Magic Lantern Forum

Magic Lantern Releases => Camera-specific discussion => Topic started by: dichterDichter on July 18, 2012, 08:55:06 AM

Title: [UNMAINTAINED] Canon 40D
Post by: dichterDichter on July 18, 2012, 08:55:06 AM
wow. I have a 40D and i think the 5Dc and the 40D are both VxWorks. Am i right? So would it work on a 40D?
It would be awsome to be able to record movies with the 40D.

nice work.
Title: Re: Canon 40D
Post by: a1ex on July 18, 2012, 09:09:09 AM
In theory, you have the foundation for running user code on 40D and most other VxWorks cameras.

In practice, there should also be a developer who must have this camera, skills and lots of time to work on it.
Title: Re: Canon 40D
Post by: dichterDichter on July 18, 2012, 09:24:59 AM
thank you.
ok... i have that camera, skills : hmmm, lots of time : doh!
but why not. maybe as a winter project.
Is it the current release or is there a special fork?
Title: Re: Canon 40D
Post by: a1ex on July 18, 2012, 09:30:59 AM
It's in the current source tree.
Title: Re: Canon 40D
Post by: dichterDichter on July 18, 2012, 02:41:20 PM
ok, lets see what happens when i start that on my 40D this evening.
Title: Re: Canon 40D
Post by: a1ex on July 18, 2012, 02:50:42 PM
Don't run that code blindly, first understand how it works. It has zero chances to work on 40D unmodified, and can be dangerous.

http://magiclantern.wikia.com/wiki/Other_dslr
http://magiclantern.wikia.com/wiki/For_Developers

First get a firmware dump, find out LED address and try blinking it.
Title: Re: Canon 40D
Post by: dichterDichter on July 18, 2012, 04:21:06 PM
yes, right. i will start with little steps. Thank you.
Title: Re: Canon 40D
Post by: coutts on July 18, 2012, 06:29:52 PM
I suggest you look at my initial project for the 5dc:
www.bitbucket.org/coutts/5dplus (http://www.bitbucket.org/coutts/5dplus)

Everything starts in entry.S. First use a dumper tool to extract the firmware image from a canon firmware update file (see the build_scripts/eos_tools_v11 folder in that project linked above). Use decrypt_fw and then dissect_fw to split the FIR up. See this wiki page for more details:
http://magiclantern.wikia.com/wiki/Packing_FIR_Files (http://magiclantern.wikia.com/wiki/Packing_FIR_Files)

After you analyze the firmware dump using a program like IDA Pro (or the free ARM Console (http://magiclantern.wikia.com/wiki/GPL_Tools/ARM_console) created by Alex) to see how the camera boots/works, then attempt to boot a custom FIR file running user code. Use the assemble_fw perl script in the eos_tools directory to assemble a new FIR file with your usercode (compiled autoexec.bin) instead of canon's payload. The final step is to run decrypt_fw again on this fir to sign it for the camera to accept it. (Note: this step may or may not be necessary, depends on the camera. Try both if one doesn't work). Start by just blinking an LED or something basic to know your code runs. You don't need to boot the main firmware to blink an LED.

If 40d is similar to the 5dc, then you won't be able to run any practical code from a FIR (including calling the EnableBootDisk function or booting the firmware/camera) so you will need to write some code that scans the bootloader area (0xFFFF0000-0xFFFFFFFF) for function signatures to identify the read/write bootflag functions. This will allow you to set the camera's bootflag, to boot an autoexec.bin file with a prepared card, and development takes off from there (you will be able to boot the firmware and do anything from autoexec). I created this bootdisk code from the 350d method, using the 400d bootloader to find the signatures I needed. Only modification you will need is to change are the references to these:
Quote
read_bootflag = (ft_read_bootflag)0xFFFF8AE0;
write_bootflag = (ft_write_bootflag)0xFFFF89F0;
https://bitbucket.org/coutts/5dplus/src/e486f2e53796/bootdisk.c (https://bitbucket.org/coutts/5dplus/src/e486f2e53796/bootdisk.c)

The 5dc took me many hours to get going, I dumped many memory addresses through LED blinks in binary, you should be prepared to do the same. Here is some code that you can use to blink out the contents of a memory address if you know the red/blue LED addresses:
https://bitbucket.org/coutts/5dplus/src/a1cc964de4af/init.c

You can use this to write code to search for specific signatures of the read_bootflag and write_bootflag functions. Some signatures would be instructions like:
Quote
MOVEQ   R7, #0xF8000000
which is assembled and looks like this in memory:
Quote
0x03A0733E

Use the 5dc bootloader (I can send you it) to know what signatures you're looking for (unique instructions that would only appear in the read/write bootflag functions). After you find a signature and have a match at some spot in the BL area (0xFFFF0000-0xFFFFFFFF), use this address and search in reverse (going backwards in memory to lower addresses) until you find the nearest PUSH (STMFD) instruction, this will be the address of the start of the function so that you can call it / use it.



I'll just tell you the signatures to find.
First, for write_bootflag. Here is a small snippet from that function, the first 5 instructions:
Quote
ROM:FFFF89F0                 STMFD   SP!, {R4-R8,LR}
ROM:FFFF89F4                 MOV     R5, R1
ROM:FFFF89F8                 MOV     R4, #0
ROM:FFFF89FC                 CMP     R0, #0
ROM:FFFF8A00                 MOVNE   R7, #0xF8000000
If you were scanning memory, these 5 instructions would look like this(starting at 0xFFFF89F0 on the left and ending on 0xFFFF8A00 on the right):
Quote
0xE92D41F0 0xE1A05001 0xE3A04000 0xE3500000 0x13A0733E

So, look for the signature for the MOVNE R7, #0xF8000000 instruction, then once you find it, search backwards for the STMFD (push) instruction signature, and you will have located write_bootflag in the 40d bootloader. Chances are the functions will probably be identical, but take caution to verify at least 3 times that you have located the correct function and it seems the same / similar to the 5dc one (remember we are working blind here).


Now, read_bootflag. First 5 instructions look like:
Quote
ROM:FFFF8AE0                 STR     LR, [SP,#var_4]!
ROM:FFFF8AE4                 CMP     R0, #0
ROM:FFFF8AE8                 MOVNE   R3, #0xF8000000
ROM:FFFF8AEC                 ADDNE   R3, R3, #0x2000
ROM:FFFF8AF0                 MOVNE   R2, #0x40
And in memory would look like this (same thing as before, starting at 0xFFFF8AE0 on left and ending at 0xFFFF8AF0 on the right):
Quote
0xE52DE004 0xE3500000 0x3E33A013 0x12833A02 0x13A02040
Note: there isn't a STMFD (push) instruction in read_bootflag. The 400d bootloader is like this too, so chances are the 40d is as well.

NOTE: you may need to reverse endianness of the assembled instructions above to see them in memory, but maybe not, I can't remember :P


So, once you have located read_bootflag() and write_bootflag(), you will be able to really start developing. :) This may seem confusing, and I'm sorry, but I hope you will see how valuable this information is (I had to figure it all out on my own). The 350d people dumped the bootloader using a photo diode and the LED to blink the code in binary to a computer, I couldn't figure that out so I did it this way. Let me know if you have any questions, I can probably help a lot. Do you use gmail?
Title: Re: Canon 40D
Post by: dichterDichter on July 23, 2012, 01:54:30 PM
Argh, first i have to repair my camera... broken release.
Thats really annoying.
Title: Re: Canon 40D
Post by: Michael Zöller on July 23, 2012, 04:20:39 PM
coutts, thats some very helpful information and should probably go into the wiki!
Title: Re: Canon 40D
Post by: coutts on July 24, 2012, 10:01:22 PM
coutts, thats some very helpful information and should probably go into the wiki!
should be more than enough to get any port started :)
Title: Re: Canon 40D
Post by: imme on July 27, 2012, 07:18:23 AM
There are plenty of Canon 40d users like me waiting to use MagicLantern on their 40d. Please! Make it happen. I am not a developer.....all can I do is to pray for your success :)

 
Title: Re: Canon 40D
Post by: jplxpto on July 29, 2012, 02:09:36 AM
Finally some good news! I am enjoying the ML. I thank all who have worked on this project. I hope one day to use the ML with a 40D. I hope to give my contribution to make this possible.

I think the work done by Coutts to 5DC will be useful for even the 40D and 400D.
Title: Re: Canon 40D
Post by: jplxpto on July 31, 2012, 01:30:31 AM
I'm thinking start doing the first tests.
I know it's a bit risky. Certainly, I will need your help.
Firstly, I will begin by installing and configuring ubuntu to compile the project. When I can, I will test the tools specified by Coutts.

Title: Re: Canon 40D
Post by: jplxpto on August 05, 2012, 02:39:09 AM
Hi,

I still have nothing to work but I have spent many hours reading the forums CHDK / ML.
I'm learning, have some patience with me. This still seems very complicated. Sorry if the questions are basic.

I got the firmware version 40d1.1.1. With application dissect_fw3_2, I got the unencrypted header and body. I've compiled a small application to try to find the addresses of the red and blue LED, but I've got a problem. I do not know how to encrypt the new firmware to be able to use on my machine. I read a lot about it but I could not understand the steps that have to follow.

If I can correctly encrypt my firmware I can proceed with my tests.

Since I've been searching for some string in the firmware files and I could see some interesting things. I found the string EnableBootDisk.

After seeing the flashing LEDs, I'll try to do a DUMP the firmware.
When I succeed in the previous tests, I proceed to the discovery of the function EnableBootDisk addresses.

Someone can help me create my own firmware for the 40D?

Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 05:09:08 AM
I have a 40D with version 1.1.1. After much reading and testing I was able to flash both LEDs.
Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 04:07:49 PM
I used the information provided by Coutts to flash both LEDs.

See the examples:


1_1000D LED Finder (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/1_1000D%20LED%20Finder/)

2_1000D LED-Dumper (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/2_1000D%20LED-Dumper)

These are the addresses of blue and red LEDs:

LED_RED     0xC02200E0
LED_BLUE    0xC02200E8
Title: Re: Canon 40D
Post by: coutts on August 10, 2012, 08:20:03 PM
I used the information provided by Coutts to flash both LEDs.

See the examples:


1_1000D LED Finder (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/1_1000D%20LED%20Finder/)

2_1000D LED-Dumper (https://bitbucket.org/coutts/1000d_dev/src/a7835d17602f/engelmarkus_examples/2_1000D%20LED-Dumper)

These are the addresses of blue and red LEDs:

LED_RED     0xC02200E0
LED_BLUE    0xC02200E8
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.

For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus
Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 08:35:04 PM
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.

For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus


Coutts,

yes I am currently reading your posts in CHDK.
In 2008 there were major developments, but for some unknown reason you moved away from this project. Made great advances that have helped future ports to other cameras but 40D & 450D were forgotten! Why?! ...

Their progress in the port 1000D can give a great help! I think the cameras 1000D, 450D, 40D have many similarities. This can be an advantage.

Thank you for providing the code :

https://bitbucket.org/coutts/1000d_dev
Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 08:42:48 PM
I really want to install the Magic Lantern in my camera and give my modest contribution to the community but,
 without your precious help will not go away.

You have done an excellent job over the years.

Congratulations.
Title: Re: Canon 40D
Post by: jplxpto on August 10, 2012, 08:58:18 PM
great job! Let's get the 40d port on its way :)
Next step: copy/paste boot code into entry.S like the 5dc one. copy enough of the boot code until you can hook a task.

For initial hacking you may want to refer to 5dplus:
https://bitbucket.org/coutts/5dplus


Many will read this and get to thinking that an easy task! ;)
Title: Re: Canon 40D
Post by: jplxpto on August 11, 2012, 05:45:19 PM
Has anyone done a dump of the ROM and BL fir v 1.1.1.?
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 06:31:20 AM
I read a lot and follow the tips and suggestions from Coutts.

I analyzed the 5DC BL code and found the signatures of functions and read_bootflag write_bootflag.
Later, I created a small program to find them in my 40d fir 1.1.1.

I still do not know the original values of bootflags but I have called the function read_bootflags.

Not yet confirmed, but I believe that the addresses are:

read_bootflag -> 0xffff 63a8
write_bootflag -> 0xffff 62b8
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 06:34:09 AM
Someone can explain me how to operate the boot flags?
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 08:07:59 PM
The original values of bootflags are:

F8000000 =  0
F8000004 =  0
F8000008 = -1
F800000C = -1
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 08:58:35 PM
I have good news.

The autoboot already works!!!

I used the addresses of functions and LEDs that I presented to you earlier.
I used some test applications of Coutts, and made the necessary changes.

The second obstacle has been overcome.

I level up but, the game becomes more complicated and risky.

Wish me luck! ;)
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2012, 09:04:03 PM
My next steps are:

1) find the addresses of the functions Open, Write and Close;

2) create BL & ROM dumps.
Title: Re: Canon 40D
Post by: coutts on August 13, 2012, 04:50:10 AM
My next steps are:

1) find the addresses of the functions Open, Write and Close;

2) create BL & ROM dumps.
you must boot the firmware first. you cannot call file i/o until it has been initialized by VxWorks. now that you can run autoexec.bin, you can boot the firmware :)
Title: Re: Canon 40D
Post by: jplxpto on August 13, 2012, 07:16:22 AM
I've been reading the forums and ML CHDK and found some examples to dump the ROM and BL.

http://chdk.setepontos.com/index.php?topic=1651.45 (http://chdk.setepontos.com/index.php?topic=1651.45)

I found one that allowed you to dump the 40D FW 1.0.8.
They called on four functions in the code of the flasher.
The 'ASalina' made ??the dump from earlier versions.
I now want to do with version 1.1.1.

They found these features in version 1.0.8:

/ / 40d - flasher v1.0.8
         open = (ft_open) 0x00989a34;
         create = (ft_creat) 0x00989a44;
         write = (ft_write) 0x00989534;
         close = (ft_close) 0x009896a0;

I've been researching the same functions in version 1.1.1:

/ / 40d - flasher v1.1.1
         open = (ft_open) 0x00989a3c;
         create = (ft_creat) 0x00989a4c
         write = (ft_write) 0x0098953c;
         close = (ft_close) 0x009896a8;

I've thought maybe it was not possible to call these functions before starting VxWorks.
I got confused with anything ...

The flasher code calls functions of the ROM?! ...

I still can not understand well the memory map and this is making me lose some time and let me crazy :)

Someone can give me some tips? Maybe you Coutts ... ;) Again ...
Title: Re: Canon 40D
Post by: jplxpto on August 13, 2012, 07:33:16 AM
you must boot the firmware first. you cannot call file i/o until it has been initialized by VxWorks. now that you can run autoexec.bin, you can boot the firmware :)


Coutts I understand but how do I boot VxWorks?! ...
My apologies if the question is basic! ;)

I've been to see the entry.S 5DC but still seems to me very complicated.
How do you know the sequence of function calls to boot.
I studied multitasking, but on the VxWorks I only know the name: (

How do I use AUTOEXEC.BIN to start the VxWorks?! ...

Can I use the functions DEBUGMSG and dump before starting VxWorks?
Title: Re: Canon 40D
Post by: coutts on August 13, 2012, 05:25:21 PM

Coutts I understand but how do I boot VxWorks?! ...
My apologies if the question is basic! ;)

I've been to see the entry.S 5DC but still seems to me very complicated.
How do you know the sequence of function calls to boot.
I studied multitasking, but on the VxWorks I only know the name: (

How do I use AUTOEXEC.BIN to start the VxWorks?! ...

Can I use the functions DEBUGMSG and dump before starting VxWorks?

Those functions you listed earlier sound like they are bootloader functions but they are being called from RAM, so I wouldn't call those (not sure if the functions are copied there or not). I've been looking for file i/o in the bootloader for a while but haven't found it, if you have found these functions in the BL, then that is huge progress! It will help new ports a lot.

Now for booting VxWorks, what I mean is you must copy/paste the boot code starting at 0xFF810000 far enough to where you can spawn your own task. We need to hook ourselves into VxWorks. Once we have started our one task, we can hand execution back to canon and boot the camera like normal.

So, I used some bootcode from chuchin but it is literally copy/pasted line for line from the ROM (at FF810000). As a test, see if you can make your entry.S jump execution to FF810000 and see if the camera boots like normal.

Then begin tracing the boot process to know how much code needs to be re-written. You only need to write until the part where it calls CreateTask on the startup task. We can hook our task in here.
Title: Re: Canon 40D
Post by: jplxpto on August 14, 2012, 08:59:59 PM
Quote
As a test, see if you can make your entry.S jump execution to FF810000 and see if the camera boots like normal.

I'll test it ...
Title: Re: Canon 40D
Post by: jplxpto on August 17, 2012, 09:44:46 PM
I'm working on it ...

I already have the dump of the ROM. I've also got the boot flag active.

The Coutts and Cucho have given me a great help ..
They have been fantastic.


The Nano has sent me a file entry.S.

I'll be a little busy, but soon I hope to present you some results.


Does anyone else want to help me?! ... Any help is welcome.
Title: Re: Canon 40D
Post by: jplxpto on August 18, 2012, 09:11:57 PM

I have good news ...

I already have a tread running ... flashing blue LED!

The LED turns off when the TFT is turned off but with the MENU button it lights up again.

I already found the address of some functions but there is still much work ahead to be able to integrate my code with ML.
Title: Re: Canon 40D
Post by: jplxpto on August 26, 2012, 11:45:30 PM
Hi guys,

I keep working on this project and I having some successes

Now I can write logs on the card.

I've been analyzing the logs and found some messages that can help me identify the VRAM.

Then I present some:

Code: [Select]
   304:   591.053 < GUI Lock > InitializeGUILock (PUB)
   305:   592.017 [GUI] MasterResultCBR
   306:   592.224 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
   307:   593.033 [GUI] -> handleGuiInit
   308:   598.963 [DispCon] InitializeDisplayDeviceController (PUB)
   309:   600.121 [IMP] (PUB) InitializeImagePlayer 1113
   310:   601.818 [CERES] RegisterAdapterStatusCallback
   311:   607.638 [Graphics] GuiStartGraphics (PUB)
   312:   608.057 [IMP] (PUB) StartImagePlayer(mode=0) 1189
   313:   608.094 [IMP] CreateVram 665
   330:   684.874 [Graphics] GuiClearImage
   331:   684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
   332:   684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
   333:   685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644
   334:   685.052 [IMP] GetVramNumber 580
   335:   685.072 [IMP] GetVramNumber 580
   336:   716.486 [IMP] (PUB) RefreshImageVram 1597
   337:   716.519 [IMP] GetVramNumber 580
   338:   716.765 [IMP] GetVramNumber 580
   339:   716.791 [IMP] GetVramNumber 580
   340:   716.823 [GUI] StopDateTimer
   341:   716.852 [GUI] ClearColorPalette (0)
   342:   716.924 [GUI] GUI_RegisterPropertySlave
   343:   724.367 [GUI] MasterResultCBR_AvailableMyMenuList(0x79594c)
   344:   724.618 [GUI] MasterResultCBR_ErrBattery(0x79599c)
   345:   725.033 [DP]Dp_GetGlbRegisterCbrTAdr()
   346:   725.182 [DP]Dp_GetGlbRegisterCbrTAdr()
   347:   725.645 [GUI] GUI_SetLanguage (15)
Title: Re: Canon 40D
Post by: a1ex on August 26, 2012, 11:54:20 PM
Sounds good.

Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.

Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.
Title: Re: Canon 40D
Post by: jplxpto on August 27, 2012, 02:37:40 AM
Now I'm trying to change the logging level.
I hope to see something else, but I'm not having great success.

I have to confirm my stubs ... I must be doing something wrong.

I changed the amount of logging that is written but there is something wrong.
I have to understand what is happening.

I wanted to make sure that those are the addresses of VRAM.

I'm going to dump the VRAM (1M) but I still do not know what to do with it... :(
Title: Re: Canon 40D
Post by: jplxpto on August 27, 2012, 02:40:41 AM
Sounds good.

Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.

Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.


These  EDMAC registers are also valid in the DIGIC III?
Title: Re: Canon 40D
Post by: a1ex on August 27, 2012, 07:34:33 AM
You can post them here.

I have no idea what's inside DIGIC III.
Title: Re: Canon 40D
Post by: jplxpto on August 28, 2012, 12:36:22 AM
Thanks Alex, I'll analyze the problem better
Title: Re: Canon 40D
Post by: coutts on September 05, 2012, 08:24:52 PM
One way to find vram:

All vram buffers are like structures, with off_0x00 pointing to a string in the ROM that says "Vram Instance". There's a few of these so you'll have to check for all of them. But, you can dump say the first 0x10000 bytes of ram and look for these pointers. Tip for dumping: you might need to do what I have to do with the 5dc (which I learned from 0xAF with the 400d) and dump using a buffer.

For whatever reason, I can't seem to dump very much without using a buffer. simple code:

Code: [Select]
//~ dump memory 64kb at a time using a buffer.
void dump_with_buffer(int addr, int len, char* filename)
{
    FIO_RemoveFile(filename);
    FILE* f = FIO_CreateFile(filename);
    if (f!=-1)
    {
        int address = addr;
        while (address<addr+len)
        {
            char buf[0x10000];
            memcpy(buf, (void*)address, 0x10000);
            FIO_WriteFile(f, buf, 0x10000);
            address += 0x10000;
        }
        FIO_CloseFile(f);
    }
}
Title: Re: Canon 40D
Post by: coutts on September 05, 2012, 08:32:41 PM
when I found the 5dc vram, I did it a bit oddly. I used img.py (http://magiclantern.wikia.com/wiki/VRAM/550D#How_to_find_segments[/url]). You should look into this. You already know the dimensions of the buffer (same as 5dc): 720x240 with a pitch of 360 I believe. so, dump an area of memory and run it all through img.py to see if you can see the menu or whatever screen you dumped the ram at.
Title: Re: Canon 40D
Post by: jplxpto on September 06, 2012, 12:38:07 AM
Coutts, once again thank you for your help.

I already knew that page. I've also ran this section of your code.
I've done dump part of RAM, but I have not had time to test this python script. Once I have the opportunity I will do this test.

However, I've spent a few hours looking at the 40D firmware. I identified many functions on my camera.
I think there are too many in your 5DC. If you want I send you my stubs for 40D v1.1.1.

I try to read all your posts. You have written some things that I have been very useful for my port.

Soon I will try to present some results. I've been working on it a little every day.
Title: Re: Canon 40D
Post by: jplxpto on September 09, 2012, 02:20:15 AM
I have found many functions in 40D firmware.
These are the ones that create the state objects (I still do not know if missing some function)

Code: [Select]
NSTUB(0xFFD4F17C, CreateTaskClass);

NSTUB(0xFFD4EE48, CreateStateObject);

NSTUB(0xFFB04634, DpImgEditState_CreateStateObject);
NSTUB(0xFFB06DC4, DpState_CreateStateObject);
NSTUB(0xFFBB0A2C, TOMState_CreateStateObject);
NSTUB(0xFFC7F9E0, USBC20State_CreateStateObject);

NSTUB(0xFFBB7DFC, CeresState_CreateStateObject);
NSTUB(0xFFB72BEC, PtpDpsState_CreateStateObject);
NSTUB(0xFF84BD74, RMTState_CreateStateObject);
NSTUB(0xFFB57FC4, FSSState_CreateStateObject);
NSTUB(0xFFC86AFC, PropState_CreateStateObject);
NSTUB(0xFFB618B8, RDState_CreateStateObject);
NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject);
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject);
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject);
NSTUB(0xFFB32CB8, LVState_CreateStateObject);
NSTUB(0xFFBFDB18, FWState_CreateStateObject);
NSTUB(0xFFBFB9A8, FRState_CreateStateObject);
NSTUB(0xFFBF0B6C, MrkState_CreateStateObject);
NSTUB(0xFFB56580, FCSState_CreateStateObject);
NSTUB(0xFFBAE9D8, SdioTskState_CreateStateObject);
NSTUB(0xFFBD5564, FMNormalState_CreateStateObject);
NSTUB(0xFFD5CEA4, DMState_CreateStateObject);
Title: Re: Canon 40D
Post by: a1ex on September 09, 2012, 11:30:54 AM
Yay!

http://a1ex.bitbucket.org/ML/states/40D-alt/index.html

Some functions named automatically with my scripts: http://a1ex.magiclantern.fm/bleeding-edge/40D.111.idc

Try to dump from MEM(0x7768), size MEM(0x7764), while you are in LiveView. If successful, we can record MJPEG video :)
Title: Re: Canon 40D
Post by: jplxpto on September 10, 2012, 03:43:54 PM
Alex,

Thanks for your help.

I'll do this test ..
Title: Re: Canon 40D
Post by: jplxpto on September 13, 2012, 02:14:55 AM
Yay!

http://a1ex.bitbucket.org/ML/states/40D-alt/index.html

Some functions named automatically with my scripts: http://a1ex.magiclantern.fm/bleeding-edge/40D.111.idc

Try to dump from MEM(0x7768), size MEM(0x7764), while you are in LiveView. If successful, we can record MJPEG video :)


----------------------------------------

Alex,

I want to know which of your script made ​​this excellent work. I have little experience in the use of your tools. I saw nothing that did that.

I found hundreds of methods in firmware but it took me many hours looking at the assembly.

And how did you get those addresses? ...

Thanks in advance ...



Title: Re: Canon 40D
Post by: ilguercio on September 13, 2012, 02:34:03 AM
How is this going on? :)
Title: Re: Canon 40D
Post by: a1ex on September 13, 2012, 08:55:43 AM
This one:

1) guessfunc.run(dump) in arm console
2) run -i namefuncx.py

http://a1ex.magiclantern.fm/name_funcx.py
Title: Re: Canon 40D
Post by: jplxpto on September 14, 2012, 01:05:06 AM
IT'S WORKING !!! IT'S WORKING !!! IT'S WORKING !!!

Alex, thanks for the tip

Finally, I got a little time I did the test and it worked!!

I got the JPEG successfully.
Title: Re: Canon 40D
Post by: jplxpto on September 14, 2012, 01:36:48 AM

LV - JPEG

1024 x 680

-----

LCD

mode :  w x h

0 : 720 x 240
1 : 704 x 480
2 : 720 x 576
Title: Re: Canon 40D
Post by: jplxpto on September 14, 2012, 02:00:45 AM
Code: [Select]
51722: 13249.867 [DispCon] TurnOnDisplay (PUB)
 51723: 13266.642 [LV] lvSetPsave 0x0
 51724: 13267.371 [LV] LV_GetPtpZoomWindowArea IX=1560(16384), IY=1038(0)
 51725: 13267.404 [LV] LV_GetPtpZoomWindowArea CX=0, CY=0
 51726: 13268.004 [LV] lvSetWbIntegRegisterForAe 1
 51727: 13268.045 [LV] StartLiveViewWbPass
 51728: 13268.920 [LVCDEV]->lvcdevStartDev
 51729: 13270.190 [LV] lvResetPsave
 51730: 13270.396 [LV] WB 1974 1151 1151 2533(1377)
 51731: 13270.503 [LV] lvResetPsave(1) 0x5A 0x454 0x49E
 51732: 13270.528 [LV] lvResetPsave(2) 0x0 0x0 0x0
 51733: 13271.801 [LVCDEV]->lvcdevResourceGet(0,1)
 [b]51734: 13272.366 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0[/b]
 51735: 13275.198 [LV] lvVDInterrupt
 51736: 13275.363 [LV] WB 1974 1151 1151 2533(1158)
 51737: 13279.334 [DEV] LV_JPG YuvWriteCompleteCBR
 51738: 13279.373 [DEV] LV_JPG YUVReadCompleteCBR
 51739: 13279.499 [DEV] LV_JPG JpCoreCompleteCBR( 0x2e1c6 )
 51740: 13279.553 [DEV] LV_JPG JpegPopCompleteCBR
[b] 51741: 13279.672 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1ca9e28e Y411:0x107a0e20[/b]
 51742: 13280.277 [LVCDEV]->PD(VF:0x107927ec,MS:0x485540)
[b] 51743: 13282.818 [LV] lvReturnVram[/b]
 51744: 13282.851 < GUI Lock > GUILock_PermitPowerLock (PUB)
 51745: 13283.134 < GUI Lock > GUILockTask 1
Title: Re: Canon 40D
Post by: Chucho on September 14, 2012, 02:46:30 AM
In 2008 dataghost teased the world be getting video from his 40d. Now it looks like it might just happen for other 40d users. Congratulation on your hard work!!!
Title: Re: Canon 40D
Post by: a1ex on September 14, 2012, 07:35:59 AM
Yay!

I think this is a lot better than Dataghost obtained (I've followed the thread back then). If all goes well, we will have MJPEG 422 at 1024x680.

Sure, we need to have a working port first. If you share the current status and code, I can help with this.
Title: Re: Canon 40D
Post by: imme on September 14, 2012, 08:07:28 AM
Congrats you have done marvelous job...........eagerly waiting to use it on my 40d :)
Title: Re: Canon 40D
Post by: jplxpto on September 14, 2012, 11:54:06 AM
Thank you all, but this would not have been possible without your help.

The Coutts, Chucho and the A1ex helped me a lot.

I have to thank also to the guys of CHDK. In the past they did an excellent job.
Without this work and without tools Alex would be very complicated.

I have spent many hours on it. I'm a little tired. Once you have a little time, I'll share with you my code.

My next steps will be to change the boot process.
I want to do something similar to what exists for other cameras.

I've read some things and did not seem very complex. With time and with your help will be easy.

Title: Re: Canon 40D
Post by: a1ex on September 14, 2012, 12:04:25 PM
Take it easy. This low-level stuff can take a lot of time, even for experienced people.
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 02:55:22 AM
'Vram Instance' : 0xFF9B943C
Title: Re: Canon 40D
Post by: ilguercio on September 15, 2012, 12:50:19 PM
That's the same LV resolution as the 50D, what about frame rates though?
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 03:45:14 PM
Some strings from 40dv111 ...


s vram
Code: [Select]
[b]ffca0178: '[IMP] CreateVram %d' [/b]
ffca0930: '[IMP] CompleteVramSyncroClearCBR err:%d'
ffca0d48: '[IMP] (PUB) SetVramInformation(w:%ld h:%ld) %d'
[b]ffca7528: '[IMPV] MakeHDVram %d' [/b]
ffca0e9c: '[IMP] DrawImageToVram GetJpegInfo():%d'
ffca1298: '[IMP] (PUB) RefreshImageVram %d'
ffca12b8: '[IMP] RefreshImageVram : VramNo not found'
ffca15a8: '[IMP] (PUB) AbortDrawImageToVram %d'
[b]ffca648c: '[IMPV] SetVramImageInfo %d' [/b]
ffca2c04: '[IMP] (PUB) SyncroClearImagePlayVram %d'
ffca089c: '[IMP] ImageVramCompleteCBR err:%d'
ffca349c: '[IMP] (PUB) SetVisibleImageVramOffset %d'
ffca3518: '[IMP]  pVramImagePositionY %d'
ffcaff38: 'Not Exist Bitmap Vram!!'
[b]ffca32fc: '[IMP] (PUB) GetVramImageInfo %d' [/b]
[b]ffca0ec4: '[IMP] ERROR DrawImageToVram %s, %d' [/b]
ffca644c: '[IMPV] Complete MakeHDVram Error(%d)\n'
[b] ffca64a8: '[IMPV] SetVramImageInfo x:%ld y:%ld w:%ld h:%ld' [/b]
ff906cd4: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramWidth(%d)'
ff906d88: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramHeight(%d)'
ffca087c: '[IMP] ImageVramCompleteCBR %d'
[b]ffca12e4: '[IMP] RefreshImageVram VramAdd:0x%lX' [/b]
[b]ffca7b8c: '[IMPV] MakeHDVramFromJpeg Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7f74: '[IMPV] (PUB) MakeHDVramCheck %d' [/b]
[b]ffca8254: '[IMPV] GetVramImagePosAndSize s:%ld y:%ld w:%ld h:%ld' [/b]
[b]ffca01b4: '[IMP] Vram%d:0x%lX' [/b]
ffca34f8: '[IMP]  pVramImagePositionX %d'
[b]ffcb16fc: '[BmpDDev] RefreshPhysicalVram (PUB)' [/b]
ffca7c84: '[IMPV] MakeHDVram Error!'
ffca02a8: '[IMP] DeleteVram %d'
ffca02bc: '[IMP] CopyCurrentDisplayVramToIdleVram %d'
ffca08c0: '[IMP] CompleteVramSyncroCopyCBR %d'
[b]ffcb0290: '[BmpDDev] CreatePhysicalVram (PUB)' [/b]
[b]ffb2d1d0: 'lv_vram_dump' [/b]
ffca7bd8: '[IMPV] WorkAdd:0x%lX VramAdd:0x%lX RotWork:0x%lX'
[b]ffca7b68: '[IMPV] (PUB) MakeHDVramFromJpeg %d' [/b]
ffca7c50: '[IMPV] VramWork basew:%ld x:%ld y:%ld w:%ld h:%ld'
[b]ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d' [/b]
ffca2984: '[IMP] ERR: Not Found Display Vram'
ffcb03b4: '[BmpDDev] DeletePhysicalVram (PUB)'
ffca822c: '[IMPV] (PUB) GetVramImagePosAndSize %d'
ffcb1ba8: '[ImgDDev] WARNING Divide Zero Vram Width (%d)'
ffca2ff8: '[IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine %d'
ff9122a4: '[GUI] CalcLvVramSize VramSize X(%d) Y(%d) W(%d) H(%d)'
[b]ffb32b30: '[LV] lvReturnVram' [/b]
ffcb3204: 'Already Vram For Adjust!!'
ff8b30ac: '[GUI] PlayModel.c DrawAspectFrame VramSize X(%d) Y(%d) W(%d) H(%d)'
ffca331c: '[IMP] GetVramImageInfo x:%ld y:%ld w:%ld h:%ld'
ffca334c: '[IMP] (STUB) SetImageVramColorMode(color:%ld) %d'
ffcb3530: 'Not Exist Vram For Adjust!!'
ffb34d94: '[LV] WriteEDmacVramCompleteCBR_x5'
[b]ffca3810: '[IMP] (PUB) GetVramInformation %d' [/b]
ffca08e4: '[IMP] CompleteVramSyncroCopyCBR err:%d'
ffca090c: '[IMP] CompleteVramSyncroClearCBR %d'
ffb361c4: '[LV] WriteEDmacVramCompleteCBR_x10'
ff883b18: '[TestEndDrawToVram] dwErrCode = %d'
ffcb8b6c: '[DispCon] GetVramSize (PUB)'
ffb39140: '[LV] WriteEDmacVramCompleteCBR_x1'
[b]ff9b943c: 'Vram Instance' [/b]
ff9b9558: 'pVram->Image.pPaletteIndex != NULL'
ff9b9594: '!IS_ERROR(pVram->hSemaphore)'
ff9b96b0: 'pVram->Mode == LOGICAL_VRAM'
ffca2e4c: '[IMP] (PUB) SyncroAllClearImagePlayIdleVramWithoutEngine %d'
ffca2e88: '[IMP] ERROR : Vram State'
ffca0e6c: '[IMP] (PUB) DrawImageToVram(rot:%d cb:0x%lX) %d'
ffca0d88: '[IMP] (PUB) SetCopyVramMode(mode=%d) %d'
ff87ece8: '  [Graphics] EndDrawToVram (PRI), err %d'
ffcaa8bc: '[IMP][PBFEN] Fencing_StartVRAMMode'
ffca0e0c: 'SetImageVramParameter x:%ld y:%ld w:%ld h:%ld/* Aspect:%d*/'
ffc9ff6c: '[IMP] GetVramNumber %d'
ffc9ffa0: '[IMP] SetVramImageParameter %d'
ffc9ffc0: '[IMP] SetVramImageParameter add:0x%lX BaseW:%ld'

s 411
Code: [Select]
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffc492c0: '[DPATH] LV_YPACK START Y411:%#lx YPACK:%#lx'
ffc492ec: '[DPATH] LV_YPACK STOP Y411:%#lx YPACK:%#lx'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc46e00: '[DPATH] LV_JPG START Y:%#lx J:%#lx Y411:%#lx'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffc46fbc: '[DPATH] LV_JPG STOP Y:%#lx J:%#lx Y411:%#lx'
ffc96db0: '[IMP][PBRSZ] GetCnv411Mode %d'

s 422
Code: [Select]
ffc96d90: '[IMP][PBRSZ] GetCnv422Mode %d'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'

s YUV
Code: [Select]
ffc95578: '<RESIZE> SetParameterResizeYuv Abort End Before Lock'
ffc955fc: '[IMP][PBRSZ] RequestResizeYuv RdAdr:%#lx, WrAdr:%#lx'
ffcb56b8: 'gyuv'
ffb301f8: '[LV] YuvAddress = 0x%08lX'
ffb00db8: 'Dp_ReduceImageData_Yuv()'
ffc498dc: 'PonyYuvPath'
ffc95810: '[IMP][PBRSZ] RegisterCBROfCompleteResizeYuv %d'
ffb01094: 'Dp_AdobeRgbToSRgb_Yuv()'
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffb013c0: 'Dp_ClearWidth_Yuv()'
ffc959b8: '[IMP][PBRSZ] Zoom:%d InYuv:%d OutYuv:%d'
ffafaf14: 'Dp_ExecuteYuvRotatingCBR() ErrorCode [0x%08x]'
ffc49f7c: '[DEV] Pony YuvWriteCompleteCBR'
ffca6754: '[IMPV] Yuv:%d Add:0x%lX BaseW:%ld'
ffb02720: 'Dp_CopyImageData_Yuv()'
ffb02738: 'pDstYuvDataAddress [%d]'
ffb02750: 'pSrcYuvDataAddress [%d]'
ffc45c34: 'FactoryYuvPath'
ffc444b8: '[DEV] JPG_EN YuvWriteCompleteCBR'
ffaf9fa8: 'Dp_YuvToYuv()'
ffca47a8: '[IMPL] Yuv:%d Add:0x%lX BaseW:%ld'
ffca4c1c: '[IMPL] (PUB) CalculateYuvResizeParameter %d'
ffb36258: '[LV] WriteEDmacYuvCompleteCBR_x10'
ffc988b0: '<ROTATE> RequestRotationYuv Before Lock'
ffca5294: '[IMPL]_CalcResizeSizeForRotZoom InYuv:%d OutYuv:%d Aspect:%d'
ff84534c: '[FA] FA_YuvDevelopTestImage'
ffca580c: '[IMPL] _CalcResizeSize InYuv:%d OutYuv:%d Aspect:%d'
ffc4604c: '[DEV] FactoryYuvPath_ChangeCBR(ID=%#lx)'
ffca630c: '[IMPV] GetAjustUnitYUV %d'
ffb018bc: 'Dp_CutImageWidth_Yuv()'
ffca6dec: '[IMPV] YuvMode:%d'
ffc47068: '[DEV] LV_JPG YuvWriteCompleteCBR'
ffca72e0: '[IMPV] YuvMode:%d BaseAdd:0x%lX BaseW:%ld'
ffca730c: '[IMPV] YuvMode:%d  BaseAdd:0x%lX BaseW:%ld'
ffcadf00: '[IMP][DECWIN] SetNQDecParam adr:0x%08lX yuv:%d'
ffb01438: 'Dp_ExpandImageWidth_Yuv()'
ffb01490: 'Dp_ShiftYuvRotationData_Yuv()'
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
ffc49c90: '[DPATH] Pony2 START YUV1:%#lx YUV2:%#lx'
ffc9c32c: '[IMPD] (PUB) ExecuteYuvRotating %d'
ffcb6ddc: '[DispCon] Err Factory Adjust For DisplayYUVGain'
ffc49ae4: '[DPATH] Pony1 START C:%#lx YUV:%#lx'
ffc49c2c: '[DPATH] Pony1 STOP C:%#lx YUV:%#lx'
ffc458c0: '[DEV] YuvWriteCompleteCBR'
ffc47048: '[DEV] LV_JPG YUVReadCompleteCBR'
ffb01b2c: 'Dp_AdjustCroppingSize_Yuv()'
ffc49e94: '[DPATH] Pony2 ReStartPonyYuvPath2'
ffb0134c: 'Dp_ClearHeight_Yuv()'
ffc49eb8: '[DPATH] Pony2 STOP YUV1:%#lx YUV2:%#lx'
ffc99db0: '[IMPD] YuvMode:%d'
ffc99de4: '[IMPD] StartYuvResizing Comp'
[b]ffb2d1e0: 'lv_yuv_dump' [/b]
ffcad330: '[IMP][DECWIN] SetResizeParam OutYuv:%d InputSel:%d'
ffcada9c: '[IMP][DECWIN] SetWinResDecParam adr:0x%08lX yuv:%d base:%ld'
ffcb15fc: '[BmpDDev] GetYUVPaletteFromDisplayDevice (PUB)'
ffb02798: 'Dp_ShiftImageHeight_Yuv()'
ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d'
ffc8f344: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc8f3a0: '[IMP][PBLOT]  RequestRotationYuv Before Lock'
ffcb0608: '[BmpDDev] SetYUVPaletteToDisplayDeviceh (PUB)'
ffad0f50: 'YuvMode[%d]'
ffad0fd0: 'YuvMode[%d] BaseAddress[%d]'
ffafa738: 'ResizeYuvT Input nYuvMode [%d]'
ffb391d4: '[LV] WriteEDmacYuvCompleteCBR_x1'
ffc98708: '[IMP][PBROT]  OUTPUT --- Yuv:%d Add:0x%lX Base:%ld'
ffca6d94: '[IMPV] ZoomMode:%d YuvMode:%d'
ffb0ff6c: 'Dp_YuvToJpeg [0x%08x]'
ffcadfa0: '[IMP][DECWIN] pYuvAddress:%#lx'
ffb02004: 'Dp_AdjustFrameWithWhite_Yuv()'
ffb34e28: '[LV] WriteEDmacYuvCompleteCBR_x5'
ffca5dd0: '[IMPL] rot:%d zoom:%d inYUV:%d outYUV:%d'
ffcb8d9c: '[DispCon] GetYUVGain'
ffc95520: '[IMP][PBRSZ] SetParameterResizeYuvForMovie %d'
ffc95634: '<RESIZE> RequestResizeYuv Abort End Before Lock'
ffc95664: '[IMP][PBRSZ] ERROR pResizeYuvCompleteCBR is NULL'
ffc95698: '[IMP][PBRSZ] CancelResizeYuv %d'
ffc95840: '[IMP][PBRSZ] UnregisterCBROfCompleteResizeYuv %d'
ffc95874: '[IMP][PBRSZ] AbortResizeYuv %d'
ffc96334: '[IMP][PBRSZ] Input:%ld Output:%ld InYuv_f:%ld OutYuv_f:%ld'
ffc46030: '[DEV] YuvWriteCompleteCBR'
ffc4937c: '[DEV] LV_YPACK YuvReadCompleteCBR'
ffb0ff5c: 'Dp_YuvToJpeg()'
ffcb7564: "[DispCon] Warning: YUV Gain Don't Adjust"
ffb17f6c: '[GYO]Dp_YUVDustReduction'
ffc98684: '[IMP][PBROT] SetParameterRotationYuv %d'
ffc986ac: '[IMP][PBROT]  INPUT  --- Yuv:%d Add:0x%lX Base:%ld'
ffc98838: '[IMP][PBROT] RequestRotationYuv %d'
ffc9885c: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc98cc0: '[IMP][PBROT] CancelRotationYuv %d'
ffc98ce4: '[IMP][PBROT] RegisterCBROfCompleteRotationYuv %d'
ffc98d18: '[IMP][PBROT] UnregisterCBROfCompleteRotationYuv %d'
ffaf9720: 'Dp_JpegToYuvNew() Layout[0x%08x]'
ffaf97a4: 'Dp_JpegToYuvNew [0x%08x]'
ffcad788: '[IMP][DECWIN] SetResWinParam yuv:%d InputSel:%d'
ffb01160: 'YuvBaseAddress [0x%08x]'
ffc99dc4: '[IMPD] StartYuvResizing TIMEOUT'
ffc9a150: '[IMPD] StartYuvRotating Comp'
ffafa4cc: 'Not Executed Dp_YuvToYuvHalf()'
ffafa6a8: 'Dp_YuvToYuvCopy()'
ffafa6d8: 'Dp_YuvToYuvReduce()'
ffafa720: 'Dp_ExecuteYuvResizing()'
ffafa758: 'ResizeYuvT Output nYuvMode [%d]'
ffafa998: 'Dp_ExecuteYuvResizingCBR() ErrorCode [0x%08x]'
ffafa9dc: 'Dp_YuvRotation() Rotate:%d'
ffc8f1c8: 'EvenSize >= YuvUnit'
ffc9f1e0: '  < IMD > ERR: YUV mode'
ffafaf44: 'ExecuteYuvRotation'
ffc99d44: '[IMPD] StartYuvResizing %d'
ffc955d0: '<RESIZE> SetParameterResizeYuv Before Lock'
ffc99d78: '[IMPD] ZoomMode:%d YuvMode:%d'
ffc99e04: '[IMPD] ResizeYuv:%d'
ffc9b9d8: '[IMPD] ERROR Dpx_ExecuteYuvAngleAdjust %d'
ffc49f9c: '[DEV] PonyYuvPath_ChangeCBR(ID=%#lx)'
ffc9c308: '[IMPD] (PUB) ExecuteYuvResizing %d'
ffc9a0f0: '[IMPD] StartYuvRotating %d'
ffcaf664: '  [BmpDDev] ConvertYUVPaletteToPBPalette (PRI)'
ffc44d70: '[DPATH] DCF_EN START DCF:%#lx YUV:%#lx'
ffc44f24: '[DPATH] DCF_EN STOP DCF:%#lx YUV:%#lx'
ffafa4b8: 'Dp_YuvToYuvHalf()'
ffc9c350: '[IMPD] (PUB) ExecuteYuvRotatingFor2Buffer %d'
ffafa68c: 'Dp_YuvToYuv64up() W:%d H:%d'
ff83e778: 'FA_YuvDevelopTestImage'
ff83e844: 'FA_GetYuvImage'
ffb151a8: 'YUV-Control Done'
ffca62f4: '[IMPV] SetUnitYUV %d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'
ffafa9c8: 'ExecuteYuvResize'
ff845488: '[FA] FA_GetYuvImage'
ffca0e48: '[IMP] (PUB) SetYuvColorParameter %d'
ffc95550: '[IMP][PBRSZ] SetParameterResizeYuv %d'
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 05:05:51 PM

something interesting... mbm29lv2mx16

ROM:FFD5D808 aAssertionFai_0 DCB "Assertion failed: (char*)WriteDataInFastModeOnRam > (char*)Erasi"
ROM:FFD5D808                                         ; DATA XREF: sub_FFD5DE00+28o
ROM:FFD5D808                                         ; ROM:off_FFD5DE80o
ROM:FFD5D808                 DCB "ngMethodOnRam, file ../MTD/mbm29lv2mx16/mbm29lv2mx16.c, line 86",0xA
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 06:02:20 PM
some more addresses : 0xC0F1407C , 0xC0F14074
   
In [12]: r 0xC0F1407C

str:[DispCon]_TurnOnDisplay_PUB+172:
str:[DispCon]_ShowBitmap_PUB+60:
str:[DispCon]_HideBitmap_PUB+60:
str:[DispCon]_SetDisplayType_PUB+372:

In [13]: r 0xC0F14074

str:[DispCon]_ShowImage_PUB+60:
str:[DispCon]_HideImage_PUB+60:
str:[DispCon]_SetDisplayType_PUB+356:
str:[DispCon]_TurnOnDisplay_PUB+156:
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 06:59:58 PM
GetDisplayType_FFCB8668

return *0xBEA0

--------------------------------------------------------------------------------

GetDisplayWidth_FFCB6CAC

if *0xBEA4 == 0 /*EQ*/:
    return 720
return 704

--------------------------------------------------------------------------------

GetDisplayHeight_FFCB8B04

if *0xBEA4 == 0 /*EQ*/:
    return 240
if *0xBEA4 == 1 /*EQ*/:
    return 480
return 576

--------------------------------------------------------------------------------


Display Resolution/Mode (maybe):

0 : w = 720, h = 240
1 : w = 704, h = 480
2 : w = 704, h = 576


--------------------------------------------------------------------------------

0x5B74 : unknown
0x5B78 : unknown
0x5BB8 : unknown
0x5BF8 : Vram Instance (maybe)
0x5BFC : unknown
0x5C00 : unknown
0x5C04 : unknown
0x5C08 : unknown
0x5C0C : unknown

0xB854 : unknown

0xBEA0 : DISPLAY TYPE
0xBEA4 : DISPLAY MODE (maybe)


0x1E004 : VRAM SEMAPHORE (maybe)
0x1E010 : VRAM INFORMATION
0x1E0A8 : unknown
0x1E100 : VRAM PARAMETERS  // 0x1E0A8 + 0x58 = 0x1E100
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 09:36:16 PM
   302:   589.004 [GUI] MasterResultCBR
   303:   589.210 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
   304:   589.992 [GUI] -> handleGuiInit
   305:   595.929 [DispCon] InitializeDisplayDeviceController (PUB)
   306:   597.086 [IMP] (PUB) InitializeImagePlayer 1113
   307:   598.805 [CERES] RegisterAdapterStatusCallback
   308:   604.642 [Graphics] GuiStartGraphics (PUB)
   309:   605.045 [IMP] (PUB) StartImagePlayer(mode=0) 1189
   310:   605.096 [IMP] CreateVram 665
   311:   605.252 [IMP] Vram0:0x1065BE00
   312:   605.354 [IMP] Vram1:0x106F3C8C
   ...
   858: 10003.647 myTaskDumpf:80: [MY_TEST] VRAM INFO:
   859: 10003.702 myTaskDumpf:84: [MY_TEST] Show ImageVramParameter : x:0 y:24 w:720 h:216
   861: 10118.505 [IMP] (PUB) GetVramInformation 3766
   862: 10118.608 myTaskDumpf:101: [MY_TEST] GetVramInformation : arg0=1065BE00 ; Vram0
   863: 10118.642 myTaskDumpf:102: [MY_TEST] GetVramInformation : arg1=00000000
   864: 10118.683 myTaskDumpf:103: [MY_TEST] GetVramInformation : arg2=106F3C8C ; Vram1
   865: 10118.708 myTaskDumpf:104: [MY_TEST] GetVramInformation : arg3=00000002
   866: 10118.739 myTaskDumpf:105: [MY_TEST] GetVramInformation : arg4=000002D0 ; 720
   867: 10118.768 myTaskDumpf:106: [MY_TEST] GetVramInformation : arg5=000002D0 ; 720
   868: 10118.798 myTaskDumpf:107: [MY_TEST] GetVramInformation : arg6=000000F0 ; 240


0x1E010+0x00 -> arg0
0x1E010+0x04 -> arg4
0x1E010+0x08 -> arg5
0x1E010+0x0C -> arg6
0x1E010+0x10 -> arg1
0x1E010+0x14 -> arg2
0x1E010+0x24 -> arg3
Title: Re: Canon 40D
Post by: jplxpto on September 15, 2012, 11:00:24 PM
Some more stubs :
Code: [Select]
NSTUB(0xFFCB02B4, CreatePhysicalVram)
NSTUB(0xFFCA01C8, CreateVram)
NSTUB(0xFFCA75C4, MakeHDVram)
NSTUB(0xFFB32EA0, LV_lvReturnVram)
NSTUB(0xFFCA130C, RefreshImageVram)
NSTUB(0xFFCA38DC, SetVramInformation)
NSTUB(0xFFCA432C, GetVramInformation)
NSTUB(0xFFCA3AA0, SetImageVramParameter)
NSTUB(0xFFCA6520, SetVramImageInfo)
NSTUB(0xFFCA3EC4, GetVramImageInfo)
NSTUB(0xFFCA8498, GetVramImagePosAndSize)
NSTUB(0xFFCA35D0, GetWorkImageLengthAndPosition)
Title: Re: Canon 40D
Post by: jplxpto on September 16, 2012, 02:12:02 AM
I did dump some state-objects and found that the structure appears to be the same as 5DC.


NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject);   // Mem 0x7770 / state matrix : 0xFFB3C9D4
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject);    // Mem 0x7748 / state matrix : 0xFFB3B540
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject);    // Mem 0x7738 / state matrix : 0xFFB39F5C
NSTUB(0xFFB32CB8, LVState_CreateStateObject);      // Mem 0x7628 / state matrix : 0xFFB2EDC4
NSTUB(0xFFD5CEA4, DMState_CreateStateObject);      // Mem 0xEFDC / state matrix : 0xFFD5CD84

   973: 11003.762 logMemory:24: DUMP DMState:
   974: 11003.815 logMemory:30: MEM(0x00201AD8) = 0xFFD4EE3C : type - "StateObject"
   975: 11003.861 logMemory:30: MEM(0x00201ADC) = 0xFFD5CD7C : name - "DMState"
   976: 11003.890 logMemory:30: MEM(0x00201AE0) = 0x00000000 : auto_sequence
   977: 11003.935 logMemory:30: MEM(0x00201AE4) = 0xFFD4F018 : StateTransition_maybe
   978: 11003.980 logMemory:30: MEM(0x00201AE8) = 0xFFD5CD84 : state_matrix
   979: 11004.009 logMemory:30: MEM(0x00201AEC) = 0x0000000E : max_inputs
   980: 11004.039 logMemory:30: MEM(0x00201AF0) = 0x00000002 : max_states
   981: 11004.069 logMemory:30: MEM(0x00201AF4) = 0x00000000 : current_state
   
   983: 11004.124 logMemory:24: DUMP LVState:
   984: 11004.169 logMemory:30: MEM(0x00797940) = 0xFFD4EE3C
   985: 11004.214 logMemory:30: MEM(0x00797944) = 0xFFB2F454
   986: 11004.244 logMemory:30: MEM(0x00797948) = 0x00000000
   987: 11004.289 logMemory:30: MEM(0x0079794C) = 0xFFD4F018
   988: 11004.335 logMemory:30: MEM(0x00797950) = 0xFFB2EDC4
   989: 11004.366 logMemory:30: MEM(0x00797954) = 0x0000000F
   990: 11004.396 logMemory:30: MEM(0x00797958) = 0x0000000E
   991: 11004.426 logMemory:30: MEM(0x0079795C) = 0x00000000

   993: 11004.483 logMemory:24: DUMP LVCAEState:
   994: 11004.528 logMemory:30: MEM(0x00796FB4) = 0xFFD4EE3C
   995: 11004.573 logMemory:30: MEM(0x00796FB8) = 0xFFB39F50
   996: 11004.603 logMemory:30: MEM(0x00796FBC) = 0x00000000
   997: 11004.648 logMemory:30: MEM(0x00796FC0) = 0xFFD4F018
   998: 11004.693 logMemory:30: MEM(0x00796FC4) = 0xFFB39F5C
   999: 11004.724 logMemory:30: MEM(0x00796FC8) = 0x0000000A
  1000: 11004.754 logMemory:30: MEM(0x00796FCC) = 0x00000006
  1001: 11004.784 logMemory:30: MEM(0x00796FD0) = 0x00000002

  1003: 11004.841 logMemory:24: DUMP LVCAFState:
  1004: 11004.887 logMemory:30: MEM(0x0079742C) = 0xFFD4EE3C
  1005: 11004.932 logMemory:30: MEM(0x00797430) = 0xFFB3B534
  1006: 11004.962 logMemory:30: MEM(0x00797434) = 0x00000000
  1007: 11005.007 logMemory:30: MEM(0x00797438) = 0xFFD4F018
  1008: 11005.052 logMemory:30: MEM(0x0079743C) = 0xFFB3B540
  1009: 11005.082 logMemory:30: MEM(0x00797440) = 0x0000000C
  1010: 11005.112 logMemory:30: MEM(0x00797444) = 0x00000009
  1011: 11005.143 logMemory:30: MEM(0x00797448) = 0x00000001

  1013: 11005.199 logMemory:24: DUMP LVCDEVState:
  1014: 11005.245 logMemory:30: MEM(0x0079754C) = 0xFFD4EE3C
  1015: 11005.290 logMemory:30: MEM(0x00797550) = 0xFFB3C9C8
  1016: 11005.320 logMemory:30: MEM(0x00797554) = 0x00000000
  1017: 11005.365 logMemory:30: MEM(0x00797558) = 0xFFD4F018
  1018: 11005.410 logMemory:30: MEM(0x0079755C) = 0xFFB3C9D4
  1019: 11005.440 logMemory:30: MEM(0x00797560) = 0x00000008
  1020: 11005.471 logMemory:30: MEM(0x00797564) = 0x00000003
  1021: 11005.501 logMemory:30: MEM(0x00797568) = 0x00000001
Title: Re: Canon 40D
Post by: jplxpto on September 16, 2012, 04:37:19 AM
DUMP FROM MEMORY ADDRESS 0x0001E000:
   
MEM(0x0001E000) = 0x00000000 (0)         // unknown parameter
MEM(0x0001E004) = 0x0011C1B0 (1163696)      // VRAM SEMAPHORE (maybe)
MEM(0x0001E008) = 0x0011C18C (1163660)      // maybe another semaphore
MEM(0x0001E00C) = 0x00000000 (0)         // unknown parameter
   
MEM(0x0001E010) = 0x1065BE00 (275103232)   // Vram0 address - (GetVramInformation - arg 0)
MEM(0x0001E014) = 0x000002D0 (720)         // Vram0 width (maybe) - (GetVramInformation - arg 4)
MEM(0x0001E018) = 0x000002D0 (720)         // Vram0 pitch (maybe) - (GetVramInformation - arg 5)
MEM(0x0001E01C) = 0x000000F0 (240)         // Vram0 height (maybe) - (GetVramInformation - arg 6)
MEM(0x0001E020) = 0x00000000 (0)         // unknown parameter - (GetVramInformation - arg 1)
   
MEM(0x0001E024) = 0x106F3C8C (275725452)   // Vram1 address - (GetVramInformation - arg 2)
MEM(0x0001E028) = 0x000002D0 (720)         // Vram1 width (maybe)
MEM(0x0001E02C) = 0x000002D0 (720)         // Vram1 pitch (maybe)
MEM(0x0001E030) = 0x000000F0 (240)         // Vram1 height (maybe)
MEM(0x0001E034) = 0x00000002 (2)         // unknown parameter - (GetVramInformation - arg 3)
   
MEM(0x0001E038) = 0x1DBC0064 (498860132) // Some Video memory
MEM(0x0001E03C) = 0x00000798 (1944)         // RAW (w / 2) - SRAW ???
MEM(0x0001E040) = 0x00000798 (1944)         // RAW (w / 2) - SRAW ???
MEM(0x0001E044) = 0x00000510 (1296)         // RAW (h / 2) - SRAW ???
MEM(0x0001E048) = 0x00000798 (1944)         // WorkImageSize - w
MEM(0x0001E04C) = 0x00000510 (1296)         // WorkImageSize - h
   
MEM(0x0001E050) = 0x00000000 (0)
MEM(0x0001E054) = 0x00000000 (0)
MEM(0x0001E058) = 0x00000000 (0)
MEM(0x0001E05C) = 0x00000000 (0)
MEM(0x0001E060) = 0x00000000 (0)
MEM(0x0001E064) = 0x00000000 (0)
MEM(0x0001E068) = 0x00000000 (0)
MEM(0x0001E06C) = 0x00000000 (0)
MEM(0x0001E070) = 0x00000000 (0)
MEM(0x0001E074) = 0x00000000 (0)
MEM(0x0001E078) = 0x00000000 (0)
MEM(0x0001E07C) = 0x00000000 (0)
MEM(0x0001E080) = 0x00000000 (0)
MEM(0x0001E084) = 0x00000000 (0)
   
MEM(0x0001E088) = 0x00484E5C (4738652)
MEM(0x0001E08C) = 0x00400000 (4194304)
MEM(0x0001E090) = 0x00000001 (1)

MEM(0x0001E094) = 0x00000F30 (3888)         // JpegSize - w
MEM(0x0001E098) = 0x00000A20 (2592)         // JpegSize - h

MEM(0x0001E09C) = 0x00001D40 (7488)         // EffectiveSizeOfJpeg - w
MEM(0x0001E0A0) = 0x00001380 (4992)         // EffectiveSizeOfJpeg - h

MEM(0x0001E0A4) = 0x00000000 (0)


MEM(0x0001E0A8) = 0x00000001 (1)   // star of some structure - unknown parameter ???
MEM(0x0001E0AC) = 0x00000000 (0)
MEM(0x0001E0B0) = 0x00000000 (0)

MEM(0x0001E0B4) = 0x1DBC0064 (498860132)        // SetImageWorkMemory - 1
MEM(0x0001E0B8) = 0x1E26F264 (505868900)         // SetImageWorkMemory - 2
MEM(0x0001E0BC) = 0x106F3C8C (275725452)    // Vram1 address

MEM(0x0001E0C0) = 0x00000000 (0)
   
MEM(0x0001E0C4) = 0x00484E5C (4738652)
MEM(0x0001E0C8) = 0x00400000 (4194304)
MEM(0x0001E0CC) = 0x00000000 (0)
MEM(0x0001E0D0) = 0x00000000 (0)

MEM(0x0001E0D4) = 0x00000F30 (3888)         // RAW w
MEM(0x0001E0D8) = 0x00000A20 (2592)         // RAW h

MEM(0x0001E0DC) = 0x000009C0 (2496)         // SetImageWorkMaxPixel - w
MEM(0x0001E0E0) = 0x00000750 (1872)         // SetImageWorkMaxPixel - h

MEM(0x0001E0E4) = 0x00000000 (0)
MEM(0x0001E0E8) = 0x00000000 (0)
MEM(0x0001E0EC) = 0x00000000 (0)
MEM(0x0001E0F0) = 0x00000000 (0)
MEM(0x0001E0F4) = 0x000002D0 (720)
MEM(0x0001E0F8) = 0x000001E0 (480)
MEM(0x0001E0FC) = 0x000002D0 (720)
   
================================================================
   
DUMP FROM MEMORY ADDRESS 0x0001E100:
   
MEM(0x0001E100) = 0x00000000 (0)         // pVramImagePositionX - ImageVramParameter
MEM(0x0001E104) = 0x00000018 (24)         // pVramImagePositionY - ImageVramParameter
MEM(0x0001E108) = 0x000002D0 (720)         // WholeWidth - ImageVramParameter
MEM(0x0001E10C) = 0x000000D8 (216)         // WholeHeigh - ImageVramParameter
MEM(0x0001E110) = 0x0001DC00 (121856)      // Aspect - ImageVramParameter ???
MEM(0x0001E114) = 0x00000000 (0)
MEM(0x0001E118) = 0x00000000 (0)
MEM(0x0001E11C) = 0x00000000 (0)
MEM(0x0001E120) = 0x00000000 (0)
MEM(0x0001E124) = 0x00000000 (0)
MEM(0x0001E128) = 0x00000000 (0)
MEM(0x0001E12C) = 0x00000000 (0)
MEM(0x0001E130) = 0x00000000 (0)
MEM(0x0001E134) = 0x00000000 (0)
MEM(0x0001E138) = 0x00000000 (0)
MEM(0x0001E13C) = 0x00000000 (0)
MEM(0x0001E140) = 0x005E5558 (6182232)
MEM(0x0001E144) = 0x00000000 (0)
MEM(0x0001E148) = 0x0001DB90 (121744)
MEM(0x0001E14C) = 0x00000000 (0)
MEM(0x0001E150) = 0xFF8851E4 (-7843356)
MEM(0x0001E154) = 0x00012D6C (77164)
MEM(0x0001E158) = 0x00000000 (0)
MEM(0x0001E15C) = 0x00000000 (0)
MEM(0x0001E160) = 0xFFCA415C (-3522212)
MEM(0x0001E164) = 0x00000000 (0)
MEM(0x0001E168) = 0x00000000 (0)
MEM(0x0001E16C) = 0x00000000 (0)
MEM(0x0001E170) = 0x00000000 (0)

MEM(0x0001E174) = 0x00000000 (0) // SetVramImageInfo - x
MEM(0x0001E178) = 0x00000018 (24) // SetVramImageInfo - y
MEM(0x0001E17C) = 0x000002D0 (720) // SetVramImageInfo - w
MEM(0x0001E180) = 0x000000D8 (216) // SetVramImageInfo - h

MEM(0x0001E184) = 0x00000000 (0)
MEM(0x0001E188) = 0x00000000 (0)
   
MEM(0x0001E18C) = 0x106F3C8C (275725452)   // Vram1 address
MEM(0x0001E190) = 0x000002D0 (720)
MEM(0x0001E194) = 0x000000F0 (240)
MEM(0x0001E198) = 0x00000000 (0)
MEM(0x0001E19C) = 0x00000018 (24)
MEM(0x0001E1A0) = 0x000002D0 (720)
MEM(0x0001E1A4) = 0x000000D8 (216)
   
MEM(0x0001E1A8) = 0x00000000 (0)
MEM(0x0001E1AC) = 0x00000000 (0)
MEM(0x0001E1B0) = 0x00000000 (0)
MEM(0x0001E1B4) = 0x00000000 (0)
MEM(0x0001E1B8) = 0x00000000 (0)
MEM(0x0001E1BC) = 0x00000000 (0)
MEM(0x0001E1C0) = 0x00000000 (0)
MEM(0x0001E1C4) = 0x00000000 (0)
MEM(0x0001E1C8) = 0x00000000 (0)
MEM(0x0001E1CC) = 0x00000000 (0)
MEM(0x0001E1D0) = 0x00000000 (0)
MEM(0x0001E1D4) = 0x00000000 (0)
MEM(0x0001E1D8) = 0x00000000 (0)
MEM(0x0001E1DC) = 0x00000000 (0)
MEM(0x0001E1E0) = 0x00000000 (0)
MEM(0x0001E1E4) = 0x00000000 (0)
MEM(0x0001E1E8) = 0x00000000 (0)
MEM(0x0001E1EC) = 0x00000000 (0)
MEM(0x0001E1F0) = 0x00000000 (0)
MEM(0x0001E1F4) = 0x00000000 (0)
MEM(0x0001E1F8) = 0x00000000 (0)
MEM(0x0001E1FC) = 0x00000000 (0)
   

Vram0:0x1065BE00
Vram1:0x106F3C8C
Title: Re: Canon 40D
Post by: jplxpto on September 17, 2012, 01:36:51 AM
   698:  3711.532 [GUI] StartPlayMain
   699:  3718.551 [Graphics] CreateSharedBuffer !!!
   700:  3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
   701:  3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200

   702:  3719.292 [Graphics] GuiGraphicsNormalMode (PUB)


ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264


0x1dbc0064 + 0x6af200 = 0x1e26f264

0x6af200 size (maybe)


Maybe YUV422 VRAM - Playback Image
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 01:37:33 AM
I found four 'Vram Instance' strings in memory.
I believe that is the beginning of the structure vram_object.
I think two of them should be cacheable version and the other two uncacheable version.

0x00400B84   
0x00800B84
   
0x10400B84
0x10800B84
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 03:41:21 AM
    I found a service menu on the 40D.
    I ran the function at 0xFF8170D4 and appeared to me an error in the CMOS camera's LCD.

   NSTUB(test_servicemenu_maybe, 0xFF8170D4)  at v1.1.1

   757: 59388.950 [GUI] DlgMnMainTabHeader.c PRESS_MLT_LEFT_BUTTON
   758: 59403.149 [GUI] DlgMnMainPlay1 GOT_TOP_OF_CONTROL
   760: 60043.684 [GUI_E] GUI_Control:60 0x0
   761: 60044.247 [GUI] IDLEHandler SERVICE_MENU
   762: 60044.300 [GUI] SetGUIRequestMode(25)
   763: 60044.324 [GUI] NotifyGUIEvent(1)

---------------------------------------------

ERR    123 123 123 025 032

REL     11709

CMOS  J0369547

---------------------------------------------
Title: Re: Canon 40D
Post by: a1ex on September 19, 2012, 07:38:48 AM
Be careful what you call, some things can do permanent damage.
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 11:33:29 AM
Thank you Alex. I'll be careful. I am aware that there is dangerous.
Title: Re: Canon 40D
Post by: nanomad on September 19, 2012, 12:39:53 PM
no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them
Title: Re: Canon 40D
Post by: a1ex on September 19, 2012, 01:00:23 PM
For a first port, take a look at 7D changeset, once you find the stubs it's probably a good starting point.
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 01:07:30 PM
Ok, i'll do that...

Thank you
Title: Re: Canon 40D
Post by: jplxpto on September 19, 2012, 11:05:19 PM
no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them

I appreciate your advice. I've been through some of these stubs and thought the same.

I hope not to make any serious mistake ... I really want to have the ML in my precious camera.

Thank you
Title: Re: Canon 40D
Post by: jplxpto on September 20, 2012, 01:18:51 AM
40D v 1.1.1 - StateObjects List

Code: [Select]
NSTUB(0x62B4, DpImgEditState);
NSTUB(0x5D88, DpState);
NSTUB(0x7E38, TOMState);

//NSTUB(, USBC20State_1);
//NSTUB(, USBC20State_2);
//NSTUB(, USBC20State_3);
//NSTUB(, USBC20State_4);

NSTUB(0x7E60, CeresStateState);
NSTUB(0x1AF60, PtpDpsStateState);
NSTUB(0x1AF64, PtpEvtListAccsSem);
NSTUB(0x1D34, RMTState);

NSTUB(0x7824, FSSState);
//NSTUB(0xB710, PropState);  // maybe
NSTUB(0x7840, RDState);
NSTUB(0x7770, LVCDEVState);
NSTUB(0x7748, LVCAFState);
NSTUB(0x7738, LVCAEState);
NSTUB(0x7628, LVState);
//NSTUB(???, FWState);
//NSTUB(???, FRState);
NSTUB(0x834C, MrkState);
NSTUB(0x781C, FCSState);
NSTUB(0x7E10, SdioTskState);
NSTUB(0x82CC, FMNormalState);
NSTUB(0xEFDC, DMState);
Title: Re: Canon 40D
Post by: jplxpto on September 20, 2012, 02:28:17 AM
Dump from 0x00007600 to 0x00008000, when camera menu is showed and mode equal to M :
Code: [Select]
MEM(0x00007600) = 0xFFB2BDA4 (-5063260)
MEM(0x00007604) = 0xFFB2C4A0 (-5061472)
MEM(0x00007608) = 0x00000000 (0)
MEM(0x0000760C) = 0x00000000 (0)
MEM(0x00007610) = 0x1024F09C (270856348)
MEM(0x00007614) = 0x00000001 (1)
MEM(0x00007618) = 0x10206DC0 (270560704)
MEM(0x0000761C) = 0x10252520 (270869792)
MEM(0x00007620) = 0x10223820 (270678048)
MEM(0x00007624) = 0x007975F4 (7960052)
MEM(0x00007628) = 0x00797940 (7960896)
MEM(0x0000762C) = 0x00000000 (0)
MEM(0x00007630) = 0xC0F03030 (-1058000848)
MEM(0x00007634) = 0x80010000 (-2147418112)
MEM(0x00007638) = 0xC0F03068 (-1058000792)
MEM(0x0000763C) = 0x80010004 (-2147418108)
MEM(0x00007640) = 0xC0F03070 (-1058000784)
MEM(0x00007644) = 0x80010007 (-2147418105)
MEM(0x00007648) = 0xC0F0B008 (-1057968120)
MEM(0x0000764C) = 0x00000000 (0)
MEM(0x00007650) = 0xFFFFFFFF (-1)
MEM(0x00007654) = 0xFFFFFFFF (-1)
MEM(0x00007658) = 0xC0F03044 (-1058000828)
MEM(0x0000765C) = 0x00000002 (2)
MEM(0x00007660) = 0xC0F03044 (-1058000828)
MEM(0x00007664) = 0x00000000 (0)
MEM(0x00007668) = 0xC0F0B000 (-1057968128)
MEM(0x0000766C) = 0x00000000 (0)
MEM(0x00007670) = 0xC0F0B004 (-1057968124)
MEM(0x00007674) = 0x00000001 (1)
MEM(0x00007678) = 0xC0F09000 (-1057976320)
MEM(0x0000767C) = 0x00000001 (1)
MEM(0x00007680) = 0xFFFFFFFF (-1)
MEM(0x00007684) = 0xFFFFFFFF (-1)
MEM(0x00007688) = 0xC0F09000 (-1057976320)
MEM(0x0000768C) = 0x80000000 (-
MEM(0x00007690) = 0xC0F0B000 (-1057968128)
MEM(0x00007694) = 0x00000001 (1)
MEM(0x00007698) = 0xC0F0B004 (-1057968124)
MEM(0x0000769C) = 0x00000000 (0)
MEM(0x000076A0) = 0xFFFFFFFF (-1)
MEM(0x000076A4) = 0xFFFFFFFF (-1)
MEM(0x000076A8) = 0xC0F03030 (-1058000848)
MEM(0x000076AC) = 0x00000000 (0)
MEM(0x000076B0) = 0xC0F03068 (-1058000792)
MEM(0x000076B4) = 0x00000000 (0)
MEM(0x000076B8) = 0xC0F03070 (-1058000784)
MEM(0x000076BC) = 0x00000000 (0)
MEM(0x000076C0) = 0xFFFFFFFF (-1)
MEM(0x000076C4) = 0xFFFFFFFF (-1)
MEM(0x000076C8) = 0xC0F0851C (-1057979108)
MEM(0x000076CC) = 0x00060258 (393816)
MEM(0x000076D0) = 0xC0F08520 (-1057979104)
MEM(0x000076D4) = 0x032C0568 (53216616)
MEM(0x000076D8) = 0xC0F11250 (-1057942960)
MEM(0x000076DC) = 0x00900000 (9437184)
MEM(0x000076E0) = 0xC0F11254 (-1057942956)
MEM(0x000076E4) = 0x028F02FF (42926847)
MEM(0x000076E8) = 0xFFFFFFFF (-1)
MEM(0x000076EC) = 0xFFFFFFFF (-1)
MEM(0x000076F0) = 0xC0F0851C (-1057979108)
MEM(0x000076F4) = 0x00060258 (393816)
MEM(0x000076F8) = 0xC0F08520 (-1057979104)
MEM(0x000076FC) = 0x032C0568 (53216616)
MEM(0x00007700) = 0xC0F11250 (-1057942960)
MEM(0x00007704) = 0x011000C0 (17825984)
MEM(0x00007708) = 0xC0F11254 (-1057942956)
MEM(0x0000770C) = 0x020F0241 (34538049)
MEM(0x00007710) = 0xFFFFFFFF (-1)
MEM(0x00007714) = 0xFFFFFFFF (-1)
MEM(0x00007718) = 0x00000000 (0)
MEM(0x0000771C) = 0x00000006 (6)
MEM(0x00007720) = 0xFFB38304 (-5012732)
MEM(0x00007724) = 0x00000000 (0)
MEM(0x00007728) = 0x00796F74 (7958388)
MEM(0x0000772C) = 0x00000000 (0)
MEM(0x00007730) = 0x00000000 (0)
MEM(0x00007734) = 0x00000000 (0)
MEM(0x00007738) = 0x00796FB4 (7958452)
MEM(0x0000773C) = 0x00000000 (0)
MEM(0x00007740) = 0x007973EC (7959532)
MEM(0x00007744) = 0x10202438 (270541880)
MEM(0x00007748) = 0x0079742C (7959596)
MEM(0x0000774C) = 0x00000000 (0)
MEM(0x00007750) = 0x00000000 (0)
MEM(0x00007754) = 0x0079750C (7959820)
MEM(0x00007758) = 0x00000000 (0)
MEM(0x0000775C) = 0x00000005 (5)
MEM(0x00007760) = 0x00000000 (0)
MEM(0x00007764) = 0x00000000 (0)
MEM(0x00007768) = 0x00000000 (0)
MEM(0x0000776C) = 0x00000000 (0)
MEM(0x00007770) = 0x0079754C (7959884)
MEM(0x00007774) = 0x00000000 (0)
MEM(0x00007778) = 0x00010339 (66361)
MEM(0x0000777C) = 0xFFFF0000 (-65536)
MEM(0x00007780) = 0x00040002 (262146)
MEM(0x00007784) = 0x00080004 (524292)
MEM(0x00007788) = 0x009000A4 (9437348)
MEM(0x0000778C) = 0x00200010 (2097168)
MEM(0x00007790) = 0x00FA0020 (16384032)
MEM(0x00007794) = 0x0015FF06 (1441542)
MEM(0x00007798) = 0xFFE80000 (-1572864)
MEM(0x0000779C) = 0x00100040 (1048640)
MEM(0x000077A0) = 0x0018000E (1572878)
MEM(0x000077A4) = 0x00480078 (4718712)
MEM(0x000077A8) = 0x00000010 (16)
MEM(0x000077AC) = 0x00000098 (152)
MEM(0x000077B0) = 0x00000060 (96)
MEM(0x000077B4) = 0x00000088 (136)
MEM(0x000077B8) = 0x0000006F (111)
MEM(0x000077BC) = 0x00000048 (72)
MEM(0x000077C0) = 0x00000058 (88)
MEM(0x000077C4) = 0x00000056 (86)
MEM(0x000077C8) = 0x00000100 (256)
MEM(0x000077CC) = 0x00000080 (128)
MEM(0x000077D0) = 0x00000000 (0)
MEM(0x000077D4) = 0x00000000 (0)
MEM(0x000077D8) = 0x00000000 (0)
MEM(0x000077DC) = 0x00000000 (0)
MEM(0x000077E0) = 0x00000000 (0)
MEM(0x000077E4) = 0x00000000 (0)
MEM(0x000077E8) = 0x00000000 (0)
MEM(0x000077EC) = 0x00000001 (1)
MEM(0x000077F0) = 0x00000000 (0)
MEM(0x000077F4) = 0x00000000 (0)
MEM(0x000077F8) = 0x00000004 (4)
MEM(0x000077FC) = 0x00000000 (0)


Code: [Select]
MEM(0x00007648) = 0xC0F0B008 (-1057968120)
Title: Re: Canon 40D
Post by: jplxpto on September 20, 2012, 04:15:34 AM
Sounds good.

Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.

Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.

        These are the values ​​I got ...

   EDMAC Registers (maybe)
Code: [Select]
MEM(0xC0F04008) = 0x3FBFFFF6
MEM(0xC0F04108) = 0x3695B69E
MEM(0xC0F04208) = 0x3F802DFC
MEM(0xC0F04308) = 0x1BB044CA
MEM(0xC0F04408) = 0x3E04583E
MEM(0xC0F04508) = 0x3A91B07C
MEM(0xC0F04608) = 0x1EA3FFCC
MEM(0xC0F04708) = 0x00000000
MEM(0xC0F04808) = 0x3A6F3EDE
MEM(0xC0F04908) = 0x3F20DE9E
MEM(0xC0F04A08) = 0x3D701EFE
MEM(0xC0F04B08) = 0x194F3D52
MEM(0xC0F04C08) = 0x34794AD6
MEM(0xC0F04D08) = 0x2A674EDE
MEM(0xC0F04E08) = 0x00000000
MEM(0xC0F04F08) = 0x00000000


at 0xFFCF8184 : MOV     R3, 0xC0F04008

Code: [Select]
NSTUB(0xFFCF8184, GetEDmacAddress)
Title: Re: Canon 40D
Post by: a1ex on September 20, 2012, 08:35:01 AM
Doesn't look like anything known, so it's probably not edmac.
Title: Re: Canon 40D
Post by: jplxpto on September 20, 2012, 12:27:58 PM
I also did not like the results.
Title: Re: Canon 40D
Post by: jplxpto on September 21, 2012, 02:25:14 AM
I found several LV functions that are registered, so they can be invoked by name.

FW v 1.1.1

Code: [Select]
NSTUB(0xFFB2E208, lv_start)
NSTUB(0xFFB2E244, lv_stop)

NSTUB(0xFFB2E280, lv_vram_dump)
NSTUB(0xFFB2E308, lv_yuv_dump)
NSTUB(0xFFB2E38C, lv_fps)

NSTUB(0xFFB2E3FC, lv_psave_on)
NSTUB(0xFFB2E46C, lv_psave_off)

NSTUB(0xFFB2DB54, lv_debug_ae)
NSTUB(0xFFB2DCF4, lv_debug_wb)
NSTUB(0xFFB2E4DC, lv_debug_af)

NSTUB(0xFFB2E5F8, lv_ae)
NSTUB(0xFFB2E668, lv_wb)
NSTUB(0xFFB2E6D8, lv_af_raw)

NSTUB(0xFFB2E748, lv_debug_flag)

NSTUB(0xFFB2E588, lv_data_count)

NSTUB(0xFFB2E82C, lv_eshutter)
NSTUB(0xFFB2E97C, lv_tvaf_start)
NSTUB(0xFFB2E89C, lv_magnify)

NSTUB(0xFFB2E90C, lv_save_raw)
Title: Re: Canon 40D
Post by: LensPainter on September 21, 2012, 10:01:58 AM
Hi,
I'm new here and anxious to see the 40D to be used with ML:)
This is very very techy-stuff and hard for me to understand - so I'd just like to know, if there is a lantern at the end of the tunnel;)

Is there any way to support you?

Kind regards

Uwe
Title: Re: Canon 40D
Post by: jplxpto on September 21, 2012, 11:33:17 AM
Hi,
I'm new here and anxious to see the 40D to be used with ML:)
This is very very techy-stuff and hard for me to understand - so I'd just like to know,
if there is a lantern at the end of the tunnel;)

Is there any way to support you?

Kind regards

Uwe


I'm also very anxious to see the ML working for the first time ... and on my camera :)

I am new at this but I'm motivated ... soon I hope to ignite that light ...
for now i just lit the blue and red LED :)

I never received anything for my work, but donations are welcome.
They are the fuel needed to be able to see the light ... My God! :)

Title: Re: Canon 40D
Post by: jplxpto on September 21, 2012, 11:37:48 AM
I found the location of the structure 'vram_info'.

Code: [Select]
/** VRAM info in the BSS.
 *
 * Pixels are in an YUV 422 format.
 * This points to the image VRAM, not the bitmap vram
 */
struct vram_info
{
        uint8_t *               vram;           // off 0x00
        uint32_t                width;          // maybe off 0x04
        uint32_t                pitch;          // maybe off 0x08
        uint32_t                height;         // off 0x0c
        uint32_t                vram_number;    // off 0x10
};
SIZE_CHECK_STRUCT( vram_info, 0x14 );

extern struct vram_info vram_info[2];

Code: [Select]
NSTUB(0x0001E010, vram_info)

 MEM(0x0001E010) = 0x1065BE00 (275103232)
 MEM(0x0001E014) = 0x000002D0 (720)
 MEM(0x0001E018) = 0x000002D0 (720)
 MEM(0x0001E01C) = 0x000000F0 (240)
 MEM(0x0001E020) = 0x00000002 (2)
 
 MEM(0x0001E024) = 0x106F3C8C (275725452)
 MEM(0x0001E028) = 0x000002D0 (720)
 MEM(0x0001E02C) = 0x000002D0 (720)
 MEM(0x0001E030) = 0x000000F0 (240)
 MEM(0x0001E034) = 0x00000000 (0)
Title: Re: Canon 40D
Post by: mediabaron on September 23, 2012, 04:36:05 AM
Having the 40D record video would be excellent. The resolution of 1024 x 680 is plenty for web video.

People do have to realize that the 40D was never intended to shoot video so it doesn't have a microphone or audio circuitry built into it. You will have to capture audio separately or lay down a background track of something like music.

But having the other ML still image features would greatly increase the use of the 40D for things like time-lapse photography and other applications.
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 05:31:55 PM
Having the 40D record video would be excellent. The resolution of 1024 x 680 is plenty for web video.

People do have to realize that the 40D was never intended to shoot video so it doesn't have a microphone or audio circuitry built into it. You will have to capture audio separately or lay down a background track of something like music.

But having the other ML still image features would greatly increase the use of the 40D for things like time-lapse photography and other applications.


I have spent many hours with my camera, but I've done a few shots. I can not say when will release the first version for testing. I believe there are many users around the world who have this camera. I started this project because I feel a little revolted. The canon has never released a version with AF microadjustment. Many of us bought high quality lenses that would greatly benefit from this functionality. We gave billions of profit to Canon. I think they should respect us more and remember living of our money. I know the camera was discontinued but I did not let being a customer paying for a quality service. I may be a drop in the ocean with sharks but many, donald duck got rich collecting small coins. This is my response to the canon. If things go the way I want in a few months you can all enjoy my work without being forced to pay a penny.
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 06:41:38 PM
I found some more interesting things:

Code: [Select]
strings -t x 40d.111.ROMF1.0xFF800000.bin | perl renumber.pl 0xFF800000 > 40d.111.ROMF1.0xFF800000.string

grep 40d.111.ROMF1.0xFF800000.strings -e "Mgr$"

Code: [Select]
ffacff30 DpMgr
ffb04078 DpImgEditMgr
ffb2d10c LiveViewMgr
ffbaee34 TOMgr
ffbc55a0 FileMgr
ffc49060 DDDMgr
ffc877fc PropMgr
ffd17614 CardServiceMgr
ffd4c084 DbgMgr
ffd5a30c PowerMgr


With this simple command is simple filter many of the file names of the source code.
Sometimes it may be useful to help find some things in the dump.

Code: [Select]
grep 40d.111.ROMF1.0xFF800000.strings -e ".*\.c" > 40d.111.ROMF1.0xFF800000.files
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 07:13:01 PM
Some memory address at firmware:

Code: [Select]
ffff1c6c Write Address : 0x00000000
ffff1c8c Write Address : 0x04000000
ffff2714 4.Erase TORNADO and Command area (0x%x -> 0x%x)
ffff2748 5.Erase Program area (0xF8010000 -> 0xF862FFFF)
ffff3578 Is flg written(Y=ON(0xFFFFFFFF)/N=OFF(0x00000000))? :
ffff3608 Is flg written(Y=ON(0x00000000)/N=OFF(0xFFFFFFFF))? :
ffff3774 ERASE [ROM1][0x00000000]
ffff39e4 Input start_address (ram 0x00000000 -> 0x40000000) :
ffff3a1c Input end_address   (ram 0x00000000 -> 0x40000000) :
ffff3a54 Input address       (rom 0xf8000000 -> 0xf87FE000) :
ffff5914 FROM Check Sum is 0x%08x
ffff5930 ( 0xF8010000 - 0xF85FFFFF )
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 07:27:06 PM


grep 40d.111.ROMF1.0xFF800000.strings -e ".*[GUI].*StartMn" | awk -F' ' '{ print $3 }' | sort | uniq -u

Code: [Select]
StartMnActiveSweepApp
StartMnActiveSweepAutoApp
StartMnBrightnessApp
StartMnBusyApp
StartMnBusyKeepEventBtnApp()
StartMnCameraClearApp
StartMnCameraRegApp
StartMnCameraRegConfirmApp
StartMnCameraUnRegApp
StartMnCameraUnRegConfirmApp
StartMnCameraUnRegSelectApp
StartMnCardExtensionApp
StartMnCardFormatBeginAp
StartMnCardFormatexcuteApp
StartMnCopyBusyApp()
StartMnCopyConfirmApp
StartMnCopyMsgApp(
StartMnCopyResultApp(
StartMnCustomFnApp(%d)(%d)
StartMnCustomFnClearApp
StartMnDustOffDataApp
StartMnDustOffDataCompleteApp
StartMnDustOffDataExcuteApp
StartMnEraseImageApp
StartMnEraseImageBusyApp
StartMnEraseImageConfirmApp
StartMnEraseImageDummyApp
StartMnHandWorkSweepApp
StartMnImageZoneQualityApp
StartMnLanguageApp
StartMnLiveViewApp
StartMnMainCustomFuncApp()
StartMnMainMyMenuApp()
StartMnMainPlay1App()
StartMnMainPlay2App()
StartMnMainRec1App()
StartMnMainRec2App()
StartMnMainSetup1App()
StartMnMainSetup2App()
StartMnMainSetup3App()
StartMnMainStudioApp()
StartMnMmMessageApp(
StartMnMwbImageConfirmApp
StartMnMWBWarningApp
StartMnMyMenuDeleteApp()
StartMnMyMenuPreRearrange(
StartMnMyMenuRearrange(
StartMnMyMenuSelect()
StartMnMyMenuSetting()
StartMnPictureStyleDetailApp
StartMnPictureStyleMain
StartMnPictureUserDetail
StartMnQualityApp
StartMnQualityDivideApp
StartMnQualityDivideSelectApp
StartMnSensorCleanApp
StartMnStroboBuiltInSettingApp
StartMnStroboControlApp
StartMnStroboCustomFnApp
StartMnStroboCustomFnClearApp
StartMnStroboErrorApp
StartMnStroboFnSettingApp
StartMnStroboFnSettingClearApp
StartMnStroboFnSettingHeaderApp()
StartMnStroboOldOutSettingApp
StartMnStroboWirelessApp
StartMnStudioModeChangeConfirmApp
StartMnWBApp
StartMnWbBktApp

With this command we can get the list of menus available in firmware. This command can be useful for finding the code some functionality that is available in the original firmware.
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 07:59:18 PM
Some more strings...

Code: [Select]
grep -e "libc" 40d.111.ROMF1.0xFF800000.strings
Code: [Select]
ffcb9150 ../libcsvg/svg_canvas.c
ffcbd930 gfff../libcsvg/svg_paint.c
ffcbe118 ../libcsvg/svg_render.c
ffcbeb48 ../libcsvg/dom/dom.c
ffcbfc5c ../libcsvg/dom/dom_common.c
ffcc22e4 ../libcsvg/dom/dom_trait.c
ffcc629c ../libcsvg/core/attrib_core.c
ffcc6a88 ../libcsvg/core/attrib_graphics.c
ffcc733c ../libcsvg/core/attrib_paint.c
ffcca84c ../libcsvg/core/elem_anim.c
ffcd3138 ../libcsvg/core/elem_path.c
ffcd5b54 ../libcsvg/core/elem_shape.c
ffcd8354 ../libcsvg/core/elem_struct.c
ffcda5fc ../libcsvg/core/render_path.c
ffcdb054 ../libcsvg/core/render_shape.c
ffcdda64 ../libcsvg/core/stack_canvas.c
ffcddba4 ../libcsvg/core/stack_common.c
ffcddd38 ../libcsvg/core/stack_coordinate.c
ffcddedc ../libcsvg/core/stack_core.c
ffcde000 ../libcsvg/core/stack_element.c
ffcdebf8 ../libcsvg/core/stack_transform.c
ffce0f44 ../libcsvg/common/hash.c
ffce1274 ../libcsvg/common/id_table.c
ffce15b0 ../libcsvg/common/queue.c
ffce3a1c ../libcsvg/common/utils.c
ffce5bd8 ../libcucs/ucs.c
ffce9b34 ../libcsvg/common/uriref.c
ffcea324 ../libcsvg/svg_path.c
ffcef4e0 ../libcsvg/core/attrib_animtiming.c
ffcf09f4 ../libcsvg/core/datatype_preserveaspectratio.c
ffcf1568 ../libcsvg/core/render_anim.c
Title: Re: Canon 40D
Post by: a1ex on September 23, 2012, 08:05:33 PM
Those Start***App sometimes can be started, but it's not a clean method for using them IMO. These calls may bring the correct dialog, but they do not setup the keys (guimode) and probably other things.

There is a SVG library inside, but nobody figured out how to use it.
Title: Re: Canon 40D
Post by: jplxpto on September 23, 2012, 10:08:54 PM
I keep looking for the addresses of VRAM ... My next goal is to write on the LCD.

Unfortunately I have not got great results ... soon, I hope to get this my goal.

I know there are many similarities between the 5DC and 40D cameras.
So I decided to look some things coutts already found in your 5DC.



from magic lantern source code...

Code: [Select]
/** Canon data structure containing BMP VRAM address.
 *
 * LCD: it points to a 720x480 cropped area, but the image buffer is actually 960x540.
 * HDMI: it points to the full image buffer.
 *
 * ML alters this pointer to always indicate the 720x480 cropped area
 * (to avoid the possibility of buffer overflow due to race conditions when changing display modes).
 */
struct bmp_vram_info
{
        uint8_t *               vram0;
        uint32_t                off_0x04;
        uint8_t *               vram2;
};

extern struct bmp_vram_info bmp_vram_info[];

from 5DC.111 firmware...

Code: [Select]

NSTUB(0x29448, bmp_vram_info)

MakeName(0xFFB0A95C, "str:[BmpDDev]_SelectParameter");
MakeName(0xFFB0B174, "str:[BmpDDev]_DisplayPhysicalScreen");

REAL BMP VRAM  : 0x29320+8 =0x29328

REAL BMP VRAM  : 0x29330+8 =0x29338
REAL BMP VRAM  : 0x29350+8 =0x29358

from 40D.111 firmware...

Code: [Select]
NSTUB(0x1E450, bmp_vram_info)

MakeName(0xFFCAFAE0, "str:[BmpDDev]_SelectParameter");
MakeName(0xFFCB0468, "str:[BmpDDev]_DisplayPhysicalScreen");

REAL BMP VRAM  : 0x1E328+8 = 1E330

REAL BMP VRAM  : 0x1E338+8 = 1E340
REAL BMP VRAM  : 0x1E358+8 = 1E360




Here are some of the logs generated by my tests ...

Code: [Select]
   667: 10003.609 myTaskDumpf:204: [JP] VRAM INFO:
   668: 10003.670 printVramInfo:25: [JP] VRAM_INFO: vram address = 0x1065BE00
   669: 10003.698 printVramInfo:26: [JP] VRAM_INFO: width = 720
   670: 10003.722 printVramInfo:27: [JP] VRAM_INFO: pitch = 720
   671: 10003.746 printVramInfo:28: [JP] VRAM_INFO: height = 240
   672: 10003.767 printVramInfo:29: [JP] VRAM_INFO: vram_number = 0
   673: 10003.806 printVramInfo:25: [JP] VRAM_INFO: vram address = 0x106F3C8C
   674: 10003.830 printVramInfo:26: [JP] VRAM_INFO: width = 720
   675: 10003.853 printVramInfo:27: [JP] VRAM_INFO: pitch = 720
   676: 10003.876 printVramInfo:28: [JP] VRAM_INFO: height = 240
   677: 10003.897 printVramInfo:29: [JP] VRAM_INFO: vram_number = 2
   678: 10003.921 printBmpVramInfo:45: [JP] BMP_VRAM_INFO: i = 0x00
   679: 10003.961 printBmpVramInfo:46: [JP] BMP_VRAM_INFO: vram0 address = 0x10631714
   680: 10003.988 printBmpVramInfo:47: [JP] BMP_VRAM_INFO: off_0x04 address = 0x00000000
   681: 10004.027 printBmpVramInfo:48: [JP] BMP_VRAM_INFO: vram2 address = 0x48544F00

   687: 11143.643 myTaskDumpf:230: [JP] MEM(0x0001E330) = 0x10631714  // vram0 address
   688: 11143.707 myTaskDumpf:231: [JP] MEM(0x0001E340) = 0x10631714  // vram0 address
   689: 11143.741 myTaskDumpf:232: [JP] MEM(0x0001E360) = 0x00000000
   690: 11143.773 myTaskDumpf:234: [JP] MEM(0x0000BEA0) = 0x00000000 // DisplayType
   691: 11143.802 myTaskDumpf:235: [JP] MEM(0x0000BEA4) = 0x00000000 // W x H = 720x240
   692: 11143.832 myTaskDumpf:236: [JP] MEM(0x0000B854) = 0x00000002
Title: Re: Canon 40D
Post by: jplxpto on September 24, 2012, 01:42:59 AM
These stubs are very important for our work so I decided to put them here ... require confirmation ...
I have not tested them all. I have used them to make some memory dumps.

40d v 1.1.1

Code: [Select]
NSTUB(0xFFC39AE4, FIO_RemoveFile)
NSTUB(0xFFD1682C, FIO_OpenFile)
NSTUB(0xFFD168F8, FIO_CreateFile)
NSTUB(0xFFD16A80, FIO_ReadFile)
NSTUB(0xFFD16BF0, FIO_WriteFile)
NSTUB(0xFFD16CA8, FIO_CloseFile)
NSTUB(0xFFD16D5C, FIO_GetFileSize)
NSTUB(0xFFD17244, FIO_GetDeviceName)
NSTUB(0xFFD7A968, FIO_FindNextEx)
Title: Re: Canon 40D
Post by: a1ex on September 24, 2012, 08:40:42 AM
Can you dump around 200K from each VRAM address?

Use the cacheable addresses if you can't (remove the first 1).
Title: Re: Canon 40D
Post by: jplxpto on September 24, 2012, 12:01:31 PM
Can you dump around 200K from each VRAM address?

Use the cacheable addresses if you can't (remove the first 1).

Yes, I will do that ..
Title: Re: Canon 40D
Post by: coutts on September 26, 2012, 08:12:32 PM
Yes, I will do that ..
A simple test to see if you found the vram is to try and paint on the screen, write something like 64kb of 1s to the buffer and you should see a colored square on the screen.

great to see your progress!!
Title: Re: Canon 40D
Post by: jplxpto on September 27, 2012, 12:39:35 AM
A simple test to see if you found the vram is to try and paint on the screen, write something like 64kb of 1s to the buffer and you should see a colored square on the screen.

great to see your progress!!


Cloutts, thank you for this suggestion ... more I had thought about doing something similar but I am afraid to write to memory before I was sure it matches the VRAM.
Title: Re: Canon 40D
Post by: jplxpto on September 27, 2012, 02:05:52 AM
Hi guys

I did some more tests today ...
I finally got the memory address of LV_VRAM.
I made a small application that writes into log file the addresses of LV_VRAM.
I put the camera in LV mode, and every 40ms, I wrote in the log file, the address and size of the LV_VRAM.

I repeated the process twice, and got the following data:

Address : 0x1CA700C8 / Average Size : ??????????

Address : 0x1CEAE304 / Average Size : 0x0003D068


I've also downloaded the JPEG. I had done before but did not know the memory address.

The JPEG has 1024x680 pixels and has a size of 213446 bytes


Some logs...

Code: [Select]
45578: 63053.752 [LVCDEV]->lvcdevResourceGet(0,1)
 45579: 63054.313 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0
 45580: 63057.331 [LV] lvVDInterrupt
 45581: 63057.493 [LV] WB 1926 1135 1135 2454(1158)
 45582: 63059.349 [LV] lvReturnVram
 45583: 63059.379 < GUI Lock > GUILock_PermitPowerLock (PUB)
 45584: 63059.666 < GUI Lock > GUILockTask 1
 45585: 63059.735 [DispCon] TurnOnDisplay (PUB)
 45586: 63061.319 [DEV] LV_JPG YuvWriteCompleteCBR
 45587: 63061.365 [DEV] LV_JPG YUVReadCompleteCBR
 45588: 63061.498 [DEV] LV_JPG JpCoreCompleteCBR( 0x4af66 )
 45589: 63061.558 [DEV] LV_JPG JpegPopCompleteCBR
 45590: 63061.701 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1cabb02e Y411:0x107a0e20
 45591: 63062.313 [LVCDEV]->PD(VF:0x1078d7e8,MS:0x485540)
 45592: 63081.284 [LV] WriteEDmacWbIntegCompleteCBR


 45579: 63054.313 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0
 45590: 63061.701 [DPATH] LV_JPG STOP   Y:0x1df97c64 J:0x1cabb02e  Y411:0x107a0e20
Title: Re: Canon 40D
Post by: jplxpto on September 27, 2012, 06:26:54 AM

I managed to blur the image of the LCD. I now have to know the coordinates valid in order to draw a rectangle.

I used this STUB, and wrote somewhere in vram0.

NSTUB(0x1E450, bmp_vram_info)

In the coming days, I'll want to have a bmp_printf(...) function to write text on the display.

Once you get it, I want to improve the boot process.
Title: Re: Canon 40D
Post by: jplxpto on September 28, 2012, 01:07:44 AM
Some additional information:

http://en.wikipedia.org/wiki/Canon_EOS_40D (http://en.wikipedia.org/wiki/Canon_EOS_40D)
Title: Re: Canon 40D
Post by: coutts on September 28, 2012, 08:49:36 AM
I managed to blur the image of the LCD. I now have to know the coordinates valid in order to draw a rectangle.

I used this STUB, and wrote somewhere in vram0.

NSTUB(0x1E450, bmp_vram_info)

In the coming days, I'll want to have a bmp_printf(...) function to write text on the display.

Once you get it, I want to improve the boot process.

you should start porting ML to the 40d, clone the latest repo and look for CONFIG_5DC, maybe add #define CONFIG_5DC CONFIG_40D and copy the same diretory structure / entry.S of the 5dc. All of the changes for the 5dc in menu.c should be valid for the 40d too.
Title: Re: Canon 40D
Post by: jplxpto on September 28, 2012, 12:16:12 PM
Thanks Coutts ... I'm working on it :)
Title: Re: Canon 40D
Post by: jplxpto on September 30, 2012, 02:15:07 AM
Good news ...

In recent days, me and Alex, we can give a good progress in 40D port.

Finally, we have a "Hello World" working ...

soon I'll post a picture here ...
Title: Re: Canon 40D
Post by: dichterDichter on October 01, 2012, 04:22:18 PM
Awsome. My Camera is still broken and im trying to repair it.
Title: Re: Canon 40D
Post by: imme on October 03, 2012, 07:21:48 AM
Me and many others are silently waiting for Good news
Title: Re: Canon 40D
Post by: jplxpto on October 03, 2012, 11:45:50 AM
With a little time and patience, one day will come true ...

The Coutts and Alex have done an excellent job with 5DC.
I think that much of this work can be useful for the 40D.
Title: Re: Canon 40D
Post by: jplxpto on October 04, 2012, 01:08:11 AM
Some more stubs

40D v1.1.1

Quote

NSTUB(0x1E458, LCD_Palette)
NSTUB(0x1E498, RGB_Palette)
NSTUB(0x1E388, PB_Palette)

NSTUB(0xFFCB0B6C, SetRGBPaletteToDisplayDevice)
NSTUB(0xFF867AA8, ChangeColorPalette)
NSTUB(0xFFCAFA0C, SetParameterToBitmapDisplayDevice)

NSTUB(0xFFCB7EBC, EnableBitmapVBufferForPlayBackAndWaiting)

NSTUB(0xFFCB9078, BmpDDev_give_semaphore);
NSTUB(0xFFCB9028, BmpDDev_take_semaphore);

NSTUB(0xFF8156F8, bindGUISwitchCBR)



Alex... I'm working on it :)
Title: Re: Canon 40D
Post by: jplxpto on October 04, 2012, 03:35:29 AM
Code: [Select]

  3878: 23394.264 [MC] M:1,ID:B(29)
  3879: 23394.303 [BIND] Switch (11, 5)
  3880: 23394.345 [GUI_E] GUI_Control:25 0x0
  3881: 23394.537 [JP] (50/3) my_gui_main_task:85: EVT 246[0]: p=19 *o=0x0/0x0/0x0 a=0
  3884: 23426.474 [JP] (50/3) my_gui_main_task:85: EVT 247[4]: p=0 *o=0x80030014/0x96/0x0 a=0
  3887: 23445.017 [MC] M:1,ID:B(30)
  3888: 23445.059 [BIND] Switch (11, 3)
  3889: 23445.092 [GUI_E] GUI_Control:23 0x0
  3890: 23458.398 [JP] (50/3) my_gui_main_task:85: EVT 248[0]: p=17 *o=0x0/0x0/0x0 a=0
  3893: 23489.950 [GUI] DlgPlayMain.c PRESS_MLT_RIGHT_BUTTON
  3894: 23490.172 [DispCon] SetTempForBackLight Temp 150
  3895: 23490.318 [GUI] DlgPlayMain.c PRESS_MLT_RIGHTUP_BUTTON
  3896: 23495.865 [MC] M:1,ID:B(31)
  3897: 23495.904 [BIND] Switch (11, 2)
  3898: 23495.941 [GUI_E] GUI_Control:22 0x0
  3899: 23496.137 [JP] (50/3) my_gui_main_task:85: EVT 249[0]: p=16 *o=0x0/0x0/0x0 a=0
  3902: 23527.803 [GUI] DlgPlayMain.c PRESS_MLT_UP_BUTTON
  3903: 23546.781 [MC] M:1,ID:B(32)
  3904: 23546.821 [BIND] Switch (11, 4)
  3905: 23546.853 [GUI_E] GUI_Control:24 0x0
  3906: 23547.040 [JP] (50/3) my_gui_main_task:85: EVT 250[0]: p=18 *o=0x0/0x0/0x0 a=0
  3909: 23578.686 [GUI] DlgPlayMain.c PRESS_MLT_LEFTUP_BUTTON
  3910: 23589.717 [MC] M:1,ID:B(0)
  3911: 23589.753 [BIND] Switch (11, 6)
  3912: 23589.790 [GUI_E] GUI_Control:26 0x0
  3913: 23589.970 [JP] (50/3) my_gui_main_task:85: EVT 251[0]: p=1a *o=0x0/0x0/0x0 a=0
  3916: 23621.610 [GUI] DlgPlayMain.c PRESS_MLT_LEFT_BUTTON
  3917: 23640.641 [MC] M:1,ID:B(1)
  3918: 23640.683 [BIND] Switch (11, 8)
  3919: 23640.721 [GUI_E] GUI_Control:28 0x0
  3920: 23640.907 [JP] (50/3) my_gui_main_task:85: EVT 252[0]: p=1c *o=0x0/0x0/0x0 a=0
  3923: 23672.516 [GUI] DlgPlayMain.c PRESS_MLT_LEFTDOWN_BUTTON
  3924: 23691.575 [MC] M:1,ID:B(2)
  3925: 23691.617 [BIND] Switch (11, 9)
  3926: 23691.655 [GUI_E] GUI_Control:29 0x0
  3927: 23691.839 [JP] (50/3) my_gui_main_task:85: EVT 253[0]: p=1d *o=0x0/0x0/0x0 a=0
  3930: 23723.499 [GUI] DlgPlayMain.c PRESS_MLT_DOWN_BUTTON
  3931: 23793.658 [MC] M:1,ID:B(3)
  3932: 23793.698 [BIND] Switch (11, 5)
  3933: 23793.737 [GUI_E] GUI_Control:25 0x0
  3934: 23793.937 [JP] (50/3) my_gui_main_task:85: EVT 254[0]: p=19 *o=0x0/0x0/0x0 a=0
  3937: 23825.534 [GUI] DlgPlayMain.c PRESS_MLT_RIGHT_BUTTON
  3938: 23844.343 [MC] M:1,ID:B(4)
  3939: 23844.384 [BIND] Switch (11, 3)
  3940: 23844.420 [GUI_E] GUI_Control:23 0x0
  3941: 23844.610 [JP] (50/3) my_gui_main_task:85: EVT 255[0]: p=17 *o=0x0/0x0/0x0 a=0
  3944: 23876.253 [GUI] DlgPlayMain.c PRESS_MLT_RIGHTUP_BUTTON
  3945: 23895.276 [MC] M:1,ID:B(5)
  3946: 23895.315 [BIND] Switch (11, 0)
  3947: 23895.350 [GUI_E] GUI_Control:21 0x0
  3948: 23895.543 [JP] (50/3) my_gui_main_task:85: EVT 256[0]: p=15 *o=0x0/0x0/0x0 a=0
  3951: 23945.275 [MC] M:1,ID:B(6)
  3952: 23945.317 [BIND] Switch (11, 6)
  3953: 23945.354 [GUI_E] GUI_Control:26 0x0
  3954: 23945.559 [JP] (50/3) my_gui_main_task:85: EVT 257[0]: p=1a *o=0x0/0x0/0x0 EVT 257 a=0
  3957: 23977.234 [GUI] DlgPlayMain.c PRESS_MLT_LEFT_BUTTON

Title: Re: Canon 40D
Post by: nanomad on October 04, 2012, 09:22:14 PM
Do you have a fork with your 40D work on bitbucket? I'd like to "follow" it
Title: Re: Canon 40D
Post by: jplxpto on October 04, 2012, 11:53:12 PM
Do you have a fork with your 40D work on bitbucket? I'd like to "follow" it


Nanomad.  I haven't shared my code in this repository.
I sent my initial developments to Alex's email.
After that, he then began to integrate it into the ML.
We've been working together a few hours.
I loved working with him on this project, but we had little time.

Right now, I have a problem displaying the menus on the LCD.
I suspect there is a problem of any competition in memory access, calculations wrong, wrong resolutions or access buffers that were allocated dynamically and are already invalid.

Yes, I am thinking to create a repository on bitbucket

I also hope to have their precious help ;)

BR
Title: Re: Canon 40D
Post by: jplxpto on October 05, 2012, 02:05:30 AM
Hi guys

My 40D camera now say :

"Magic Lantern is up and running...3 tasks started."


... but has serious problems on the LCD. I still can not see the menu of ML :(
I can only see messages like "Hello World!" and sometimes appears at the top of the image a green rectangle,
a little blurred with pixels of other colors. I think is the menu! And sometimes the entire screen flashes.
It seems that, we switch the color palette. This is something very strange happens.

I'll have to ask someone for help ... I still can not fully understand the code of VRAM.
We should be using buffers invalid or the wrong dimensions. If I can I do some tests for next week

Guys? Someone can help me on this? ... Maybe you Alex ... ;)
Thank you in advance!

I'll keep you updated with the latest news ...
Title: Re: Canon 40D
Post by: jplxpto on October 05, 2012, 02:10:25 AM
I identified some errors ...

Code: [Select]

   618:  1078.659 [JP] (50/3) read_entire_file:889: File 'A:/ML/DATA/FONTS.DAT' size 32744 by
   619:  1091.459 [FR] readsize = 0x20000
   620:  1110.717 [FR] readsize = 0x20000
   621:  1124.497 [FR] readsize = 0x20000
   622:  1141.060 [FR] readsize = 0x20000
   623:  1155.195 [FR] readsize = 0x20000
   624:  1172.910 [FR] readsize = 0x1f000
   625:  1187.773 [FR] A:/DCIM/100CANON/IMG_1685.JPG read done (8288KB/S)
   626:  1187.961 [GUI] SetPlInfoPLAYMode(100_1685)
   627:  1188.080 [IMP] (PUB) SetDpRotationAngle 2845(0)
   628:  1188.119 [IMP] (PUB) SetColorConvertTable 2832( 0x0 )
   629:  1188.137 [Graphics] GuiDrawOneImage (PUB)
   630:  1188.180 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
   631:  1188.208 [IMP] (PUB) SyncroClearImagePlayVram 2569
   632:  1188.226 [IMP] GetVramNumber 580
   633:  1188.246 [IMP] GetVramNumber 580
   634:  1189.050 <RECTCOLOR> RequestRectangleColor Before Lock
   635:  1189.432 [FW] fwSetUnitSize (0x200000)
   636:  1191.298 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
   637:  1191.367 [IMP] (PUB) SetImageAspect 3683
   638:  1191.451 SetImageVramParameter x:48 y:24 w:340 h:102/* Aspect:976264*/
   639:  1191.489 [IMP] (PUB) SetImageFileParameter 1348
   640:  1191.567 [IMP] (PUB) DrawImageToVram(rot:0 cb:0xFF8851E4) 1393
   641:  1191.593 [IMP] GetJpegInfo 750
   642:  1192.330 <DJP> RequestDecodeJpeg Before Lock
   643:  1214.231 [IMP] SetRotationAngle 616
   644:  1214.264 [IMP] SetVramImageParameter 640
   645:  1214.294 [IMP] GetVramNumber 580
   646:  1215.508 <DJP> RequestDecodeJpeg Before Lock
   647:  1242.982 [JP] (50/3) Calling init_func ../../src/bmp.c (b807f4)
   648:  1247.041 [JP] (50/3) Calling init_func ../../src/font-dyn.c (b82aa8)
   649:  1247.089 [JP] (50/3) Calling init_func debug (b87f68)
   650:  1247.193 [JP] (50/3) Calling init_func ../../src/property.c (b8b020)


   651:  1248.238 [PROPAD] ERROR GetPropertyData ID = 0x0205000E
   652:  1248.373 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0205000E L:874
   653:  1248.839 [JP] (50/3) _prop_handler_PROP_LAST_JOB_STATE:1781: job state: 0
   654:  1249.631 [PROPAD] ERROR GetPropertyData ID = 0x0206001E
   655:  1249.745 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0206001E L:874
   656:  1249.901 [PROPAD] ERROR GetPropertyData ID = 0x0204000D
   657:  1249.983 [PROP] ERROR NOT FOUND PROPERTY ID = 0x0204000D L:874

   658:  1250.579 [JP] (50/3) Calling init_func ../../src/tweaks.c (b8bf38)
   659:  1251.006 [JP] (50/3) Calling init_func lens (b8f1f8)
   660:  1251.151 [JP] (50/3) Calling init_func ../../src/zebra.c (b93e00)
   661:  1251.681 [JP] (50/3) Calling init_func shoot (b9f87c)
   662:  1252.387 [JP] (50/3) Calling init_func ../../src/movtweaks.c (ba7b30)
   663:  1252.554 [JP] (50/3) Calling init_func help_menu (ba8fbc)
   664:  1252.724 [JP] (50/3) Calling init_func ../../src/focus.c (ba97c0)
   665:  1253.079 [JP] (50/3) Calling init_func ../../src/notify_box.c (bab220)

Code: [Select]
  1381:  1791.326 < GUI Lock > GUILock_TurnOnDisplay (PUB)
  1382:  1791.488 < GUI Lock > GUILockTask 1
  1383:  1791.527 [DispCon] TurnOnDisplay (PUB)
  1384:  1791.555 [DispCon] TFT_POWDET Low Wait
  1385:  1792.743 [DispCon] TFT_POWDET Low Wait
  1386:  2262.465 [CFS] Mini Info. (0x1000000e)
  1387:  2262.552 [JP] (50/3) read_entire_file:910: failed
Title: Re: Canon 40D
Post by: jplxpto on October 05, 2012, 02:23:00 AM
The my_gui_main_task seems to be working... ;)

Code: [Select]
  5938: 15903.631 [MC] M:1,ID:E(1)
  5939: 15903.676 [BIND] Switch (14, 1)
  5940: 15903.714 [GUI_E] GUI_Control:1 0x0

  5941: 15903.898 [JP] (50/3) my_gui_main_task:85: EVT 372[0]: p=1
  5942: 15903.942 [JP] (50/3) my_gui_main_task:90: EVT 372 *o=0x0/0x0/0x0
  5943: 15903.973 [JP] (50/3) my_gui_main_task:93: EVT 372 a=0
  5944: 15935.627 [GUI] DlgPlayMain.c ROTATE_ELECTRONIC_SUB_DIAL_RIGHT

  5945: 15935.719 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5946: 15935.804 [FC] _FC_GetDriveObject (1,1)
  5947: 15935.884 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5948: 15935.999 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5949: 15936.053 [FC] _FC_GetDriveObject (1,1)
  5950: 15936.104 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5951: 15936.160 [GUI] ChangeMultiCurrentPositionForMove hOldFile(0x51906950)
  5952: 15936.213 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5953: 15936.253 [FC] _FC_GetDriveObject (1,1)
  5954: 15936.297 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5955: 15936.334 [FC] _FC_GetFirstFileHandle
  5956: 15936.368 [FC] ctgFileGetFirstFileHandle (1, 0, 0, 0)

  5957: 15936.958 [JP] (50/3) my_gui_main_task:85: EVT 373[4]: p=0
  5958: 15937.035 [JP] (50/3) my_gui_main_task:90: EVT 373 *o=0x2050000/0x7f3c2c/0x6c
  5959: 15937.070 [JP] (50/3) my_gui_main_task:93: EVT 373 a=0
  5960: 15968.951 [JP] (50/3) my_gui_main_task:85: EVT 374[4]: p=0
  5961: 15969.028 [JP] (50/3) my_gui_main_task:90: EVT 374 *o=0x2050000/0x7f3d24/0x6c
  5962: 15969.061 [JP] (50/3) my_gui_main_task:93: EVT 374 a=0

  5963: 16000.466 [GUI] GUI_SetFileIndexInDrive(1)
  5964: 16000.993 [JP] (50/3) my_gui_main_task:85: EVT 375[4]: p=0
  5965: 16001.076 [JP] (50/3) my_gui_main_task:90: EVT 375 *o=0x2050000/0x7f3e1c/0x6c
  5966: 16001.115 [JP] (50/3) my_gui_main_task:93: EVT 375 a=0
  5967: 16032.895 [JP] (50/3) my_gui_main_task:85: EVT 376[4]: p=0
  5968: 16032.969 [JP] (50/3) my_gui_main_task:90: EVT 376 *o=0x2050000/0x7f3f14/0x6c
  5969: 16033.003 [JP] (50/3) my_gui_main_task:93: EVT 376 a=0
  5970: 16064.777 [JP] (50/3) my_gui_main_task:85: EVT 377[4]: p=0
  5971: 16064.855 [JP] (50/3) my_gui_main_task:90: EVT 377 *o=0x2050000/0x7f400c/0x6c
  5972: 16064.890 [JP] (50/3) my_gui_main_task:93: EVT 377 a=0
  5973: 16096.291 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)


I think that once the problem of LCD is resolved, we can say that we have the ML running on 40D :)


Be patience, ... we still have much work ahead!

Title: Re: Canon 40D
Post by: samacochan on October 05, 2012, 09:29:09 PM
The my_gui_main_task seems to be working... ;)

Code: [Select]
  5938: 15903.631 [MC] M:1,ID:E(1)
  5939: 15903.676 [BIND] Switch (14, 1)
  5940: 15903.714 [GUI_E] GUI_Control:1 0x0

  5941: 15903.898 [JP] (50/3) my_gui_main_task:85: EVT 372[0]: p=1
  5942: 15903.942 [JP] (50/3) my_gui_main_task:90: EVT 372 *o=0x0/0x0/0x0
  5943: 15903.973 [JP] (50/3) my_gui_main_task:93: EVT 372 a=0
  5944: 15935.627 [GUI] DlgPlayMain.c ROTATE_ELECTRONIC_SUB_DIAL_RIGHT

  5945: 15935.719 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5946: 15935.804 [FC] _FC_GetDriveObject (1,1)
  5947: 15935.884 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5948: 15935.999 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5949: 15936.053 [FC] _FC_GetDriveObject (1,1)
  5950: 15936.104 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5951: 15936.160 [GUI] ChangeMultiCurrentPositionForMove hOldFile(0x51906950)
  5952: 15936.213 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)
  5953: 15936.253 [FC] _FC_GetDriveObject (1,1)
  5954: 15936.297 [GUI] GUI_GetTotalFileInDrive FM_GetDriveObject Num(5)
  5955: 15936.334 [FC] _FC_GetFirstFileHandle
  5956: 15936.368 [FC] ctgFileGetFirstFileHandle (1, 0, 0, 0)

  5957: 15936.958 [JP] (50/3) my_gui_main_task:85: EVT 373[4]: p=0
  5958: 15937.035 [JP] (50/3) my_gui_main_task:90: EVT 373 *o=0x2050000/0x7f3c2c/0x6c
  5959: 15937.070 [JP] (50/3) my_gui_main_task:93: EVT 373 a=0
  5960: 15968.951 [JP] (50/3) my_gui_main_task:85: EVT 374[4]: p=0
  5961: 15969.028 [JP] (50/3) my_gui_main_task:90: EVT 374 *o=0x2050000/0x7f3d24/0x6c
  5962: 15969.061 [JP] (50/3) my_gui_main_task:93: EVT 374 a=0

  5963: 16000.466 [GUI] GUI_SetFileIndexInDrive(1)
  5964: 16000.993 [JP] (50/3) my_gui_main_task:85: EVT 375[4]: p=0
  5965: 16001.076 [JP] (50/3) my_gui_main_task:90: EVT 375 *o=0x2050000/0x7f3e1c/0x6c
  5966: 16001.115 [JP] (50/3) my_gui_main_task:93: EVT 375 a=0
  5967: 16032.895 [JP] (50/3) my_gui_main_task:85: EVT 376[4]: p=0
  5968: 16032.969 [JP] (50/3) my_gui_main_task:90: EVT 376 *o=0x2050000/0x7f3f14/0x6c
  5969: 16033.003 [JP] (50/3) my_gui_main_task:93: EVT 376 a=0
  5970: 16064.777 [JP] (50/3) my_gui_main_task:85: EVT 377[4]: p=0
  5971: 16064.855 [JP] (50/3) my_gui_main_task:90: EVT 377 *o=0x2050000/0x7f400c/0x6c
  5972: 16064.890 [JP] (50/3) my_gui_main_task:93: EVT 377 a=0
  5973: 16096.291 [GUI] GUI_GetTotalFileInDrive hDriveHandle(0x50000000)


I think that once the problem of LCD is resolved, we can say that we have the ML running on 40D :)


Be patience, ... we still have much work ahead!
Good job. I am waiting.
Title: Re: Canon 40D
Post by: Indy on October 06, 2012, 04:03:28 PM
Jplxpto,

First: impressive progress for your first port!
if you could publish your code (bitbucket fork?) we can better help you...
for example see missing stubs/consts

Indy
Title: Re: Canon 40D
Post by: jplxpto on October 07, 2012, 10:18:49 PM
Jplxpto,

First: impressive progress for your first port!
if you could publish your code (bitbucket fork?) we can better help you...
for example see missing stubs/consts

Indy


Hi Indy

Will I have a great honor to also have your help.
You have given me a fantastic help. I am very grateful to you all.

My current code is all in hudson repository of ML.

For more details we can exchange some PM.

BR
Title: Re: Canon 40D
Post by: jplxpto on October 07, 2012, 11:44:33 PM
Sounds good.

Point the camera to something recognizable and dump roughly 1MB from the VRAM address to confirm it.

Another way to find VRAM buffers: look for EDMAC registers. In digic 4, these are c0f04008, c0f04108 ... c0f04f08, then c0f26008, c0f26108 etc. One of those registers should point to the LiveView buffer.


I found this :

MEM(0x00007648) = 0xC0F0B008

http://www.magiclantern.fm/forum/index.php?topic=1452.msg12152#msg12152
Title: Re: Canon 40D
Post by: jplxpto on October 08, 2012, 02:04:15 AM
I found three 40D v 1.1.1 fonts:

I used the script find_fnt.py but I changed it a bit.

Code: [Select]
...

print 'Find bitmap fonts in Canon DSLR firmwares'
print 'Arm.Indy. based on work by Pel, Trammel Hudson and A1ex\n'

off = 0
while off < len(m) and off <> -1:
  off = m.find('FNT\0', off)
  if off <> -1:
    val = getShortLE(m, off+4)
    if val==0xffd8 or val==0xffe2               or val==0xffec:
      parseFont(m, off, base)
    off = off + 4
...

Code: [Select]
python ../../../../find_fnt.py 40d.111.ROMF1.0xFF800000.bin 0xFF800000
Code: [Select]
Find bitmap fonts in Canon DSLR firmwares
Arm.Indy. based on work by Pel, Trammel Hudson and A1ex

0xff9ed2e4: FNT
0xff9ed2e8: (+0x04) 0xffec
0xff9ed2ea: (+0x06) font_width = 20
0xff9ed2ec: (+0x08) charmap_offset = 0x24
0xff9ed2f0: (+0x0c) charmap_size = 0x21f0
0xff9ed2f4: (+0x10) bitmap_size = 0x36858
0xff9ed2f8: (+0x14) font name = 'HCanonGothic'
0xff9ed308: (+0x24) char_codes[]. 2172 chars
0xff9ef4f8: (+0x2214) offsets[]. Last offset value = 0x367ea
0xff9f16e8: (+0x4404) bitmaps[]
  0xffa27ed2: (+0x3abee) last bitmap
  +0x00: bitmap width = 36
  +0x02: bitmap height = 36
  +0x04: char width = 36
  +0x06: X offset = 0
  +0x08: Y offset = 0
    bitmap size = 0xb4

0xffa27f40: FNT
0xffa27f44: (+0x04) 0xffe2
0xffa27f46: (+0x06) font_width = 30
0xffa27f48: (+0x08) charmap_offset = 0x24
0xffa27f4c: (+0x0c) charmap_size = 0x170
0xffa27f50: (+0x10) bitmap_size = 0x2eb8
0xffa27f54: (+0x14) font name = 'HCanonGothic'
0xffa27f64: (+0x24) char_codes[]. 92 chars
0xffa280d4: (+0x194) offsets[]. Last offset value = 0x2e36
0xffa28244: (+0x304) bitmaps[]
  0xffa2b07a: (+0x313a) last bitmap
  +0x00: bitmap width = 30
  +0x02: bitmap height = 30
  +0x04: char width = 30
  +0x06: X offset = 0
  +0x08: Y offset = 0
    bitmap size = 0x78

0xffa2b0fc: FNT
0xffa2b100: (+0x04) 0xffe2
0xffa2b102: (+0x06) font_width = 36
0xffa2b104: (+0x08) charmap_offset = 0x24
0xffa2b108: (+0x0c) charmap_size = 0x170
0xffa2b10c: (+0x10) bitmap_size = 0x4448
0xffa2b110: (+0x14) font name = 'HCanonGothic'
0xffa2b120: (+0x24) char_codes[]. 92 chars
0xffa2b290: (+0x194) offsets[]. Last offset value = 0x438a
0xffa2b400: (+0x304) bitmaps[]
  0xffa2f78a: (+0x468e) last bitmap
  +0x00: bitmap width = 36
  +0x02: bitmap height = 36
  +0x04: char width = 36
  +0x06: X offset = 0
  +0x08: Y offset = 0
    bitmap size = 0xb4
Title: Re: Canon 40D
Post by: a1ex on October 08, 2012, 12:06:17 PM
Sounds good.

On 5Dc, ML changes the palette, so it's probably normal. Can you post some screenshots?

You can map the button codes, and once this is done, menu should be usable.
Title: Re: Canon 40D
Post by: Indy on October 09, 2012, 08:23:27 PM
At least someone else is using this script ;-) maybe I should put them on bitbucket...

@jplxpto
your files on bitbucket are one week old and comments are "not tested"
- what is working/not working ?
- what are missing / working stubs and consts values ?

Indy
Title: Re: Canon 40D
Post by: jplxpto on October 09, 2012, 11:06:57 PM
At least someone else is using this script ;-) maybe I should put them on bitbucket...

@jplxpto
your files on bitbucket are one week old and comments are "not tested"
- what is working/not working ?
- what are missing / working stubs and consts values ?

Indy



Indy, you're right files have one week ... in the last days I had little time to work on it.
I was just looking for some stubs and clarify my doubts with other forum members.

Yes I used your script and it was useful to confirm the addresses of fonts.

I have enabled the bootflags and dump the ROM dump.

Last week, me and Alex located the HD & BMP VRAM, but I still do not know the address of the LV VRAM.
I already have some ML threads running but, still could not see any menu. Is there any problem in presenting the image on the LCD.
I should have solved this, but my lack of time and knowledge has not allowed me to resolve this issue.
There is also a problem in the image display on the LCD.
The can.on menus are constantly changing color. The problem must be related to the color palette.
I already found the addresses of color palettes and some stubs used by Alex in 5DC. I did not upload but did post here.



Title: Re: Canon 40D
Post by: jplxpto on October 10, 2012, 02:58:07 AM
Some more stubs

40D v1.1.1

Code: [Select]
NSTUB(0xFFD4F338, TryPostEvent)
NSTUB(0xFFD4F398, TryPostEvent_end)

NSTUB(0xFFD56470, TryPostStageEvent)
NSTUB(0xFFD564FC, TryPostStageEvent_end) // PendStageEvent

NSTUB(0xFFD6A1C8, get_current_task) // 0x22E00
NSTUB(0xFFD69F8C, get_task_info)
NSTUB(0xFFD6B8B0, get_active_task_list)
Title: Re: Canon 40D
Post by: jplxpto on October 10, 2012, 03:45:29 AM
I commented out the calls to the set_ml_palette and set_ml_palette_if_dirty functions and,
now the colors are presented as they were before.

I have not created my repository to share my changes with you, but I hope to do that later this week.

After upgrading my project with the latest version of ML available,
I checked that the code does not compile.
 Some more stubs are needed to 40D. I however able find what was missing.

I'm now using changeset a53eef8d1c7d.

Code: [Select]
NSTUB(0xFFD6A1C8, get_current_task) // 0x22E00
NSTUB(0xFFD69F8C, get_task_info)
NSTUB(0xFFD6B8B0, get_active_task_list)


My next step is to draw a rectangle on the screen to see if I understand what is happening with the VRAM. Later, I'll validate events. The ML is already processing some events but I have to review all the constants.
Title: Re: Canon 40D
Post by: a1ex on October 10, 2012, 07:59:28 AM
For drawing, use bmp_fill and bmp_draw_rect (they both have the same syntax, so rectangles drawn with those two functions should overlap).
Title: Re: Canon 40D
Post by: Indy on October 10, 2012, 04:06:30 PM
jplxpto,

As long as you're a way to progress, it sounds good. That's not easy after all...
How about audio threshold (there is a script for that :-) and stubs ?
maybe I could help here...

Indy
Title: Re: Canon 40D
Post by: jplxpto on October 10, 2012, 11:05:03 PM
For drawing, use bmp_fill and bmp_draw_rect (they both have the same syntax, so rectangles drawn with those two functions should overlap).

Thanks, I'll test it soon ...
Title: Re: Canon 40D
Post by: jplxpto on October 11, 2012, 12:06:24 AM
jplxpto,

As long as you're a way to progress, it sounds good. That's not easy after all...
How about audio threshold (there is a script for that :-) and stubs ?
maybe I could help here...

Indy

"How about audio threshold (there is a script for that :-) " ...

I'm sorry but I did not understand what you mean.
Why tell me in audio?
Title: Re: Canon 40D
Post by: Indy on October 11, 2012, 01:09:39 PM
Dear Jplxpto,

sorry I was not clear.
do you have all audio stubs ? and the address of audio threshold ?

Indy
Title: Re: Canon 40D
Post by: jplxpto on October 11, 2012, 01:14:39 PM
"How about audio threshold (there is a script for that :-) " ...

I'm sorry but I did not understand what you mean.
Why tell me in audio?

Sorry, I also do not explained well
I think the 40D has no audio.
Title: Re: Canon 40D
Post by: a1ex on October 11, 2012, 01:22:31 PM
Well.. the 40D doesn't record video normally, but will do so with Magic Lantern. We already have the ingredients :)
Title: Re: Canon 40D
Post by: jplxpto on October 12, 2012, 05:37:52 AM
Today I had a big scare. I was trying to get all the constants of the buttons and my camera blocked. Moments later I realized that it was not possible to navigate the menus of the canon. Only the icons appeared, but the items were not presented. After a few tries, remove card, remove battery, put battery, remove the lens, place the lens, changes ... so, disconnect, connect, etc, etc ... I was scared but I can resurrect my camera. After a few attempts, I managed to solve the problem because I was able to open the 'My Menu' ... (Mode C1 + Menu  + SET) ... this sequence showed me the items of 'My Menu' and I registered the function that cleans the camera settigns, and I enabled this custom menu. After I accept the changes, the camera is working again normally. It seemed a miracle!!!! Huufff

I have not given up yet, I'll start having more careful ... I'll analyze the firmware to obtain the constants of a safer way. I think the code that writes the LCD acceded to an invalid memory area. I still have problems with the VRAM. Solving this problem is now a top priority.
Title: Re: Canon 40D
Post by: a1ex on October 12, 2012, 07:18:01 AM
There are a few other features that write to RAM (e.g. magic zoom writing on LV buffer, fast zoom in play mode altering the current zoom value, exposure override, SET+MainDial changing the image buffers). Look through consts.h to see how each thing is used - and if you are not sure about that constant, and it's used for writing, don't enable that feature.

For menu, you should start only the two menu-related tasks and some button/event handlers.
Title: Re: Canon 40D
Post by: jplxpto on October 12, 2012, 11:47:26 AM
Hello Alex,

I think almost everything is disabled. How can I check the tasks/features are being launched?

I checked that some of the listed buttons are wrong.
I was trying to solve this problem. I just enabled the hijack of the events and removed the comment from end_gui_...
How can I force automatic presentation of the menu at system startup.

I've done some tests with bmp_fill, bmp_draw_rec, draw_palette.
Soon I will send you a picture with the palette drawn on the LCD.

Thank you
Title: Re: Canon 40D
Post by: a1ex on October 12, 2012, 11:53:18 AM
The source from ML repo only starts 3 tasks (debug, menu, menu_redraw) => it's OK. There are a few features that run from button handlers too (e.g. histogram in playback mode, which you showed me).

To start the menu... give_semaphore(gui_sem).

Edit: if you use the 5DC method for task hijacking (which you probably should, I don't know a better one), leave the gui_init commented (Canon code already did it).
Title: Re: Canon 40D
Post by: jplxpto on October 12, 2012, 12:22:50 PM
Alex, thanks for your clarification.  I'll see it better.
Title: Re: Canon 40D
Post by: jplxpto on October 13, 2012, 04:27:29 PM

Finally I had a little time to create my repository ...

https://bitbucket.org/jplxpto/magic-lantern
Title: Re: Canon 40D
Post by: jplxpto on October 13, 2012, 10:13:28 PM
Some more constants (gui.h)

Code: [Select]
#define BGMT_WHEEL_UP   0x00  
#define BGMT_WHEEL_DOWN 0x01
#define BGMT_WHEEL_LEFT               0x02
#define BGMT_WHEEL_RIGHT              0x03
#define BGMT_PRESS_SET                0x04

#define BGMT_MENU                     0x05
#define BGMT_INFO                     0x06
#define BGMT_JUMP                     0x07
#define BGMT_PLAY                     0x08
#define BGMT_TRASH                    0x09

#define BGMT_PICSTYLE                 0x13

#define BGMT_PRESS_ZOOMIN_MAYBE       0x0a
#define BGMT_UNPRESS_ZOOMIN_MAYBE     0x0b

#define BGMT_PRESS_ZOOMOUT_MAYBE      0x0c
#define BGMT_UNPRESS_ZOOMOUT_MAYBE    0x0d

#define BGMT_PRESS_DIRECT_PRINT       0x0e
//#define BGMT_UNPRESS_DIRECT_PRINT_     0x0f WRONG MAYBE

//~ happens anytime joy stick is unpressed from any position
#define BGMT_UNPRESS_UDLR             0x15
#define BGMT_PRESS_UP                 0x16
#define BGMT_PRESS_UP_RIGHT           0x17
#define BGMT_PRESS_UP_LEFT            0x18
#define BGMT_PRESS_RIGHT              0x19
#define BGMT_PRESS_LEFT               0x1a
#define BGMT_PRESS_DOWN_RIGHT         0x1b
#define BGMT_PRESS_DOWN_LEFT          0x1c
#define BGMT_PRESS_DOWN               0x1d
#define BGMT_PRESS_CENTER             0x1e

// dummy
#define BGMT_PRESS_HALFSHUTTER   0x0b
//#define BGMT_UNPRESS_HALFSHUTTER   -12345

#define BGMT_UNPRESS_SET   -123456789

#define GMT_GUICMD_OPEN_SLOT_COVER   0x28
#define GMT_GUICMD_START_AS_CHECK   -12345678
#define GMT_GUICMD_LOCK_OFF     -12345678

#define BGMT_Q BGMT_PRESS_DIRECT_PRINT
#define BGMT_LV BGMT_JUMP

#define BTN_ZEBRAS_FOR_PLAYBACK BGMT_JUMP

#define GMT_OLC_INFO_CHANGED -12344
Title: Re: Canon 40D
Post by: ilguercio on October 13, 2012, 10:16:18 PM
Same button codes as the 50D.
What about unpress_set though? Does the camera correct the unpress correctly?
Title: Re: Canon 40D
Post by: jplxpto on October 13, 2012, 10:17:35 PM
Same button codes as the 50D.
What about unpress_set though? Does the camera correct the unpress correctly?

Sorry but I still do not know!

Title: Re: Canon 40D
Post by: jplxpto on October 13, 2012, 10:22:56 PM
Hello guys,

I keep working on this project and A1ex has helped me a lot.

Now I'm trying to open the ML menu.

Again ... thanks Alex
Title: Re: Canon 40D
Post by: jplxpto on October 14, 2012, 01:39:21 AM
Hi Guys,

I've got to see the menus of ML. But I still have some problems ... DOUBLE_BUFFERING with 1 not working.
The menus are constantly flashing. The keys work almost all.
Title: Re: Canon 40D
Post by: jplxpto on October 15, 2012, 01:30:21 AM
Hi guys,

After a few hours of work and an excellent help from Alex,
I could finally see the menus of ML. This is a modest contribution but I'm happy.

The port of ML for 40D was not planned and I donated a few hours of my work and
dedication to one day also be a user of this wonderful sofware.

I'm still new to this project and I have a lot to learn but motivated to continue so that one day all
40D owners can also take advantage of ML.

Today, I made ​​my first Pull Requests into hudson repository.

If you are interested can follow my development at:

https://bitbucket.org/jplxpto/magic-lantern (https://bitbucket.org/jplxpto/magic-lantern)
Title: Re: Canon 40D
Post by: ilguercio on October 15, 2012, 01:53:48 AM
Thumbs up and thanks for the effort.
The family is getting bigger as time passes.
:)
Title: Re: Canon 40D
Post by: jplxpto on October 15, 2012, 12:15:15 PM
Thumbs up and thanks for the effort.
The family is getting bigger as time passes.
:)

Thank you!
Title: Re: Canon 40D
Post by: jplxpto on October 16, 2012, 12:23:00 AM

Don't click me! ;)

https://bitbucket.org/jplxpto/magic-lantern/changeset/6c64a92b94bbd81619a6b128c9e2d24d01660bd3 (https://bitbucket.org/jplxpto/magic-lantern/changeset/6c64a92b94bbd81619a6b128c9e2d24d01660bd3)
Title: Re: Canon 40D
Post by: nanomad on October 19, 2012, 12:28:17 AM
Your ptp_register_handler function is correct
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 01:37:18 AM
Your ptp_register_handler function is correct

For me this is a good and bad news ... : (

I can't connect to the camera with --chdk switch and i don´t know why...

I see the logs of the camera again ... perhaps there is some hint

Thank you!!!
Title: Re: Canon 40D
Post by: Faxe on October 19, 2012, 01:30:25 PM
Created account just to state that we are more people that eagerly and happily follow your progression.   ;)
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 02:56:19 PM

I'm happy to know there are more people interested in this project.

I and other developers have been working on this project almost every day.
The Coutts, the Chochin the A1ex, the Nanomad and G3gg0 and Indy have helped me.

Thanks to all of them ...
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 03:00:14 PM
In recent days I and G3gg0 have invested some time trying to change the boot process.
The idea is to do something similar to what has already been done for other cameras.

The G3gg0 have helped me a lot ... it also has many technical skills and is an excellent 'colleague';)

Thank you G3gg0.
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 03:03:59 PM
I've done some testing in order to use PTP to transfer ML for my camera.

To perform the tests sometimes need to constantly insert and remove the card ...
I've done it dozens or hundreds of times.
I want to make this task easier and increase the life of the CF connector of my camera.
Title: Re: Canon 40D
Post by: Faxe on October 19, 2012, 03:15:38 PM
I want to make this task easier and increase the life of the CF connector of my camera.

It isn't easier, but have you thought about an SD to CF converter? I know they exist, but not sure how they would work with ML. http://forums.dpreview.com/forums/post/29819778 (http://forums.dpreview.com/forums/post/29819778) looks a little suspicious in terms of 40D, but that was in 2008... If it worked it would at least remove the strain on your CF connector.
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 07:59:21 PM
It isn't easier, but have you thought about an SD to CF converter? I know they exist, but not sure how they would work with ML. http://forums.dpreview.com/forums/post/29819778 (http://forums.dpreview.com/forums/post/29819778) looks a little suspicious in terms of 40D, but that was in 2008... If it worked it would at least remove the strain on your CF connector.

I'll see that...

Thank you

Title: Re: Canon 40D
Post by: g3gg0 on October 19, 2012, 09:24:28 PM
n/p, you are welcome ;)

check your mail, i sent you a new version.
Title: Re: Canon 40D
Post by: jplxpto on October 19, 2012, 10:56:33 PM
n/p, you are welcome ;)

check your mail, i sent you a new version.

Thank you G3 ...
Title: Re: Canon 40D
Post by: jplxpto on October 20, 2012, 09:59:27 PM
More some stubs for 40d v1.1.1 :

NSTUB(0xFFD427B0, register_interrupt)
NSTUB(0xFFC8DF90, SIO3_ISR)
NSTUB(0xFFC8DEC8, MREQ_ISR)
Title: Re: Canon 40D
Post by: jplxpto on October 21, 2012, 06:01:11 AM
Hello everybody.

I come here today to inform you that I finally able change the boot process in 40D.
Now I use the cache_hacks.

I have to thank once again the A1ex and G3gg0.
They have many skills and have helped me a lot.

If you wish you can see my changes in:
https://bitbucket.org/jplxpto/magic-lantern/changeset/af731ecd17a42f0714f0f9f4d13383ba073a604f (https://bitbucket.org/jplxpto/magic-lantern/changeset/af731ecd17a42f0714f0f9f4d13383ba073a604f)
Title: Re: Canon 40D
Post by: g3gg0 on October 21, 2012, 10:10:54 AM
you got it working? nice, good job!
Title: Re: Canon 40D
Post by: silverfirebird on October 21, 2012, 12:13:00 PM
I own a 40D, and I look forward to seeing this! I also own a Rebel T3i with Magic Lantern installed, and it works great. I'm eager to see what this port has to offer! ;D
Title: Re: Canon 40D
Post by: jplxpto on October 21, 2012, 10:14:24 PM
you got it working? nice, good job!

Without your valuable help I would never have succeeded.

Thank you.
Title: Re: Canon 40D
Post by: Polanin on October 21, 2012, 11:39:27 PM
Hi
I'm just another guy who is keeping fingers crossed for this port.
I have 40D with firmware 1.0.8. (not updated yet) so if any testing on this firmware is needed you can sign me in.
Title: Re: Canon 40D
Post by: jplxpto on October 22, 2012, 01:44:52 AM
Hi
I'm just another guy who is keeping fingers crossed for this port.
I have 40D with firmware 1.0.8. (not updated yet) so if any testing on this firmware is needed you can sign me in.

I'm working with the latest version available ... 1.1.1. I advise you to update the firmware of your camera. see page of the canon ... is simple and fast.
Title: Re: Canon 40D
Post by: nanomad on October 22, 2012, 10:42:53 AM
And, unless I'm mistaken, you can always roll-back to an older fw version
Title: Re: Canon 40D
Post by: jplxpto on October 22, 2012, 12:10:25 PM
And, unless I'm mistaken, you can always roll-back to an older fw version

I already did rollback to version 1.0.8 just to create a dump :)
Title: Re: Canon 40D
Post by: jplxpto on October 23, 2012, 04:18:23 AM
Some more progress ... now with PTP ;)

http://www.magiclantern.fm/forum/index.php?topic=1512.msg16147#msg16147
Title: Re: Canon 40D
Post by: dor1847 on October 26, 2012, 09:44:53 PM
hi, 40D owner here :)

i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..

i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!

i hope to hear some good news soon!

Good Luck :)
Title: Re: Canon 40D
Post by: samacochan on October 27, 2012, 03:48:19 PM
hi, 40D owner here :)

i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..

i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!

i hope to hear some good news soon!

Good Luck :)

A donation will be a good gesture of support.
Title: Re: Canon 40D
Post by: jplxpto on October 27, 2012, 08:18:53 PM
hi, 40D owner here :)

i've been searching some information about a version of ML for the 40D for months and today i stumbled upon this thread..

i signed in just to say that you guys are doing an amazing job!
unfortunately, im not very familiar with all this programming stuff so the only thing i can do is waiting for you to finish working on it :D
if there is anything i can do to help you guys with the project that does not involve taking a risk of bricking my cam (its my only one) ill be glad to do it!

i hope to hear some good news soon!

Good Luck :)


Thanks for your eulogy.

My friend, everything in life has its risks. Currently, I just got this camera. If you ever want to try ML in your camera will have to take the risk. They may be very low, but there will always be a risk associated with it.
Title: Re: Canon 40D
Post by: jplxpto on October 27, 2012, 08:22:30 PM
A donation will be a good gesture of support.

I'm perfectly in accordance with your comment.
Title: Re: Canon 40D
Post by: jplxpto on November 02, 2012, 03:55:43 AM
Hi,

My work on this project continues. I've made some progress.

I have been trying to use the PTP and GDB in 40D.

1) With the help of g3gg0 and their fantastic cache hacks I managed to change the boot of the 40D. This may solve some legal problems.

2) I've able register the operations of ML & CHDK but this subject is not yet closed. I still have some unresolved issues.

I've done some tests but still can not debug with GDB. I'm trying the GDB Stubs created by g3gg0. This task is not a priority but soon I hope to get back to doing some tests and be successful.

3) In the last days, I spent some time with the overlays.
I'm trying to use the code developed for 5DC.
With Alex's help I managed to display some overlays in play mode.
Title: Re: Canon 40D
Post by: LensPainter on November 02, 2012, 03:45:06 PM
Hi all,

have you considered to integrate the additional menus of the WFT-E3 and the GPS Menu? Maybe this is disturbing a little bit the ability to read out all the parameters and set the values. The screen flashing because of nulls/values missing??
I think it's the most complicated part of the menu-structure! Lots of menus where you can really get lost...

I could shoot some pics with my iPhone and mail them, if you are interested.

Kind regards

Uwe
Title: Re: Canon 40D
Post by: jplxpto on November 03, 2012, 03:51:29 PM

@LensPainter

Hi,

I just had a chance to answer it now.
I appreciate your suggestion, but I do not know if this is possible.

I do not own any of these devices, so I never saw these menus.
I know they exist because I've seen some strings in the firmware.
I would love to see these photos. I'm waiting ... Thank you.
Title: Re: Canon 40D
Post by: LensPainter on November 05, 2012, 12:11:42 PM
@jplxpto
Hi,

I think I need your email-address - there are 98 pictures so far...

Kind regards

Uwe
Title: Re: Canon 40D
Post by: jplxpto on November 06, 2012, 12:20:50 AM

Thank you!
Title: Re: Canon 40D
Post by: LensPainter on November 06, 2012, 12:36:44 AM
Hi Pedro -  and your welcome - de nada (is that right?)

Hope it helps!

Kind regards

Uwe
Title: Re: Canon 40D
Post by: jplxpto on November 11, 2012, 06:34:02 PM
Some screenshots:

(http://i.imgur.com/fSV5U.jpg)

(http://i.imgur.com/cX2od.jpg)

(http://i.imgur.com/0T3EJ.jpg)

(http://i.imgur.com/Nq8le.jpg)

(http://i.imgur.com/M0NeM.jpg)

(http://i.imgur.com/2AIC3.jpg)
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 03:12:41 AM
I think, finally found a buffer of LVRAM.
I had seen the address of a memory dumps I made with the help of ptpcam.
With the help of Alex and his img.py file. I can guess the width and height of the image as well as the pitch.
I intercepted the PRINT key event and did two dumps of RAM starting at address 0x10000000 and a size of 256M.

I followed the instructions described on the following page

http://magiclantern.wikia.com/wiki/VRAM/550D

Code: [Select]
ipython

run -i img.py

a = readsampled("./VRAM_01.DAT")

b = readsampled("./VRAM_02.DAT")

d = array(a) - array(b)

d[d != 0] = 1

plot(d); show()

After reviewing the chart and repeat the test a few times, I identified the pitch.

guessed pitch = 2916
width = pitch / 2 = 1458
height = 1458 / (3/2) = 972

With the help of graphic and addresses that I found when I did a dump to address 0x1e000.
I suspected that the address 0x1dbc0064 is an address VRAM.

I subtract the address of the beginning of my dump and got the following value:

0x1dbc0064 - 0x10000000 = 0xdbc0064 = 230424676

Code: [Select]
x = 230424676

gw = 1458
gh = 972
gp = 2916

gx = x + gp * (0)

gs = gp * gh

s = readseg("./VRAM_02.DAT", gx, gs)

imgseq(s, gp)

hex(gx)

In the end I visualized the images generated and to my surprise
I finally had my picture in perfect condition (black and white).
The best picture was the 000-odd.png

Code: [Select]
MEM(0x1e020 + 0x18) = MEM(0x1E038) = 0x1dbc0064
MEM(0x1e0a0 + 0x14) = MEM(0x1E0B4) = 0x1dbc0064

<conn> w 0x1e000 512
0001e000 00000000 0013a2dc 0013a2b8 00000000 10687248 000002d0 000002d0 000000f0
0001e020 00000000 1071f0d4 000002d0 000002d0 000000f0 00000002 1dbc0064 00000798
0001e040 00000798 00000510 00000798 00000510 00000000 00000000 00000000 00000000
0001e060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e080 00000000 00000000 00484e5c 001ee400 00000001 00000f30 00000a20 00001d40
0001e0a0 00001380 00000000 00000001 00000000 00000000 1dbc0064 1e26f264 1071f0d4
0001e0c0 00000000 00484e5c 001ee400 00000000 00000000 00000f30 00000a20 000009c0
0001e0e0 00000750 00000000 00000000 00000000 00000000 000002d0 000001e0 000002d0
0001e100 00000000 00000018 000002d0 000000d8 0001dc00 00000000 00000000 00000000
0001e120 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e140 0080478c 00000000 0001db90 00000000 ff8851e4 00012d6c 00000000 00000000
0001e160 ffca415c 00000000 00000000 00000000 00000000 00000000 00000018 000002d0
0001e180 000000d8 00000000 00000000 1071f0d4 000002d0 000000f0 00000000 00000018
0001e1a0 000002d0 000000d8 00000000 00000000 00000000 00000000 00000000 00000000
0001e1c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
0001e1e0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 03:19:28 AM
(http://i.imgur.com/csh1y.png)
Title: Re: Canon 40D
Post by: nexiabass on November 12, 2012, 07:16:31 AM
Wow, really great to see this progress!
Is it possible to extend highiso to 12.800?
What about AF-microadjust?

If this could be added, we could name this cam 45D ^^
Title: Re: Canon 40D
Post by: a1ex on November 12, 2012, 09:44:36 AM
LV buffer is the one used for LiveView display, it's extremely unlikely to have higher resolution than 720x480.

If you alter the data in the LV buffer, the changes should be visible on the display (that's how magic zoom works).

What you found seems to be a buffer used to decode the images in playback (before downsampling it for display), and probably the zoom operations are based on that buffer. It's not used in LiveView (otherwise 40D would be the first Canon dslr that can record 2K). 5Dc has one too.

Check repo.
Title: Re: Canon 40D
Post by: Indy on November 12, 2012, 12:04:25 PM
Hi,

good progress Jplxpto !

maybe by enable debug on these functions we can find LVRAM addresses (offsets in firmware in the 1st column) :
  4a0290 [BmpDDev] CreatePhysicalVram (PUB)
 4a03b4 [BmpDDev] DeletePhysicalVram (PUB)


in 40d 1.1.1 it seems there are function to monitor the MPU=TX19A
  32fa8 MonOpen
  32fb0 MonClose
  32fbc MonRead
  32fc4 MonReadAndGetData
  32fd8 MonWrite
  32fe4 MonCall
  32fec FA_TestMonRead
  32ffc FA_TestMonCall
  3300c FA_TestMonReadAndWrite
  33130 m_hSemaphoreDataComp
  33148 ../MpuMonitor.c


Indy
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 10:32:42 PM
Wow, really great to see this progress!
Is it possible to extend highiso to 12.800?
What about AF-microadjust?

If this could be added, we could name this cam 45D ^^

Welcome to our forum.

Thank you for your nice words.

Remember, we can add great features in ML but still can not transform an old black & white TV to a color TV with a feature like HD and 3D.

For now, I just think support the features that already exist in other cameras, If I ever get that it will be a big win for me :)

When I reach that goal, I hope to have your help to test the result of my work.

BR
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 10:53:49 PM
Hi,

good progress Jplxpto !

maybe by enable debug on these functions we can find LVRAM addresses (offsets in firmware in the 1st column) :
  4a0290 [BmpDDev] CreatePhysicalVram (PUB)
 4a03b4 [BmpDDev] DeletePhysicalVram (PUB)


in 40d 1.1.1 it seems there are function to monitor the MPU=TX19A
  32fa8 MonOpen
  32fb0 MonClose
  32fbc MonRead
  32fc4 MonReadAndGetData
  32fd8 MonWrite
  32fe4 MonCall
  32fec FA_TestMonRead
  32ffc FA_TestMonCall
  3300c FA_TestMonReadAndWrite
  33130 m_hSemaphoreDataComp
  33148 ../MpuMonitor.c


Indy


Hi, Indy.

I hope you're well.

To be honest I had met some of these stubs 'Mon' but I did not know its purpose.
I still do not know what is in them. I no longer have to availability or knowledge to explore these stubs.
Maybe you are one of the people with the capacity to accomplish this task.

I had already looked at the [BmpDDev] CreatePhysicalVram and [BmpDDev] DeletePhysicalVram but
I did not know how to intercept the calls to these functions.
I think I saw something in your post about the 500D or 550D.

I'll follow your suggestion ...

Thank you.

Code: [Select]
NSTUB(0xFF8448B4, FA_TestMonCall)
NSTUB(0xFF8446EC, FA_TestMonReadAndWrite)
NSTUB(0xFF8445AC, FA_TestMonRead)
NSTUB(0xFF844528, MonCall)
NSTUB(0xFF844284, MonClose)
NSTUB(0xFF84425C, MonOpen)
NSTUB(0xFF844354, MonReadAndGetData)
NSTUB(0xFF8442AC, MonRead)
NSTUB(0xFF844480, MonWrite)
NSTUB(0xFFB27438, mon)
NSTUB(0xFF843024, mon_funcs_table)

Code: [Select]
grep -i mon 40d.111.ROMF1.0xFF800000.strings

ffb44014  (Called->MoveFocusLensForPcMon)
ffb44038 Err:MoveFocusLensForPcMon, Unexpected PC_MON_MF_MODE = %d
ffb44074  MoveFocusLensForPcMon LatestStep=%d
ffb46c38 Err:HaveLensError, Mounting MonitorTool
ffb47a28 Err:CalcMovingStepForPcMon, Unexpected Coeff = %d
ffb47a5c Err:CalcMovingStepForPcMon, Result step is over 2bytes
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 11:48:26 PM
Here is the result of my first analysis to function BmpDDev_CreatePhysicalVram.

Code: [Select]
NSTUB(0xFFCB02B4, BmpDDev_CreatePhysicalVram);
Code: [Select]
extern int BmpDDev_CreatePhysicalVram(int *pWidth, int *pHeight, int *pPitch, int **pVRamAddress);

int width;
int height;
int pitch;
int *vRamAddress;

int result;

result = BmpDDev_CreatePhysicalVram(&width, &height, &pitch, &vRamAddres);

result is :
   0 when : The parameters are all valid and was allocated a block of 0x15184 bytes
   3 when :(pWidth == NULL || pHeight == NULL || pPitch == NULL || pVRamAddress == NULL)
   5 when : Could not allocate memory (pVRamAddress != NULL && *pVRamAddress == NULL)

width  is 0x2D0 (720)
height is 0x0F0 (240)
pitch  is 0x2D0 (720)
*pRamAddress is the vram address allocated by DMA a filled with zeros.

block size = 0x15180+4 = 86404 d = 360 * 240 bytes

I think, it takes 4 bits per pixel or 2 pixels per byte...
then the resolution should be: 720 * 240

Code: [Select]
   313:   608.094 [IMP] CreateVram 665
   330:   684.874 [Graphics] GuiClearImage
   331:   684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
   332:   684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
   333:   685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644

I will explore the mechanisms of debug, developed by g3gg0 and try to get the list of function parameters.
Title: Re: Canon 40D
Post by: jplxpto on November 12, 2012, 11:54:35 PM
I think, there is another memory location (temporary?) in memory address 0x1e26f264.

Code: [Select]
0001e0a0 00001380 00000000 00000001 00000000 00000000 1dbc0064 1e26f264 1071f0d4

   698:  3711.532 [GUI] StartPlayMain
   699:  3718.551 [Graphics] CreateSharedBuffer !!!
   700:  3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
   701:  3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200

   702:  3719.292 [Graphics] GuiGraphicsNormalMode (PUB)


ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264



0x1dbc0064 + 0x6af200 = 0x1e26f264

0x6af200 size (maybe)


Seems I actually found two memory locations that I had seen in the past.
ImageWorkMemory 1 & 2. They are YUV 411. W:2496, H:1872 and size: 0x6af200 (>6,68MB)
Title: Re: Canon 40D
Post by: jplxpto on November 13, 2012, 12:27:10 AM
LV buffer is the one used for LiveView display, it's extremely unlikely to have higher resolution than 720x480.

If you alter the data in the LV buffer, the changes should be visible on the display (that's how magic zoom works).

What you found seems to be a buffer used to decode the images in playback (before downsampling it for display), and probably the zoom operations are based on that buffer. It's not used in LiveView (otherwise 40D would be the first Canon dslr that can record 2K). 5Dc has one too.

Check repo.

"otherwise 40D would be the first Canon dslr that can record 2K" ... that would be fantastic, a miracle! :)
Thank you
Title: Re: Canon 40D
Post by: jplxpto on November 13, 2012, 12:34:37 AM
I found these stubs for testing :

Code: [Select]
NSTUB(0xFF83EE50, FA_CaptureTestImage)
NSTUB(0xFF8473B4, FA_CreateTestImage)
NSTUB(0xFF83F1C4, FA_DefectsTestImag)
NSTUB(0xFF847538, FA_DeleteTestImage)
NSTUB(0xFF840880, FA_DetectDefTestImage)
NSTUB(0xFF83FF80, FA_FA_ProjectionTestImage)
NSTUB(0xFF840060, FA_FA_ShadingTestImage)
NSTUB(0xFF84037C, FA_ObIntegTestImage)
NSTUB(0xFF840C78, FA_ShadingTestImageForLV)
NSTUB(0xFF83F084, FA_SubtractTestImage)
NSTUB(0xFF8448B4, FA_TestMonCall)
NSTUB(0xFF8446EC, FA_TestMonReadAndWrite)
NSTUB(0xFF8445AC, FA_TestMonRead)
NSTUB(0xFF84144C, FA_VProjectionTestImage)
NSTUB(0xFF845380, FA_YuvDevelopTestImage)

NSTUB(0xFF8841E4, GuiTestOneImage)

NSTUB(0xFFB64954, LVTest)
Title: Re: Canon 40D
Post by: jplxpto on November 13, 2012, 01:34:23 AM

I checked that there are several functions that use the memory address registered in memory location
MEM(0x1e020 + 0x18) = MEM(0x1E038) = 0x1dbc0064. (SetImageWorkMemory 1)

For example, in the function IMP_PUB_DrawImageToVram the following happens:


FFCA110C : R0=0x1E038
...
FFCA1120 call IMPV_PUB_MakeHDVramFromYuv_FFCA7D48

I think that in this case the address 0x1E038 is the parameter of the function IMPV_PUB_MakeHDVramFromYuv

Code: [Select]
NSTUB(0xFFCA0EE8, IMP_PUB_DrawImageToVram)
NSTUB(0xFFCA7D48, IMPV_PUB_MakeHDVramFromYuv)
Title: Re: Canon 40D
Post by: jplxpto on November 13, 2012, 02:02:11 AM
I think that the memory allocated by BmpDDev_CreatePhysicalVram is stored at (*0x5C00)->off_0x4.
You can see that at FF9B9510 (sub_FF9B944C).

Today, I no longer have time to test ... tests are for another day!
Title: Re: Canon 40D
Post by: nexiabass on November 13, 2012, 06:36:05 AM
When I reach that goal, I hope to have your help to test the result of my work.

For sure :)

I can't wait to see this happen to the good old 40D!
Title: Re: Canon 40D
Post by: jplxpto on November 23, 2012, 02:55:50 AM
Hello people...

I have good news...

As I told you before, I don't have much time to dedicate myself to this project but, 
I have devoted some time to understand code and read some documentation.
I have talked to other ML developers and they have helped me a lot.
They have been fantastic ... I think we have a team motivated, united and well organized.

Yesterday I have dedicated some time to test autofocus patterns (AF POINTS)
I can now choose the focus points.

Title: Re: Canon 40D
Post by: scaricame on November 23, 2012, 10:13:54 AM
Thanks from an Italian fan for the job that is doing, also I possess a canon 40D is I wait for good news!  ;)
Title: Re: Canon 40D
Post by: jplxpto on November 23, 2012, 12:17:05 PM
Thanks from an Italian fan for the job that is doing, also I possess a canon 40D is I wait for good news!  ;)

You're welcome!
Title: Re: Canon 40D
Post by: tanninety on November 25, 2012, 12:05:58 AM
40D owner here. Been eying the T4i for a while. If I could get video out of this 40D (atleast 480p) I'd be holding off getting the T4i for now.

Thanks for the time that's already been put towards this and the efort that's currently being invested.

And thanks jplxpto!
Title: Re: Canon 40D
Post by: jplxpto on November 25, 2012, 03:22:51 AM
40D owner here. Been eying the T4i for a while. If I could get video out of this 40D (atleast 480p) I'd be holding off getting the T4i for now.

Thanks for the time that's already been put towards this and the efort that's currently being invested.

And thanks jplxpto!

The work is advancing slowly ... in the last days were made many changes to the code of ML.
I'm now trying to recover what has been working.
The g3gg0 needed to make changes to the boot process and the camera stopped doing boot.
He is helping me solve this problem.
Title: Re: Canon 40D
Post by: jplxpto on November 29, 2012, 01:49:12 AM
I have to find STUB PtpPropSetUILock.
The Coutts used to unlock the UI when the PTP is connected. I need to do the same.

40d 111

ffb66f7c %s PtpPropSetUILock [%x][%x]

STUB(0xFFB67014, PtpPropSetUILock__maybe);

https://bitbucket.org/hudson/magic-lantern/commits/f85b386a2d61c369050edf490fa324da17794e40
Title: Re: Canon 40D
Post by: jplxpto on December 03, 2012, 02:52:09 AM
Here is the result of my first analysis to function BmpDDev_CreatePhysicalVram.

Code: [Select]
NSTUB(0xFFCB02B4, BmpDDev_CreatePhysicalVram);
Code: [Select]
extern int BmpDDev_CreatePhysicalVram(int *pWidth, int *pHeight, int *pPitch, int **pVRamAddress);

int width;
int height;
int pitch;
int *vRamAddress;

int result;

result = BmpDDev_CreatePhysicalVram(&width, &height, &pitch, &vRamAddres);

result is :
   0 when : The parameters are all valid and was allocated a block of 0x15184 bytes
   3 when :(pWidth == NULL || pHeight == NULL || pPitch == NULL || pVRamAddress == NULL)
   5 when : Could not allocate memory (pVRamAddress != NULL && *pVRamAddress == NULL)

width  is 0x2D0 (720)
height is 0x0F0 (240)
pitch  is 0x2D0 (720)
*pRamAddress is the vram address allocated by DMA a filled with zeros.

block size = 0x15180+4 = 86404 d = 360 * 240 bytes

I think, it takes 4 bits per pixel or 2 pixels per byte...
then the resolution should be: 720 * 240

Code: [Select]
   313:   608.094 [IMP] CreateVram 665
   330:   684.874 [Graphics] GuiClearImage
   331:   684.933 [IMP] (PUB) SetVramInformation(w:720 h:240) 1291
   332:   684.997 SetImageVramParameter x:0 y:0 w:720 h:240/* Aspect:0*/
   333:   685.032 [IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine 2644

I will explore the mechanisms of debug, developed by g3gg0 and try to get the list of function parameters.

I think that the memory allocated by BmpDDev_CreatePhysicalVram is stored at (*0x5C00)->off_0x4.
You can see that at FF9B9510 (sub_FF9B944C).

Today, I no longer have time to test ... tests are for another day!

Code: [Select]
MEM(0x5BF8) = 0xff9b943c
MEM(ff9b943c) = 'Vram Instance' (0x6D617256 0x736E4920 0x636E6174 0x00000065)

Code: [Select]
00005be0 aaaaaa7f bbbbbb7f cccccc7f dddddd7f eeeeee7f ffffff7f ff9b91e4 ff9b943c
00005c00 0065cae4 000002d0 000000f0 00000001 00000001 00000000 006301dc 0062ffcc
00005c20 0065cae4 00671d2c 000002d0 000001e0 00000000 00000000 007c417c 00687104
00005c40 ff9c1918 000ea508 00000007 00000001 00000000 00000000 00000000 00000000
00005c60 ff9c3540 0065bbec 0065bcb0 0065c28c 0065c424 0065c1ec 0065bf0c ff9caf40
00005c80 ff9caf50 ff9caf68 0062e8d8 00000000 ff9ed2bc ffa2f848 ffa913e4 ff9d1368

Code: [Select]
0065cae0 00000038 ff9b943c 000002d0 000002d0 000000f0 10671da4 000ea52c 00000000
0065cb00 00000000 00000000 000002d0 000000f0 0065cad8 00671d20 00015210 22f586fa
0065cb20 50bf205e 0c2f13f7 407d0aff 12fa6ff5 05f758ff 08f70afa 00df0aed 81f92c25
0065cb40 409fe0ff 00fe3dff 01bc04df 027f0d1f 84fe20fc 017db0e5 08fd08cf 22222222

Code: [Select]
MEM(0x5BFC) = 0xff9b943c  ; pointer to 'Vram Instance'

MEM(0x5c00) = 0x0065cae4  ; VRAM Address (maybe)
MEM(0x5c04) = 0x000002d0  ; width (720)
MEM(0x5c08) = 0x000000f0  ; height(240)
MEM(0x5c0C) = 0x00000001  ; ???

MEM(0x5c24) = 0x00671d2c  ; VRAM Address (maybe)
MEM(0x5c28) = 0x000002d0  ; width (720)
MEM(0x5c2c) = 0x000001e0  ; height(480)
MEM(0x5c3f) = 0x00000000  ; ???

MEM(0x0065cae4) = 0xff9b943c  ; pointer to 'Vram Instance'
MEM(0x0065cae8) = 0x000002d0  ; width  (720)
MEM(0x0065caec) = 0x000002d0  ; pitch  (720)
MEM(0x0065caf0) = 0x000000f0  ; height (240)
MEM(0x0065caf4) = 0x1065cb5c  ; ???

MEM(0x00671d2c) = 0xff9b943c  ; pointer to 'Vram Instance'
MEM(0x00671d30) = 0x000002d1  ; width  (721) ???
MEM(0x00671d34) = 0x000002d0  ; pitch  (720)
MEM(0x00671d38) = 0x000000f0  ; height (240)
MEM(0x00671d3C) = 0x10671da4  ; ???

size = 0x15180 bytes ( 720 / 2  * 240 )
Title: Re: Canon 40D
Post by: jplxpto on December 04, 2012, 04:36:24 AM
In search of lost VRAM of 40D111...

Code: [Select]
MEM(ff9b943c) = 'Vram Instance' (0x6D617256 0x736E4920 0x636E6174 0x00000065)
Code: [Select]
hexdump -C DUMP_RAM_0x0_0x100000.bin | grep "3c 94 9b ff"
Code: [Select]
00005bf0  7f ee ee ee 7f ff ff ff  e4 91 9b ff 3c 94 9b ff  |............<...|
000ea4e0  12 00 00 00 02 00 00 00  3c 94 9b ff 01 00 00 00  |........<.......|
000ea530  3c 94 9b ff 01 00 00 00  38 a5 0e 00 38 a5 0e 00  |<.......8...8...|
0065cae0  38 00 00 00 3c 94 9b ff  d0 02 00 00 d0 02 00 00  |8...<...........|
00671d20  10 cb 65 00 58 1d 67 00  38 00 00 00 3c 94 9b ff  |..e.X.g.8...<...|

Code: [Select]
MEM(0x00005BF0) = 0xFF9B943C

MEM(0x000EA4E8) = 0xFF9B943C (LV VRAM 1) maybe
MEM(0x000EA530) = 0xFF9B943C (LV VRAM 2) maybe

MEM(0x0065CAE4) = 0xFF9B943C (BMP VRAM 1) maybe
MEM(0x00671D2C) = 0xFF9B943C (BMP VRAM 2) maybe
Title: Re: Canon 40D
Post by: TTS on December 05, 2012, 12:19:21 AM
I've got 2 x 40D, therefore following this development with a smile :-)
Title: Re: Canon 40D
Post by: jplxpto on December 05, 2012, 02:25:26 AM
I've got 2 x 40D, therefore following this development with a smile :-)

Thank you!

When there is life there is hope ... do not give up.
Sometimes dreams do come true. If not I give you this, others will certainly do it!
Title: Re: Canon 40D
Post by: tanninety on December 08, 2012, 12:44:14 AM
I crossed the T4i off my Christmas list. Still holding on to my 40D :)
Title: Re: Canon 40D
Post by: jplxpto on December 08, 2012, 12:54:10 AM
I crossed the T4i off my Christmas list. Still holding on to my 40D :)

Unfortunately, I've been a little tired and busy with other tasks. Soon I hope to dedicate myself more time to this port. The good news I have to give you is that in principle we have more developers to work with me on this port. We have verified that there are still very users interested in having ML this camera so, you'll spend more time. This of course depends on our available time.
Title: Re: Canon 40D
Post by: RenatoPhoto on December 08, 2012, 01:57:08 AM
Unfortunately I just sold my 40D!  But I root for your success!  Nice work.
Title: Re: Canon 40D
Post by: jplxpto on December 08, 2012, 02:15:15 AM
Unfortunately I just sold my 40D!  But I root for your success!  Nice work.

Thank you and good Christmas
Title: Re: Canon 40D
Post by: moodoki on December 08, 2012, 05:10:15 AM
newbie developer on the block and willing to help, just had my toolchain setup and looking for a place to start :)

I have a 40D and i'm more than willing to help with the porting effort.
Title: Re: Canon 40D
Post by: jplxpto on December 08, 2012, 06:44:22 PM
newbie developer on the block and willing to help, just had my toolchain setup and looking for a place to start :)

I have a 40D and i'm more than willing to help with the porting effort.

You are welcome to our team.

http://www.magiclantern.fm/develop

"
Become developer
Our development capacity is limited. A lot of time goes into bugfixing and working towards a stable version.

If you'd like to help, here are the steps for getting started:

Step 1. Get the source code
hg clone -r unified https://bitbucket.org/hudson/magic-lantern

Step 2. Setup the compiler
http://magiclantern.wikia.com/wiki/Build_instructions/Unified

Step 3. Start hacking
http://magiclantern.wikia.com/wiki/For_Developers
 
If you get stuck, ask here.
"

You can do: make clean; make 40D

There are some methods to launch ML but have not yet been published. You need to activate the bootflag.
I suggest you start with me to spend a few hours reading documentation. And I did that and still did not stop.
You can also look at the source code.

Thou shalt also read:

http://wiki.magiclantern.fm/install

http://wiki.magiclantern.fm/userguide

You should know that you can turn your camera into a brick. We take great care with the development but we are not free from danger.

We CAN NOT be responsible for something bad to happen to your camera.

Good Luck
Title: Re: Canon 40D
Post by: jplxpto on December 08, 2012, 06:50:05 PM
@moodoki

Some more links

http://magiclantern.wikia.com/wiki/Developing_info
http://magiclantern.wikia.com/wiki/Special:AllPages

http://www.magiclantern.fm/forum/index.php?topic=3267.msg20369#msg20369

Title: Re: Canon 40D
Post by: jplxpto on December 09, 2012, 02:12:22 AM

I found a stub with an interesting name (BugDetect).

One of two ... or Canon admits may have bugs in the firmware, or they implemented some functionality to help take pictures of wildlife :)

40d111

NSTUB(0xFFD3E2FC, BugDetect)
Title: Re: Canon 40D
Post by: moodoki on December 09, 2012, 03:41:50 PM
@jplxpto

thanks for all the links:)

got everything setup correctly (hopefully) and managed to build a version and have it run successfully on a borrowed 550D.

Now to get working on 40D..
Title: Re: Canon 40D
Post by: jplxpto on December 09, 2012, 04:09:04 PM
@jplxpto

thanks for all the links:)

got everything setup correctly (hopefully) and managed to build a version and have it run successfully on a borrowed 550D.

Now to get working on 40D..

You have to check if your camera has installed the FIR version 1.1.1

Good Luck
Title: Re: Canon 40D
Post by: mrcornelia on December 10, 2012, 11:34:43 PM
Nice work jplxpto and associates! I'm so happy to see the amazing job you guys have done so far! I'll be following with great interest!! :)
Title: Re: Canon 40D
Post by: Faxe on December 11, 2012, 12:38:05 PM
Keep it up!
As much as I want new features on the 40d I have to admit the largest problem with taking nice shots is the head behind the camera.  ::)
Title: Re: Canon 40D
Post by: jplxpto on December 11, 2012, 02:57:18 PM
Thank you!
Our team likes to know that you value our work and support us. Your words are always welcome lovable.

I'm a little busy but I still work in this port. In recent days I devoted some time to the forum and other matters of our development team. Soon I hope to have time and can get the intervalometer working. I've invested some time in this feature.

It is with pleasure that I announce you that we have another developer in the team.The 0xAF from 400dplus.
He has already started working on the port of 5DC.

There is much in common between the 40D and 5DC.
I will work in partnership with him. He is a good developer and already has much experience in this type of projects.

I hope to soon have the collaboration of Chucho.
He helped me a lot earlier this port. I hope your life, possible to devote a little more to this project.
Title: Re: Canon 40D
Post by: samacochan on December 11, 2012, 07:26:20 PM
Sounds good. Now more developers will be jumping in to explore the world of 40D ML and help to make our dream come true one day. I will not be selling my 40D definitely. I may be able to get $300 for the selling of it but keeping the camera and keep coming back to this thread everyday is like waiting for the birth of my baby and it's a lot of joy and fun.

Thank you guys.
Title: Re: Canon 40D
Post by: jplxpto on December 11, 2012, 10:47:16 PM
Sounds good. Now more developers will be jumping in to explore the world of 40D ML and help to make our dream come true one day. I will not be selling my 40D definitely. I may be able to get $300 for the selling of it but keeping the camera and keep coming back to this thread everyday is like waiting for the birth of my baby and it's a lot of joy and fun.

Thank you guys.

Hi

Thank you for your kind words.

I have the same dream and that is why I have registered in this forum.

I never thought of creating an application to run on my little princess.
I almost killed my little baby, but little by little it grows and and gaining some maturity.

I started this project by insistence.
Everyone told me that this camera has VxWorks and this made it almost impossible one day ML support this equipment.
I've always been hurt by this statement.
I thought ... why my camera need be excluded from this wonderful world that is ML.

I wanted to learn a bit more and one day be able to have ML on my camera that I decided to start learning about ML. Past few days I've registered in the forum I was admitted as a developer for this fantastic team. I'm very grateful, they all welcomed me in the best way. Until today, always helped me whenever I needed. My free time is not much but I have learned a lot. I hope one day give you this happiness. Do not worry, I'm hoping to achieve ... if not me, another member will do it for me. Keep on dreaming ... maybe one day wake up and have a surprise in our forum :)

jp
Title: Re: Canon 40D
Post by: jplxpto on December 12, 2012, 03:27:05 AM
I was examining some stubs that allow register, search and call functions by name.

I already knew them almost all but this time I found one that sounded interesting.
Some time ago I wanted to, at runtime, get the list of all registered functions.
I intend to write code that creates in the memory card, a file (registered_stubs.S) with all stubs registered by name.

I found the stub GetListOfName which I believe to be part of the tasks necessary to accomplish this goal.
When I have an opportunity I will analyze the firmware in more detail the firmware and do some testing.


40D111

Code: [Select]
NSTUB(0xFFD45DE0, GetListOfName)

NSTUB(0xFFD3E320, call);

NSTUB(0xFFD45CB8, FindName)

NSTUB(0xFFD4ECC0, Register_Func_with_Name)
NSTUB(0xFFD3E45C, Register_Func_with_Name_sub_1)
Title: Re: Canon 40D
Post by: jplxpto on December 12, 2012, 03:50:11 AM
As I mentioned in a previous post, I'm trying to put the intervalometer working.
I've been examining the firmware and found some strings that can help me find the STUB that take photos.
I suspect the FA_Release stub is that I need to take pictures.
Once I have the opportunity I will try.

Code: [Select]
NSTUB(0xFF84768C, FA_Release)
Code: [Select]
ff811130 FA_Release
ff83ebc8 FA_Release
ff83ebd4 FA_ClearReleaseModeForLV
ff83ebf0 FA_SetReleaseModeForLV

ff83edec [FA] FA_CaptureTestImage

ff8478fc Remote
ff847a58 this
ff847a60 ../Remote.c
ff847a6c rmtRelease
ff847a78 rmtSaveToPC

ff84c148 RssRemoteReleaseQue
ff84c15c [RSS]FAReleaseExecute:%lx,%lx,%lx
ff84c180 [RSS]rssFAReleaseEnd:%lx

ff84c19c FA_RemoteRelease
ff84c1b0 FA_FinishRemoteRelease
ffb64a38 PtpDpsRmtReleaseEventFlag

The strings rmtRelease and rmtSaveToPC should be used to make the registration by name but i still unknown where on the registration is done. Maybe a solution is to list all the functions that are registered by name at runtime. Maybe.....
Title: Re: Canon 40D
Post by: 0xAF on December 12, 2012, 10:00:28 AM
I was examining some stubs that allow register, search and call functions by name.

In 400d most of these registered (by name) functions are only for eventproc stuff and the internal console (the shell) stuff.
Not all functions are registered there, and I believe that they wont help you.
In 400d there is a list with strings for the functions,
let's say for example "Function1, Function2, Function3, ..."
These strings are pointing to the real functions which are:
eventproc_Function1, eventproc_Function2, eventproc_Function3, ...

So finding this list with pointers, may only help you to name the real functions (if you haven't done it so far).
But if you need to call suck function, you can directly call the eventproc_Function1(), instead of call_function("Function1");
Title: Re: Canon 40D
Post by: jplxpto on December 12, 2012, 11:52:36 AM
In 400d most of these registered (by name) functions are only for eventproc stuff and the internal console (the shell) stuff.
Not all functions are registered there, and I believe that they wont help you.
In 400d there is a list with strings for the functions,
let's say for example "Function1, Function2, Function3, ..."
These strings are pointing to the real functions which are:
eventproc_Function1, eventproc_Function2, eventproc_Function3, ...

So finding this list with pointers, may only help you to name the real functions (if you haven't done it so far).
But if you need to call suck function, you can directly call the eventproc_Function1(), instead of call_function("Function1");

Thank you
Title: Re: Canon 40D
Post by: jplxpto on December 15, 2012, 04:21:16 AM
I used a button to call the stub FA_Release.
I could take pictures inside and outside the LV mode but it always opens and closes the shutter and this should not be proper operation for the intervalometer.
Title: Re: Canon 40D
Post by: 0xAF on December 15, 2012, 02:52:26 PM
I used a button to call the stub FA_Release.
I could take pictures inside and outside the LV mode but it always opens and closes the shutter and this should not be proper operation for the intervalometer.

I'm not sure how it works on LV cameras, but in 400d it is always moving the mirror, even when MLU (Mirror Lock Up) is set. This is expected behavior.
Perhaps what you want to do is not calling the "Release". Which is basically the shutter button press. Perhaps you wanted to take snapshot of the LV screen, but then you wont have the resolution you need ?
Title: Re: Canon 40D
Post by: jplxpto on December 15, 2012, 04:28:26 PM
I'm not sure how it works on LV cameras, but in 400d it is always moving the mirror, even when MLU (Mirror Lock Up) is set. This is expected behavior.
Perhaps what you want to do is not calling the "Release". Which is basically the shutter button press. Perhaps you wanted to take snapshot of the LV screen, but then you wont have the resolution you need ?

You are right. After writing this post I read a bit more and this seems to be the expected behavior.
Title: Re: Canon 40D
Post by: jplxpto on December 16, 2012, 01:32:09 AM
I have news.

After a few days away from development ... I came back to dedicate a few hours to the 40D port.

I managed to carry one more feature. The intervalometer is already working on my 40D.

I still can not decide which will be the new feature, maybe start by getting a list of all properties (or more important).
Title: Re: Canon 40D
Post by: Crowler on December 16, 2012, 04:33:06 PM
Hello jplxpto ! Focus assist will be work in ML for 40D ? I need it very much !
Thank You !
Title: Re: Canon 40D
Post by: jplxpto on December 16, 2012, 07:42:03 PM
Hello jplxpto ! Focus assist will be work in ML for 40D ? I need it very much !
Thank You !

I hope so, but first I'll have to solve some problems with overlays.
Title: Re: Canon 40D
Post by: jplxpto on December 17, 2012, 03:09:54 AM
I'm starting to identify some necessary properties for future functionality.

I've been testing two additional features that seem to be working well:

Expo/Aperture
Expo/Shutter

I will not be already available features because they change the values ​​of properties and can turn the camera on a brick :)
I first got to have more trust in changes.

Once I have some free time, I'll try to change the value of the ISO and the program.

I'll try to provide all the features that are on the menu Expo.

Title: Re: Canon 40D
Post by: jplxpto on December 18, 2012, 01:56:14 AM
Here is a list with the names of the properties. Regular expressions are not my specialty. :)

Code: [Select]
grep ".*[[:space:]]PROP_" 40d.111.ROMF1.0xFF800000.bin.strings | sed -e "s|.*[[:space:]]PROP_|PROP_|g" | sed -e "s|[[:space:]].*$||g" | sed -e "s|[\:\=\[\(].*$||g" | sort | uniq > 40d111_properties.txt

cat 40d111_properties.txt

Code: [Select]
PROP_ABORT
PROP_ACCESS_REMAIN
PROP_ACTIVE_SWEEP_ACTIVATE_CONDITION
PROP_ACTIVE_SWEEP_MODE
PROP_ACTIVE_SWEEP_STATUS
PROP_AEB
PROP_AFPOINT
PROP_AUTO_POWEROFF_TIME
PROP_AUTO_ROTATE
PROP_BATTERY_CHECK
PROP_BATTERY_REPORT
PROP_BEEP
PROP_BODY_ID
PROP_BUILTIN_STROBO_SETTING
PROP_CARD1_CLUSTER_SIZE
PROP_CARD1_EXIST
PROP_CARD1_FILE_NUMBER
PROP_CARD1_FOLDER_NUMBER
PROP_CARD1_FREE_SIZE
PROP_CARD1_IMAGE_FORMAT
PROP_CARD1_IMAGE_QUALITY
PROP_CARD1_IMAGE_SIZE
PROP_CARD1_NEXT_FOLDER_NUMBER
PROP_CARD1_RECORD
PROP_CARD1_STATUS
PROP_CARD2_CLUSTER_SIZE
PROP_CARD2_EXIST
PROP_CARD2_FILE_NUMBER
PROP_CARD2_FOLDER_NUMBER
PROP_CARD2_FREE_SIZE
PROP_CARD2_NEXT_FOLDER_NUMBER
PROP_CARD2_RECORD
PROP_CARD2_STATUS
PROP_CARD3_CLUSTER_SIZE
PROP_CARD3_EXIST
PROP_CARD3_FILE_NUMBER
PROP_CARD3_FOLDER_NUMBER
PROP_CARD3_FREE_SIZE
PROP_CARD3_IMAGE_FORMAT
PROP_CARD3_IMAGE_QUALITY
PROP_CARD3_IMAGE_SIZE
PROP_CARD3_NEXT_FOLDER_NUMBER
PROP_CARD3_RECORD
PROP_CARD3_STATUS
PROP_CARD_EXTENSION
PROP_CARD_IMAGE_FORMAT
PROP_CARD_IMAGE_QUALITY
PROP_CARD_IMAGE_SIZE
PROP_CARD?_STATUS
PROP_CFN_TAB3
PROP_CFN_TAB4
PROP_COLOR_SPACE
PROP_COMP
PROP_COMPRESSION_L
PROP_COMPRESSION_M1
PROP_COMPRESSION_M2
PROP_CONNECT_TARGET
PROP_CONNECT_TARGET_WFT
PROP_CURRENT_MEDIA
PROP_CUSTOM_WB
PROP_DATA_INPUT_TRANSMISSION
PROP_DATE_DISPLAY_FORMAT
PROP_DEFAULT_OBWBREG
PROP_DIR_SUFFIX
PROP_DISPLAY_AF_POINTS
PROP_DP_DPOF_PARAM
PROP_DP_EXT_OPTION_PARAM
PROP_DP_STANDARD_PARAM
PROP_DSDEFINE
PROP_DUST_DELETE_DATA
PROP_ELECTRIC_SHUTTER_MODE
PROP_ERROR_FOR_DISPLAY
PROP_FILE_NUMBERING_MODE
PROP_FILE_PREFIX
PROP_FIRM_VERSION
PROP_FIXED_VERSION
PROP_FLAVOR_BW
PROP_FLAVOR_FAITHFUL
PROP_FLAVOR_LANDSCAPE
PROP_FLAVOR_MODE
PROP_FLAVOR_NEUTRAL
PROP_FLAVOR_PORTRAIT
PROP_FLAVOR_STANDARD
PROP_FLAVOR_USER1
PROP_FLAVOR_USER2
PROP_FLAVOR_USER3
PROP_FLAVOR_XXXX
PROP_GPS_STATUS
PROP_GUI_STATE
PROP_HDD_DCIM_PATH
PROP_HIGHLIGHT_ALERT
PROP_HISTOGRAM
PROP_ICU_AUTO_POWEROFF
PROP_ICU_UILOCK
PROP_Initialize
PROP_LANGUAGE
PROP_LAST_JOBID
PROP_LAST_JOB_STATE
PROP_LCD_BRIGHTNESS
PROP_LCD_STATE
PROP_LENS
PROP_LIVE_VIEW_GRID
PROP_LIVE_VIEW_VALID
PROP_LOGICAL_CONNECT
PROP_LOGICAL_CONNECT_WFT
PROP_LV_AF_RESULT
PROP_LV_AVAILABLE_AREA
PROP_LV_EXPOSURE_MODE
PROP_LV_HISTOGRAM
PROP_LV_OUTPUT_DEVICE
PROP_LV_SPDN_BTN_STATUS
PROP_LV_TEST_REMOTE_RELEASE
PROP_MENU_POSITION
PROP_METERING_MODE
PROP_METERING_TIMER_FOR_LV
PROP_MWB
PROP_MWB1
PROP_MYMENU_LIST
PROP_NO_CARD_RELEASE
PROP_NUMBER_OF_CONTINUOUS_MODE
PROP_PC_FLAVOR1_PARAM
PROP_PC_FLAVOR2_PARAM
PROP_PC_FLAVOR3_PARAM
PROP_PC_FREE_SIZE
PROP_PC_WB1
PROP_PC_WB2
PROP_PC_WB3
PROP_PC_WB4
PROP_PC_WB5
PROP_PERMIT_ICU_EVENT
PROP_PHOTO_STUDIO_ENABLE_ISOCOMP
PROP_PHOTO_STUDIO_ISOCOMP
PROP_PHOTO_STUDIO_MODE
PROP_PHOTO_STUDIO_MODE_CHANGE_AUTO_PASSWORD_KEY
PROP_PHOTO_STUDIO_MODE_CHANGE_MANUAL_PASSWORD
PROP_PHOTO_STUDIO_SETUP_PASSWORD
PROP_PHYSICAL_CONNECT
PROP_QUICKREVIEW
PROP_QUICKREVIEW_MODE
PROP_RED_EYE_REDUCTION
PROP_REMOTE_BULB_RELEASE_END
PROP_REMOTE_BULB_RELEASE_START
PROP_REMOTE_RELEASE
PROP_SAVE_MODE
PROP_SaveMpuDebugData
PROP_SDIO_PHYSICAL_CONNECT
PROP_SDIO_PHYSICAL_CONNECT_START
PROP_SELECTED_FILE_PREFIX
PROP_SET_TV
PROP_SHOOTING_TYPE
PROP_SHUTTER_COUNTER
PROP_SPECIAL_OPTION
PROP_STARTUP_CONDITION
PROP_STROBO_CFN
PROP_STROBO_SETTING
PROP_STROBO_WIRELESS_SETTING
PROP_TEMP_STATUS
PROP_TRANS_METHOD_WFT
PROP_TUNING_FLAG
PROP_USBDEVICE_CONNECT
PROP_USER_FILE_PREFIX
PROP_USER_FILE_PREFIX2
PROP_VIDEO_PHYSICAL_CONNECT
PROP_VIDEO_SYSTEM
PROP_WBB_BA
PROP_WBB_GM
PROP_WB_MODE
PROP_WBS_BA
PROP_WBS_GM
PROP_WFT_ADAPTERINFO
PROP_WFT_CAPTION
PROP_WFT_DELIMITER_STATUS
PROP_WFT_DONGLE
PROP_WFT_FTP
PROP_WFT_HOSTINFO
PROP_WFT_HTTP
PROP_WFT_IMAGE_TRANS
PROP_WFT_LOCK
PROP_WFT_SYSTEM
PROP_WFT_TCPIP
PROP_WFT_TRANSMISSION
PROP_WFT_WIRED
PROP_WFT_WIRELESS
PROP_WIZARD_WFT

I think it is not missing any. If you detect any problems let me know. Thank you.
Title: Re: Canon 40D
Post by: jplxpto on December 18, 2012, 02:15:02 AM
I think that 40D only allows MF on LV mode. What is the purpose of this property? ...

PROP_LV_AF_RESULT
Title: Re: Canon 40D
Post by: CaesarB on December 19, 2012, 09:15:42 PM
I think that 40D only allows MF on LV mode. What is the purpose of this property? ...

PROP_LV_AF_RESULT

Hi guys, glad to see an active develop thread on the 40D.

My 2 cents: 40D can indeed autofocus in LV, via C. Fn. III-6. Please check http://photography-on-the.net/forum/showthread.php?t=428535, so PROP_LV_AF_RESULT is probably related to it.

Regards
Title: Re: Canon 40D
Post by: jplxpto on December 20, 2012, 12:27:24 AM
Hi Thank you for registering at our forum. You are welcome to this community.
I appreciate your link. I learn a little more. Glad to hear that works with a 40D.
I hope one day to enhance your camera.

BR
Title: Re: Canon 40D
Post by: CaesarB on December 20, 2012, 12:35:11 AM
I'm sure you will.

Thank you very much!
Title: Re: Canon 40D
Post by: imme on December 29, 2012, 09:11:31 AM
waiting waiting waiting :)

Just tried ML on a friend's 400d and now waiting aggressively for 40d version.......JPL really nice work and dedication.......

Title: R: Re: Canon 40D
Post by: nanomad on December 29, 2012, 11:32:16 AM
waiting waiting waiting :)

Just tried ML on a friend's 400d and now waiting aggressively for 40d version.......JPL really nice work and dedication.......
There's no ML for the 400D. It's a different project altogether called 400plus. We do share some code and ideas though
Title: Re: Canon 40D
Post by: imme on December 31, 2012, 02:07:37 PM
Thanks ......I thought it was ML. 400plus is a good project. I am waiting for 40d ML. It good to see you people working on this project
Title: Re: Canon 40D
Post by: scaricame on January 10, 2013, 06:04:18 PM
News??? :)
Title: Re: Canon 40D
Post by: imme on January 11, 2013, 01:56:47 PM
Is there any progress? Any idea (days or months) when we will be able to run ML on our 40d? Please! Do something we are waiting waiting waiting.
Title: Re: Canon 40D
Post by: jplxpto on January 12, 2013, 06:22:51 PM
Is there any progress? Any idea (days or months) when we will be able to run ML on our 40d? Please! Do something we are waiting waiting waiting.

I can't answer that question.
I work on this project whenever I have time and disposition.
I'm busy finishing a project and I have many issues to deal with in my life.
I hope soon to be able to continue with this port.

I started making the discovery of most properties.
Many of them are critical to continue the port but this task takes a long time.

In recent days I have devoted some time to the 650D.
I have a camera with me and I'll start doing some tests with ML.
Title: Re: Canon 40D
Post by: imme on January 14, 2013, 09:01:47 AM
JPLXPTO........i am a big fan of your work. It was you who started working on this port. I am hopeful you will make 40d ML very soon.
Title: Re: Canon 40D
Post by: jplxpto on January 24, 2013, 11:21:19 PM
Thank you!
Title: Re: Canon 40D
Post by: j_veitch on February 04, 2013, 06:59:12 PM
I just wanted to say I remember sitting in the earlier days of ML, hoping a 40D patch would come, then hearing not, and I don't know how I missed this thread...

Anway, just going to give some moral support, and when I get a little time see if I can assist further (I do own a 40D, and am happy to help where I can).

PS I am really impressed by the work of the developers and the talented people using ML.
Title: Canon 40D
Post by: lalama on February 04, 2013, 10:59:40 PM
Took time following the fantastic work they are doing you, and just wanted to congratulate you for it.
I also give my moral support to this project, because as j-Veitch said I too have been waiting for the arrival of the patch to the 40D.
I think we all know how hard it must be to create this, and I also believe strongly that the EOS 40D ML deserves.
I hope to be helpful at some point and I apologize for my bad English.
A greeting.
Title: Re: Canon 40D
Post by: scaricame on February 21, 2013, 10:28:14 AM
news???
Title: Re: Canon 40D
Post by: ariznaf on February 21, 2013, 06:38:21 PM
I have just registered just to post here and give you a thumbs up.

Great effort, I have been long waiting for somebody to port ML to my 40D.
It would be great to be able to record video and many of the ML features in photography, like focus peaking, advance bracketing, focus bracketing, etc.

I am seeking for any news about it.

Please keep trying and thanks for your efforts.
I will pay for the firmware as soon as there is an early versión.
Title: Re: Canon 40D
Post by: samacochan on February 28, 2013, 12:03:54 AM
I have just registered just to post here and give you a thumbs up.

Great effort, I have been long waiting for somebody to port ML to my 40D.
It would be great to be able to record video and many of the ML features in photography, like focus peaking, advance bracketing, focus bracketing, etc.

I am seeking for any news about it.

Please keep trying and thanks for your efforts.
I will pay for the firmware as soon as there is an early versión.

I am afraid you will be disappointed. Come back in six months and see if I am wrong.
Title: Re: Canon 40D
Post by: j_veitch on February 28, 2013, 12:13:49 AM
Well, firmware is new to me. And I am reading what I can in the time I have.  i did get round to dl'ing the ubuntu vm... And one o the devs at my work has at least used vxworks amd arm in the past. But, really not sure where to go from here.  Anyway, i haven't given up hope yet.
Title: Re: Canon 40D
Post by: blue9 on March 01, 2013, 02:02:57 PM
I have several Eos cameras, however the 40D has the best sharpness per pixel performance. Just look at DP preview's review of 50D and how it compared to the 40D 10mp sensor. So if someone are able to fix ML for the 40D, it think it will be one of the sharpest video enabled DSLR.
Title: Re: Canon 40D
Post by: jurojuro on March 04, 2013, 10:03:45 PM
 I will also pay something if I get HD video properties to 40D! Would be great to utilize the old camera!!
Title: Re: Canon 40D
Post by: imme on March 05, 2013, 11:49:00 AM
We all are desperately waiting for 40d Magiclantern version. But I think 40d is not on priority list of ML.

Please! I request that If 40d port is possible than keep this thread alive in other case close this thread and say 40d port is not possible due to all new camera portings. It will close the case forever. I am not disappointed or emotional but I am trying to convey feelings of several 40d users who are anxiously waiting for 40d version. But there is no development priority for this.
Title: Re: Canon 40D
Post by: ariznaf on March 06, 2013, 11:13:04 PM
The dveloper does  not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.

Of course this is not  probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.
Title: Re: Canon 40D
Post by: jplxpto on March 21, 2013, 01:56:47 AM
I'M LIVE :)

Sorry ... I have spent many days with health problems and hard work.
My life has been a bit complicated but I hope to get back to work on this project a few days from now.
I'll need to read some posts. I am now a bit outdated.

I think the developers have done an excellent job.

I promise appear shortly.

BR
Title: Re: Canon 40D
Post by: jplxpto on March 21, 2013, 02:04:22 AM
The dveloper does  not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.

Of course this is not  probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.

YES!!! You are right! Thank you for your kindness.

You may not believe but I finally went and uncle have not photographed the child with a DSLR. :(

I love to shoot a little of everything but children are at the top of my list. And now I have a new reason to shoot.

BR
Title: Re: Canon 40D
Post by: jplxpto on March 21, 2013, 02:08:01 AM
The dveloper does  not seem to be active in the forum, not just this post.
It seems he is busy with personal tasks.

Of course this is not  probably his main priority, there is work and family, personal troubles...
Hope he will work en this soon.

I still have some outstanding issues to resolve but I will endeavor to return soon.
Title: Re: Canon 40D
Post by: blue9 on March 21, 2013, 12:14:52 PM
I have several eos cameras, the 40D however produses very sharp and clean images for it's size (10Mp). Take a look at DP's (Digital preview) review of the 50D where the older 40D at delivered the same image quality as the 50D when magnefied, even if the 50D has a 15.1 Mp sensor.

I think a Magic Lantern converted 40D camera would be one of the best and sharpest film cameras, and to a fair price.  ;)
Title: Re: Canon 40D
Post by: ariznaf on March 21, 2013, 10:21:07 PM
YES!!! You are right! Thank you for your kindness.

You may not believe but I finally went and uncle have not photographed the child with a DSLR. :(

I love to shoot a little of everything but children are at the top of my list. And now I have a new reason to shoot.

BR
Well come back and many thanks for your efforts.  Glad to hear from you.
Hope your personal troubles and your health issues have been solved.

Programming is a very time consuming task,  and this kind of programming Is even more demanding.
Hope you find the time to complete the task,  but even if you cannot complete it,  we should be gratefully for your efforts and time.

I come often to the thread to read about the progress.  I would like to test ml in my 40d and test video in a DSLR.

May be in the near future,  when the price lowers more,  I will buy a 7d as my video camera is dead,  but I am not sure that a DSLR is an alternative to a consumer video camera.

Anyway there are many interesting g things in ml for photography too.
Title: Re: Canon 40D
Post by: mincanphoto on March 24, 2013, 02:33:52 AM
jplxpto,I found some information for you
1.http://valexvir.narod.ru/      -----from Russian,for 40D, 50D, 5D Mark II и 1Ds Mark III -  record video 1024x680 with a pc.
2.DIGIC III - (VxWorks OS) from CHDK    http://chdk.wikia.com/wiki/For_Developers
3.one  chinese cracked the firmware of 40D,found out the “factory menu”;ISO 50-6400;AF CK;but he stoped (write text.bin),
http://bbs.fengniao.com/forum/1397306_8.html
http://bbs.fengniao.com/forum/1397306_9.html
Title: Re: Canon 40D
Post by: jplxpto on March 24, 2013, 03:37:32 AM
jplxpto,I found some information for you
1.http://valexvir.narod.ru/      -----from Russian,for 40D, 50D, 5D Mark II и 1Ds Mark III -  record video 1024x680 with a pc.
2.DIGIC III - (VxWorks OS) from CHDK    http://chdk.wikia.com/wiki/For_Developers
3.one  chinese cracked the firmware of 40D,found out the “factory menu”;ISO 50-6400;AF CK;but he stoped (write text.bin),

Thank you!
Title: Re: Canon 40D
Post by: jplxpto on March 30, 2013, 03:42:18 AM
My dear friends,

Finally, I got some time to update my repositories and make the necessary changes to make the build of ML for 40D.

My next task will be to fix the menus.
Many changes were made to the menu system and now some things are not well presented. For example, icons appear with double the size.

I think, users of 5DC will have the same problem.
I made small fixes that should have an impact on 5DC but I do not have this camera for testing.

https://bitbucket.org/hudson/magic-lantern/pull-request/71/some-change-to-build-ml-for-vxworks/diff
Title: Re: Canon 40D
Post by: j_veitch on March 30, 2013, 10:15:27 AM
Just want to say, thanks for all your efforts so far.  I just never seem to have the time to look further myself... It is quite a learning curve for me.
Title: Re: Canon 40D
Post by: jplxpto on March 30, 2013, 08:32:55 PM
Some screenshots:

http://i.imgur.com/qfFlm6w.jpg

http://i.imgur.com/cqslQ9x.jpg

http://i.imgur.com/eRVDcgb.jpg

http://i.imgur.com/X0YpUVX.jpg
Title: Re: Canon 40D
Post by: muzsielod on March 31, 2013, 11:50:44 PM
This are great news ;D
Title: Re: Canon 40D
Post by: nexiabass on April 02, 2013, 07:58:52 AM
Great to see progress.
I really would like to help, so if some alpha-testing is necessary ^^
Do you already have an idea if a iso expansion would work?
Title: Re: Canon 40D
Post by: ilguercio on April 02, 2013, 09:24:10 AM
It does already, use Lightroom.
;)
Title: Re: Canon 40D
Post by: nexiabass on April 02, 2013, 10:26:29 AM
Thats the standard answer ;)
But it's a bit easier and better to handle to select a iso value instead of underexposure.
It's just the standard workflow with the cam - for me ;)
Title: Re: Canon 40D
Post by: adentallon on April 04, 2013, 04:57:34 AM
Created an account to show support for this project.  I'll also throw my camera up for grabs for testing if needed.
Title: Re: Canon 40D
Post by: fotosi on April 06, 2013, 03:59:29 PM
Hello! I have created account too, just to show my support. I already follow this thread unregistered, from the its begining and just because of maybe incoming Magic Lantern for 40D, I still keep my three 40D's.
Many many thanks to the developers of Magic Lantern! When I watch what you guys do, it seems to my like a rocket science. Really unbeliveable...
If you successfuly finish this project, you will receive a donation from me, for your big success.
Big thanks in advance and I will stay tuned to the new happening.... :)
Title: Re: Canon 40D
Post by: jplxpto on April 07, 2013, 02:31:34 AM
Thank you!
Title: Re: Canon 40D
Post by: Bimmer_E30 on April 08, 2013, 12:47:47 AM
I too have created account, to congratulate you all, for trying. My 40D is wainting to test ML.
Title: Re: Canon 40D
Post by: danniorn on April 09, 2013, 04:12:44 PM
I did the same thing as anyone else :) i made an account just to say good work and keep it going! i would love to make my 40d take short clips but i have one thing to ask, would it be hard to add the timelaps feature in the 40d magic lantern?  becouse i would loe to take some timelaps without the 200$+ remote  :o

Keep doing your awesome work  8)
Title: Re: Canon 40D
Post by: vladzilla on April 09, 2013, 04:24:55 PM
 :) will we be able to film video on 40D?) cool
Title: Re: Canon 40D
Post by: ariznaf on April 10, 2013, 10:32:27 PM
Great, I see that you are now back in the developement and makin progress.

Thank you for your work and time.
Title: Re: Canon 40D
Post by: thome on April 11, 2013, 03:33:03 AM
I love my 40D - its a great camera and it does a great job!
If ML is going to hit it, it would be a big rebirth for the cam.
I am thankful to all of  the developers for their personal effort in ML as a whole and jplxpto in special for his work on the 40D.
It's an "old" camera, so it is not a matter of course that someone takes over such a hard and long work for it. So: thumbs up for you jpl and never forget: don't mind how many people are asking for features/dates/whatever: there are more important things in life.
Title: Re: Canon 40D
Post by: Faxe on April 11, 2013, 03:17:04 PM
> there are more important things in life.

Such as?!

No, seriously. While I go to this page almost every day in the hope of some progress, I realize that ML is not a make or break for me becoming a better photographer. And, sadly enough, neither is getting new lenses... But the geek in me would love to test out new features on the 40D any day, so I keep coming back. Keep it up jplxto, really appreciated!
Title: Re: Canon 40D
Post by: a1ex on April 11, 2013, 04:59:50 PM
At this point, anyone with a 40D and some C skills can grab the source code and improve it. So... what are you waiting for? ;)
Title: Re: Canon 40D
Post by: samacochan on April 11, 2013, 07:57:30 PM
Alex is right about it.
 
But is there an easier way to do it for the majority who may not know how to do with the source codes. Is there a simplified version with only a few functions e.g. intervalometer, auto WB control etc. to start with. I think most 40D owners will agree to pay to finance the development.

Any thoughts from the supporters of this thread.
Title: Re: Canon 40D
Post by: a1ex on April 11, 2013, 08:21:23 PM
Compiling the current source code will give you that version to get started. The menu works, but other than that I have no idea what else works.

Maybe jplxpto can publish the devkit (the FIR for enabling the bootflag and dumping the firmware)?
Title: Re: Canon 40D
Post by: muzsielod on April 15, 2013, 09:22:26 PM
How much it cost the developing of a working firmware?
Title: Re: Canon 40D
Post by: nanomad on April 15, 2013, 09:34:51 PM
Hundreds of man-hours.
Title: Re: Canon 40D
Post by: blue9 on April 19, 2013, 01:27:33 AM
I bought a second 40D (i have another 40D from before) that i intend to reserve for use with and furure realease of ML.
Title: Canon 40D
Post by: n0rt0n on April 19, 2013, 11:04:16 AM
Hello all!
Tell me please, where I can download current source code?
Is there AF microadjustment function? I need only this one.
Or maybe I can adjust AF without ML?
Thank you for this job!
And sorry for my english, I'm from Russia :)
Title: Will this bring ML to 450D
Post by: ixtlan on April 23, 2013, 11:11:28 AM
@ jplxpto , coutts.

Thanks guys for all your efforts and hard work.  :)

If finally we get a ML download for 40D, do we get a ML for 450D as well?
Title: Re: Canon 40D
Post by: a1ex on April 23, 2013, 04:38:58 PM
No, but it will be easier to port, if anyone is interested in doing that.
Title: Re: Canon 40D
Post by: eugene-r on April 23, 2013, 07:57:54 PM
Is there AF microadjustment function?
Нету в ML микроаджустмента, такчто даже не надейтесь.

Or maybe I can adjust AF without ML?
У 40д нет такой фичи, так что только нести объектив в сервис.

I'm from Russia :)
Ничего, бывает =)
Title: Re: Canon 40D
Post by: zfeet on April 24, 2013, 05:25:36 AM
I have 40D and would like to give it a try with Magic Lantern. I have a background with CHDK but never thought about ML until now. If anyone has a dumped 1.1.1 please PM me.
Title: Re: Canon 40D
Post by: samacochan on April 26, 2013, 06:14:10 PM
Consider to switch to 50D/550D and install ML to play with. The price drop of the 40D since last year was a significant amount(from $350 to $250 on the Craigslist in Canada) and so are the other two mentioned here. 40D is good but the other two are equally good in some other aspects.

Anyway, don't waste time waiting, just go out and click, click and click.
Title: Re: Canon 40D
Post by: ixtlan on April 29, 2013, 02:00:49 PM
No, but it will be easier to port, if anyone is interested in doing that.

Thanks for the reply. I hope this happens.  :)
Title: Re: Canon 40D
Post by: a1ex on April 29, 2013, 02:07:36 PM
It's not really that hard - if you have enough time, motivation, some basic programming skills and the desire to learn, you can do it. It's quite similar to programming embedded devices or microcontrollers.

See also:
http://chdk.wikia.com/wiki/FAQ#Q._My_camera_isn.27t_ported_yet._Is_a_port_planned.C2.A0.3F_When_will_it_be_ready.C2.A0.3F_How_can_I_help.C2.A0.3F
Title: Re: Canon 40D
Post by: scaricame on May 07, 2013, 10:10:32 AM
news???
Title: Re: Canon 40D
Post by: nativeridge on May 26, 2013, 10:18:22 PM
news? oh you are wanting a personal update just for you, gotcha, sorry carry on......
Title: Re: Canon 40D
Post by: samacochan on May 27, 2013, 01:56:01 PM
http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster (http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster)

Wow......will this happen on 40D ?
Title: Re: Canon 40D
Post by: coutts on May 27, 2013, 04:28:03 PM
http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster (http://www.eoshd.com/content/10507/it-lives-5-year-old-350-canon-50d-becomes-raw-cinema-monster)

Wow......will this happen on 40D ?
I found the required function stubs for it, so in theory it should work if somebody is still working on this port ;)
Title: Re: Canon 40D
Post by: Faxe on June 14, 2013, 12:43:13 PM
Too bad that the developer seems to have abandoned ship, so we may never know... :-\
Then again, this is all voluntary work, and messy stuff, so I can understand it if he suddenly decided it wasn't worth the effort... I unfortunately completely lacks the skill to finish off what he started.
Title: Re: Canon 40D
Post by: iNva on June 16, 2013, 04:34:12 PM
I have 5DmII but I would like to try ML on my 40D its any progress there? :)

+ I could help you with testing etc
Title: Re: Canon 40D
Post by: redhancer on June 16, 2013, 05:14:42 PM
this topic caught my attention as well. If I had the skills I certainly would help, I did a little of coding in my past years but I can't imagine how hard it is to achieve a firmware modification on a camera. there are certain things that an older camera like the 40D would benfefit from, like the software is really old (auto-iso etc.) but the images are still awesome (I do prefer sometimes the 10MP sensor over smaller pixels) so, what canon wants us to do: buy a newer tool. with software so complicated to adjust on cameras its really a smart step of camera manufactures to keep them at dinousaur stage.
well, I assume you all agree, what I wanted to say: If there is a way I can help, I'll invest a lot of my free time (which I got like a month for this summer) If there is enough information available that someone like me could possibly read into that field of work.

best regards
Title: Re: Canon 40D
Post by: sm105 on June 16, 2013, 05:35:08 PM
I was following this thread when it was active, but I think the 50D development has been prioritized for the moment.

I've got a 40D, so I would certainly help with testing builds, but like others I have limited programming experience.

Title: Re: Canon 40D
Post by: iNva on June 16, 2013, 07:53:02 PM
yea 40D is really good camera.. (I used 50d and I dont like it 40 was better) I like this camera cause this cam is very good in sharp and its really fast in focus (im still using it for rally etc)
Title: Re: Canon 40D
Post by: Bongle on June 22, 2013, 09:56:58 PM
I'M LIVE :)

Sorry ... I have spent many days with health problems and hard work.
My life has been a bit complicated but I hope to get back to work on this project a few days from now.
I'll need to read some posts. I am now a bit outdated.

I think the developers have done an excellent job.

I promise appear shortly.

BR

Hope things have bettered up for you 'jplxpto'. Thanks so much for the dedication you have put into the development of ML for us 40D users. (Of course gratitude goes out to Alex and all the other developers also).

I heard about ML only last night from my wife's boss who uses it on the 5D MkII. He does commercials and all that stuff with it. He's very excited about it and trust me, I can see why.
It would be a real joy to be able to shoot video on my trusty 40D. I just cant wait.
Thanks for the great work guys. I'll surely be one of the first to download ML for the 40D.
Title: Re: Canon 40D
Post by: jplxpto on July 27, 2013, 10:01:38 PM
Hello guys ... sorry ... I've been very busy with work ...and also some health problems.

I've been completely absent during the last months ...
I hope to soon be able to return to work for this magnificent community
and of course I'll come to invest some time in the port of 40D.

Best regards
Title: Re: Canon 40D
Post by: nativeridge on July 28, 2013, 10:46:01 PM
that is awesome news jplxpto, I am new to the community and although I am fortunate enough to have ML for 6D I have been hoping to see the 40D with some ML 'goodness' :D

very encouraging!! 
Title: Re: Canon 40D
Post by: imme on July 31, 2013, 09:59:31 AM
Good to hear from jplxpto after long long time. You are only person working on this port and all our eyes are on you.....May God bless you with health and you can work on this port.

Can you please tell us how much more work would be required to complete this port. Last time I think you were working with menus. hope to hear good news from you and we all pray from your health......amen
Title: Re: Canon 40D
Post by: jplxpto on July 31, 2013, 03:07:45 PM
Good to hear from jplxpto after long long time. You are only person working on this port and all our eyes are on you.....May God bless you with health and you can work on this port.

Can you please tell us how much more work would be required to complete this port. Last time I think you were working with menus. hope to hear good news from you and we all pray from your health......amen

Hi,

This week I've been reading about the latest news.

I updated the source code to the 40D but the project did not compile ...
I've started to make some changes but still could not test anything.

The menus have worked in 40D.
Before getting out of the project, I was making the discovery of the main properties.
The selection of the focus points have worked correctly.
I also able to change the aperture and shutter speed.

Some overlays also have work in play mode.
I still can not display the overlays in live view mode.
I still could not find the addresses of HDVRAM. I hope to do that soon.
Title: Re: Canon 40D
Post by: ilguercio on July 31, 2013, 03:19:58 PM
I hope your health problems are not serious.
It's nice to see you are back to work with us!
Title: Re: Canon 40D
Post by: jplxpto on July 31, 2013, 10:48:47 PM
I hope your health problems are not serious.
It's nice to see you are back to work with us!

I'm fine... Thank you...

BR
Title: Re: Canon 40D
Post by: imme on August 01, 2013, 12:54:33 PM
Goodluck........ :D
Title: Re: Canon 40D
Post by: ariznaf on August 07, 2013, 11:08:36 AM
Well come back.
Glad to hear you aee ok and tour health problemas are gone.

Great to ser you are back to the project toó.
As soon as you have a operational alpha versión i will try it in my camera.
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2013, 02:49:01 AM
After a few months away. ML works again on my 40D.

I hope soon to have time to fix the loading of modules.
At this time no module is loaded.
I also saw that there are some problems in the menus.
The fonts seem to me unclear.
Title: Re: Canon 40D
Post by: jplxpto on August 12, 2013, 02:50:52 AM
Well come back.
Glad to hear you aee ok and tour health problemas are gone.

Great to ser you are back to the project toó.
As soon as you have a operational alpha versión i will try it in my camera.

Thanks for everything but there is still much work to be done.
Title: Re: Canon 40D
Post by: nexiabass on August 13, 2013, 11:44:58 AM
if you could add iso 12800 - i would donate some cash for your work :)
Title: Re: Canon 40D
Post by: jplxpto on August 14, 2013, 12:44:32 AM
if you could add iso 12800 - i would donate some cash for your work :)


I apologize to disappoint you, but all systems have their physical limits (hardware) and the software does not perform miracles ...
I do not think that's possible.
If I could do that, probably the noise would be so high that no one would want to use.

Still ... this fantastic community needs help to survive.
There are some very active members who deserve to be properly rewarded, even if it's with new equipment, ... new challenges, ...
and recognition of their work ... some of them work hard for this project ... day after day ...

Briefly, a help is always welcome :)

BR


Title: Re: Canon 40D
Post by: fotosi on August 14, 2013, 08:39:23 PM
Hello jplxpto, I can and wish to help if you just give me a few step-by-steps how to.
What do I need of the equipment to start working and helping in this project?
Title: Re: Canon 40D
Post by: imme on August 15, 2013, 08:50:18 AM
JPL........its good you are back on track. I know port will take time to complete and also it needs your spare time and good health. We are waiting and wish you goodluck.

Title: Re: Canon 40D
Post by: rufustfirefly on August 27, 2013, 12:32:25 AM
Is there currently a more "modern" version of the firmware extract/build instructions to create a FIR file for the 40D than the one located here : http://www.magiclantern.fm/forum/index.php?topic=1452.msg3856#msg3856 ?

Some of the tools listed in that don't exist in the repository anymore, so I'm getting the distinct impression that the build process has changed slightly.

Thanks!
Title: Re: Canon 40D
Post by: rufustfirefly on August 28, 2013, 05:45:10 PM
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.

https://bitbucket.org/rufustfirefly/magic-lantern/downloads
Title: Re: Canon 40D
Post by: jplxpto on August 29, 2013, 01:18:08 AM
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.

https://bitbucket.org/rufustfirefly/magic-lantern/downloads

http://www.magiclantern.fm/forum/index.php?topic=7955.new#new (http://www.magiclantern.fm/forum/index.php?topic=7955.new#new)
Title: Re: Canon 40D
Post by: imme on September 04, 2013, 08:17:13 AM
JPL any update???????
Title: Re: Canon 40D
Post by: rufustfirefly on September 08, 2013, 12:23:21 AM
I've got a 40D body laying around -- I'd be perfectly willing to dump the firmware, search for function calls, etc; I just have little to no expertise in doing any of that, and the Magic Lantern wiki seems perilously out of date. Could anyone point me to a somewhat more up to date walkthrough of either a) using the extracted firmware components to analyse or b) dumping active ROM to do the same -- and any postings, articles, or pages about digging for the locations of specific calls?

I know it seems like a tall order, but I'd love to help if anyone can point me in the right direction. I'm using a Linux machine, but I have a Windows VM handy (as well as a copy of WINE) if it's needed.
Title: Re: Canon 40D
Post by: imme on September 10, 2013, 07:09:33 AM
I've got a 40D body laying around -- I'd be perfectly willing to dump the firmware, search for function calls, etc; I just have little to no expertise in doing any of that, and the Magic Lantern wiki seems perilously out of date. Could anyone point me to a somewhat more up to date walkthrough of either a) using the extracted firmware components to analyse or b) dumping active ROM to do the same -- and any postings, articles, or pages about digging for the locations of specific calls?

I know it seems like a tall order, but I'd love to help if anyone can point me in the right direction. I'm using a Linux machine, but I have a Windows VM handy (as well as a copy of WINE) if it's needed.

rufustfirefly. I am not a developer but if you read this thread from start you will get lots of information. JPL, Nanomad and alex had in detail discussions related to development and 40d porting. 
Title: Re: Canon 40D
Post by: StefanKeller.AC on September 21, 2013, 12:07:01 PM
I built a 40D "snapshot" build (but without the FIR loader, as I haven't nailed down a procedure for putting one together yet), if anyone is interested. To "bump up" interest, there's also 5D3 and 50D builds there.

https://bitbucket.org/rufustfirefly/magic-lantern/downloads

loading that 40d00111-ML.2013-08-30-007bb9a0574d.fir with the files from ML-40D.2013-08-30.53fbc6b53da5.zip on the card
doesnt work, only the upper display is on, battery has to be taken out...
how shall it work?

Title: Re: Canon 40D
Post by: rufustfirefly on September 25, 2013, 10:16:51 PM
loading that 40d00111-ML.2013-08-30-007bb9a0574d.fir with the files from ML-40D.2013-08-30.53fbc6b53da5.zip on the card
doesnt work, only the upper display is on, battery has to be taken out...
how shall it work?

I'm having some issues getting development rolling on the 40D, primarily because I've been unable to extract an unencrypted version of the 1.1.1 firmware (as I had mentioned earlier in the thread). This has left me unable to find the rest of the function locations, so getting this port working, at least at the 1.1.1 firmware revision, isn't going to happen -- pending being able to get an unencrypted copy of the firmware to work with.

Alternately, I can try to move to using 1.0.5 or 1.0.8, which have both had their encryption keys reverse engineered. I hate backing out versions of firmware, but if it's the only way I can proceed, I may go that way.
Title: Re: Canon 40D
Post by: scaricame on October 24, 2013, 06:42:36 PM
News???
Title: Re: Canon 40D
Post by: rufustfirefly on October 29, 2013, 09:12:57 PM
I have built a set of dumpers, which should dump out the active firmware. If someone wants to try to load one or the other up on their 40D running v1.1.1, we should be able to get an unencrypted dump of the firmware.

It's all based off of the previous 1.0.5 and 1.0.8 work, so mileage may vary.

https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D1.fir (https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D1.fir)
https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D2.fir (https://bitbucket.org/rufustfirefly/magic-lantern/downloads/108D2.fir)

There's a disclaimer that this could do something awful -- but one of them should just dump a file to your card (after a flurry of activity).

If anyone wants to check my work, it's all on bitbucket:

https://bitbucket.org/rufustfirefly/40d108-dumper (https://bitbucket.org/rufustfirefly/40d108-dumper)
Title: Re: Canon 40D
Post by: imme on November 02, 2013, 06:00:11 AM
rufustfirefly can you please add a little tutorial as how can I added it to 40d and CF card. sorry but I am totally new to these firmwares stuff. 
Title: Re: Canon 40D
Post by: rufustfirefly on November 08, 2013, 09:04:27 PM
rufustfirefly can you please add a little tutorial as how can I added it to 40d and CF card. sorry but I am totally new to these firmwares stuff.

The trick is to dump the .FIR file onto your CF card (presumably using a CF card reader), then use the "Update Firmware" menu option to attempt to sideload the dumper code. It won't actually upgrade your firmware, but rather attempt to run the custom code which should, in theory, spin the CF card for a bit and dump out a file containing the loaded firmware.

It could also do bad things, which it shouldn't do. If, for some reason, it locks up completely and hasn't done anything within 30 seconds or so, you might want to pull the battery.
Title: Re: Canon 40D
Post by: pixelk on November 09, 2013, 02:21:38 PM
On a 1.1.1 40D with full battery :

After a few seconds of "loading firmware update"

- 108D1.fir : White on yellow "Update file error. Please check the memory card and reload the battery and try again."
- 108D2.fir : White on yellow "Update file error. Please check the memory card and reload the battery and try again."

Both needed a battery remove, and the 40D still works fine after that.

40d00111-ML.2013-08-30-007bb9a0574d.fir : screen turns black, DSLR works apart from the fact that it doesn't recognize the CF carf anymore. Needed a battery remove to restore proper function.
Title: Re: Canon 40D
Post by: anderskvist on November 12, 2013, 01:47:38 PM
40d00111-ML.2013-08-30-007bb9a0574d.fir : screen turns black, DSLR works apart from the fact that it doesn't recognize the CF carf anymore. Needed a battery remove to restore proper function.
I see more or less the same (also with 1.1.1) - except the camera won't capture, but focus works...

/Anders
Title: Re: Canon 40D
Post by: pixelk on November 18, 2013, 08:00:01 PM
Yes sorry, I didn't try to capture, maybe it didn't work, maybe it did. But without the CF card recognised, my only urge was a full reset  ;D
Title: Re: Canon 40D
Post by: imme on December 03, 2013, 01:53:56 PM
hi,

rufustfirefly is there any update on 40d ML version you are working ????
Title: Re: Canon 40D
Post by: imme on December 23, 2013, 11:30:00 AM
jplxpto & rufustfirefly any latest update on 40d port? have not heard from you guys for a long time.
Title: Re: Canon 40D
Post by: frix23 on January 11, 2014, 08:21:04 PM
...and here's another guy willing to contribute work that
might even brick his camera for the sake of getting a
running 40d port. So, if there's anything I could
possibly do, let me know!
Title: Canon 40D
Post by: AOK on February 06, 2014, 08:15:59 PM
Hi everyone,

What is the current status? Do we have a forked development of the 40D ML or rufustfirefly progressing on his own? I am very confused.

Guys whatever the case is thank you so much! Let us hope for the best.  ;D

I've just installed his build - and it has a few features... Now I know we are talking about quite an old body. Indeed since 2007 way too many things have developed. And yet could some more features
be expected?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: imme on February 28, 2014, 01:27:32 PM
Can you please tell me what features are supported in this firmware. I just need HDR and timelapse feature. is it there?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Canon40D on March 31, 2014, 05:18:59 AM
Anyone have an update on ML for the 40D? I've read this thread start to finish and looked all over without a clear answer. The ML website claims it's compatible with the 40D but I can't get it to work. Any help or guidance is much appreciated thanks to all for the hard work and time given to make this possible.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Marsu42 on March 31, 2014, 11:37:32 AM
Anyone have an update on ML for the 40D? I've read this thread start to finish and looked all over without a clear answer. The ML website claims it's compatible with the 40D but I can't get it to work. Any help or guidance is much appreciated thanks to all for the hard work and time given to make this possible.

I also thought so and even told other people as such, but then I was told here that 40d is not working at all and this most likely won't change :-\ ... it's not even digic4 so copy/pasting code most likely won't work.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Canon40D on March 31, 2014, 08:08:53 PM
I also thought so and even told other people as such, but then I was told here that 40d is not working at all and this most likely won't change :-\ ... it's not even digic4 so copy/pasting code most likely won't work.

I'll just stick to my T2i for now, though I love the feel of my 40D over my T2i which is why I would love to get ML working on it.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: rufustfirefly on April 02, 2014, 05:49:10 PM
If anyone's still watching this, here's where I'm at:

I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:

https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)

Thanks!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: sedayu on April 03, 2014, 05:53:49 PM
If anyone's still watching this, here's where I'm at:

I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:

https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)

Thanks!

wow, god job bro
Title: Re: [UNMAINTAINED] Canon 40D
Post by: NurseBob on April 04, 2014, 11:51:18 PM
If anyone's still watching this, here's where I'm at:

I had tried, relatively unsuccessfully, to port the existing VxWorks ports to the 40D. I'm going back to the 1000d_dev work, and pushing out my current work, etc, to github. If anyone would like to assist, it's here:

https://github.com/jbuchbinder/40d_dev (https://github.com/jbuchbinder/40d_dev)

Thanks!

Just joined, and have a 40D.  Noted that 40D is listed on the home page as "supported" but based on what I'm seeing, that's perhaps a bit misleading...
However, I do have code experience with the msp430 microcontrollers, and from what I'm seeing, there would be a learning curve with the controller for the 40D, but hopefully not insurmountable.  I guess time will tell.
Aside from this extensive thread, are there any other resources regarding design of the app???  Or is it just "read the code?"
Thanks!

bob
Title: Re: [UNMAINTAINED] Canon 40D
Post by: chris_overseas on April 05, 2014, 01:29:49 AM
Aside from this extensive thread, are there any other resources regarding design of the app???  Or is it just "read the code?"

I've found it to be a bit sprawling, but there is a lot of information buried on the wiki http://magiclantern.wikia.com/wiki/Magic_Lantern_Firmware_Wiki (http://magiclantern.wikia.com/wiki/Magic_Lantern_Firmware_Wiki)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: NurseBob on April 05, 2014, 07:12:53 AM
chris_overseas
Thanks!  Looks like a great starting point, and a whole lot of homework...  So it goes. :)

bob
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Faxe on April 09, 2014, 11:34:05 AM
> Thanks!  Looks like a great starting point, and a whole lot of homework...  So it goes. :)

For what it is worth, we are several people who still follow this thread closely! We wish you good luck, should you except the challenge.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: imme on April 12, 2014, 09:36:35 AM
I am following and waiting for this port for long time :D
Today I thought I must remove 40d ML updates from my RSS feeds. But NurseBob I hope you can make it a reality for lot of Magic lantern users.

I am not a developer but this whole 40d thread contains lots of information sharing by some developers and Magic lantern team lead.

Goodluck
Title: Re: [UNMAINTAINED] Canon 40D
Post by: tonesen on April 23, 2014, 12:44:55 PM
i just want to say that i would be so freakin' happy if you could make it possible to use a 40d as a video camera.
thank you very much for all the work here!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Canon40D on April 24, 2014, 02:17:24 AM
i just want to say that i would be so freakin' happy if you could make it possible to use a 40d as a video camera.
thank you very much for all the work here!

I've seen some videos on YouTube that show video recording on a 40D already. I'm going to google it now.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: dazzle on April 24, 2014, 05:31:05 PM
hi

im donating some micro bitcoins to someone who can finally make the 40d capture video at, preferably, 24fps with 720p resolution, ideally

who's with me? ive got a 40d lying around here, clean and dust free.. by the way, good job on that rufustfirefly!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Faxe on April 25, 2014, 01:44:38 PM
I've seen some videos on YouTube that show video recording on a 40D already. I'm going to google it now.

It is possible to shoot video today, but through a connected computer.

See http://sourceforge.net/projects/eos-movrec/
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ansius on April 30, 2014, 09:10:28 PM
First - thanks to those who have contributed to ML, it is an awesome tool.

I have 7D with it running, but my 40D seams to be collecting dust, because some of the tasks I would use it for would benefit form ML. like built in intervalometer, bulb timer, bulb ramping or even better - automatic ettr with deflicker. I wish i could help, even tough I have written some code in in various languages, including even low level assambler for atmel avr micro controllers, newer got a good grasp of C, somewhat it always have made me lose interest in it. now I bite my fingers, should have learned it.

I really hope that some day, before the 40D dies we would see ML in it. IMHO video functions, even tough cool, are not for the humble 40D, there are cameras much better for this. Photography would benefit greatly form ML tough.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: bubbleg5 on May 07, 2014, 04:29:09 PM
Hello friends!
I did not understand where I can download the modified firmware for my Canon 40D ... can you help?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: dazzle on May 09, 2014, 04:59:35 PM
it is still in development.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: techbp on May 14, 2014, 05:12:59 AM
Any updates? Also waiting for this firmware update... goodluck guys
Title: Re: [UNMAINTAINED] Canon 40D
Post by: dazzle on June 01, 2014, 04:58:53 PM
everyone is really anticipating this great hack/tool for a great camera 40D :)

I am waiting too! :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on June 01, 2014, 06:02:48 PM
Don't pray, code!

Also, these days you can emulate ML code in QEMU (http://www.magiclantern.fm/forum/index.php?topic=2864.msg117430#msg117430) and you have two early ports in progress. No more excuses ;)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: techbp on June 13, 2014, 08:55:26 AM
Any update?  :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on July 03, 2014, 01:10:18 PM
No volunteer for a DIGIC 3 based system.... Come one. Where is the chalenge these days?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: domovets on July 04, 2014, 02:19:57 PM
What need help? I have 40d camera.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: frank007 on July 08, 2014, 04:58:10 AM
great, it seems to work anyway.  :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ansius on July 08, 2014, 02:23:54 PM
seams to work what?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: bostjanr on July 24, 2014, 04:01:51 PM
What is working? Where???

Ok. What do you need? Voulontier? here i am. Shoot. :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kjgregory on August 08, 2014, 05:19:50 AM
Any updates? I just heard about Magic Lantern and wanted to try it on my 40D, was dissappointed to see that the latest release doesn't support it.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Z@ on August 12, 2014, 09:43:39 AM
Hi all,
Can somebody clarify about 40D?

On main page it is written

Supported Cameras:
5Dc, 5D2, 5D3, 6D, 7D, 40D, 50D, 60D, 500D (T1i), 550D (T2i), 600D (T3i), 650D (T4i), 700D (T5i), 1100D (T3), EOS M, 100D (SL1)

On download page http://www.magiclantern.fm/downloads.html is written that only these camera are supported

5D Mark ii 2.1.2
50D 1.0.9
60D 1.1.1
500D 1.1.1
550D 1.0.9
600D 1.0.2

and finally here http://www.magiclantern.fm/features.html is written that for 40D only beta version with Core ML features exists.

I completely do not understand will it work or not? and if beta exists where can I download this beta and try?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: S-tomas on August 19, 2014, 07:18:13 PM
Is somebody working on the 40D ML right now? I know it is hard to say, but when we could expect some update or even first working version. (Video recording feature will be great!)

Thank you, for any responses. ;)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Plynlimon on September 01, 2014, 12:04:58 AM
I too hope that you get ML working on the 40D I would love to do time lapse with mine and as for video....well ;)

Daf
Title: Re: [UNMAINTAINED] Canon 40D
Post by: iNva on September 09, 2014, 08:16:32 PM
i think that we will never get 40d i wanted to know programming to do it.. but idk :/  :(
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ansius on September 11, 2014, 08:10:27 AM
40D is not going to have video, it has not that much cpu power, nor hardware for that, in 50D case the feature (h264 encoding) was there, just not enabled. Other thing is that 40D is VxWorks so that is different platform at all.

for time lapses tough 40D is grate, I own one, and I would like to have histograms, intervalometer, bulb timer, dual iso there - but it seams that those few capable of doing this are not owning a 40D, so thus no progress. Sadly CHSDK says that 40D is to pro for them. so we are stuck in between.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on September 11, 2014, 08:11:40 AM
It can, both MJPEG and RAW. Read the thread ;)

(whether somebody will implement it or not, that's another story, but the proof of concept was done)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ansius on September 11, 2014, 11:05:41 AM
I ment the h264 one, mjpeg would be possible for any camera that shoots jpg, right. as for raw, Have anybody done tests on max card speed in this camera? Otherwise the 40D would be a good choice because of considerably smaller pixel count, thus when skipping lines, less moire. I really wish that I would had time to learn C, and could work on this port...
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AndreaXP on November 18, 2014, 08:10:04 AM
Has anyone done a dump of the ROM?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: imme on November 30, 2014, 10:44:00 AM
But a1ex unfortunately most of us on this 40d post are not developers. We are waiting for someone who can do this favour to us. Can you please do us a favour and do something for all people like us who are waiting for this port.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: tomce on February 09, 2015, 04:25:36 PM
any update on the port
i realy like the ML on 500D and want to have on 40d
Title: Re: [UNMAINTAINED] Canon 40D
Post by: strohscw on March 04, 2015, 06:47:15 PM
I would like to use my 40d as timelapse camera, so if there is a version that enables the main features for timelapse would be great!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: dazzle on March 06, 2015, 04:20:30 AM
I think vxworks is really very difficult task to do since no one has yet been able to create a workable solution for the 40D.

I am buying another 40D again today (since it is the cheapest decent camera I could find) after I sold that last one (due to money problems) and I would really like to see some developments for this in Magic Lantern.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Matchek on May 10, 2015, 09:52:23 PM
Any chance for 40D ? It can be without video, timelapse is what I need.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: masterhks on March 23, 2016, 02:16:49 AM
Wake UP 40D People's after 6 month non stop work on magic lantern on my 40d already i completed some verizon and tested ML 2 days now every thing work great i will continue with testing full month.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: tecgen on March 23, 2016, 01:04:54 PM
Please share a link to your bitbucket repository.  ;)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kidkoala83 on March 25, 2016, 01:05:47 AM
Is it working? Did you manage to enable video? Will you share?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Hibercoco on March 27, 2016, 04:10:06 AM
Please, Post here all the news with the 40d, there is a lot of people wanting to record video on the great 40D and you´re our last hope, we appreciate all of your work. Thanks.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: naegelejd on April 08, 2016, 05:00:15 PM
Hi everyone, I just discovered Magic Lantern for the first time and I'm interested in getting involved. I have a 40D and I'm a software engineer by profession. I'm not sure exactly where to start, i.e. what's the status on 40D support, what needs to be done, etc? I can download the code and build it but I don't want to brick my camera right off the bat. If anyone can point me in the right direction it'd be great!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: nikfreak on April 09, 2016, 02:01:40 PM
Source to use:
https://bitbucket.org/hudson/magic-lantern/src/7d67bc6f378a8e7f607369a374f617491f32d2c5/platform/unmaintained/40D.111/stubs.S?at=unified&fileviewer=file-view-default

Check also "Qeen Mum's" thread:
http://www.magiclantern.fm/forum/index.php?topic=1010.0

eduperez has also 400plus running which is not ML but they share some stuff:
https://github.com/400plus/400plus

Title: Re: [UNMAINTAINED] Canon 40D
Post by: wigyori on May 24, 2016, 05:28:40 PM
Hi all,

Do you accept pull requests for unmaintained (f.e. this very 40D) platforms? Instead of someone hacking on his/her own and later possibly dropping the whole thing for losing interest, or for not able to finish it, without telling anyone how far he/she got, it could make sense.

Thanks,
-w-
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on September 16, 2016, 08:06:44 PM
Now and then someone is posting something here. Now we have a some source files at our disposal, but how to run them on the Canon 40D?

Please could anyone explain.

Thank you in advance who ever you might be.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: vnd on September 25, 2016, 07:58:34 PM
Hi,

I checked out changeset 8159 (the last one with 40d changes) and compiled it with arm toolchain 4.6.2. It went without problems, I did not try any newer version)

Then I took the 5D installer from installer/5DC.111, replaced the addresses of LEDs and write_bootflag/read_bootflag functions with the ones found on the first page of this thread, compiled and created installer firmware with dissect_fw3 and assemble_fw tools. There is no known address for write_card_bootflag so I formatted the card manually.

Then It successfully enabled the bootflag and the camera is able to boot the built magic lantern, which works good enough to show menu. Then I dumped the fw and run ARM-console on it. Too bad that I don't understand the ARM assembler much.

I wanted the fps override function for night focusing, but I could not find anything like shadow registers, so I ended with a hack that writes hardcoded value to fps register from ISO prop handler each time when iso is set to 1600.

Also I noticed that the camera is rather unstable and crashes after several shots. I disabled everything except boot code and finally found that it gets fixed by calling cache_unlock() from ml_hijack_create_task_cmd_shell() in  platform/40D.111/init.c.

Then I just re-enabled the ISO prop hack.

The camera now provides all the functionality that I need and is quite stable, so I don't plan to work on it further,

Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on September 25, 2016, 10:53:27 PM
Sounds good!

Do you mind sending me a copy of your ROM, for trying it in QEMU? The one I have is incomplete.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on September 27, 2016, 04:13:19 PM
It would be lovely if a usable version could be made before I buy the 5D M4.

If I can make use of the huge ML features 
- Auto ETTR and
- RAW histogram
- dual ISO (if possible).

That would make quite an awesome old camera.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: rufustfirefly on October 01, 2016, 04:57:23 PM
I've been plugging away at trying to replicate vnd's success with a modern version of ML -- which has been complicated by most of the VxWorks code being relatively unmaintained (from what I can see).

I'm most of the way through getting it to compile, although there are some deficiencies I've been trying to hack around. If anyone's interested in jumping in:

https://bitbucket.org/rufustfirefly/magic-lantern (https://bitbucket.org/rufustfirefly/magic-lantern)

(I'd be more than happy to either accept pull requests or grant full access to the repository, if anyone else wants to work on it.)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: rufustfirefly on October 01, 2016, 06:41:44 PM
For a quick update:

I've got everything compiling, but I'm pretty sure some of my functions aren't defined in the right places, etc, so it's failing to link properly -- but otherwise it looks as though it's doable to get this working with the modern ML codebase, assuming that I (or someone else a bit better at this) untangle a few of the bad references and definitions in there.

That's as of this commit:

https://bitbucket.org/rufustfirefly/magic-lantern/commits/da9358bcac3caf54a0572be07cad611ee0922b3d (https://bitbucket.org/rufustfirefly/magic-lantern/commits/da9358bcac3caf54a0572be07cad611ee0922b3d)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: rufustfirefly on October 01, 2016, 11:13:50 PM
Update:

I've got it compiling and linking, although there's some serious hackery involved, as well as a bunch of functions which have been dummied up, since I'm not sure where they map on the 40D's OS.

https://bitbucket.org/rufustfirefly/magic-lantern/commits/4a738f3938437566f93fd1def8ff7168ffc90847 (https://bitbucket.org/rufustfirefly/magic-lantern/commits/4a738f3938437566f93fd1def8ff7168ffc90847)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Ant123 on October 16, 2016, 10:09:42 PM
I've got it compiling and linking
Did you try to run it on your camera?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Ant123 on October 27, 2016, 07:47:46 PM
There is no known address for write_card_bootflag so I formatted the card manually.

For 40D111 it should be 0xFFFF43A0.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on November 01, 2016, 08:46:20 PM
Some small progress that also applies to 40D:

Added the 450D and 40D changes to the vxworks branch (https://bitbucket.org/hudson/magic-lantern/branch/vxworks) in the main repo. Did some minor cleanups (compiler warnings), had some attempts at emulating it in QEMU, but didn't really check any deeper yet.

For reverse engineering, I've adapted the dm-spy-experiments (http://www.magiclantern.fm/forum/index.php?topic=2388.msg113154#msg113154) branch as vxworks-dm-spy (https://bitbucket.org/hudson/magic-lantern/branch/vxworks-dm-spy) (tested in qemu).
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on December 23, 2016, 01:09:50 AM
So is it working? :-) Sorry not quite clear for me  :-[
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on January 11, 2017, 09:12:30 PM
Nobody knows.... as it seems. A dead end :/
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Morbius on August 16, 2017, 02:48:46 PM
Is ML for the 40D working? Are there any other alternatives? Does 400Plus work on the 40D or is only for the 400D as the documentation implies.

Thanks
Title: Re: [UNMAINTAINED] Canon 40D
Post by: eduperez on August 22, 2017, 11:25:10 PM
Is ML for the 40D working? Are there any other alternatives? Does 400Plus work on the 40D or is only for the 400D as the documentation implies.

Thanks

As the documentation for 400plus clearly states, "It is designed specifically for the Canon 400D/XTi and will not work with other camera models".
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on October 09, 2017, 01:57:51 AM
Even after all this time.... Here things are as stuck as they are on the 5D4. Why do I pick the wrong for ML camera :/
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on December 02, 2017, 03:46:39 PM
Is there anyone currently working on porting ML to the 40D? If not, is that primarily due to the age of the camera, the difficulty, or the devs lacking 40Ds on hand?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Audionut on December 04, 2017, 07:35:07 AM
is that primarily due to the age of the camera, the difficulty, or the devs lacking 40Ds on hand?

Likely all three.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on December 07, 2017, 03:06:27 AM
Likely all three.

Give me a pie chart, then.  ;)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on December 23, 2017, 09:39:29 AM
Good news - 40D boots the GUI in QEMU, just like most other EOS models!

(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D111.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu16.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)

The last screen looks a bit odd - how does it look on a real camera?

Also compiled ML from the rufustfirefly (https://bitbucket.org/rufustfirefly/magic-lantern/commits/all) repository and got a half-working Space Invaders clone (menu appears when pressing delete, navigation keys are working, fonts don't seem to work):
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-ml1.png) (http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-ml2.png)

What does this mean? Porting ML on this camera is no longer difficult at all - it's just a matter of fixing the remaining issues (you've just got a very powerful tool for that) and bringing the source tree up to date with the mainline code. All the changes from rufustfirefly are also in our vxworks branch (https://bitbucket.org/hudson/magic-lantern/branch/vxworks), but there are a few stubs missing; still, it shouldn't be hard to fix them and get this working in the emulator.

For the impatient: QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/), installation video for Ubuntu (https://twitter.com/autoexec_bin/status/913530810686418944), for Mac (http://www.magiclantern.fm/forum/index.php?topic=16012.msg191686#msg191686) and guide for Windows (http://www.magiclantern.fm/forum/index.php?topic=20214.0).
Next steps: dfort's porting tutorial (http://www.magiclantern.fm/forum/index.php?topic=19417.0) the EOS M2 walkthrough (http://www.magiclantern.fm/forum/index.php?topic=15895.msg185084#msg185084) and the 450D port (http://www.magiclantern.fm/forum/index.php?topic=8119.0) as reference.

As mentioned earlier - the camera is capable to record video (both MJPEG and RAW).

Want to help? Please follow the above links and confirm you can get the same results (screenshots) on your system. Proof-reading the QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/) is also very welcome.

Happy hacking!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: goldenchild9to5 on December 24, 2017, 06:32:26 AM
@a1ex WOW.. you are putting in work.  By the way happy holidays.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kyrobb on December 24, 2017, 11:51:07 PM
Possible MJPEG? Is this something unique to the 40D or have I missed out on some more recent developments?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Walter Schulz on December 25, 2017, 12:13:35 AM
https://mobile.twitter.com/autoexec_bin/status/944627528999800839
Title: Re: [UNMAINTAINED] Canon 40D
Post by: kyrobb on December 25, 2017, 04:26:52 AM
Awesome! Thank you Walter!
Title: Re: [UNMAINTAINED] Canon 40D
Post by: AOK on December 30, 2017, 09:47:24 AM
Good news - 40D boots the GUI in QEMU, just like most other EOS models!
...
Also compiled ML from the rufustfirefly (https://bitbucket.org/rufustfirefly/magic-lantern/commits/all) repository and got a half-working Space Invaders clone (menu appears when pressing delete, navigation keys are working, fonts don't seem to work):
.....
Happy hacking!

Lovely! MORRAL KOMBAT is next! :)))

Joke aside! This is a great news! After all these years it would be lovely to have a working 40D with advanced functions available. Even though my 40 D got so broken to the point its repair cost is the same as buying a second hand 40D. But I’ve got a friend who’s hobby is photography and he got the same body.

I hope for the best! :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Konrad on January 01, 2018, 11:16:16 AM
(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)
The last screen looks a bit odd - how does it look on a real camera?

Thanks a1ex!

Here's photo of my 40d's info screen:
(https://i.imgur.com/fWyLEk3.jpg)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on January 02, 2018, 12:07:39 PM
Beautiful. You are wonderful people. :)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: R on January 03, 2018, 09:53:31 PM

(http://a1ex.magiclantern.fm/bleeding-edge/qemu/40D-menu15.png)

The last screen looks a bit odd - how does it look on a real camera?

Here's mine.

(http://image.ibb.co/bwu4Uw/20180103_214532.jpg)
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ilex on February 15, 2018, 09:48:54 PM
a year ago my 50D eos where I had installed ML crashed and since then I'm using the old 40D, although I miss not being able to enjoy ML. Is there anyone who's managed to get ML running on the 40D? Thank you in advance
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on February 15, 2018, 09:56:35 PM
The closest thing I could find is reply #379 (https://www.magiclantern.fm/forum/index.php?topic=1452.msg172529#msg172529) - that provides some good hints on how to get started, and a changeset ID that is known to work, to some extent.

Next stops:
https://www.magiclantern.fm/forum/index.php?topic=991
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst
Title: Re: [UNMAINTAINED] Canon 40D
Post by: ilex on February 16, 2018, 02:26:59 PM
Thank you A1ex for your information and time. Unfortunately, my knowledge does not allow me to perform the tasks recommended in the posts. I will have to wait until some member can upload an operational version for the 40D  :'(. Greetings
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on May 02, 2018, 08:32:21 PM
I started to think this might happen before the 80D was cracked, but it looks that's a bit more lively at the moment.

Are the issues wholly different, or is the primary roadblock common to both efforts?
Title: Re: [UNMAINTAINED] Canon 40D
Post by: a1ex on May 02, 2018, 08:55:04 PM
This one is quite straightforward (anyone can follow a tutorial, sit down and debug ML). I've already provided and documented the tools for that.

The only roadblock is finding a 40D owner interested in porting ML on this camera (maybe you?), rather than waiting for someone else.

Don't expect a new port from me; these old models are very low on my priority list. I'm just making sure others have the tools they need to port ML, that's all.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: Theta Sigma on May 05, 2018, 09:31:25 PM
This one is quite straightforward (anyone can follow a tutorial, sit down and debug ML). I've already provided and documented the tools for that.

The only roadblock is finding a 40D owner interested in porting ML on this camera (maybe you?), rather than waiting for someone else.

Don't expect a new port from me; these old models are very low on my priority list. I'm just making sure others have the tools they need to port ML, that's all.

If you want to PM me the steps and risks involved, I might be able to help in that regard.
Title: Re: [UNMAINTAINED] Canon 40D
Post by: tensiondriven on December 11, 2018, 03:16:16 PM
Hi All,

I have a Canon 40D and am somewhat technical, I would be happy to invest a few hours testing with the advice of someone who knows the deeper development side.

Really looking forward to getting a distributable build working for the 40D, even if it doesn't have *all* the features!

Jonathan