
Keep doing your awesome work 8)
-
:) will we be able to film video on 40D?) cool
-
Great, I see that you are now back in the developement and makin progress.
Thank you for your work and time.
-
I love my 40D - its a great camera and it does a great job!
If ML is going to hit it, it would be a big rebirth for the cam.
I am thankful to all of the developers for their personal effort in ML as a whole and jplxpto in special for his work on the 40D.
It's an "old" camera, so it is not a matter of course that someone takes over such a hard and long work for it. So: thumbs up for you jpl and never forget: don't mind how many people are asking for features/dates/whatever: there are more important things in life.
-
> there are more important things in life.
Such as?!
No, seriously. While I go to this page almost every day in the hope of some progress, I realize that ML is not a make or break for me becoming a better photographer. And, sadly enough, neither is getting new lenses... But the geek in me would love to test out new features on the 40D any day, so I keep coming back. Keep it up jplxto, really appreciated!
-
At this point, anyone with a 40D and some C skills can grab the source code and improve it. So... what are you waiting for? ;)
-
Alex is right about it.
But is there an easier way to do it for the majority who may not know how to do with the source codes. Is there a simplified version with only a few functions e.g. intervalometer, auto WB control etc. to start with. I think most 40D owners will agree to pay to finance the development.
Any thoughts from the supporters of this thread.
-
Compiling the current source code will give you that version to get started. The menu works, but other than that I have no idea what else works.
Maybe jplxpto can publish the devkit (the FIR for enabling the bootflag and dumping the firmware)?
-
How much it cost the developing of a working firmware?
-
Hundreds of man-hours.
-
I bought a second 40D (i have another 40D from before) that i intend to reserve for use with and furure realease of ML.
-
Hello all!
Tell me please, where I can download current source code?
Is there AF microadjustment function? I need only this one.
Or maybe I can adjust AF without ML?
Thank you for this job!
And sorry for my english, I'm from Russia :)
-
@ jplxpto , coutts.
Thanks guys for all your efforts and hard work. :)
If finally we get a ML download for 40D, do we get a ML for 450D as well?
-
No, but it will be easier to port, if anyone is interested in doing that.
-
Is there AF microadjustment function?
Нету в ML микроаджустмента, такчто даже не надейтесь.
Or maybe I can adjust AF without ML?
У 40д нет такой фичи, так что только нести объектив в сервис.
I'm from Russia :)
Ничего, бывает =)
-
I have 40D and would like to give it a try with Magic Lantern. I have a background with CHDK but never thought about ML until now. If anyone has a dumped 1.1.1 please PM me.
-
Consider to switch to 50D/550D and install ML to play with. The price drop of the 40D since last year was a significant amount(from $350 to $250 on the Craigslist in Canada) and so are the other two mentioned here. 40D is good but the other two are equally good in some other aspects.
Anyway, don't waste time waiting, just go out and click, click and click.
-
No, but it will be easier to port, if anyone is interested in doing that.
Thanks for the reply. I hope this happens. :)
-
It's not really that hard - if you have enough time, motivation, some basic programming skills and the desire to learn, you can do it. It's quite similar to programming embedded devices or microcontrollers.
See also:
http://chdk.wikia.com/wiki/FAQ#Q._My_camera_isn.27t_ported_yet._Is_a_port_planned.C2.A0.3F_When_will_it_be_ready.C2.A0.3F_How_can_I_help.C2.A0.3F
-
news???
-
news? oh you are wanting a personal update just for you, gotcha, sorry carry on......
-
http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster (http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster)
Wow......will this happen on 40D ?
-
http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster (http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster)
Wow......will this happen on 40D ?
I found the required function stubs for it, so in theory it should work if somebody is still working on this port ;)
-
Too bad that the developer seems to have abandoned ship, so we may never know... :-\
Then again, this is all voluntary work, and messy stuff, so I can understand it if he suddenly decided it wasn't worth the effort... I unfortunately completely lacks the skill to finish off what he started.
-
I have 5DmII but I would like to try ML on my 40D its any progress there? :)
+ I could help you with testing etc
-
this topic caught my attention as well. If I had the skills I certainly would help, I did a little of coding in my past years but I can't imagine how hard it is to achieve a firmware modification on a camera. there are certain things that an older camera like the 40D would benfefit from, like the software is really old (auto-iso etc.) but the images are still awesome (I do prefer sometimes the 10MP sensor over smaller pixels) so, what canon wants us to do: buy a newer tool. with software so complicated to adjust on cameras its really a smart step of camera manufactures to keep them at dinousaur stage.
well, I assume you all agree, what I wanted to say: If there is a way I can help, I'll invest a lot of my free time (which I got like a month for this summer) If there is enough information available that someone like me could possibly read into that field of work.
best regards
-
I was following this thread when it was active, but I think the 50D development has been prioritized for the moment.
I've got a 40D, so I would certainly help with testing builds, but like others I have limited programming experience.
-
yea 40D is really good camera.. (I used 50d and I dont like it 40 was better) I like this camera cause this cam is very good in sharp and its really fast in focus (im still using it for rally etc)
-
I'M LIVE :)
Sorry ... I have spent many days with health problems and hard work.
My life has been a bit complicated but I hope to get back to work on this project a few days from now.
I'll need to read some posts. I am now a bit outdated.
I think the developers have done an excellent job.
I promise appear shortly.
BR
Hope things have bettered up for you 'jplxpto'. Thanks so much for the dedication you have put into the development of ML for us 40D users. (Of course gratitude goes out to Alex and all the other developers also).
I heard about ML only last night from my wife's boss who uses it on the 5D MkII. He does commercials and all that stuff with it. He's very excited about it and trust me, I can see why.
It would be a real joy to be able to shoot video on my trusty 40D. I just cant wait.
Thanks for the great work guys. I'll surely be one of the first to download ML for the 40D.
-
Hello guys ... sorry ... I've been very busy with work ...and also some health problems.
I've been completely absent during the last months ...
I hope to soon be able to return to work for this magnificent community
and of course I'll come to invest some time in the port of 40D.
Best regards
-
that is awesome news jplxpto, I am new to the community and although I am fortunate enough to have ML for 6D I have been hoping to see the 40D with some ML 'goodness' :D
very encouraging!!
-
Good to hear from jplxpto after long long time. You are only person working on this port and all our eyes are on you.....May God bless you with health and you can work on this port.
Can you please tell us how much more work would be required to complete this port. Last time I think you were working with menus. hope to hear good news from you and we all pray from your health......amen
-
Good to hear from jplxpto after long long time. You are only person working on this port and all our eyes are on you.....May God bless you with health and you can work on this port.
Can you please tell us how much more work would be required to complete this port. Last time I think you were working with menus. hope to hear good news from you and we all pray from your health......amen
Hi,
This week I've been reading about the latest news.
I updated the source code to the 40D but the project did not compile ...
I've started to make some changes but still could not test anything.
The menus have worked in 40D.
Before getting out of the project, I was making the discovery of the main properties.
The selection of the focus points have worked correctly.
I also able to change the aperture and shutter speed.
Some overlays also have work in play mode.
I still can not display the overlays in live view mode.
I still could not find the addresses of HDVRAM. I hope to do that soon.
-
I hope your health problems are not serious.
It's nice to see you are back to work with us!
-
I hope your health problems are not serious.
It's nice to see you are back to work with us!
I'm fine... Thank you...
BR
-
Goodluck........ :D
-
Well come back.
Glad to hear you aee ok and tour health problemas are gone.
Great to ser you are back to the project toó.
As soon as you have a operational alpha versión i will try it in my camera.
-
After a few months away. ML works again on my 40D.
I hope soon to have time to fix the loading of modules.
At this time no module is loaded.
I also saw that there are some problems in the menus.
The fonts seem to me unclear.
-
Well come back.
Glad to hear you aee ok and tour health problemas are gone.
Great to ser you are back to the project toó.
As soon as you have a operational alpha versión i will try it in my camera.
Thanks for everything but there is still much work to be done.
-
if you could add iso 12800 - i would donate some cash for your work :)
-
if you could add iso 12800 - i would donate some cash for your work :)
I apologize to disappoint you, but all systems have their physical limits (hardware) and the software does not perform miracles ...
I do not think that's possible.
If I could do that, probably the noise would be so high that no one would want to use.
Still ... this fantastic community needs help to survive.
There are some very active members who deserve to be properly rewarded, even if it's with new equipment, ... new challenges, ...
and recognition of their work ... some of them work hard for this project ... day after day ...
Briefly, a help is always welcome :)
BR
-
Hello jplxpto, I can and wish to help if you just give me a few step-by-steps how to.
What do I need of the equipment to start working and helping in this project?
-
JPL........its good you are back on track. I know port will take time to complete and also it needs your spare time and good health. We are waiting and wish you goodluck.
-
Is there currently a more "modern" version of the firmware extract/build instructions to create a FIR file for the 40D than the one located here : http://www.magiclantern.fm/forum/index.php?topic=1452.msg3856#msg3856 ?
Some of the tools listed in that don't exist in the repository anymore, so I'm getting the distinct impression that the build process has changed slightly.
Thanks!
-
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.
https://bitbucket.org/rufustfirefly/magic-lantern/downloads
-
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.
https://bitbucket.org/rufustfirefly/magic-lantern/downloads
http://www.magiclantern.fm/forum/index.php?topic=7955.new#new (http://www.magiclantern.fm/forum/index.php?topic=7955.new#new)
-
JPL any update???????
-
I've got a 40D body laying around -- I'd be perfectly willing to dump the firmware, search for function calls, etc; I just have little to no expertise in doing any of that, and the Magic Lantern wiki seems perilously out of date. Could anyone point me to a somewhat more up to date walkthrough of either a) using the extracted firmware components to analyse or b) dumping active ROM to do the same -- and any postings, articles, or pages about digging for the locations of specific calls?
I know it seems like a tall order, but I'd love to help if anyone can point me in the right direction. I'm using a Linux machine, but I have a Windows VM handy (as well as a copy of WINE) if it's needed.
-
I've got a 40D body laying around -- I'd be perfectly willing to dump the firmware, search for function calls, etc; I just have little to no expertise in doing any of that, and the Magic Lantern wiki seems perilously out of date. Could anyone point me to a somewhat more up to date walkthrough of either a) using the extracted firmware components to analyse or b) dumping active ROM to do the same -- and any postings, articles, or pages about digging for the locations of specific calls?
I know it seems like a tall order, but I'd love to help if anyone can point me in the right direction. I'm using a Linux machine, but I have a Windows VM handy (as well as a copy of WINE) if it's needed.
rufustfirefly. I am not a developer but if you read this thread from start you will get lots of information. JPL, Nanomad and alex had in detail discussions related to development and 40d porting.
-
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.
https://bitbucket.org/rufustfirefly/magic-lantern/downloads
loading that 40d00111-ML.2013-08-30-007bb9a0574d.fir with the files from ML-40D.2013-08-30.53fbc6b53da5.zip on the card
doesnt work, only the upper display is on, battery has to be taken out...
how shall it work?
-
loading that 40d00111-ML.2013-08-30-007bb9a0574d.fir with the files from ML-40D.2013-08-30.53fbc6b53da5.zip on the card
doesnt work, only the upper display is on, battery has to be taken out...
how shall it work?
I'm having some issues getting development rolling on the 40D, primarily because I've been unable to extract an unencrypted version of the 1.1.1 firmware (as I had mentioned earlier in the thread). This has left me unable to find the rest of the function locations, so getting this port working, at least at the 1.1.1 firmware revision, isn't going to happen -- pending being able to get an unencrypted copy of the firmware to work with.
Alternately, I can try to move to using 1.0.5 or 1.0.8, which have both had their encryption keys reverse engineered. I hate backing out versions of firmware, but if it's the only way I can proceed, I may go that way.
-
News???
-
I have built a set of dumpers, which should dump out the active firmware. If someone wants to try to load one or the other up on their 40D running v1.1.1, we should be able to get an unencrypted dump of the firmware.
It's all based off of the previous 1.0.5 and 1.0.8 work, so mileage may vary.
https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D1.fir (https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D1.fir)
https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D2.fir (https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D2.fir)
There's a disclaimer that this could do something awful -- but one of them should just dump a file to your card (after a flurry of activity).
If anyone wants to check my work, it's all on bitbucket:
https://bitbucket.org/rufustfirefly/40d108-dumper (https://bitbucket.org/rufustfirefly/40d108-dumper)
-
rufustfirefly can you please add a little tutorial as how can I added it to 40d and CF card. sorry but I am totally new to these firmwares stuff.
-
rufustfirefly can you please add a little tutorial as how can I added it to 40d and CF card. sorry but I am totally new to these firmwares stuff.
The trick is to dump the .FIR file onto your CF card (presumably using a CF card reader), then use the "Update Firmware" menu option to attempt to sideload the dumper code. It won't actually upgrade your firmware, but rather attempt to run the custom code which should, in theory, spin the CF card for a bit and dump out a file containing the loaded firmware.
It could also do bad things, which it shouldn't do. If, for some reason, it locks up completely and hasn't done anything within 30 seconds or so, you might want to pull the battery.
-
On a 1.1.1 40D with full battery :
After a few seconds of "loading firmware update"
- 108D1.fir : White on yellow "Update file error. Please check the memory card and reload the battery and try again."
- 108D2.fir : White on yellow "Update file error. Please check the memory card and reload the battery and try again."
Both needed a battery remove, and the 40D still works fine after that.
40d00111-ML.2013-08-30-007bb9a0574d.fir : screen turns black, DSLR works apart from the fact that it doesn't recognize the CF carf anymore. Needed a battery remove to restore proper function.
-
40d00111-ML.2013-08-30-007bb9a0574d.fir : screen turns black, DSLR works apart from the fact that it doesn't recognize the CF carf anymore. Needed a battery remove to restore proper function.
I see more or less the same (also with 1.1.1) - except the camera won't capture, but focus works...
/Anders
-
Yes sorry, I didn't try to capture, maybe it didn't work, maybe it did. But without the CF card recognised, my only urge was a full reset ;D
-
hi,
rufustfirefly is there any update on 40d ML version you are working ????
-
jplxpto & rufustfirefly any latest update on 40d port? have not heard from you guys for a long time.
-
...and here's another guy willing to contribute work that
might even brick his camera for the sake of getting a
running 40d port. So, if there's anything I could
possibly do, let me know!
-
Hi everyone,
What is the current status? Do we have a forked development of the 40D ML or rufustfirefly progressing on his own? I am very confused.
Guys whatever the case is thank you so much! Let us hope for the best. ;D
I've just installed his build - and it has a few features... Now I know we are talking about quite an old body. Indeed since 2007 way too many things have developed. And yet could some more features
be expected?
-
Can you please tell me what features are supported in this firmware. I just need HDR and timelapse feature. is it there?
-
Anyone have an update on ML for the 40D? I've read this thread start to finish and looked all over without a clear answer. The ML website claims it's compatible with the 40D but I can't get it to work. Any help or guidance is much appreciated thanks to all for the hard work and time given to make this possible.
-
Anyone have an update on ML for the 40D? I've read this thread start to finish and looked all over without a clear answer. The ML website claims it's compatible with the 40D but I can't get it to work. Any help or guidance is much appreciated thanks to all for the hard work and time given to make this possible.
I also thought so and even told other people as such, but then I was told here that 40d is not working at all and this most likely won't change :-\ ... it's not even digic4 so copy/pasting code most likely won't work.
-
I also thought so and even told other people as such, but then I was told here that 40d is not working at all and this most likely won't change :-\ ... it's not even digic4 so copy/pasting code most likely won't work.
I'll just stick to my T2i for now, though I love the feel of my 40D over my T2i which is why I would love to get ML working on it.
-
If anyone's still watching this, here's where I'm at:
I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:
https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)
Thanks!
-
If anyone's still watching this, here's where I'm at:
I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:
https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)
Thanks!
wow, god job bro
-
If anyone's still watching this, here's where I'm at:
I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:
https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)
Thanks!
Just joined, and have a 40D. Noted that 40D is listed on the home page as "supported" but based on what I'm seeing, that's perhaps a bit misleading...
However, I do have code experience with the msp430 microcontrollers, and from what I'm seeing, there would be a learning curve with the controller for the 40D, but hopefully not insurmountable. I guess time will tell.
Aside from this extensive thread, are there any other resources regarding design of the app??? Or is it just "read the code?"
Thanks!
bob
-
Aside from this extensive thread, are there any other resources regarding design of the app??? Or is it just "read the code?"
I've found it to be a bit sprawling, but there is a lot of information buried on the wiki http://magiclantern.wikia.com/wiki/Magic_Lantern_Firmware_Wiki (http://magiclantern.wikia.com/wiki/Magic_Lantern_Firmware_Wiki)
-
chris_overseas
Thanks! Looks like a great starting point, and a whole lot of homework... So it goes. :)
bob
-
> Thanks! Looks like a great starting point, and a whole lot of homework... So it goes. :)
For what it is worth, we are several people who still follow this thread closely! We wish you good luck, should you except the challenge.
-
I am following and waiting for this port for long time :D
Today I thought I must remove 40d ML updates from my RSS feeds. But NurseBob I hope you can make it a reality for lot of Magic lantern users.
I am not a developer but this whole 40d thread contains lots of information sharing by some developers and Magic lantern team lead.
Goodluck
-
i just want to say that i would be so freakin' happy if you could make it possible to use a 40d as a video camera.
thank you very much for all the work here!
-
i just want to say that i would be so freakin' happy if you could make it possible to use a 40d as a video camera.
thank you very much for all the work here!
I've seen some videos on YouTube that show video recording on a 40D already. I'm going to google it now.
-
hi
im donating some micro bitcoins to someone who can finally make the 40d capture video at, preferably, 24fps with 720p resolution, ideally
who's with me? ive got a 40d lying around here, clean and dust free.. by the way, good job on that rufustfirefly!
-
I've seen some videos on YouTube that show video recording on a 40D already. I'm going to google it now.
It is possible to shoot video today, but through a connected computer.
See http://sourceforge.net/projects/eos-movrec/
-
First - thanks to those who have contributed to ML, it is an awesome tool.
I have 7D with it running, but my 40D seams to be collecting dust, because some of the tasks I would use it for would benefit form ML. like built in intervalometer, bulb timer, bulb ramping or even better - automatic ettr with deflicker. I wish i could help, even tough I have written some code in in various languages, including even low level assambler for atmel avr micro controllers, newer got a good grasp of C, somewhat it always have made me lose interest in it. now I bite my fingers, should have learned it.
I really hope that some day, before the 40D dies we would see ML in it. IMHO video functions, even tough cool, are not for the humble 40D, there are cameras much better for this. Photography would benefit greatly form ML tough.
-
Hello friends!
I did not understand where I can download the modified firmware for my Canon 40D ... can you help?
-
it is still in development.
-
Any updates? Also waiting for this firmware update... goodluck guys
-
everyone is really anticipating this great hack/tool for a great camera 40D :)
I am waiting too! :)
-
Don't pray, code!
Also, these days you can emulate ML code in QEMU (http://www.magiclantern.fm/forum/index.php?topic=2864.msg117430#msg117430) and you have two early ports in progress. No more excuses ;)
-
Any update? :)
-
No volunteer for a DIGIC 3 based system.... Come one. Where is the chalenge these days?
-
What need help? I have 40d camera.
-
great, it seems to work anyway. :)
-
seams to work what?
-
What is working? Where???
Ok. What do you need? Voulontier? here i am. Shoot. :)
-
Any updates? I just heard about Magic Lantern and wanted to try it on my 40D, was dissappointed to see that the latest release doesn't support it.
-
Hi all,
Can somebody clarify about 40D?
On main page it is written
Supported Cameras:
5Dc, 5D2, 5D3, 6D, 7D, 40D, 50D, 60D, 500D (T1i), 550D (T2i), 600D (T3i), 650D (T4i), 700D (T5i), 1100D (T3), EOS M, 100D (SL1)
On download page http://www.magiclantern.fm/downloads.html is written that only these camera are supported
5D Mark ii 2.1.2
50D 1.0.9
60D 1.1.1
500D 1.1.1
550D 1.0.9
600D 1.0.2
and finally here http://www.magiclantern.fm/features.html is written that for 40D only beta version with Core ML features exists.
I completely do not understand will it work or not? and if beta exists where can I download this beta and try?
-
Is somebody working on the 40D ML right now? I know it is hard to say, but when we could expect some update or even first working version. (Video recording feature will be great!)
Thank you, for any responses. ;)
-
I too hope that you get ML working on the 40D I would love to do time lapse with mine and as for video....well ;)
Daf
-
i think that we will never get 40d i wanted to know programming to do it.. but idk :/ :(
-
40D is not going to have video, it has not that much cpu power, nor hardware for that, in 50D case the feature (h264 encoding) was there, just not enabled. Other thing is that 40D is VxWorks so that is different platform at all.
for time lapses tough 40D is grate, I own one, and I would like to have histograms, intervalometer, bulb timer, dual iso there - but it seams that those few capable of doing this are not owning a 40D, so thus no progress. Sadly CHSDK says that 40D is to pro for them. so we are stuck in between.
-
It can, both MJPEG and RAW. Read the thread ;)
(whether somebody will implement it or not, that's another story, but the proof of concept was done)
-
I ment the h264 one, mjpeg would be possible for any camera that shoots jpg, right. as for raw, Have anybody done tests on max card speed in this camera? Otherwise the 40D would be a good choice because of considerably smaller pixel count, thus when skipping lines, less moire. I really wish that I would had time to learn C, and could work on this port...
-
Has anyone done a dump of the ROM?
-
But a1ex unfortunately most of us on this 40d post are not developers. We are waiting for someone who can do this favour to us. Can you please do us a favour and do something for all people like us who are waiting for this port.
-
any update on the port
i realy like the ML on 500D and want to have on 40d
-
I would like to use my 40d as timelapse camera, so if there is a version that enables the main features for timelapse would be great!
-
I think vxworks is really very difficult task to do since no one has yet been able to create a workable solution for the 40D.
I am buying another 40D again today (since it is the cheapest decent camera I could find) after I sold that last one (due to money problems) and I would really like to see some developments for this in Magic Lantern.
-
Any chance for 40D ? It can be without video, timelapse is what I need.
-
Wake UP 40D People's after 6 month non stop work on magic lantern on my 40d already i completed some verizon and tested ML 2 days now every thing work great i will continue with testing full month.
-
Please share a link to your bitbucket repository. ;)
-
Is it working? Did you manage to enable video? Will you share?
-
Please, Post here all the news with the 40d, there is a lot of people wanting to record video on the great 40D and you´re our last hope, we appreciate all of your work. Thanks.
-
Hi everyone, I just discovered Magic Lantern for the first time and I'm interested in getting involved. I have a 40D and I'm a software engineer by profession. I'm not sure exactly where to start, i.e. what's the status on 40D support, what needs to be done, etc? I can download the code and build it but I don't want to brick my camera right off the bat. If anyone can point me in the right direction it'd be great!
-
Source to use:
https://bitbucket.org/hudson/magic-lantern/src/7d67bc6f378a8e7f607369a374f617491f32d2c5/platform/unmaintained/40D.111/stubs.S?at=unified&fileviewer=file-view-default
Check also "Qeen Mum's" thread:
http://www.magiclantern.fm/forum/index.php?topic=1010.0
eduperez has also 400plus running which is not ML but they share some stuff:
https://github.com/400plus/400plus
- Preferrably you would fork the unified branch from ML on bitbucket
- Move the initial linked 40D platform out of unmaintained
- Strip down code or uncomment stuff which produces compile errors while first trying to #define CONFIG_HELLO_WORLD
- regarding your brick question: comment out #define CONFIG_PROP_REQUEST_CHANGE from internals.h and you are good to go
- You would need the 40D.111 firmware dump (anyone?) to find stubs and consts. Remember: dumps have to be kept private. No public posting.
- You would need a way to enable bootloader (is there any installer (ML-SETUP.FIR) available already?)
- for state objects check: http://a1ex.bitbucket.io/ML/states/index.html
- Prepare yourself for endless hours of work and try to catch a1ex on IRC if you need help with the bootloader :P
-
Hi all,
Do you accept pull requests for unmaintained (f.e. this very 40D) platforms? Instead of someone hacking on his/her own and later possibly dropping the whole thing for losing interest, or for not able to finish it, without telling anyone how far he/she got, it could make sense.
Thanks,
-w-
-
Now and then someone is posting something here. Now we have a some source files at our disposal, but how to run them on the Canon 40D?
Please could anyone explain.
Thank you in advance who ever you might be.
-
Hi,
I checked out changeset 8159 (the last one with 40d changes) and compiled it with arm toolchain 4.6.2. It went without problems, I did not try any newer version)
Then I took the 5D installer from installer/5DC.111, replaced the addresses of LEDs and write_bootflag/read_bootflag functions with the ones found on the first page of this thread, compiled and created installer firmware with dissect_fw3 and assemble_fw tools. There is no known address for write_card_bootflag so I formatted the card manually.
Then It successfully enabled the bootflag and the camera is able to boot the built magic lantern, which works good enough to show menu. Then I dumped the fw and run ARM-console on it. Too bad that I don't understand the ARM assembler much.
I wanted the fps override function for night focusing, but I could not find anything like shadow registers, so I ended with a hack that writes hardcoded value to fps register from ISO prop handler each time when iso is set to 1600.
Also I noticed that the camera is rather unstable and crashes after several shots. I disabled everything except boot code and finally found that it gets fixed by calling cache_unlock() from ml_hijack_create_task_cmd_shell() in platform/40D.111/init.c.
Then I just re-enabled the ISO prop hack.
The camera now provides all the functionality that I need and is quite stable, so I don't plan to work on it further,
-
Sounds good!
Do you mind sending me a copy of your ROM, for trying it in QEMU? The one I have is incomplete.
-
It would be lovely if a usable version could be made before I buy the 5D M4.
If I can make use of the huge ML features
- Auto ETTR and
- RAW histogram
- dual ISO (if possible).
That would make quite an awesome old camera.
-
I've been plugging away at trying to replicate vnd's success with a modern version of ML -- which has been complicated by most of the VxWorks code being relatively unmaintained (from what I can see).
I'm most of the way through getting it to compile, although there are some deficiencies I've been trying to hack around. If anyone's interested in jumping in:
https://bitbucket.org/rufustfirefly/magic-lantern (https://bitbucket.org/rufustfirefly/magic-lantern)
(I'd be more than happy to either accept pull requests or grant full access to the repository, if anyone else wants to work on it.)
-
For a quick update:
I've got everything compiling, but I'm pretty sure some of my functions aren't defined in the right places, etc, so it's failing to link properly -- but otherwise it looks as though it's doable to get this working with the modern ML codebase, assuming that I (or someone else a bit better at this) untangle a few of the bad references and definitions in there.
That's as of this commit:
https://bitbucket.org/rufustfirefly/magic-lantern/commits/da9358bcac3caf54a0572be07cad611ee0922b3d (https://bitbucket.org/rufustfirefly/magic-lantern/commits/da9358bcac3caf54a0572be07cad611ee0922b3d)
-
Update:
I've got it compiling and linking, although there's some serious hackery involved, as well as a bunch of functions which have been dummied up, since I'm not sure where they map on the 40D's OS.
https://bitbucket.org/rufustfirefly/magic-lantern/commits/4a738f3938437566f93fd1def8ff7168ffc90847 (https://bitbucket.org/rufustfirefly/magic-lantern/commits/4a738f3938437566f93fd1def8ff7168ffc90847)
-
I've got it compiling and linking
Did you try to run it on your camera?
-
There is no known address for write_card_bootflag so I formatted the card manually.
For 40D111 it should be 0xFFFF43A0.
-
Some small progress that also applies to 40D:
Added the 450D and 40D changes to the vxworks branch (https://bitbucket.org/hudson/magic-lantern/branch/vxworks) in the main repo. Did some minor cleanups (compiler warnings), had some attempts at emulating it in QEMU, but didn't really check any deeper yet.
For reverse engineering, I've adapted the dm-spy-experiments (http://www.magiclantern.fm/forum/index.php?topic=2388.msg113154#msg113154) branch as vxworks-dm-spy (https://bitbucket.org/hudson/magic-lantern/branch/vxworks-dm-spy) (tested in qemu).
-
So is it working? :-) Sorry not quite clear for me :-[
-
Nobody knows.... as it seems. A dead end :/
-
Is ML for the 40D working? Are there any other alternatives? Does 400Plus work on the 40D or is only for the 400D as the documentation implies.
Thanks
-
Is ML for the 40D working? Are there any other alternatives? Does 400Plus work on the 40D or is only for the 400D as the documentation implies.
Thanks
As the documentation for 400plus clearly states, "It is designed specifically for the Canon 400D/XTi and will not work with other camera models".
-
Even after all this time.... Here things are as stuck as they are on the 5D4. Why do I pick the wrong for ML camera :/
-
Is there anyone currently working on porting ML to the 40D? If not, is that primarily due to the age of the camera, the difficulty, or the devs lacking 40Ds on hand?
-
is that primarily due to the age of the camera, the difficulty, or the devs lacking 40Ds on hand?
Likely all three.
-
Likely all three.
Give me a pie chart, then. ;)
-
Good news - 40D boots the GUI in QEMU, just like most other EOS models!
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D111.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu16.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)
The last screen looks a bit odd - how does it look on a real camera?
Also compiled ML from the rufustfirefly (https://bitbucket.org/rufustfirefly/magic-lantern/commits/all) repository and got a half-working Space Invaders clone (menu appears when pressing delete, navigation keys are working, fonts don't seem to work):
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-ml1.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-ml2.png)
What does this mean? Porting ML on this camera is no longer difficult at all - it's just a matter of fixing the remaining issues (you've just got a very powerful tool for that) and bringing the source tree up to date with the mainline code. All the changes from rufustfirefly are also in our vxworks branch (https://bitbucket.org/hudson/magic-lantern/branch/vxworks), but there are a few stubs missing; still, it shouldn't be hard to fix them and get this working in the emulator.
For the impatient: QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/), installation video for Ubuntu (https://twitter.com/autoexec_bin/status/913530810686418944), for Mac (http://www.magiclantern.fm/forum/index.php?topic=16012.msg191686#msg191686) and guide for Windows (http://www.magiclantern.fm/forum/index.php?topic=20214.0).
Next steps: dfort's porting tutorial (http://www.magiclantern.fm/forum/index.php?topic=19417.0) the EOS M2 walkthrough (http://www.magiclantern.fm/forum/index.php?topic=15895.msg185084#msg185084) and the 450D port (http://www.magiclantern.fm/forum/index.php?topic=8119.0) as reference.
As mentioned earlier - the camera is capable to record video (both MJPEG and RAW).
Want to help? Please follow the above links and confirm you can get the same results (screenshots) on your system. Proof-reading the QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/) is also very welcome.
Happy hacking!
-
@a1ex WOW.. you are putting in work. By the way happy holidays.
-
Possible MJPEG? Is this something unique to the 40D or have I missed out on some more recent developments?
-
https://mobile.twitter.com/autoexec_bin/status/944627528999800839
-
Awesome! Thank you Walter!
-
Good news - 40D boots the GUI in QEMU, just like most other EOS models!
...
Also compiled ML from the rufustfirefly (https://bitbucket.org/rufustfirefly/magic-lantern/commits/all) repository and got a half-working Space Invaders clone (menu appears when pressing delete, navigation keys are working, fonts don't seem to work):
.....
Happy hacking!
Lovely! MORRAL KOMBAT is next! :)))
Joke aside! This is a great news! After all these years it would be lovely to have a working 40D with advanced functions available. Even though my 40 D got so broken to the point its repair cost is the same as buying a second hand 40D. But I’ve got a friend who’s hobby is photography and he got the same body.
I hope for the best! :)
-
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)
The last screen looks a bit odd - how does it look on a real camera?
Thanks a1ex!
Here's photo of my 40d's info screen:
(https://i.imgur.com/fWyLEk3.jpg)
-
Beautiful. You are wonderful people. :)
-
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)
The last screen looks a bit odd - how does it look on a real camera?
Here's mine.
(http://image.ibb.co/bwu4Uw/20180103_214532.jpg)
-
a year ago my 50D eos where I had installed ML crashed and since then I'm using the old 40D, although I miss not being able to enjoy ML. Is there anyone who's managed to get ML running on the 40D? Thank you in advance
-
The closest thing I could find is reply #379 (https://www.magiclantern.fm/forum/index.php?topic=1452.msg172529#msg172529) - that provides some good hints on how to get started, and a changeset ID that is known to work, to some extent.
Next stops:
https://www.magiclantern.fm/forum/index.php?topic=991
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
-
Thank you A1ex for your information and time. Unfortunately, my knowledge does not allow me to perform the tasks recommended in the posts. I will have to wait until some member can upload an operational version for the 40D :'(. Greetings
-
I started to think this might happen before the 80D was cracked, but it looks that's a bit more lively at the moment.
Are the issues wholly different, or is the primary roadblock common to both efforts?
-
This one is quite straightforward (anyone can follow a tutorial, sit down and debug ML). I've already provided and documented the tools for that.
The only roadblock is finding a 40D owner interested in porting ML on this camera (maybe you?), rather than waiting for someone else.
Don't expect a new port from me; these old models are very low on my priority list. I'm just making sure others have the tools they need to port ML, that's all.
-
This one is quite straightforward (anyone can follow a tutorial, sit down and debug ML). I've already provided and documented the tools for that.
The only roadblock is finding a 40D owner interested in porting ML on this camera (maybe you?), rather than waiting for someone else.
Don't expect a new port from me; these old models are very low on my priority list. I'm just making sure others have the tools they need to port ML, that's all.
If you want to PM me the steps and risks involved, I might be able to help in that regard.
-
Hi All,
I have a Canon 40D and am somewhat technical, I would be happy to invest a few hours testing with the advice of someone who knows the deeper development side.
Really looking forward to getting a distributable build working for the 40D, even if it doesn't have *all* the features!
Jonathan