My attempts to jump to Canon firmware failed on both 760D and 80D.
source (https://bitbucket.org/hudson/magic-lantern/commits/306fc3a33334)
Also tried to:
- identify the main firmware start address from the string "/_term" (tested on 7D2 in QEMU and on 60D; should work on all DIGIC 4/5 models)
- jump to 0xFFFF0000 (hivecs reset interrupt, tested on 60D, probably works on all DIGIC 4/5 models)
- jump to MEM(0xFC000000) (reset address for EOS M3 and M10)
All attempts resulted in black screen and camera locked up.
The LED blinks!
I need some help from somebody willing to do a small hardware mod (details (http://www.magiclantern.fm/forum/index.php?topic=13746.msg168431#msg168431)). The FIR from the linked post won't work here, but I can prepare one for 760D (or any other DIGIC 6 camera) on request.
Meanwhile, I've found the LED address on 7D2 (http://magiclantern.fm/forum/index.php?topic=13746.msg168514#msg168514). It's unlikely to be the same address on other DIGIC 6 cameras, but it's likely to be in the same range. Therefore, we could try to poke a few addresses nearby [1] (https://chdk.setepontos.com/index.php?topic=1493.msg13469#msg13469) [2] (https://chdk.setepontos.com/index.php?topic=11316.msg111290#msg111290).
The LED address is somewhere between 0xd20b0800 and 0xd20b1000 (source) (https://bitbucket.org/hudson/magic-lantern/commits/89f7063cd9460ab3942c86b8e219891e02abff73) (credits 1) (https://chdk.setepontos.com/index.php?topic=11316.msg111290#msg111290) (credits 2) (https://chdk.setepontos.com/index.php?topic=1493.msg13469#msg13469).
Looks like we no longer need the power supply hack :)
Next steps: http://chdk.wikia.com/wiki/Obtaining_a_firmware_dump#Hardware-software_solution
Please let me know once you have the hardware ready.
Ok, photo transistor connected to Audacity, ready to record.
Just need to attach it a bit better to the cam.
FC000008: MCR p15,0,Rd,cr6,cr2,0: RGNR <- 0x0
FC000010: MCR p15,0,Rd,cr6,cr1,0: DRBAR <- 0x0
FC000018: MCR p15,0,Rd,cr6,cr1,2: DRSR <- 0x3F
FC000020: MCR p15,0,Rd,cr6,cr1,4: DRACR <- 0x320
FC000028: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0x2001
FE020040: MCR p15,0,Rd,cr9,cr1,1: BTCM <- 0x1
FE025884: MCR p15,0,Rd,cr6,cr2,0: RGNR <- 0x1
FE02588C: MCR p15,0,Rd,cr6,cr1,0: DRBAR <- 0x0
FE025894: MCR p15,0,Rd,cr6,cr1,4: DRACR <- 0x329
FE02589C: MCR p15,0,Rd,cr6,cr1,2: DRSR <- 0x3B
FE0258A4: MCR p15,0,Rd,cr6,cr2,0: RGNR <- 0x2
FE0258AC: MCR p15,0,Rd,cr6,cr1,0: DRBAR <- 0xBFE00000
FE0258B4: MCR p15,0,Rd,cr6,cr1,4: DRACR <- 0x324
FE0258BC: MCR p15,0,Rd,cr6,cr1,2: DRSR <- 0x29
FE0258C4: MCR p15,0,Rd,cr6,cr2,0: RGNR <- 0x4
FE0258CC: MCR p15,0,Rd,cr6,cr1,0: DRBAR <- 0xDFE00000
FE0258D4: MCR p15,0,Rd,cr6,cr1,4: DRACR <- 0x324
FE0258DC: MCR p15,0,Rd,cr6,cr1,2: DRSR <- 0x29
FE0258E4: MCR p15,0,Rd,cr6,cr2,0: RGNR <- 0x5
FE0258EC: MCR p15,0,Rd,cr6,cr1,0: DRBAR <- 0xEE000000
FE0258F4: MCR p15,0,Rd,cr6,cr1,4: DRACR <- 0x329
FE0258FC: MCR p15,0,Rd,cr6,cr1,2: DRSR <- 0x31
FE025904: MCR p15,0,Rd,cr6,cr2,0: RGNR <- 0x6
FE02590C: MCR p15,0,Rd,cr6,cr1,0: DRBAR <- 0xFE000000
FE025914: MCR p15,0,Rd,cr6,cr1,4: DRACR <- 0x329
FE02591C: MCR p15,0,Rd,cr6,cr1,2: DRSR <- 0x31
FE025924: MCR p15,0,Rd,cr6,cr2,0: RGNR <- 0x3
FE02592C: MCR p15,0,Rd,cr6,cr1,0: DRBAR <- 0xC0000000
FE025934: MCR p15,0,Rd,cr6,cr1,4: DRACR <- 0x305
FE02593C: MCR p15,0,Rd,cr6,cr1,2: DRSR <- 0x3B
FE025944: MCR p15,0,Rd,cr15,cr5,0: idk <- 0x0
FE025944: MCR p15,0,Rd,cr1,cr0,0: SCTLR <- 0x1005
FE020400: MCR p15,0,Rd,cr9,cr1,0: ATCM <- 0x80000001
BooBTCM Start
MR[5]=00000001
MR[6]=00000011
MR[7]=00000000
MR[8]=00000018
MID=SAMSUNG
Erase FROM(start:0xFC080000,size:0x68)
Sector erase error
MEMIF Uncomplete
Accessing the RGNR
To access the RGNR, software reads or writes the CP15 registers with <opc1> set to 0, <CRn> set to c6, <CRm> set to c2, and <opc2> set to 0. For example:
MRC p15, 0, <Rt>, c6, c2, 0 ; Read RGNR into Rt
MCR p15, 0, <Rt>, c6, c2, 0 ; Write Rt to RGNR
[ init:fe237fa9 ] Memory region: start=00000000 end=00000000 flags=00000001
[ init:fe237fbf ] Memory region: start=00000000 end=00000000 flags=00000002
[ init:fe237fcb ] Memory region: start=E0000000 end=FFFFFFFF flags=00000020
[ init:fe237ffd ] Memory region: start=FE000000 end=FFFFFFFF flags=00000008
[ init:fe237ffd ] Memory region: start=EE000000 end=EFFFFFFF flags=00000008
[ init:fe237ffd ] Memory region: start=DFE00000 end=DFFFFFFF flags=00000004
[ init:fe237ffd ] Memory region: start=C0000000 end=FFFFFFFF flags=00000010
[ init:fe237ffd ] Memory region: start=BFE00000 end=BFFFFFFF flags=00000004
[ init:fe237ffd ] Memory region: start=00000000 end=3FFFFFFF flags=00000008
[ init:fe237ffd ] Memory region: start=00000000 end=FFFFFFFF flags=00000004
[ init:fe237e5f ] Memory region: start=00000000 end=FFFFFFFF flags=00000000
MPU region 0 base 0x00000000
Base address 0x0 0
MPU region 0 size & enable 0x0000003F
Enabled 0x1 1
Size 0x1F 31 [4G]
- 0x0 0
Sub-regions disabled 0x0 0 [00000000]
MPU region 0 access control 0x00000320
Region attributes 0x20 32 [Inner Non-cacheable; Outer Non-cacheable; Non-shared]
- 0x0 0
Access permission 0x3 3 [P:RW U:RW]
- 0x0 0
Execute never 0x0 0
MPU region 1 base 0x00000000
Base address 0x0 0
MPU region 1 size & enable 0x0000003B
Enabled 0x1 1
Size 0x1D 29 [1G]
- 0x0 0
Sub-regions disabled 0x0 0 [00000000]
MPU region 1 access control 0x00000329
Region attributes 0x29 41 [Inner Write-back, write-allocate; Outer Write-back, write-allocate; Non-shared]
- 0x0 0
Access permission 0x3 3 [P:RW U:RW]
- 0x0 0
Execute never 0x0 0
MPU region 2 base 0xBFE00000
Base address 0xBFE00000 -1075838976
MPU region 2 size & enable 0x00000029
Enabled 0x1 1
Size 0x14 20 [2M]
- 0x0 0
Sub-regions disabled 0x0 0 [00000000]
MPU region 2 access control 0x00000324
Region attributes 0x24 36 [Inner Non-cacheable; Outer Non-cacheable; Shared]
- 0x0 0
Access permission 0x3 3 [P:RW U:RW]
- 0x0 0
Execute never 0x0 0
MPU region 3 base 0xC0000000
Base address 0xC0000000 -1073741824
MPU region 3 size & enable 0x0000003B
Enabled 0x1 1
Size 0x1D 29 [1G]
- 0x0 0
Sub-regions disabled 0x0 0 [00000000]
MPU region 3 access control 0x00000305
Region attributes 0x5 5 [Shareable device; Shareable]
- 0x0 0
Access permission 0x3 3 [P:RW U:RW]
- 0x0 0
Execute never 0x0 0
MPU region 4 base 0xDFE00000
Base address 0xDFE00000 -538968064
MPU region 4 size & enable 0x00000029
Enabled 0x1 1
Size 0x14 20 [2M]
- 0x0 0
Sub-regions disabled 0x0 0 [00000000]
MPU region 4 access control 0x00000324
Region attributes 0x24 36 [Inner Non-cacheable; Outer Non-cacheable; Shared]
- 0x0 0
Access permission 0x3 3 [P:RW U:RW]
- 0x0 0
Execute never 0x0 0
MPU region 5 base 0xEE000000
Base address 0xEE000000 -301989888
MPU region 5 size & enable 0x00000031
Enabled 0x1 1
Size 0x18 24 [32M]
- 0x0 0
Sub-regions disabled 0x0 0 [00000000]
MPU region 5 access control 0x00000329
Region attributes 0x29 41 [Inner Write-back, write-allocate; Outer Write-back, write-allocate; Non-shared]
- 0x0 0
Access permission 0x3 3 [P:RW U:RW]
- 0x0 0
Execute never 0x0 0
MPU region 6 base 0xFE000000
Base address 0xFE000000 -33554432
MPU region 6 size & enable 0x00000031
Enabled 0x1 1
Size 0x18 24 [32M]
- 0x0 0
Sub-regions disabled 0x0 0 [00000000]
MPU region 6 access control 0x00000329
Region attributes 0x29 41 [Inner Write-back, write-allocate; Outer Write-back, write-allocate; Non-shared]
- 0x0 0
Access permission 0x3 3 [P:RW U:RW]
- 0x0 0
Execute never 0x0 0
md5sum -c *.MD5
strings ROM1A.BIN | grep -C 2 "1\.0\.1"
./run_canon_fw.sh 80D -s -S & arm-none-eabi-gdb -x 80D/debugmsg.gdb
ML has no "delivery date". Nobody is able to say how long it will take and if your cam is not supported by ML you should act like there will be no ML for your cam ever.
Top of page -> User Guide -> FAQ -> Troll Questions section
Same for features ...
"if your cam is not supported by ML you should act like there will be no ML for your cam ever" is simply not true!
NSTUB(0xFE482A00 + 1, FIO_CloseFile) // Thumb
NSTUB(0xFE4834CC + 1, FIO_FindClose) // Thumb
NSTUB(0xFE48344A + 1, FIO_FindNextEx) // Thumb
NSTUB(0xFE482880 + 1, FIO_ReadFile) // Thumb
NSTUB(0xFE4828F0 + 1, FIO_SeekSkipFile) // Thumb
NSTUB(0xFE482992 + 1, FIO_WriteFile) // Thumb
NSTUB(0xFE482FEE + 1, _FIO_CreateDirectory) // Thumb
NSTUB(0xFE4827AA + 1, _FIO_CreateFile) // Thumb
NSTUB(0xFE4833B6 + 1, _FIO_FindFirstEx) // Thumb
NSTUB(0xFE482AEC + 1, _FIO_GetFileSize) // Thumb
NSTUB(0xFE482734 + 1, _FIO_Open) // Thumb
NSTUB(0xFE482814 + 1, _FIO_RemoveFile) // Thumb
If you are thinking about buying a new camera and you positively need ML, do not buy one not supported now with hopes that it will be supported in the future; it may never be supported, and you will be stuck to an unsupported camera.
Combining the expanded dynamic range of the 80d with dual_iso would be a dream and beat Sonikon, but notice the "but".
it's not certain what ML features will work or won't work ever
Even if dual iso will work (which we don't know yet), the gain will be small, probably about 0.5 stops at 100/1600. From DxO data (https://www.dxomark.com/Cameras/Compare/Side-by-side/Canon-EOS-80D-versus-Canon-EOS-70D___1076_895), I expect the 80D sensor at ISO 100 to be nearly as good as the 70D at say 100/800, without the resolution loss.
ISO 100
80D -> 13.17EV
D7200 -> 14.59EV
ISO 100 + ISO 6400
80D -> 14.4EV
D7200 -> 15.22EVISO 100
80D -> 12.33EV
D7200 -> 13.79EV
ISO 100 + ISO 6400
80D -> 13.37EV
D7200 -> 14.42EVUgh!? How so? I understand the dr gain of the 80d is achieved by eliminating low-iso read noise, so higher iso values are just as they used to be - but still, an overlap should get us more than 0.5ev? https://www.dxomark.com/Cameras/Canon/EOS-80D---Measurements
And if dual_iso on 80d isn't really something to look forward to, it means even a ml'ed Canon doesn't reach recent Sonikon at all: https://www.dxomark.com/Cameras/Compare/Side-by-side/Canon-EOS-80D-versus-Nikon-D7200-versus-Canon-EOS-70D___1076_1020_895
With that camera, in most situations you can just take the shot at ISO 100 and then raise the shadows during post-processing.
Loss of detail for 1EV more does not make sense.
I'd tend to disagree there, 1ev is double or half the light which is a lot.
Anyway, I guess either the current dual_iso code works with the 80d or it doesn't b/c Canon has done some radical changes ...
RegisterSendCMOSGainCBR
( pCmosGain[0] & CMOS_ADDR_MASK ) == CMOS_REG_R_GAIN9
( pCmosGain[1] & CMOS_ADDR_MASK ) == CMOS_REG_R_GAIN10
( pCmosGain[2] & CMOS_ADDR_MASK ) == CMOS_REG_R_GAIN11
( pCmosGain[3] & CMOS_ADDR_MASK ) == CMOS_REG_R_GAIN12
(R_GAIN9_Param & CMOS_ADDR_MASK ) == CMOS_REG_R_GAIN9
(R_GAIN10_Param & CMOS_ADDR_MASK ) == CMOS_REG_R_GAIN10
(R_GAIN11_Param & CMOS_ADDR_MASK ) == CMOS_REG_R_GAIN11
(R_GAIN12_Param & CMOS_ADDR_MASK ) == CMOS_REG_R_GAIN12
( *pwRegister & 0xF000 ) == CMOS_VSKIP_START_ADDRESS
( *pwRegister & 0xF000 ) == CMOS_VSKIP_END_ADDRESS
( *pwRegister & 0xF000 ) == CMOS_HSKIP_ADDRESS
( *pwRegister & 0xF000 ) == CMOS_SAF_RESET_ADDRESS
[REG] @@@@@@@@@@@@ Start ADTGDMA[CS:%lx:%lx]size:%d
www.magiclanternrumours.com (https://www.youtube.com/watch?v=oHg5SJYRHA0)
Yes, but that comes at the cost of 4EV of aliased highlights at 100/1600
And I somehow doubt the shadows at ISO 100/1600 will actually look cleaner than at ISO 100, because of the half resolution
(which, in theory, reduces the DR by 0.5 stops and also affects the noise structure).
If we have a bracketed image set, one at ISO 100 and another at ISO 1600, we can simulate a dual ISO image (lookup fake_dual_iso.exe) and see exactly if there is any extra shadow detail or not, compared to ISO 100.
Interesting that 5D4 contains ADTG strings on the AE processor, but none of them is present on the main processor.
No you´re wrong. All AF points work as cross sensors even with a slow f5,6 lens , but only the mid Sensor works as a dual cross Sensor with a fast lens ( f 0..-f 2,8)
The Mid AF Sensor even works at f8 . With Special lenses & Converters even 27 AF Sensors work at f8.
Please excuse my worse English ;-)
Take it to PMs guys.
selfishly, all I need is Focus Peaking for video!Hello man if you only need focus peak checkout Feelworld FW759 7 Inches Here is the link for amazon. This is ready to go.
;D
There is a new firmware for the 80D available , maybe this will help developing an 80D ML Version ?No. Only finding the developer with the camera would help...
It seems that it is not easy to get the firmware out from the camera.
./run_canon_fw.sh 80D,firmware=\"boot=1\" -s -S & arm-none-eabi-gdb -x 80D/debugmsg.gdbWhen we will see exactly the same picture on the camera display? :)
Is this for real or trolling ?
... about 7 months ago (http://www.magiclantern.fm/forum/index.php?topic=17360.msg169752#msg169752) ;)
0xFE5F150C(0xFC040004, -1);0xFE5F150C(0xFC040004, 0);
EnableBootDiskTry it on YOUR camera first. ;DCode: [Select]0xFE5F150C(0xFC040004, -1);
DisableBootDiskCode: [Select]0xFE5F150C(0xFC040004, 0);
Any plans with digic 6/7?
ROM:FC000000 ; Processor : ARM
ROM:FC000000 ; ARM architecture: metaarm
ROM:FC000000 ; Target assembler: Generic assembler for ARM
ROM:FC000000 ; Byte sex : Little endian
ROM:FC000000
ROM:FC000000 ; ===========================================================================
ROM:FC000000
ROM:FC000000 ; Segment type: Pure code
ROM:FC000000 AREA ROM, CODE, READWRITE, ALIGN=0
ROM:FC000000 ; ORG 0xFC000000
ROM:FC000000 CODE32
ROM:FC000000
ROM:FC000000 loc_FC000000 ; DATA XREF: sub_FC0274EC+34r
ROM:FC000000 ; sub_FC0274EC+40w
ROM:FC000000 STC2 p0, c0, [R0], {8}
ROM:FC000004 STC2 p0, c0, [R0], {0x48}
ROM:FC000008 MOV R0, #0
ROM:FC00000C MCR p15, 0, R0,c6,c2, 0
ROM:FC000010 MOV R0, #0
ROM:FC000014 MCR p15, 0, R0,c6,c1, 0
ROM:FC000018 MOV R0, #0x3F
ROM:FC00001C MCR p15, 0, R0,c6,c1, 2
ROM:FC000020 MOV R0, #0x320
ROM:FC000024 MCR p15, 0, R0,c6,c1, 4
ROM:FC000028 MRC p15, 0, R0,c1,c0, 0
ROM:FC00002C BIC R0, R0, #0x20000
ROM:FC000030 ORR R0, R0, #1
ROM:FC000034 DSB SY
ROM:FC000038 MCR p15, 0, R0,c1,c0, 0
ROM:FC00003C ISB SY
ROM:FC000040 LDR PC, =0xFE020000
ROM:FE0A0000 ; ---------------------------------------------------------------------------
ROM:FE0A0000 ; START OF FUNCTION CHUNK FOR sub_FE020000
ROM:FE0A0000
ROM:FE0A0000 loc_FE0A0000 ; CODE XREF: ROM:FC020E78j
ROM:FE0A0000 ; sub_FE020000+E78j
ROM:FE0A0000 ; DATA XREF: ROM:FC020E74o
ROM:FE0A0000 ; ROM:off_FC021278o ...
ROM:FE0A0000 04 00 8F E2 ADR R0, loc_FE0A000C
ROM:FE0A0004 01 00 80 E3 ORR R0, R0, #1
ROM:FE0A0008 10 FF 2F E1 BX R0 ; loc_FE0A000C
ROM:FE0A000C ; ---------------------------------------------------------------------------
ROM:FE0A000C CODE16
ROM:FE0A000C
ROM:FE0A000C loc_FE0A000C ; CODE XREF: sub_FE020000+80008j
ROM:FE0A000C ; DATA XREF: sub_FE020000:loc_FE0A0000o
ROM:FE0A000C 40 F2 00 00 C0 F2 00 00 MOV R0, #0
ROM:FE0A0014 40 F2 38 03 C0 F2 00 03 MOV R3, #0x38
ROM:FE0A001C 20 F0 01 00 BIC.W R0, R0, #1
ROM:FE0A0020 23 F0 01 03 BIC.W R3, R3, #1
ROM:FE0A0024 40 F2 00 01 C0 F2 00 01 MOV R1, #0
ROM:FE0A002C
ROM:FE0A002C loc_FE0A002C ; CODE XREF: sub_FE020000+80038j
ROM:FE0A002C 98 42 CMP R0, R3
ROM:FE0A002E 3C BF ITT CC
ROM:FE0A0030 50 F8 04 2B LDRCC.W R2, [R0],#4
ROM:FE0A0034 41 F8 04 2B STRCC.W R2, [R1],#4
ROM:FE0A0038 F8 D3 BCC loc_FE0A002C
ROM:FE0A003A 4F F0 01 00 MOV.W R0, #1
ROM:FE0A003E 06 EE 12 0F MCR p15, 0, R0,c6,c2, 0
ROM:FE0A0042 40 F2 21 11 MOVW R1, #0x121
ROM:FE0A0046 06 EE 91 1F MCR p15, 0, R1,c6,c1, 4
ROM:FE0A004A BF F3 4F 8F DSB.W SY
ROM:FE0A004E 19 EE 11 0F MRC p15, 0, R0,c9,c1, 0
ROM:FE0A0052 00 F0 7D 00 AND.W R0, R0, #0x7D
ROM:FE0A0056 40 F2 01 01 C8 F2 00 01 MOV R1, #0x80000001
ROM:FE0A005E 40 EA 01 00 ORR.W R0, R0, R1
ROM:FE0A0062 09 EE 11 0F MCR p15, 0, R0,c9,c1, 0
ROM:FE0A0066 40 F6 00 00 C8 F2 00 00 MOV R0, #0x80000800
Copying CHDK cache functions is probably enough to move forward.
Hi A1ex,
Yes, I am the emklap of CHDK, there are not may of me around :D
I already set IDA to ARMv7 A&R, didn't see any immediate change. I have no performance degradation with the entire FW Bootloader & ROM RAM loaded in one IDA project, but the suggestion to split it is a nice one, might try that myself as well.
Next steps for me will be to get QEMU up and running and to adjust the CHDK IDC Scripts for my project.
I have limited time over the next weekends so it might take some time but I will report my progress in due time. I catch up with ARM disassembly as well.
ML_MACHINE(80D, 0xFE0A0000);
EOS_MACHINE(80D, 0xFE0A0000);
qemu_register_machine(&canon_eos_machine_ml_80D);
qemu_register_machine(&canon_eos_machine_80D);I also tried 0xFC000000 and 0xFC000008#Makefile.setup.platform for 80D
CANON_NAME_FIR = 80D00102.FIR
FIRMWARE_ID = 0x80000350
UPDATE_NAME_FIR = BOOT_80D.FIR
FIR_BASE = 0x00800120
AUTOEXEC_BASE = 0x00800000
RESTARTSTART = 0x001CC400
ROMBASEADDR = 0xFE0A0000
ML_SRC_PROFILE = minimalminimal.c: In function 'my_create_init_task':
minimal.c:72:5: error: too many arguments to function 'create_init_task'
In file included from ../../src/dryos.h:41:0,
from minimal.c:5:
../../src/tasks.h:104:1: note: declared here
create_init_task( int a, int b, int c );I get further but now the make command stops with a new error.
font_direct.o: In function `font_draw':
font_direct.c:(.text+0xb0): undefined reference to `disp_set_pixel'
make: *** [magiclantern] Error 1
make: Leaving directory `/home/magiclantern/qemu/qemu-1.6.0'
00000000 - 00000FFF: eos.tcm_code
40000000 - 40000FFF: eos.tcm_data
00001000 - 3FFFFFFF: eos.ram
40001000 - 7FFFFFFF: eos.ram_uncached
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror_F1
F2000000 - F2FFFFFF: eos.rom0_mirror_F2
F3000000 - F3FFFFFF: eos.rom0_mirror_F3
F4000000 - F4FFFFFF: eos.rom0_mirror_F4
F5000000 - F5FFFFFF: eos.rom0_mirror_F5
F6000000 - F6FFFFFF: eos.rom0_mirror_F6
F7000000 - F7FFFFFF: eos.rom0_mirror_F7
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror_F9
FA000000 - FAFFFFFF: eos.rom1_mirror_FA
FB000000 - FBFFFFFF: eos.rom1_mirror_FB
FC000000 - FCFFFFFF: eos.rom1_mirror_FC
FD000000 - FDFFFFFF: eos.rom1_mirror_FD
FE000000 - FEFFFFFF: eos.rom1_mirror_FE
FF000000 - FFFFFFFF: eos.rom1_mirror_FF
C0000000 - CFFFFFFF: eos.iomem
[EOS] loading 'ROM-80D.BIN' to 0xF0000000-0xF3FFFFFF
[EOS] loading 'ROM-80D.BIN' to 0xF8000000-0xFBFFFFFF
[EOS] loading 'ROM-80D.BIN' to 0xF0000000-0xF3FFFFFF
[EOS] loading 'ROM-80D.BIN' to 0xF8000000-0xFBFFFFFF
[EOS] loading 'autoexec.bin' to 0x00800000-0x0080207F
[EOS] loading 'qemu-helper.bin' to 0x30000000-0x30008C9F
[QEMU_HELPER] stub ff86af64 -> 30000130 (d195d000)
[QEMU_HELPER] stub ff9abbf4 -> 30000768 (ce83cf89)
[QEMU_HELPER] stub ff9abd20 -> 3000073c (294b2030)
[QEMU_HELPER] stub ff9abe20 -> 3000010c (93b8e0b2)
[QEMU_HELPER] stub ff9ab304 -> 3000027c (64616c62)
[QEMU_HELPER] stub ff9aac68 -> 300000dc (e3a781e3)
[QEMU_HELPER] stub ff9aabb4 -> 3000022c (e080a0ee)
[QEMU_HELPER] stub ff9aafa0 -> 3000033c (6f76754e)
[QEMU_HELPER] stub ff9ab150 -> 30000078 (36206163)
[QEMU_HELPER] stub ff9aad10 -> 30000054 (617262)
[QEMU_HELPER] stub ff9ab050 -> 30000830 (a4e5b498)
[QEMU_HELPER] stub ff85f0f0 -> 300001b8 (84cfb7ce)
[QEMU_HELPER] stub ff85f228 -> 3000019c (b49be583)
[QEMU_HELPER] stub ff9a8170 -> 30000184 (baef208b)
[???] [0xE0411003] -> [0xCFFF9534] PC: 0x00000004
[???] [0xE12FFF1E] -> [0xCFFF9538] PC: 0x00000004
[???] [0xFF811DC0] -> [0xCFFF953C] PC: 0x00000004
[???] [0xE0030092] -> [0xCFFF9520] PC: 0x00000004
[???] [0xE0411003] -> [0xCFFF9524] PC: 0x00000004
[???] [0xE12FFF1E] -> [0xCFFF9528] PC: 0x00000004
[???] [0xFF811DC0] -> [0xCFFF952C] PC: 0x00000004
[???] [0xE0030092] -> [0xCFFF9510] PC: 0x00000004
[???] [0xE0411003] -> [0xCFFF9514] PC: 0x00000004
[???] [0xE12FFF1E] -> [0xCFFF9518] PC: 0x00000004
[???] [0xFF811DC0] -> [0xCFFF951C] PC: 0x00000004
When all else fails... read the instructions. Any recent post on the QEMU thread, that references the install instructions, should do the trick.What caching issues and babysteps you are talking about?
Or, this walkthrough (http://www.magiclantern.fm/forum/index.php?topic=15895.msg185103#msg185103). You'll want QEMU 2.5.0 (not 1.6.0 and neither 2.9.0 - for now).
Don't rush to get "Hello world" yet; on digic 6 we need some more baby steps. If you really want to run it, you can take a look in src/minimal.c from the unified branch (that shows hello world with a minimal "display driver"), and you'll probably get that working in QEMU without much trouble. Note the 80D (in the digic6-dumper branch) has a different minimal.c.
However, this won't boot on the actual hardware until the caching issues (discussed earlier) are addressed.
BTW, the "generic" ROM dumper and display test are compiled from the "recovery" branch, and they work directly from the bootloader (without starting the main firmware).
What caching issues and babysteps you are talking about?
./run_canon_fw.sh 80D,firmware=\"boot=1\" -s -S & arm-none-eabi-gdb -x 80D/debugmsg.gdb[ init:001cc438 ] task_create(dump, prio=1e, stack=1000, entry=1cc6c0, arg=0)python find_fnt.py ROM1.BIN 0xF0000000but this is the only output I'm getting:Find bitmap fonts in Canon DSLR firmwares
Arm.Indy. based on work by Pel, Trammel Hudson and A1ex
Looks mostly fine. In the second box, try Loading segment 0, Loading offset 0xFE000000, and (not sure if this is needed with latest versions) number of bytes 0x1FFFFFC.
ROM:FC2DB944 PUSH {LR}
ROM:FC2DB946 SUB SP, SP, #0x2C
ROM:FC2DB948 ADD R0, SP, #0x30+var_2C
ROM:FC2DB94A BLX sub_FC3FBC70
ROM:FC2DB94E ADR R0, aSystemMemoryIn ; "System Memory Information\n"
ROM:FC2DB950 BL sub_FC483CF0
ROM:FC2DB954 LDR R1, [SP,#0x30+var_2C]
ROM:FC2DB956 ADR R0, aStartAddress0x ; " Start Address = 0x%08lx\n"
ROM:FC2DB958 BL sub_FC483CF0
ROM:FC2DB95C LDR R1, [SP,#0x30+var_28]
ROM:FC2DB95E ADR R0, aEndAddress0x08 ; " End Address = 0x%08lx\n"
ROM:FC2DB960 BL sub_FC483CF0
ROM:FC2DB964 LDR R2, [SP,#0x30+var_24]
ROM:FC2DB966 ADR R0, aTotalSize0x08x ; " Total Size = 0x%08x (%9d)\n"
ROM:FC2DB968 MOV R1, R2
ROM:FC2DB96A BL sub_FC483CF0
ROM:FC2DB96E LDR R2, [SP,#0x30+var_20]
ROM:FC2DB970 ADR R0, aAllocatedSize0 ; " Allocated Size = 0x%08x (%9d)\n"
ROM:FC2DB972 MOV R1, R2
ROM:FC2DB974 BL sub_FC483CF0
ROM:FC2DB978 LDR R2, [SP,#0x30+var_1C]
ROM:FC2DB97A ADR R0, aAllocatedPeak0 ; " Allocated Peak = 0x%08x (%9d)\n"
ROM:FC2DB97C MOV R1, R2
ROM:FC2DB97E BL sub_FC483CF0
ROM:FC2DB982 LDR R2, [SP,#0x30+var_18]
ROM:FC2DB984 ADR R0, aAllocatedCount ; " Allocated Count = 0x%08x (%9d)\n"
ROM:FC2DB986 MOV R1, R2
ROM:FC2DB988 BL sub_FC483CF0
ROM:FC2DB98C LDR R2, [SP,#0x30+var_14]
ROM:FC2DB98E ADR R0, aFreeSize0x08x9 ; " Free Size = 0x%08x (%9d)\n"
ROM:FC2DB990 MOV R1, R2
ROM:FC2DB992 BL sub_FC483CF0
ROM:FC2DB996 LDR R2, [SP,#0x30+var_10]
ROM:FC2DB998 ADR R0, aFreeBlockMaxSi ; " Free Block Max Size = 0x%08x (%9d)\n"
ROM:FC2DB99A MOV R1, R2
ROM:FC2DB99C BL sub_FC483CF0
ROM:FC2DB9A0 LDR R2, [SP,#0x30+var_C]
ROM:FC2DB9A2 ADR R0, aFreeBlockCount ; " Free Block Count = 0x%08x (%9d)\n"seg001:FE2DB945 DCB 0xB5 ; Á
seg001:FE2DB946 DCB 0x8B ; ő
seg001:FE2DB947 DCB 0xB0 ; -
seg001:FE2DB948 DCB 1
seg001:FE2DB949 DCB 0xA8 ; Ę
seg001:FE2DB94A DCB 0x20
seg001:FE2DB94B DCB 0xF1 ; ˝
seg001:FE2DB94C DCB 0x92 ; ĺ
seg001:FE2DB94D DCB 0xE9 ; Ú
seg001:FE2DB94E DCB 0xB6 ; Â
seg001:FE2DB94F DCB 0xA0 ; á
seg001:FE2DB950 DCB 0xA8 ; Ę
seg001:FE2DB951 DCB 0xF1 ; ˝
seg001:FE2DB952 DCB 0xCE ; +
seg001:FE2DB953 DCB 0xF9 ; ¨
seg001:FE2DB954 DCB 1
seg001:FE2DB955 DCB 0x99 ; Ö
seg001:FE2DB956 DCB 0x5C ; \
seg001:FE2DB957 DCB 0xA0 ; á
seg001:FE2DB958 DCB 0xA8 ; Ę
seg001:FE2DB959 DCB 0xF1 ; ˝
seg001:FE2DB95A DCB 0xCA ; ¦
seg001:FE2DB95B DCB 0xF9 ; ¨
seg001:FE2DB95C DCB 2
seg001:FE2DB95D DCB 0x99 ; Ö
seg001:FE2DB95E DCB 0x63 ; c
seg001:FE2DB95F DCB 0xA0 ; á
seg001:FE2DB960 DCB 0xA8 ; Ę
seg001:FE2DB961 DCB 0xF1 ; ˝
seg001:FE2DB962 DCB 0xC6 ; Ă
seg001:FE2DB963 DCB 0xF9 ; ¨I suppose it's because it wasn't analyzed though I'm not sure why.Traditionally, we enable the boot flag from main firmware, but we did enable it from bootloader on VxWorks models. It's probably best to try on a less expensive D6 model first [...]
I have to install http://a1ex.magiclantern.fm/bleeding-edge/80D/BOOTF_80D.FIR, which will "only" modify the boot flag, after which the tests should not modify anything, they are just some test and then normal situation should resume?
Sounds promising; can you PM me a few autoexec.bin files you have experimented with, and their outcome? (in particular, the one that boots successfully and the one that attempts to blink the LED without success)
The best way to start learning, in my (biased) opinion, is to use the emulator. That way, the risk of bricking the camera drops to zero (as you will not experiment with real hardware, but with a PC-based program). Besides, the emulator shows a LOT of internals that are not obvious when running the code on the camera (at this stage, you'll most likely see a black screen and you'll wonder why it doesn't work).
Sure, at some point you will want to try the code on your camera. Having something that works in the emulator decreases the odds of getting into trouble, and during these early boot experiments, I'd say the bricking risk is fairly low - should anything go wrong, the camera will most likely not boot. Non-volatile memories with camera settings (ROM, serial flash, MPU eeprom) are updated on successful shutdown, to my knowledge. Experiments from bootloader (e.g. the "recovery" branch) should be fairly safe, as long as you are not calling things like EraseSectorOfRom.
Even if you manage to get some invalid setting written to ROM, we now understand how these things work and can look into it. Already recovered a couple of D4/5 cameras that way, soft-bricked by either our programming mistakes, or also by third party apps, on cameras that never ran ML before. Sure, we've never tried to recover a D6, so if your camera is mission-critical, don't try it.
To get the emulation further, I need two things:
- a log of MPU communication (http://www.magiclantern.fm/forum/index.php?topic=17596.0) (see mpu_send/mpu_recv stubs in the dm-spy-experiments branch)
- a serial flash dump (sf_dump module)
The first one can be probably started (but not completed) from bootloader. It's a bit tricky, I've got it somewhat (not reliably) working on D4/5 a while ago, the test code is somewhere in the Linux branch (look for MPU), but can be fully tested in QEMU.
The second one will probably not work from bootloader, but I haven't tested it. Todo: try on 700D/100D/M/6D/M2 in QEMU and ask owners of these cameras to try on real hardware).
Both of those will be a lot easier after being able to start DryOS tasks alongside Canon's main firmware, but if that step keeps proving difficult, there are still things to try.
BTW, high-resolution photos of the main board (http://magiclantern.wikia.com/wiki/Circuit_boards) are always welcome (for any camera model, not just 80D). No coding skills required for this one :D
( sleep 3; echo "akashimorino";
sleep 1; echo "SHM_SHOW_INFO";
sleep 1; echo "SHM_SHOW_DIST_INFO";
) | ./run_canon_fw.sh 80D -serial stdio
(
sleep 3; echo "akashimorino";
sleep 1; echo "dumpf";
) | (
./run_canon_fw.sh 80D -serial stdio -s -S &
arm-none-eabi-gdb -x 80D/patches.gdb
)
Sat Jan 1 00:00:06 2000
0: 75.264 [STARTUP]
K350 ICU Firmware Version 1.0.2 ( 6.2.3 )
1: 76.288 [STARTUP]
ICU Release DateTime 2016.12.27 09:58:00
2: 79.872 [SEQ] CreateSequencer (Startup, Num = 6)
3: 84.480 [SEQ] NotifyComplete (Cur = 0, 0x2018000, Flag = 0x10000)
4: 104.704 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x415a7000
5: 105.984 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x41487000
6: 110.336 [PROPAD] SerialFlash Packages!! 0x10000
7: 113.152 [SF] readManufactureCodeSerialFlash 0xc2
8: 113.152 [SF] MACRONIX
9: 123.392 [PROPAD] SerialFlash Packages!! 0x7
10: 123.392 [PROPAD] pFromProperty->pNextWriteAddress 0x10000
11: 123.648 [SEQ] NotifyComplete (Cur = 0, 0x2008000, Flag = 0x8000)
12: 147.456 [SEQ] NotifyComplete (Cur = 0, 0x2000000, Flag = 0x2000000)
13: 147.712 [SEQ] seqEventDispatch (Startup, 0)
14: 147.712 [STARTUP] startupEntry
15: 178.176 [PWM] PWM_Initialize
16: 178.944 [ADC] InitializePollingADC
17: 190.208 [ ADC ] Calibration Completed, 0x00000000
18: 211.712 [PROPST] Initialize Adjective & Situation
19: 232.192 [PROPST] Initialize FlaverPCValid 1 (0)
20: 232.704 [PROPST] Initialize FlaverPCValid 2 (1)
21: 232.704 [PROPST] Initialize FlaverPCValid 3 (1)
22: 232.704 [PROPST] @@@JudgeRestoreFlavorPC 701
23: 273.152 [STARTUP]startupCompleteCallback 0x2
24: 273.664 [SEQ] NotifyComplete (Cur = 1, 0x2, Flag = 0x2)
25: 281.344 [PRP] DivideCameraInitData in L:489
26: 282.880 [PROPST] dwNewAeModeDial = 3
27: 285.696 [PROPST] ChangeAEMode -> 3 @AE_MODE_DIAL
28: 286.208 [PROPST] Active Adjective & Situation 2->3
29: 286.208 [PROPST] ReqChangeCBR : Adjective 0, 0
30: 286.208 [PROPST] Not ExecMultiConvert Already None : Adjective 0, 0
31: 286.464 [PROPST] Not ExecMultiConvert : Situation 0
32: 286.976 [PROPST] !! Convert End !!
33: 288.000 [PROPAD] DataType = 0x2000000 fModify = TRUE
34: 291.072 [PRP] Deliv WaitID = 0x80000001, 0xFE15E275(1)
35: 319.488 [PROPST] PROP_DISTORTION_COMP 0
36: 326.912 [PROPST] PROP_LIGHT_FALLOFF_COMP 1 (Excluding:0)
37: 332.800 [PROPST] PROP_CHROMATISM 1 (Excluding:0)
38: 353.792 [PRP] Complete WaitID = 0x80000001, 0xFE15E275(0)
39: 354.048 [PRP] SpecialComplete ID = 0x80000001, 0x80000001 2907
40: 378.368 [EM] emSlaveChangeCBR : AUTO_POWEROFF (1)
41: 379.648 [EM] emSlaveChangeCBR : UILOCK (0x0)
42: 417.792 [LENS]AfReqAeDataMasterResultCBR
43: 425.472 [LENS]LensAedataReplyMasterResultCBR
44: 435.200 [LENS]LensAfdataReplyMasterResultCBR
45: 444.928 [LENS]LensStatusReplyMasterResultCBR
46: 455.168 [LENS]MirrorupEmdReplyMasterResultCBR
47: 463.104 [LENS]MirrorupShutterEndMasterResultCBR
48: 471.040 [LENS]LensHaltReplyMasterResultCBR
49: 479.744 [LENS]LensStatusChangeMasterResultCBR
50: 487.936 [LENS]LvLensDataMasterResultCBR
51: 499.712 [LENS]LensIdExtMasterResultCBR
52: 509.184 [LENS]LensSceneDataCBR
53: 516.608 [LENS]PowerZoomAdapterInfoCBR
54: 526.848 [LENS]LensDataForImageCBR
55: 536.064 [LENS]AfMonitorDataMasterResultCBR
56: 560.640 [MSUB]PROP_LV_LENS
57: 600.320 [SEQ] seqEventDispatch (Startup, 1)
58: 600.832 [STARTUP] startupPrepareProperty
59: 611.328 [PROPST] @@@ dwHdmiPhysicalConnect = 0(900)
60: 627.456 [HPD] HotPlug TimelapseSetting = 0
61: 629.760 [HPD] # 0 0 0
62: 640.512 [HPD] Variangle State 2
63: 645.376 [HPD] CreateTask Master End
64: 651.776 [STARTUP] PROP_GPS_AUTO_TIME_SETTING 0
65: 653.568 [STARTUP]startupCompleteCallback 0x20000000
66: 653.824 [SEQ] NotifyComplete (Cur = 2, 0x20420010, Flag = 0x20000000)
67: 653.824 [STARTUP] startupPrepareProperty : CLASSID_FLAG_PROPAD
68: 654.080 [FM] FM_Initialize (0, 1, 0)
69: 665.344 [FM] fmResultCBR (0x83b2b8)
70: 669.952 [FM] PROP_HDD_DCIM_PATH (/)
71: 672.256 [FC] FC_Initialize [drive:3][ClassID:39]
72: 698.624 ERROR [RTC] RTC_REGISTER_TIME_CORRECT ERROR 0x0 -> 0x9e
73: 708.352 ERROR [RTC] !! RTC CHECK ERROR !!
74: 729.344 [RTC] SPECIAL_OPTION 0x0, 0x0
75: 736.512 [RTC] permitCharge already permit 0x0
76: 767.232 [RSC] srmGetShootMemAreaAddress(): Area[4] isn't Exist.
77: 825.856 [RSC] CreatePackHeapObject
78: 829.184 [RSC] AllocateMemoryUnit For OnlyMem1
79: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
80: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
81: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
82: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
83: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
84: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
85: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
86: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
87: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
88: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
89: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
90: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
91: 829.440 [RSC] AllocateMemoryUnit For OnlyMem1
92: 838.656 [RSCC] ClearBusy(0x1) 0x40->0x40,0x0(0x40)[0,0]
93: 840.192 [RSC] RearrangeMemMgr add 1 0 2
94: 840.192 [RSCC] ClearBusy(0x1) 0x40->0x40,0x0(0x40)[0,0]
95: 841.216 [RSC] fDevDone 1, dwLvLock 0
96: 841.216 [RSC] 0 0 0
97: 841.728 [RSC] PROP_MEMORY_STATUS(SELF) (10->)13 (OTHER) 0, 4987
98: 841.728 [RSC] Deliver PROP_MEMORY_STATUS 19
99: 848.128 [RSC] MemMgr(IMAGE) 0 2
100: 848.640 [RSC] MemMgr(IMAGE) 0 0
101: 848.640 [RSC] MemMgr(IMAGE) 0 0
102: 848.640 [RSC] MemMgr(IMAGE) 0 0
103: 872.448 [RSCC] this->dwCardStatus[0] = 0x1(525)
104: 873.728 [RSC] fDevDone 1, dwLvLock 0
105: 873.728 [RSC] 0 0 0
106: 883.200 [RSCC] this->dwCardStatus[1] = 0x1(525)
107: 884.224 [RSC] fDevDone 1, dwLvLock 0
108: 884.224 [RSC] 0 0 0
109: 891.392 [RSCC] PROP_PC_HDD_STATUS = 0x1
110: 898.816 [RSC] fDevDone 1, dwLvLock 0
111: 899.072 [RSC] 0 0 0
112: 908.544 [RSC] fDevDone 1, dwLvLock 0
113: 909.056 [RSC] 0 0 0
114: 921.344 [RSC] fDevDone 1, dwLvLock 0
115: 921.600 [RSC] 0 0 0
116: 944.640 [RSC] fDevDone 1, dwLvLock 0
117: 944.896 [RSC] 0 0 0
118: 954.880 [RSCC] PROP_SAVE_MODE = 0x1
119: 963.584 [RSCC] PROP_CARD0_FOLDER_NUMBER
120: 971.520 [RSCC] PROP_CARD1_FOLDER_NUMBER
121: 995.072 [RSCC] PROP_NUMBER_OF_CONTINUOUS_MODE BaseDcfNo 8556
122: 1001.984 [RSC] fDevDone 1, dwLvLock 0
123: 1002.496 [RSC] 0 0 0
124: 1010.944 [RSC] fDevDone 1, dwLvLock 0
125: 1011.456 [RSC] 0 0 0
126: 1021.696 [RSC] fDevDone 1, dwLvLock 0
127: 1021.696 [RSC] 0 0 0
128: 1022.208 [RSCC] PROP_CARD_EXTENSION 0
129: 1041.920 [RSCC] PC_CLUSTER_SIZE = 0x1000
130: 1067.264 [RSC] SetAutoIsoCode 0x83
131: 1067.776 [RSCC] ChangeAutoIsoCode Factor:1 AutoIsoCode:131 -> 131
132: 1076.224 [RSC] SetAutoIsoCode 0x83
133: 1076.480 [RSCC] ChangeAutoIsoCode Factor:2 AutoIsoCode:131 -> 131
134: 1079.808 [RSCC] ClearBusy(0x1) 0x40->0x40,0x0(0x40)[0,0]
135: 1080.576 [RSC] fDevDone 1, dwLvLock 0
136: 1080.576 [RSC] 0 0 0
137: 1086.976 [RSC] fDevDone 1, dwLvLock 0
138: 1087.232 [RSC] 0 0 0
139: 1098.752 [RSCC] ClearBusy(0x40000) 0x40->0x40,0x0(0x40)[0,0]
140: 1107.456 [RSCC] ClearBusy(0x40000) 0x40->0x40,0x0(0x40)[0,0]
141: 1116.416 [RSCC] ClearBusy(0x40000) 0x40->0x40,0x0(0x40)[0,0]
142: 1124.352 [RSCC] ClearBusy(0x40000) 0x40->0x40,0x0(0x40)[0,0]
143: 1131.008 [RSC] SetAutoIsoCode 0x58
144: 1131.264 [RSCC] ChangeAutoIsoCode Factor:0 AutoIsoCode:131 -> 88
145: 1141.248 [RSCC] ClearBusy(0x1) 0x40->0x40,0x0(0x40)[0,0]
146: 1141.760 [RSC] fDevDone 1, dwLvLock 0
147: 1142.016 [RSC] 0 0 0
148: 1148.928 [RSC] fDevDone 1, dwLvLock 0
149: 1149.440 [RSC] 0 0 0
150: 1157.632 [RSC] fDevDone 1, dwLvLock 0
151: 1158.144 [RSC] 0 0 0
152: 1188.608 [RSCC] RU CLUSTER_SIZE[0] = 0x407A0150
153: 1196.288 [RSCC] RU CLUSTER_SIZE[1] = 0x407A015C
154: 1213.440 [EM] emRegisterMulticastCallback : EventID = 0, ClassID = 68
155: 1218.816 [EM] emRegisterMulticastCallback : EventID = 11, ClassID = 68
156: 1220.096 [EM] Already SW1OFF
157: 1230.080 [EM] emRegisterMulticastCallback : EventID = 14, ClassID = 68
158: 1236.480 [EM] emRegisterMulticastCallback : EventID = 15, ClassID = 68
159: 1242.368 [EM] emRegisterMulticastCallback : EventID = 4, ClassID = 68
160: 1251.328 [FM] FM_RegisterSpaceNotifyCallback
161: 1252.352 [MRK] MRK_RegisterSpaceNotifyCallback
162: 1253.120 [MRK] RegisterSpaceNotifyCallback : DriveNo = 2
163: 1253.376 [FM] voiRegisterSpaceNotifyCallback : DriveNo = 2
164: 1253.376 [LVMOV][GPS] GPS_RegisterSpaceNotifyCallback
165: 1253.632 [FM] [GPS] gpsRegisterSpaceNotifyCallback : DriveNo = 2
166: 1253.888 [FM] RegisterSpaceNotifyCallback : DriveNo = 2
167: 1254.144 [FC] FcmcRegisterSpaceNotifyCallback : DriveNo = 2
168: 1254.400 [FM] FM_RegisterSpaceNotifyCallback
169: 1261.056 [BIND] Stage : NORMAL
170: 1263.616 [JOB] InitializeJobClass (ID = 8331, Num = 14)
171: 1263.616 [JOB] InitializeJobClass 84 206 17216 22940
172: 1267.456 [JOB] [BIND] dcsResultCBR (0x83d3a4)
173: 1271.552 [JOB] PROP_GPS_INFORMATION fGPSConnect = 0x0
174: 1271.552 [JOB] MPU 0x0 USB 0x0 WFT 0x0 INNER 0x0
175: 1271.552 [JOB] PROP_MPU_GPS fGPSConnect = 0x0
176: 1271.808 [JOB] MPU 0x0 USB 0x0 WFT 0x0 INNER 0x0
177: 1272.576 [JOB] @@@setDefaultImgDirection
178: 1272.832 [JOB] PROP_GPS_DEVICE_ACTIVE INNER 0x0 fGPSConnect = 0x0
179: 1273.088 [JOB] @@@setDefaultImgDirection
180: 1276.928 [JOB] PROP_BTDEVICE_CONNECT WFT 0x0 fGPSConnect = 0x0
181: 1292.288 [EM] emLockControl (TYPE_JOBSTATE = 0x0)
182: 1298.176 [RSC] fDevDone 1, dwLvLock 0
183: 1298.944 [RSC] 0 0 0
184: 1330.688 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
185: 1331.456 [PRP] ERROR NOT FOUND PROPERTY ID = 0x01000007 L:2849
186: 1337.088 [EM] emRegisterMulticastCallback : EventID = 20, ClassID = 72
187: 1341.440 [JOB] InitializeInnerDevelopJobClass (ID = 8331, Num = 16)
188: 1341.696 [JOB] InitializeMultipleExposureShootJobClass ( Num = 28,11 )
189: 1341.696 [JOB] InitializeMultipleExposureSaveAndEndJobClass ( Num = 14 )
190: 1341.952 [JOB] InitializeHDRShootJobClass ( Num = 12 )
191: 1341.952 [JOB] InitializeHDRSaveAndEndJobClass ( Num = 36 )
192: 1342.208 [JOB] InitializeGISShootJobClass ( Num = 12 )
193: 1342.208 [JOB] InitializeGISSaveAndEndJobClass ( Num = 27, 30 )
194: 1342.976 [JOB] InitializeShufflehootJobClass (ID = 8331, Num = 14)
195: 1348.864 [GUILOCK]InitializeGUILock (PUB)
196: 1360.896 [GUILOCK][GUI] MasterResultCBR
197: 1364.224 [TERM] terminateChangeCBR : SHUTDOWN (255)
198: 1364.480 [TERMINATE] SHUTDOWN init comp
199: 1364.736 [TERM] terminateChangeCBR : AUTO_POWEROFF (1)
200: 1364.736 [TERMINATE] Abort init comp
201: 1380.608 [EM] emRegisterMulticastCallback : EventID = 0, ClassID = 156
202: 1385.472 [EM] emRegisterMulticastCallback : EventID = 1, ClassID = 156
203: 1390.848 [EM] emRegisterMulticastCallback : EventID = 4, ClassID = 156
204: 1399.296 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
205: 1400.064 [PRP] ERROR NOT FOUND PROPERTY ID = 0x01000007 L:2849
206: 1401.344 [FSS] PROP_SHOOTING_TYPE (0x0->0x0)
207: 1401.344 [FSS] PROP_AF_SHIFT_AFB_INFO (0x0 0)
208: 1446.912 [EM] emRegisterMulticastCallback : EventID = 0, ClassID = 244
209: 1452.032 [EM] emRegisterMulticastCallback : EventID = 11, ClassID = 244
210: 1453.056 [EM] Already SW1OFF
211: 1455.872 [MC] MeteringTimerStart
212: 1459.200 [EM] emRegisterMulticastCallback : EventID = 7, ClassID = 244
213: 1465.088 [EM] emRegisterMulticastCallback : EventID = 1, ClassID = 244
214: 1469.952 [EM] emRegisterMulticastCallback : EventID = 4, ClassID = 244
215: 1475.328 [EM] emRegisterMulticastCallback : EventID = 6, ClassID = 244
216: 1480.192 [EM] emRegisterMulticastCallback : EventID = 3, ClassID = 244
217: 1485.312 [EM] emRegisterMulticastCallback : EventID = 2, ClassID = 244
218: 1491.200 [EM] emRegisterMulticastCallback : EventID = 20, ClassID = 244
219: 1496.832 [EM] emRegisterMulticastCallback : EventID = 22, ClassID = 131
220: 1501.952 [EM] emRegisterMulticastCallback : EventID = 23, ClassID = 131
221: 1516.032 [MC] PROP_DISPLAY_OFF_SENSOR 1
222: 1516.544 [MC] PROP_DISPSENSOR_CTRL 1(0)
223: 1517.568 [MC] PROP_SHOOTING_TYPE 0
224: 1517.824 [MC] set_lv_act2 : 0 -1 1 0
225: 1518.080 [MC] PROP_GUI_STATE 0
226: 1518.592 [MC] PROP_LV_ACTION LV_STOP
227: 1518.848 [MC] judge_lv_disp_busy(mode_change): 0 0 1 1 0
228: 1519.360 [MC] PROP_LV_DISPBUSY not Busy
229: 1519.616 [MC] PROP_LV_LOCK LVLOCK_PERMIT
230: 1519.616 [MC] set_lv_act2 : 0 1 1 0
231: 1519.616 [MC] judge_lv_disp_busy(mode_change): 0 0 1 1 0
232: 1519.872 [MC] PROP_DISABLE_PLAY_IMAGE Enable Play
233: 1519.872 [MC] JobState 0
234: 1519.872 [MC] on_digi_event start
235: 1520.384 [MC] set_lv_act2 : 0 1 1 0
236: 1520.384 [MC] judge_lv_disp_busy(mode_change): 0 0 1 1 0
237: 1520.896 [MC] PROP_AE_MODE m_AeMode=0x03 m_SetTv =0x70 ,m_ModeBulb=0
238: 1521.152 [MC] PROP_SET_TV m_SetTv =0x4D m_AeMode=0x03 ,m_ModeBulb=0
239: 1521.664 [MC] QRTime 0
240: 1522.944 [DISP] ForceBackLightOff
241: 1523.200 [DISP] ERROR BackLightCtrl:0
242: 1523.712 [MC] PROP_VARIANGLE_GUICTRL Enable
243: 1523.968 [MC] PROP_HEADPHONE_VOLUME_VALUE : 0
244: 1523.968 [MC] PROP_MOVIE_PLAY_VOLUME : 0
245: 1524.480 [MC] PROP_LCD_OFFON_BUTTON : 2
246: 1524.736 [MC] PROP_LV_CFILTER 0
247: 1524.736 [MC] set_lv_act2 : 0 1 1 0
248: 1524.992 [MC] judge_lv_disp_busy(mode_change): 0 1 1 1 0
249: 1530.880 [MC] PROP_GUIGROUND_STATE 0
250: 1537.024 [MC] PROP_LV_ACTION LV_STOP
251: 1537.536 [MC] judge_lv_disp_busy(mode_change): 0 1 1 1 0
252: 1556.480 [MC] PROP_VARIANGLE_GUICTRL Disable
253: 1576.192 [MC] PROP_LV_DISPBUSY Busy
254: 1582.080 [MC] PROP_LV_DISPBUSY Busy
255: 1586.944 [MC] PROP_LV_DISPBUSY Busy
256: 1592.832 [MC] PROP_LV_DISPBUSY not Busy
257: 1607.680 [MC] CardCover=0
258: 1608.448 [MC] regist master CardCover
259: 1611.776 [EM] emRegisterMulticastCallback : EventID = 13, ClassID = 244
260: 1614.336 [TA10] TA10_Initialize : Start
261: 1655.296 [TA10] ### TA10Setting Clear (OFF->OFF) ###
262: 1656.576 [TA10] ERROR Irregular TotalSheets 0 !!
263: 1657.344 [TA10] ChangePropCBR ShotsPlan 2 / TotalSheets 2
264: 1704.960 [TA10] TA10_Initialize : End
265: 1705.472 [HDR] HDR_Initialize : Start
266: 1729.280 [HDR] ### HDRSetting Clear (OFF->OFF) ###
267: 1730.304 [HDR] ChangePropCBR HDRFunc 0
268: 1732.352 [HDR] HDRS_Initialize
269: 1732.608 [HDR] CreateStageClass
270: 1741.824 [HDR] HDRS_Initialize : End
271: 1742.080 [HDR] HDR_Initialize : End
272: 1742.336 [GIS] GIS_Initialize : Start
273: 1762.560 [GIS] ### GISSetting Clear (OFF->OFF) ###
274: 1763.328 [GIS] ChangePropCBR GISFunc 0
275: 1766.912 [GIS] GISS_Initialize
276: 1767.168 [GIS] CreateStageClass
277: 1773.568 [GIS] GISS_Initialize : End
278: 1773.824 [GIS] GIS_Initialize : End
279: 1781.248 [FM] PROP_CARD1_STATUS = 0x1
280: 1788.672 [FM] PROP_CARD1_FOLDER_NUMBER = 142
281: 1796.352 [FM] PROP_CARD1_FILE_NUMBER = 0
282: 1810.176 [FM] PROP_CARD2_STATUS = 0x1
283: 1817.856 [FM] PROP_CARD2_FOLDER_NUMBER = 100
284: 1826.560 [FM] PROP_CARD2_FILE_NUMBER = 8556
285: 1837.056 [FM] PROP_FILE_NUMBERING_MODE = 1, 0
286: 1841.408 [FM] PROP_CARD_EXTENSION = 0
287: 1847.296 [FM] PROP_CURRENT_MEDIA = 2
288: 1851.392 [FM] PROP_USBDEVICE_CONNECT = -1
289: 1853.952 [FM] PROP_NUMBER_OF_CONTINUOUS_MODE = 8556
290: 1853.952 [STARTUP]startupCompleteCallback 0x10
291: 1854.208 [SEQ] NotifyComplete (Cur = 2, 0x420010, Flag = 0x10)
292: 1858.304 [FM] PROP_DSDEFINE ModelId 80000350
293: 1861.888 [FM] PROP_APPENDMOVINFO Handle 0,205001d
294: 1862.400 [FM] PROP_APPENDMOVINFO VideoSnapMode 4,205001d
295: 1867.008 [FM] PROP_SPECIAL_OPTION = 0
296: 1871.104 [FM] PROP_SCREEN_SAVER = 0
297: 1875.968 [FM] PROP_CARD1_RU_SIZE -1
298: 1879.552 [FM] PROP_CARD2_RU_SIZE 65536
299: 1885.952 [FM] fmInitialized
300: 1893.888 [FC] _FC_SetDirSuffix (CANON)
301: 1897.216 [FM] fmPrepare
302: 1919.488 [CSMGR] Card ManageArea�@Address�@:�@0x008465c4
303: 1920.256 [FM] fmAllocDcfNo(0x479e4c)(0x0)
304: 1925.120 [RSCC] srmAllocDcfNoTable
305: 1926.144 [FM] fmAllocateDcfNoCompleteCallback(0x43ae8c00,0x4000)
306: 1935.360 [FM] fmAllocDcfNo : DcfNoTable(0x43ae8c00)
307: 1946.880 [NFC] PropChange:PROP_SPECIAL_OPTION Wlan off (0x0)
308: 1952.000 [SD] ---- SDEventHandler(ID=1:Event=8) ----
309: 1975.296 [SD] SD initialize start
310: 1990.144 [SD] SD initialize end speed=0 clock=12 UHS=0
311: 1992.192 [SD] Name: QEMU! Size: 247(7bc00)
312: 1992.448 [SD] nBlocks=506880, blksPerTrack=0, nHeads=0
313: 1995.776 [FSU] fsuGetPart: Block(99, 506781, 506880)
314: 2003.968 [FSU] efat_map_filesys 99 B: 1
315: 2008.576 [SD] default ru size (SC)
316: 2075.136 [FSU] AllocateMemory For Speed Class!!!
317: 2013.696 [FSU] Attach SC 0 80 80 8 248 248
318: 2016.512 [FM] EV_INSERTION_COMPLETE : ID = 2, stat = 8192
319: 2016.512 [FM] bWormCard = 0
320: 2016.512 [FM] bWriteOnceCard = 0
321: 2020.096 [FM] fmNormalMountCard (ID = 2, Ret = 0)
322: 2020.608 [FM] fmPrepareShooting (Drive = 2)
323: 2021.120 [FC] _FC_PrepareCatalog (2, B:)
324: 2114.304 [FM] DirNo = 100, FileNo = 0
325: 2050.048 [FM] Cluster = 16384, Total = 15832, Free = 13444 RU = -1 FreeRU = 1653
326: 2050.560 [FC] _FC_GetNewDirDcfNo (2, 0, 0, 0)
327: 2050.816 [FM] fmSetInitialCardInfo (Drive = 2, 0)
328: 2070.016 [RSCC] this->dwCardStatus[1] = 0x1(525)
329: 2071.552 [RSC] fDevDone 1, dwLvLock 0
330: 2071.552 [RSC] 0 0 0
331: 2102.272 [RSCC] PROP_CARD1_FOLDER_NUMBER
332: 2132.736 [RSCC] RU CLUSTER_SIZE[1] = 0x407A015C
333: 2141.952 [FM] fmWrapperRU1 : DriveNo = 2 B: 1653
334: 2141.952 [FM] fmWrapperRU : DriveNo = 2 B: 1653
335: 2145.280 [RSCC] Storage Space 13444, FreeRUCount 1653
336: 2224.384 [FM] pfNotifyDcfNoCBR(2:100_0000)
337: 2162.432 [RSCC] srmNotifyDcfNo 0x2 100 0 0 1
338: 2162.688 [RSCC] srmSetDcfNoTableOrDiff 1 100 0 1
339: 2162.688 [RSCC] Diff Dcf List
340: 2162.944 [RSCC] Create Diff Dcf ListItem 100
341: 2163.456 [RSCC] fTemporary 1 pMaxDcfNoInFolder->fTemporary 1
342: 2163.456 [RSCC] Diff Dcf Over Write 100
343: 2163.968 [RSCC] ####### [1]DCF No 8556
344: 2170.880 [RSC] ERROR GetEstimatedSizeOfMovie NOT Exist Size or FrameRate K347 0 1 0
345: 2173.952 [RSC] ERROR GetMargineSizeOfMovie NOT Exist Size or FrameRate K347 0 1 0
346: 2243.328 [RSC] ERROR GetEstimatedSizeOfMovieThumb NOT Exist Size or FrameRate K347 0
347: 2181.120 [RSC] ERROR GetEstimatedSizeOfMovie NOT Exist Size or FrameRate K347 0 1 0
348: 2184.192 [RSC] ERROR GetMargineSizeOfMovie NOT Exist Size or FrameRate K347 0 1 0
349: 2253.568 [RSC] ERROR GetEstimatedSizeOfMovieThumb NOT Exist Size or FrameRate K347 0
350: 2191.872 [RSC] ERROR GetEstimatedSizeOfMovie NOT Exist Size or FrameRate K347 0 1 0
351: 2193.664 [RSCC] BURST 4 Enable 4 Reserve 32504576
352: 2193.920 [RSCC] Burst 4 ENABLE 4 Reserve 32504576
353: 2194.176 [RSCC] ClearBusy(0x2100) 0x40->0x40,0x0(0x40)[0,0]
354: 2194.432 [STARTUP]startupCompleteCallback 0x20000
355: 2194.688 [SEQ] NotifyComplete (Cur = 2, 0x420000, Flag = 0x20000)
356: 2223.616 [STARTUP]startupCompleteCallback 0x400000
357: 2224.128 [SEQ] NotifyComplete (Cur = 2, 0x400000, Flag = 0x400000)
358: 2293.248 [FM] PROP_CARD2_STATUS = 0x1
359: 2301.696 [FM] PROP_CARD2_FOLDER_NUMBER = 100
360: 2243.072 [FM] PROP_CARD2_RU_SIZE -1
361: 2252.032 [FM] PROP_CARD2_FILE_NUMBER = 8556
362: 2253.568 [SEQ] seqEventDispatch (Startup, 2)
363: 2320.128 [STARTUP] startupPrepareCapture
364: 2334.464 [SHTLVME][MNAV] MEMNAVI_Initialize
365: 2273.024 [SHTLVME][MNAV] MEMNAVI_SetMemoryMap: 1
366: 2344.192 [EM] emRegisterMulticastCallback : EventID = 14, ClassID = 147
367: 2350.080 [EM] emRegisterMulticastCallback : EventID = 2, ClassID = 147
368: 2354.944 [EM] emRegisterMulticastCallback : EventID = 3, ClassID = 147
369: 2360.832 [EM] emRegisterMulticastCallback : EventID = 15, ClassID = 147
370: 2301.184 [EM] emRegisterMulticastCallback : EventID = 5, ClassID = 147
371: 2372.608 [EM] emRegisterMulticastCallback : EventID = 6, ClassID = 147
372: 2378.496 [EM] emRegisterMulticastCallback : EventID = 1, ClassID = 147
373: 2383.104 [EM] emRegisterMulticastCallback : EventID = 4, ClassID = 147
374: 2388.992 [EM] emRegisterMulticastCallback : EventID = 8, ClassID = 147
375: 2393.344 [EM] emRegisterMulticastCallback : EventID = 9, ClassID = 147
376: 2399.744 [EM] emRegisterMulticastCallback : EventID = 10, ClassID = 147
377: 2340.864 [EM] emRegisterMulticastCallback : EventID = 17, ClassID = 147
378: 2413.568 [EM] emRegisterMulticastCallback : EventID = 18, ClassID = 147
379: 2420.224 [EM] emRegisterMulticastCallback : EventID = 19, ClassID = 147
380: 2426.112 [EM] emRegisterMulticastCallback : EventID = 21, ClassID = 147
381: 2437.632 [SHTC] scsProperty ID=0x80030012(0x0)
382: 2441.728 [SHTC] scsIgnore
383: 2449.152 [SHTC] scsProperty ID=0x0(0x200884)
384: 2456.576 [SHTC] scsProperty ID=0x80040004(0x0)
385: 2463.232 [SHTC] scsProperty ID=0x80040069(0x0)
386: 2469.376 [SHTC] scsInit
387: 2479.616 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
388: 2480.384 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
389: 2480.384 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
390: 2480.384 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
391: 2480.384 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
392: 2480.640 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
393: 2480.640 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
394: 2480.640 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
395: 2480.640 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
396: 2480.640 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
397: 2480.896 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
398: 2480.896 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
399: 2480.896 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
400: 2480.896 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
401: 2481.152 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
402: 2481.152 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
403: 2481.152 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
404: 2481.152 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
405: 2481.152 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
406: 2481.408 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
407: 2481.408 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
408: 2481.408 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
409: 2481.408 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
410: 2481.408 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
411: 2481.664 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
412: 2481.664 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
413: 2488.832 [CAPE] InitializeHeadControl
414: 2489.856 [SHTC] Mem1Component Size=0x13c7b0
415: 2490.624 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
416: 2492.672 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
417: 2498.560 [PROPAD] ERROR SearchPropertyPackage DataType (0) = 0x01000000(L:3114)
418: 2504.192 [SHTC] DarkCurrentBuffer:0x4219c400, Size:139264
419: 2504.960 [STARTUP]startupCompleteCallback 0x40000
420: 2504.960 [SEQ] NotifyComplete (Cur = 3, 0xc0000, Flag = 0x40000)
421: 2510.848 [RSCC] RealClearBusy(0x40) 0x40->0x0,0x0(0x0)
422: 2536.704 [STARTUP]startupCompleteCallback 0x80000
423: 2537.216 [SEQ] NotifyComplete (Cur = 3, 0x80000, Flag = 0x80000)
424: 2555.648 [SHTB] sbsInit
425: 2559.744 [SHTB] VShadingAddress:0x421be400, Size:2226176
426: 2570.240 [SHTP] Init
427: 2573.824 [SEQ] seqEventDispatch (Startup, 3)
428: 2576.640 [FSU] RU defaults !
429: 2577.664 [SD] ---- SDEventHandler(ID=1:< B: >) Mounted ----
Proof-reading the QEMU guide (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/) is also very welcome.
Weird thing - LOG000.LOG is in chinese (https://hastebin.com/woxahugocu) :o
Todo: try on 700D/100D/M/6D/M2 in QEMU and ask owners of these cameras to try on real hardware).
Key event: b9 -> 0c00
[MPU] Sending : 06 05 06 0c 00 00 (GUI_SWITCH)
[MPU] Received: 06 05 03 19 01 00 (PROP_TFT_STATUS - spell #292)
[MPU] Received: 06 05 03 19 01 00 (PROP_TFT_STATUS - spell #292)
Save configs...
Opening serial flash...
Dumping serial flash... 100%
Closing serial flash...
Done!
[MPU] Received: 06 05 03 11 01 00 (unnamed - spell #14)
MD5 (/Users/rosiefort/qemu/700D/SFDATA.BIN) = bd83f093d587027a03922f47711b57da
MD5 (/Volumes/EOS_DIGITAL/ML/LOGS/SFDATA.BIN) = bd83f093d587027a03922f47711b57da
/** File I/O **/
NSTUB(0xFE482A10 + 1, FIO_CloseFile)
NSTUB(0xFE4834DC + 1, FIO_FindClose) // proper name: FindClose
NSTUB(0xFE48345A + 1, FIO_FindNextEx)
NSTUB(0xFE482890 + 1, _FIO_ReadFile)
NSTUB(0xFE482900 + 1, FIO_SeekSkipFile)
NSTUB(0xFE4829A2 + 1, _FIO_WriteFile)
NSTUB(0xFE482FFE + 1, _FIO_CreateDirectory)
NSTUB(0xFE4827BA + 1, _FIO_CreateFile)
NSTUB(0xFE4833C6 + 1, _FIO_FindFirstEx)
NSTUB(0xFE482AFC + 1, _FIO_GetFileSize)
NSTUB(0xFE482744 + 1, _FIO_OpenFile)
NSTUB(0xFE482824 + 1, _FIO_RemoveFile)
// NSTUB( ???, _FIO_RenameFile)
/** Serial Flash **/
NSTUB(0xFE344B2A + 1, SF_CreateSerial)
NSTUB(0xFE344AEE + 1, SF_readSerialFlash)
NSTUB(0xFE34663E + 1, SF_Destroy)
SF_test = (void*)0x40104EF4;
SF_testl();it shows proper output like "Read Address[0x000000-0x7FFF00]:0x".b *0x40104EF4
command
silent
print_current_location
printf "sf_read_sio(%x { ", $r0
set $addr = $r0
while *(int*)$addr != -1
printf "%x ", *(int*)$addr
set $addr = $addr + 4
end
printf "-1 }, %x, %x, %x)\n", $r1, $r2, $r3
c
end console outputs this:[CPU0] 408001CC: MCR p15,0,Rd,cr6,cr1,4: DRACR <- 0x320 (P:RW U:RW; Inner Non-cacheable; Outer Non-cacheable; Non-shared)
[ :408002c8 ] sf_read_sio(0 { e59ff018 e59ff018 e59ff018 e59ff018 e59ff018 e320f000 e59ff018 e59ff018 fe020040 40800014 40800014 40800014 40800014 0 40800014 40800014 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 After tons of zeores I have a lof of this:000 e3e00000 e58d0004 e3a00000 eb0019fa e3560000 a000005 e3560001 a000006 e1a00006 eb000f88 e28dd028 e8bd87f0 e28f0e2a eb001a25 ea000002 e3a05001 e28f0fa5 eb001a21 eb000724 eb0006e8 e59f928c e5990024 e3700001 a000002 e28f0d0a eb001a19 e3a05001 e3550000 1a000024 e28f0f9f eb001a14 eb0004f4 e599000c e3700001 a000002 eb000740 eb00028b ea000017 e28f0f97 eb001a0b e3a00001 e5991004 e3710001 1a000003 e28f0f8a eb001a05 eb000735 eb0008ea e3500001 1a00000b e28f0e23 eb0019ff e5990000 e3700001 a000004 eb000744 e28f0f87 eb0019f9 e3a00001 eaffffcd eb000727 eb000272 e5990008 e3700001 a000000 eb0004c0 e59f01f8 e3a01c05 e580140c e2811802 e580140c e590640c e3a01c06 e580140c e2811802 e580140c e590740c e28d0004 eb000679 e59f01c8 e5908000 e3a05000 e3a0a000 ea0001d6 e28f0f6e eb0019dd e3a01e35 e28f0f79 eb001a41 e28f1f7a e28f0f7a eb001a3e e28f1f7b e28f0e1f eb001a3b e20610ff e28f0f7d eb001a38 e20620ff e3520001 a000002 e3520003 a000006 ea00000a e28f0e1e eb0019c9 e20710ff e28f0e1e eb001a2d ea000004 e28f0e1e eb0019c3 e20710ff e28f0f72 eb001a27 e59d0004 e20010ff e28f0e1d eb001a23 e59d0004 e20000ff e3500089 a000002 e35000c2 a000003 ea000004 e28f0e1a eb0019b3 ea000001 e28f0f6b eb0019b0 e208100f e28f0f6b eb001a14 e28f0f6d eb0019ab e28f0f71 eb0019a9 e28f0f73 eb0019a7 e28f0f75 eb0019a5 e28f0f78 eb0019a3 e28f0f7b eb0019a1 e5992000 e1a01009 e28f0e1f eb001a04 e5990000 e3700001 a0000a1 e28f0f7f eb001998 e5992004 e59f11f4 e28f0f7d eb0019fb e5990004 e3700001 a00009b e28f0f80 eb00198f e599200c e59f11fc e28f0f7f eb0019f2 e599000c e3700001 a000095 e28f0f6d eb001986 e28f0f80 eb001984 e28f0f83 eb001982 e3a00000 eb000689 e3500000 a00008e ea00008f 4c 706d756a a fc040000 6e654d0a 6c462075 4e4f2067 a 6f 64 65 72 d2030000 d6060000 2a2a2a0a 2a2a2a2a 2a2a2a2a 5246202a 54554d4f 54494c49 454d2059 5620554e 30207265 2037302e 2a2a2a2a 2a2a2a2a 2a2a2a2a a 7079545b 78253a65 20 4344 79646f42 2073253a 0 30302e30 0 69766552 6e6f6973 5d73253a a 4d41525b 2578303a 78 4d415328 474e5553 29 76655228 2578303a 292978 43494d28 294e4f52 0 4d4f5220 2578303a 78 43414d28 494e4f52 2958 462d4520 3a455355 78257830 a5d 78452e30 66207469 206d6f72 4d4f5246 6e654d20 a75 72452e31 20657361 74636553 a726f 72452e32 20657361 70696843 a 72452e33 20657361 6d726946 65724120 a61 72572e34 20657469 6d6f7266 72616320 a64 72572e35 20657469 6d6f7266 41524420 a4d 69462e36 20206d72 616c6620 78302067 78383025 25783020 20783830 0 a4e4f fc040004 6f422e37 2020746f 616c6620 78302067 78383025 25783020 20783830 0 a46464f 0 fc04000c 70552e38 65746144 616c6620 78302067 78383025 25783020 20783830 0 72432e39 65746165 6f6f4220 69442074 a6b73 78452e41 50206365 72676f72 66206d61 206d6f72 64726163 a e24f0064 eb0018f6 eaffff5c e24f0098 eb0018f3 eaffff62 e24f007c eb0018f0 eaffff68 e28f0f9b eb0018ed e28f0f9d eb0018eb e28f0f9f eb0018e9 e28f0fa1 eb0018e7 e28f0fa3 eb0018e5 e28f0fa5 eb0018e3 e28f3fa7 e28f2fa9 e28f1e2b e28f0fae eb001945 e28f1fb1 e28f0fb3 eb001942 e28f0fb5 eb0018d9 e5cda008 ea000001 eb0007f4 e5cd0008 e5dd0008 e3500000 afffffa e3a0000a e5cd0009 e5cda00a e28d0008 eb0018cd e5dd0008 e2400030 e350004b 308ff100 ea0000bd ea0000b7 ea000048 ea000049 ea00004a ea00004b ea00004c ea00004d ea00004f ea000051 ea000053 ea0000b2 ea0000b1 ea0000b0 ea0000af ea0000ae ea0000ad ea0000ac ea00004d ea00004f ea000051 ea000058 ea000059 ea00005a ea00005b ea00008e ea00008f ea000090 ea0000a1 ea0000a0 ea00009f ea00009e ea00009d ea00009c ea00009b ea00009a ea000089 ea000098 ea000089 ea00008a ea000095 ea00008a ea000093 ea00008b ea000091 ea000090 ea00008f ea00008e ea00008d ea00008c ea00002d ea00002f ea000031 ea000038 ea000039 ea00003a ea00003b ea00006e ea00006f ea000070 ea000081 ea000080 ea00007f ea00007e ea00007d ea00007c ea00007b ea00007a ea000069 ea000078 ea000069 ea00006a ea000075 ea00006a ea000073 ea00006b eb00032f ea000072 eb000318 ea000070 eb000301 ea00006e eb0002b2 ea00006c eb00025f ea00006a e3a00000 eb000163 ea000067 e3a00001 eb000160 ea000064 e3a00003 eb00015d ea000061 eb000736 ea00005f e3a00000 eb00022b ea00005c e28f0c01 eb000228 ea000059 e3a00000 eb000569 e3500000 a000001 eb0005a6 ea000053 eb00058c ea000051 eb0001eb ea00004f eb000181 ea00004d eb00016a ea00004b eb0007e2 ea000049 6f432e43 63656e6e 61632074 a6472 654d2e47 79726f6d 6d754420 a70 72572e49 20657469 61746144 a 69442e4a 74636572 6d754a20 a70 52532e53 4d204d4f a756e65 0 69462e55 75206d72 74616470 a65 48504943 422e5245 4e49 4f534552 45435255 4e49422e 0 544f4f42 4e49422e 0 73252e56 20732520 75207325 74616470 a65 42435242 2e444e49 4e4942 73252e5a 64707520 a657461 0 3e3e20 54474d49 2e545345 4e4942 eb000815 ea000015 eb0007ee ea000013 eb0000fb ea000011 eb0013b3 ea00000f eb000094 ea00000d eb000042 ea00000b e3a04000 e3a05001 ea000008 eb00001f ea000006 e28f002c eb00180d e3a04000 e3a05000 ea000001 e28f0020 eb001808 e3540000 1afffe26 eb0015b5 eb00054d e1a00005 eafffdd8 74697845 a2e 61766e69 2064696c 75706e69 a74 e3510075 a0027d7 e3510073 a002a42 e3b00000 e1a0f00e e1500001 1a000001 e1a00002 ea0017f2 e1a00003 ea0017f0 e92d401c e1a0000d eb000540 e3500000 1a000017 e3a00000 e58d0004 e59f4260 e59d0000 e28d3004 e1a02004 e28f1f95 eb000559 e3500000 1a00000d e59d2004 e3a03001 e1a01004 e3a0033f eb000396 e1a04000 e28f1f8b e28f0f8d eb00183f e28f3e23 e28f2f8f e3a01000 e1a00004 ebffffdc e8bd801c e92d41fc e3a04000 e1a0000d eb000521 e3500000 1a000035 e59f61ec e3a05c01 e3a07000 e58d7004 e59d0000 e28d3004 e1a02006 e28f1c02 eb000539 e3500000 a00002b e1a02005 e3a0133f e1a00006 eb00287a e59f51ec e3a08a15 e58d7004 e59d0000 e28d3004 e1a02005 e28f1f76 eb00052b e3500000 a000024 e59f11d8 e1a02008 e1a00005 eb00286c e59f51cc e3a08caf e58d7004 e59d0000 e28d3004 e1a02005 e28f1f6e eb00051d e3500000 a00001c e59f11b4 e1a02008 e1a00005 eb00285e e3540000 a000008 e3a03001 e3a02802 e1a01006 e3a0033f eb000354 e28f3f4e e28f2f51 e3a01000 ebffff9f e8bd81fc e59d0004 e2601c01 e2800101 e2800502 eb00289f e3a04001 eaffffd0 e59d0004 e2601a15 e0800005 eb002899 e3a04001 eaffffd8 e59d0004 e2601caf e0800005 eb002893 e3a04001 eaffffe0 e52de004 e24dd024 e3e01000 e3a00003 eb000465 eb00155a e3a00000 eb00153a e1a0100d e28d0004 eb00062a e3500005 308ff100 ea00001f ea000003 ea000009 ea00000d ea000011 ea000015 eb00151e eb0004b6 e59d1000 e28d0004 eb000696 e28dd024 e49df004 e3a00001 eband then0 0 0 0 1 494d4448 0 0 0 0 0 0 0 1 49445541 4f 0 0 0 0 0 0 1 20554349 726556 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 -1 }, fffffff0, 0, 40104ef4)
Read Address[0x000000-0x7FFF00]:0x2345
[EEPROM] CS = 0
[DIGIC6] at 0x40104584:40104FA4 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: Got READ (03h)
[EEPROM] Verbose: address is now: 0x002345
[EEPROM] Verbose: Sent 256 bytes
[EEPROM] CS = 1
[DIGIC6] at 0x401046E8:40104FA4 [0xD20B0D8C] <- 0xD0002 : SPI
5 6 7 8 9 A B C D E F 0 1 2 3 4
00002345 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002355 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002365 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002375 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002385 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002395 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000023A5 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000023B5 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000023C5 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000023D5 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000023E5 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000023F5 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002405 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002415 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002425 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00002435 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF What am I doing wrong?AUTOEXEC.BIN not found.
File not found.
[GPIO] at 0x00101CE4:00101EE8 [0xD20B0A24] <- 0xC0003 : Card LED
[DIGIC6] at 0x0010011C:00101EE8 [0xD203040C] <- 0x500 : MR (RAM manufacturer ID)
[DIGIC6] at 0x0010011C:00101EE8 [0xD203040C] <- 0x20500 : MR (RAM manufacturer ID)
[DIGIC6] at 0x0010011C:00101EE8 [0xD203040C] -> 0x3 : MR (RAM manufacturer ID)
[DIGIC6] at 0x0010011C:00101EE8 [0xD203040C] <- 0x600 : MR (RAM manufacturer ID)
[DIGIC6] at 0x0010011C:00101EE8 [0xD203040C] <- 0x20600 : MR (RAM manufacturer ID)
[DIGIC6] at 0x0010011C:00101EE8 [0xD203040C] -> 0x1 : MR (RAM manufacturer ID)
[FlashIF] at 0x00101648:00101B4C [0xC0000000] -> 0x0 : ???
[FlashIF] at 0x00101648:00101B4C [0xC0000000] <- 0x1000000 : ???
[FlashIF] at 0x00101648:00101B4C [0xC0000010] <- 0xD9C50000: 'Write enable' enabled
[ROM1:2] at 0x00101B4C:00101B4C [0xFC000AAA] <- 0xAA : ???
[ROM1:2] at 0x00101B4C:00101B4C [0xFC000554] <- 0x55 : ???
[ROM1:2] at 0x00101B4C:00101B4C [0xFC000AAA] <- 0x90 : ???
[ROM1:2] at 0x00101B4C:00101B4C [0xFC000000] <- 0xF0 : ???
[FlashIF] at 0x00101668:00101B80 [0xC0000010] <- 0x0 : 'Write enable' disabled
[DIGIC6] at 0x00100150:00101B80 [0xD6060000] -> 0x0 : E-FUSE
************ FROMUTILITY MENU Ver 0.07 ************
[Type:350 Body:DC Revision:0.00]
[RAM:0x3(MICRON)(Rev:0x1)) ROM:0x8 E-FUSE:0x0]
0.Exit from FROM Menu
1.Erase Sector
2.Erase Chip
3.Erase Firm Area
4.Write from card
5.Write from DRAM
6.Firm flag 0xFC040000 0x00000000 ON
7.Boot flag 0xFC040004 0xFFFFFFFF ON
8.UpDate flag 0xFC04000C 0xFFFFFFFF OFF
9.Create Boot Disk
A.Exec Program from card
G.Memory Dump
I.Write Data
J.Direct Jump
S.SROM Menu
U.Firm update
V.BOOT.BIN RESOURCE.BIN CIPHER.BIN update
Z.BRCBIND.BIN update
>>s
[DIGIC6] at 0x0010574C:0010087C [0xD2090008] -> 0x10004 : CLOCK_ENABLE
[DIGIC6] at 0x0010574C:0010087C [0xD2090008] <- 0x210004 : CLOCK_ENABLE
**** SROM(SIO2) Menu ****
0.Exit from SROM Menu
1.Erase Chip 0x00800000
2.Erase Block 0x00010000
3.Erase Sector 0x00001000
4.Write Data
5.Write from Card
6.SROM Dump(SIO Read)
7.SROM Dump(QUAD Read)
8.Get Info
>>6
Read Address[0x000000-0x7FFF00]:0x1234
[ :00104fa0 ] sf_read_sio(80000f10 { 3 0 12 34 -1 }, 80000b10, 100, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:00104FA4 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: Got READ (03h)
[EEPROM] Verbose: address is now: 0x001234
[EEPROM] Verbose: Sent 256 bytes
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:00104FA4 [0xD20B0D8C] <- 0xD0002 : SPI
4 5 6 7 8 9 A B C D E F 0 1 2 3
00001234 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001244 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001254 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001264 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001274 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001284 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001294 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000012A4 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000012B4 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000012C4 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000012D4 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000012E4 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
000012F4 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001304 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001314 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
00001324 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
**** SROM(SIO2) Menu ****
0.Exit from SROM Menu
1.Erase Chip 0x00800000
2.Erase Block 0x00010000
3.Erase Sector 0x00001000
4.Write Data
5.Write from Card
6.SROM Dump(SIO Read)
7.SROM Dump(QUAD Read)
8.Get Info
>>8
[ :001056bc ] sf_read_sio(80000f3c { 3 0 0 0 -1 }, 80000f0c, c, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:001056C0 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: Got READ (03h)
[EEPROM] Verbose: address is now: 0x000000
[EEPROM] Verbose: Sent 12 bytes
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:001056C0 [0xD20B0D8C] <- 0xD0002 : SPI
0x80000325
**** SROM(SIO2) Menu ****
0.Exit from SROM Menu
1.Erase Chip 0x00800000
2.Erase Block 0x00010000
3.Erase Sector 0x00001000
4.Write Data
5.Write from Card
6.SROM Dump(SIO Read)
7.SROM Dump(QUAD Read)
8.Get Info
>>7
Read Addr[0x000000-0x7FFF00]:0x1234
Read Size[0x4-0x800000]:0x100
[ :00105194 ] sf_read_sio(80000ee8 { 9f -1 }, 80000edc, 3, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:00105198 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: Got RDID
[EEPROM] Verbose: READ in RDID = C2h
[EEPROM] Verbose: READ in RDID = 10h
[EEPROM] Verbose: READ in RDID = 0Ch
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:00105198 [0xD20B0D8C] <- 0xD0002 : SPI
MID=0xC2
[ :0010473c ] sf_read_sio(80000ebc { 6 -1 }, 0, 0, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:00104740 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: Set Write Enable Latch
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:00104740 [0xD20B0D8C] <- 0xD0002 : SPI
[ :00104768 ] sf_read_sio(80000ebc { 5 -1 }, 80000eb4, 1, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:0010476C [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: [SR] >> 0x2
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:0010476C [0xD20B0D8C] <- 0xD0002 : SPI
[ :001047b4 ] sf_read_sio(80000ee8 { 1 40 -1 }, 0, 0, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:001047B8 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: [SR] << ...
[EEPROM] Verbose: [SR] << 0x40
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:001047B8 [0xD20B0D8C] <- 0xD0002 : SPI
[ :001047d8 ] sf_read_sio(80000ebc { 5 -1 }, 80000eb4, 1, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:001047DC [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: [SR] >> 0x40
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:001047DC [0xD20B0D8C] <- 0xD0002 : SPI
[ :0010482c ] sf_read_sio(80000ebc { 4 -1 }, 0, 0, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:00104830 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: Reset Write Enable Latch
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:00104830 [0xD20B0D8C] <- 0xD0002 : SPI
[ :00104850 ] sf_read_sio(80000ebc { 5 -1 }, 80000eb4, 1, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:00104854 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: [SR] >> 0x40
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:00104854 [0xD20B0D8C] <- 0xD0002 : SPI
[EEPROM] CS = 0
[DIGIC6] at 0x001052E0:00104854 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: Got QOFR (6Bh)
[EEPROM] Verbose: address is now: 0x001234
[DIGIC6] at 0x00105330:00105330 [0xD20B0D80] <- 0xA0005 : ???
[DIGIC6] at 0x00105330:00105330 [0xD20B0D84] <- 0xA0005 : ???
[DIGIC6] at 0x00105330:00105330 [0xD20B0D88] <- 0xA0005 : ???
[DIGIC6] at 0x00105330:00105330 [0xD20B0A14] <- 0xF : ???
[DIGIC6] at 0x00105330:00105330 [0xD20B0A10] <- 0xF : ???
[DIGIC6] at 0x00105330:00105330 [0xD20B0A0C] <- 0xF : ???
[DIGIC6] at 0x00105330:00105330 [0xD20B0A08] <- 0xF : ???
[DIGIC6] at 0x00105330:00105330 [0xD20B0A04] <- 0xF : ???
[DIGIC6] at 0x00105330:00105330 [0xD20B0A00] <- 0xF : ???
[DIGIC6] at 0x00105330:00105330 [0xD209065C] <- 0x1 : ???
[SFIO] at 0x0010537C:0010537C [0xC8070004] <- 0x1 : ???
[SFIO] at 0x0010537C:0010537C [0xC8070090] <- 0xFFBFFFF9: ???
[SFIO] at 0x0010537C:0010537C [0xC8070000] <- 0x0 : ???
[SFIO] at 0x0010537C:0010537C [0xC8070018] <- 0xFF : init?
[SFIO] at 0x0010537C:0010537C [0xC807001C] <- 0x0 : ???
[SFIO] at 0x0010537C:0010537C [0xC807002C] <- 0x80002701: response setup?
[SFIO] at 0x0010537C:0010537C [0xC8070030] <- 0x0 : ???
[SFIO] at 0x0010537C:0010537C [0xC8070070] <- 0xFFFF : transfer status?
[SFIO] at 0x0010537C:0010537C [0xC8070058] <- 0x3 : bus width
[SFIO] at 0x0010537C:0010537C [0xC8070064] <- 0x610103 : bus width
[SFIO] at 0x0010537C:0010537C [0xC8070074] <- 0x0 : ???
[SFIO] at 0x0010537C:0010537C [0xC8070078] <- 0xFF : ???
[SFIO] at 0x0010537C:0010537C [0xC80700D0] <- 0x11040606: ???
[SFIO] at 0x001053DC:0010537C [0xC8070068] <- 0x100 : read block size
[SFIO] at 0x00105400:001053F4 [0xC807007C] <- 0x1 : transfer block count
[SFIO] at 0x0010540C:001053F4 [0xC8070010] <- 0x0 : Status
[SFIO] at 0x0010540C:001053F4 [0xC8070048] <- 0xFFFFFFFF: ???
[SFIO] at 0x0010540C:001053F4 [0xC807004C] <- 0xFFFFFF : ???
[SFIO] at 0x0010540C:001053F4 [0xC8070050] <- 0xFFFFFFFF: ???
[SFIO] at 0x0010540C:001053F4 [0xC8070054] <- 0xFFFFFF : ???
[SFIO] at 0x0010540C:001053F4 [0xC8070008] <- 0xF1 : DMA
[*unk*] at 0x00105448:001053F4 [0xC8030000] <- 0x40800000: ???
[*unk*] at 0x00105448:001053F4 [0xC8030004] <- 0x100 : ???
[*unk*] at 0x00105448:001053F4 [0xC8030014] <- 0x0 : ???
[*unk*] at 0x00105448:001053F4 [0xC8030018] <- 0x3 : ???
[*unk*] at 0x00105448:001053F4 [0xC8030010] <- 0x39 : ???
[DIGIC6] at 0x00105448:001053F4 [0xD20B0A14] <- 0xC0003 : ???
[DIGIC6] at 0x00105448:001053F4 [0xD20B0A10] <- 0xA0005 : ???
[DIGIC6] at 0x001050D0:00105478 [0xD2090630] <- 0x0 : ???
[DIGIC6] at 0x001050D0:00105478 [0xD2090640] <- 0x104 : ???
[DIGIC6] at 0x001050D0:00105478 [0xD2090644] <- 0x1D000002: ???
[DIGIC6] at 0x001050D0:00105478 [0xD2090648] <- 0x0 : ???
[DIGIC6] at 0x001050D0:00105478 [0xD2090654] <- 0x403 : ???
[DIGIC6] at 0x001050D0:00105478 [0xD2090658] <- 0x403 : ???
[DIGIC6] at 0x001050D0:00105478 [0xD209064C] <- 0x302 : ???
[DIGIC6] at 0x001050D0:00105478 [0xD2090650] <- 0x403 : ???
[DIGIC6] at 0x001050D0:00105478 [0xD2090634] <- 0x3 : ???
[DIGIC6] at 0x0010511C:0010511C [0xD2090638] <- 0x1 : ???
[DIGIC6] at 0x0010511C:0010511C [0xD209063C] <- 0x1 : ???
[SFIO] at 0x00105478:0010511C [0xC8070024] <- 0x5100 : cmd_hi
[SFIO] at 0x00105478:0010511C [0xC8070020] <- 0x1 : cmd_lo
[SFIO] at 0x00105478:0010511C [0xC8070028] <- 0x30 : Response size (bits)
[SFIO] at 0x00105478:0010511C [0xC807002C] <- 0x80002701: response setup?
[SFIO] at 0x00105478:0010511C [0xC8070010] <- 0x0 : Status
[SFIO] sdio_send_command (UNHANDLED)
[SFIO] at 0x00105478:0010511C [0xC807000C] <- 0x14 : Command flags?
[DIGIC6] at 0x0010512C:001054AC [0xD209063C] <- 0x0 : ???
[DIGIC6] at 0x00105144:00105144 [0xD2090638] <- 0x80000000: ???
[DIGIC6] at 0x001054B4:001054B4 [0xD20B0A14] <- 0xF : ???
[DIGIC6] at 0x001050D0:001054C0 [0xD2090630] <- 0x0 : ???
[DIGIC6] at 0x001050D0:001054C0 [0xD2090640] <- 0x104 : ???
[DIGIC6] at 0x001050D0:001054C0 [0xD2090644] <- 0x1D000002: ???
[DIGIC6] at 0x001050D0:001054C0 [0xD2090648] <- 0x0 : ???
[DIGIC6] at 0x001050D0:001054C0 [0xD2090654] <- 0x403 : ???
[DIGIC6] at 0x001050D0:001054C0 [0xD2090658] <- 0x403 : ???
[DIGIC6] at 0x001050D0:001054C0 [0xD209064C] <- 0x302 : ???
[DIGIC6] at 0x001050D0:001054C0 [0xD2090650] <- 0x403 : ???
[DIGIC6] at 0x001050D0:001054C0 [0xD2090634] <- 0x3 : ???
[DIGIC6] at 0x0010511C:0010511C [0xD2090638] <- 0x1 : ???
[DIGIC6] at 0x0010511C:0010511C [0xD209063C] <- 0x1 : ???
[*unk*] at 0x00105558:0010511C [0xC8030010] -> 0x0 : ???
[SFIO] at 0x00105584:0010511C [0xC8070010] -> 0x200001 : Status
[SFIO] at 0x001055AC:0010511C [0xC8070008] <- 0x0 : DMA
[DIGIC6] at 0x0010512C:001055B4 [0xD209063C] <- 0x0 : ???
[DIGIC6] at 0x00105144:00105144 [0xD2090638] <- 0x80000000: ???
[DIGIC6] at 0x001055B4:00105144 [0xD209065C] <- 0x0 : ???
[EEPROM] CS = 1
[DIGIC6] at 0x001055B4:00105144 [0xD20B0D8C] <- 0xD0002 : SPI
[DIGIC6] at 0x001055B4:00105144 [0xD20B0D80] <- 0xF : ???
[DIGIC6] at 0x001055B4:00105144 [0xD20B0D84] <- 0xF : ???
[DIGIC6] at 0x001055B4:00105144 [0xD20B0D88] <- 0xF : ???
[DIGIC6] at 0x001055B4:00105144 [0xD20B0A14] <- 0xA0005 : ???
[DIGIC6] at 0x001055B4:00105144 [0xD20B0A0C] <- 0xA0005 : ???
[DIGIC6] at 0x001055B4:00105144 [0xD20B0A08] <- 0xA0005 : ???
[DIGIC6] at 0x001055B4:00105144 [0xD20B0A04] <- 0xA0005 : ???
[DIGIC6] at 0x001055B4:00105144 [0xD20B0A00] <- 0xA0005 : ???
0 1 2 3 4 5 6 7 8 9 A B C D E F
40800000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
40800090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
408000A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
408000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
408000C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
408000D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
408000E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
408000F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
**** SROM(SIO2) Menu ****
0.Exit from SROM Menu
1.Erase Chip 0x00800000
2.Erase Block 0x00010000
3.Erase Sector 0x00001000
4.Write Data
5.Write from Card
6.SROM Dump(SIO Read)
7.SROM Dump(QUAD Read)
8.Get Info
b *0x104588
command
silent
print_current_location
printf "sf_read_sio(%x { ", $r0
set $addr = $r0
while *(int*)$addr != -1
printf "%x ", *(int*)$addr
set $addr = $addr + 4
end
printf "-1 }, %x, %x, %x)\n", $r1, $r2, $r3
c
endI have output like this>>6
Read Address[0x000000-0x7FFF00]:0x10000
[ :00104fa0 ] sf_read_sio(80000f10 { 3 1 0 0 -1 }, 80000b10, 100, 1)
[EEPROM] CS = 0
[DIGIC6] at 0x00104588:00104FA4 [0xD20B0D8C] <- 0xC0003 : SPI
[EEPROM] Verbose: Got READ (03h)
[EEPROM] Verbose: address is now: 0x010000
[EEPROM] Verbose: Sent 256 bytes
[EEPROM] CS = 1
[DIGIC6] at 0x001046E8:00104FA4 [0xD20B0D8C] <- 0xD0002 : SPI
0 1 2 3 4 5 6 7 8 9 A B C D E F
00010000 0F FF F0 00 00 00 01 20 00 00 00 00 18 CB C1 20
00010010 00 00 00 00 0F 00 20 00 00 00 00 00 10 C0 00 00
00010020 0F FF FF FF F0 10 00 00 10 C0 00 00 0F EA FD CB
00010030 A0 80 00 00 11 80 00 00 00 00 00 00 00 00 00 00
00010040 00 00 00 00 00 00 00 00 00 20 00 00 11 80 00 00
00010050 04 64 13 23 33 23 23 33 03 60 00 00 00 00 00 00
00010060 00 30 00 00 10 C0 00 00 00 41 00 00 00 40 00 00
00010070 10 C0 00 00 0E 40 C0 00 00 60 00 00 11 00 00 00
00010080 05 D0 00 00 08 F1 02 1D 80 70 00 00 11 00 00 00
00010090 04 94 D4 75 F0 00 00 00 00 90 00 00 10 C0 00 00
000100A0 00 00 00 00 00 A0 00 00 10 C0 00 00 00 00 00 00
000100B0 00 B0 00 00 11 00 00 00 00 00 00 00 00 00 00 00
000100C0 00 C0 00 00 11 C0 00 00 00 77 41 9B FD 64 35 76
000100D0 F9 C4 26 39 E7 26 88 EC 3B FF 24 7C 51 10 00 00
000100E0 1D 00 10 00 00 00 00 00 00 90 00 04 00 00 00 00
000100F0 02 80 00 00 0B 48 69 C0 00 00 00 00 01 A0 10 00 which means logging hook is alive, right?static int (*sf_command_sio)(uint32_t command[], void * out_buffer, int out_buffer_size, int toggle_cs) = (void*) 0x104588;
char buffer[0x100];
int addr = 0x10000;
sf_command_sio((uint32_t[]) {3, (addr >> 16) & 0xFF, (addr >> 8) & 0xFF, addr & 0xFF, -1}, buffer, sizeof(buffer), 1);emulation (./run_canon_fw.sh 80D,firmware="boot=1" -d io,sflash) ends with03C30000: Palette[E] -> R195 G195 B195
03EB0000: Palette[F] -> R235 G235 B235
[DIGIC6] at 0x40800C38:40804598 [0xD20139A0] <- 0x1 : Bootloader palette confirm
[DIGIC6] at 0x40800A30:40800A04 [0xD2030108] <- 0x440000 : BMP VRAM
[ROM1:4] at 0x00104588:408002F4 [0xFC040D8C] <- 0x104588 : ???
[EEPROM] Verbose: Got READ (03h)
[EEPROM] Verbose: address is now: 0x010000
[ROM1:4] at 0x001046E8:408002F4 [0xFC040D8C] <- 0xD0002 : ???int addr = 0x10000;
matches:[EEPROM] Verbose: address is now: 0x010000
[ROM1:4] at 0x00104588:408002F4 [0xFC040D8C] <- 0x104588 : ???
[ :00104fa0 ] sf_read_sio(80000f10 { 3 0 12 34 -1 }, 80000b10, 100, 1)
[ :001056bc ] sf_read_sio(80000f3c { 3 0 0 0 -1 }, 80000f0c, c, 1)
[ :0010473c ] sf_read_sio(80000ebc { 6 -1 }, 0, 0, 1)
...
BL sub_10456C
init_boot_file_io_stubs();
/* are we calling the right stubs? */
if (!boot_open_write)
{
print_line(COLOR_RED, 2, " - Boot file write stub not set.\n");
fail();
}
if (MEM(boot_open_write) != 0xe92d47f0)
{
print_line(COLOR_RED, 2, " - Boot file write stub incorrect.\n");
printf(" - Address: %X Value: %X\n", boot_open_write, MEM(boot_open_write));
fail();
}
if (!boot_card_init)
{
print_line(COLOR_YELLOW, 2, " - Card init stub not found.\n");
}
if ((((uint32_t)boot_open_write & 0xF0000000) == 0xF0000000) ||
(((uint32_t)boot_card_init & 0xF0000000) == 0xF0000000))
{
print_line(COLOR_YELLOW, 2, " - Boot file I/O stubs called from ROM.");
}
if (boot_card_init)
{
/* not all cameras need this, but some do */
printf(" - Init SD... (%X)\n", boot_card_init);
boot_card_init();
}
47b4da39f459c4a6d14a2458fa0ab8d2671b6402 /media/sombre/EOS_DIGITAL/SFDATA.BIN
955714c9ea9d60045ff57325ddf3b6a825a2d0b2 /home/sombre/Documents/temp2/qemu/80D/SFDATA.BIN
3b4417fc421cee30a9ad0fd9319220a8dae32da2 /home/sombre/Documents/temp2/qemu/80D/SFDATA.BIN
3b4417fc421cee30a9ad0fd9319220a8dae32da2 /media/sombre/EOS_DIGITAL/SFDATA.BIN
static void sf_read(uint32_t addr, uint8_t * buf, int size)
{
static uint32_t teaspoon[0x100];
for (int i = 0; i < size; i++)
{
if (i % COUNT(teaspoon) == 0)
{
uint32_t a = addr + i;
sf_command_sio((uint32_t[]) {3, (a >> 16) & 0xFF, (a >> 8) & 0xFF, a & 0xFF, -1}, teaspoon, COUNT(teaspoon), 1);
}
buf[i] = teaspoon[i % COUNT(teaspoon)];
}
}
./run_canon_fw.sh 80D,firmware="boot=1" -d io,sflash
AUTOEXEC.BIN not found.
File not found.
(some I/O activity, unlikely to be any of these)
S.SROM Menu
>>s
[DIGIC6] at 0x0010575C:0010087C [0xD2090008] -> 0x10004 : CLOCK_ENABLE
[DIGIC6] at 0x00105764:0010087C [0xD2090008] <- 0x210004 : CLOCK_ENABLE
**** SROM(SIO2) Menu ****
...
>>0
Exit
[DIGIC6] at 0x00105804:0010690C [0xD2090008] <- 0x10004 : CLOCK_ENABLE
*(volatile uint32_t *)0xD2090008 |= 0x200000;
[DIGIC6] at 0xFE020400:FE02013C [0xD2090008] -> 0x0 : CLOCK_ENABLE
[DIGIC6] at 0xFE020400:FE02013C [0xD2090008] <- 0x10004 : CLOCK_ENABLE
*(volatile uint32_t *)0xD2090008 |= 0x200000;
void (*srom_init_maybe)(void) = (void *) 0x105710;
srom_init_maybe();
[DIGIC6] at 0x0010575C:0010087C [0xD2090008] -> 0x10004 : CLOCK_ENABLE
[DIGIC6] at 0x00105764:0010087C [0xD2090008] <- 0x210004 : CLOCK_ENABLE
[SIO2-SF] at 0x0010572C:0010576C [0xC0820208] <- 0x1 : ???
[SIO2-SF] at 0x00105734:0010576C [0xC0820200] <- 0x0 : ???
[SIO2-SF] at 0x00105738:0010576C [0xC0820210] <- 0x0 : write mode?
[SIO2-SF] at 0x0010573C:0010576C [0xC0820214] <- 0x0 : ???
[SIO2-SF] at 0x00105744:0010576C [0xC0820238] <- 0xA00408 : mode
**** SROM(SIO2) Menu ****
0.Exit from SROM Menu
1.Erase Chip 0x00800000
2.Erase Block 0x00010000
3.Erase Sector 0x00001000
4.Write Data
5.Write from Card
6.SROM Dump(SIO Read)
7.SROM Dump(QUAD Read)
8.Get Info
>>8
[ :001056bc ] sf_read_sio(80000f3c { 3 0 0 0 -1 }, 80000f0c, c, 1)
0x80000350
0x80000350 is CanonModelID for 80D :D
selfishly, all I need is Focus Peaking for video!
;D
why the buffer in mpu_recv_log() is updated by mpu_recv() after the buffer is already decoded?
Shouldn't it be updated in advance to log the current msg?
And is there a reason why the argument "size" of mpu_recv_log() is not used, but the [-1]-Hack to get the size, although at [ 0 ] is always the encoded size, or is this not always the case?
I didn't look into it yet, so can't give many hints right now, but I'm pretty sure the image buffers should be somewhere in RAM, and CHDK folks already documented the image format.
eos_load_image(s, "RAM4.BIN", 0, s->model->ram_size, s->model->caching_bit, 0);
s->disp.bmp_vram = 0x41901800 + (30 * 960 + 120) * 2;
s->disp.bmp_pitch = 960 * 2;
msleep(5000);
call("Release");
80D: 7130: 11240.552 [CAPE] VSizeSetting Time:91 Acc:3181 loop:1
5D3: 13.715.002 ShootCaptu:ff213688:92:05: VSizeSetting Time:21 Acc:636 loop:1
239065: 35638.106 [CAPD] [0](0xd0006014),(0x617)
dump_file("RAM4-BF.BIN", 0x40000000, 0x40000000);
call("sht_mirror"); // will create MIRROR.txt
msleep(1000);
call("lv_save_raw", 1);
msleep(1000);
dump_file("RAM4-AF.BIN", 0x40000000, 0x40000000);
call("sht_mirror"); // will append to MIRROR.txt
binwalk -E -J RAM4-BF.BIN
binwalk -E -J RAM4-AF.BIN
dd if=RAM4-AF.BIN of=raw.data bs=$((0x1000)) skip=$((0x27066)) count=$((0x413))
python rawcover.py raw.data
...
Possible RAW Bayer data found
Estimated frame width: 2480 <-- likely incorrect
So, realistically what are the chances of getting 4k?
Never say never and always avoid always because all generalizations are false.
Seriously, there has been some progress made on other cameras including the 700D and 5D2 that might get them closer to 4K. It seems to indicate that all these Canon DSLR's could possibly do 4k.
For the 80D it is a little too early to say because ML isn't far enough along on that camera yet.
Right, unless someone figures out how to do mjpeg which isn't totally out of the question.
2096 x 676 (timer A = 722, B = 342, 109.345 FPS) @ feb47d48
2096 x 1162 (timer A = 722, B = 585, 63.925 FPS) @ ff01d1c0
2096 x 1372 (timer A = 722, B = 690, 54.197 FPS) @ ff01d250
2144 x 2402 (timer A = 722, B = 1205, 31.034 FPS) @ ff01d2e0
6288 x 4057 (timer A = 772, B = 4061, 8.612 FPS) @ feb47c28
6288 x 4057 (timer A = 1064, B = 4061, 6.249 FPS) @ feb47cb8
ROM:FF01D1C0 DCD 0xD0006800
ROM:FF01D1C4 DCD 0x3000E
ROM:FF01D1C8 DCD 0xD0006804
ROM:FF01D1CC DCD 0x248021A
D0006800: 0x3000E
D0006804: 0x248021A
D0006804: 2096 x 1162
D0006800: 0x3000E
D0006804: 0xFDB0320
D0006804: 6288 x 4057
| Approximate Speed | : | Shooting Conditions |
| Approx. 7 shots/sec. | : | during High-speed continuous shooting |
| Max. approx. 5.0 shots/sec | : | during Live View shooting or when [Servo AF] is set. |
| Approx. 3 shots/sec. | : | Low-speed continuous shooting Silent continuous shooting |
29061: 11306.683 [CAPE] E-7.2 SetSsgVSize for Readout
29062: 11306.692 [CAPE] VSIZE(0xfdd)
29063: 11306.705 [CAPD] [0](0xd0006008),(0x3030303)
29064: 11306.717 [CAPD] [1](0xd000600c),(0x3030303)
29065: 11306.728 [CAPD] [2](0xd0006010),(0x303)
29066: 11306.739 [CAPD] [3](0xd0006014),(0xfdd)
My 80D no longer wants to Play with ML. Any SD card with a BootLoader
or Rescue autoexec on it will cause the 80d to go Dark > No signs of Life.
With "Normal" SD it works just fine.
@ Sombree
Same 1 I Always Use > MacBoot ~
@alex how is it coming with the 80D?
I have a brand new one and might help if you need it.
How can I help sir? I have an 80d and maybe can run some tests.
Dump#1/ROM1A.BIN 0e103ef26d93d3ba7f03d5141a3f351c
Dump#1/ROM1B.BIN 0e103ef26d93d3ba7f03d5141a3f351c
iMac-27:~ $
Dump#2/ROM1A.BIN d9bfe2012acae3af0ad7cb77b751d067
Dump#2/ROM1B.BIN d9bfe2012acae3af0ad7cb77b751d067
iMac-27:~ $
Dump#3/ROM1A.BIN 59b7f7756bb6deb90e67c1e4bd0ec167
Dump#3/ROM1B.BIN 59b7f7756bb6deb90e67c1e4bd0ec167iMac-27:~ $ diskutil list
/dev/disk0 (internal):
:
/dev/disk4 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: FDisk_partition_scheme *2.0 GB disk4
1: DOS_FAT_16 EOS_DIGITAL 2.0 GB disk4s1
iMac-27:~ $ diskutil unmountDisk /dev/disk4
Unmount of all volumes on disk4 was successful
iMac-27:~ $ sudo dd if=/Users/xxxx/Desktop/sd.img of=/dev/disk4
Password:
506880+0 records in
506880+0 records out
259522560 bytes transferred in 128.059448 secs (2026579 bytes/sec)
iMac-27:~ $ sudo diskutil eject /dev/rdisk4
Disk /dev/rdisk4 ejected
iMac-27:~ $ diskutil list
/dev/disk4 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: FDisk_partition_scheme *2.0 GB disk4
1: DOS_FAT_16 EOS_DIGITAL 259.5 MB disk4s1
So far, what worked every single time was formatting the card at a much lower capacity (I've used 256MB successfully in many cases). To do this, you can write the SD image that comes with QEMU (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/sd.img.xz) to your SD or CF card. This guide (https://thepihut.com/blogs/raspberry-pi-tutorials/17789160-backing-up-and-restoring-your-raspberry-pis-sd-card) is helpful; just don't forget to unzip the SD image. This image contains the portable display test (http://www.magiclantern.fm/forum/index.php?topic=14732) and is bootable (so, you can test it in the camera straight away).
0fec9480 db "\n********** FACTORY ADJUSTMENT MENU **********\n", 0 ; DATA XREF=sub_fec9368+20
0fec94b0 db "0. Exit from Factory Adjustment\n", 0 ; DATA XREF=sub_fec9368+28
0fec94d4 db "1. Leak Check\n", 0 ; DATA XREF=sub_fec9368+36
0fec94e4 db "2. ASV Display\n", 0 ; DATA XREF=sub_fec9368+44
0fec94f4 db "3. RAM Check\n", 0 ; DATA XREF=sub_fec9368+52
0fec9504 db "4. ROM Check\n", 0 ; DATA XREF=sub_fec9368+60
0fec9514 db "5. ICU Version Check\n", 0 ; DATA XREF=sub_fec9368+68
0fec952c db "6. Serial Flash Check\n", 0 ; DATA XREF=sub_fec9368+76
0fec9544 db "9. Input Device Unique\n", 0 ; DATA XREF=sub_fec9368+84
0fec955c db "A. ALL Check\n", 0 ; DATA XREF=sub_fec9368+92
0fec956c db "B. Adjustment Data Display and Change\n", 0 ; DATA XREF=sub_fec9368+100
0fec9594 db "C. Check Flag Display and Initialization\n", 0 ; DATA XREF=sub_fec9368+108
0fec95d0 db "E. HDMI Check\n", 0 ; DATA XREF=sub_fec9368+124
0fec95e0 db "F. AUDIO Check\n", 0 ; DATA XREF=sub_fec9368+132
UPDATE: No wonder that my SFDATA.BIN is different. Just 8.4MB of 0x00's!
Have attempted to use " This guide " >
https://thepihut.com/blogs/raspberry-pi-tutorials/17789160-backing-up-and-restoring-your-raspberry-pis-sd-card
with no success ~
# all EOS models should run this without any trickery
/path/to/qemu-eos$ ./run_canon_fw.sh 60D,firmware="boot=1"No such file or directory
Guide: https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/ (README)
Video: this sticky tweet (https://twitter.com/autoexec_bin/status/913530810686418944) and the same for Mac (http://www.magiclantern.fm/forum/index.php?topic=16012.msg191686#msg191686). GUI not working yet on D6.
*** Setting up QEMU in /Users/dan/qemu-eos...AMFI: allowing exception handler for 'bash' (13379) because the handler was set by master-entitled process 'init' (1).EDIT: Hold on, working:
0K ........ ........ ........ 100% 2.61M=9.3s
Initialized empty Git repository in /Users/dan/qemu-eos/qemu-2.5.0/.git/Now compiling...dans-MacBook-Pro:qemu-eos dan$ ./run_canon_fw.sh 100D,firmware=boot=1DebugMsg=0x4A74 (from GDB script)
Lockdown read 0
Lockdown read 0
Lockdown read 1
Lockdown read 1
Lockdown read 2
Lockdown read 2
Lockdown read 3
Lockdown read 3
Lockdown read 4
Lockdown read 4
00000000 - 00000FFF: eos.tcm_code
40000000 - 40000FFF: eos.tcm_data
00001000 - 0FFFFFFF: eos.ram
40001000 - 4FFFFFFF: eos.ram_uncached
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror
F2000000 - F2FFFFFF: eos.rom0_mirror
F3000000 - F3FFFFFF: eos.rom0_mirror
F4000000 - F4FFFFFF: eos.rom0_mirror
F5000000 - F5FFFFFF: eos.rom0_mirror
F6000000 - F6FFFFFF: eos.rom0_mirror
F7000000 - F7FFFFFF: eos.rom0_mirror
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
C0000000 - DFFFFFFF: eos.mmio
[EOS] loading './100D/ROM0.BIN' to 0xF0000000-0xF0FFFFFF
[EOS] loading './100D/ROM1.BIN' to 0xF8000000-0xF8FFFFFF
Could not open ./100D/SFDATA.BINCould not open ./100D/SFDATA.BINSo, sf_dump module needed..../run_canon_fw.sh 100D,firmware=boot=1
(
> sleep 3; echo "akashimorino";
> sleep 1; echo "dumpf";
> ) | (
> ./run_canon_fw.sh 80D -serial stdio -s -S &
> arm-none-eabi-gdb -x 80D/patches.gdb
> )
-bash: arm-none-eabi-gdb: command not found
iMac-27:qemu-eos $ qemu-system-arm 25643 12u REG 1,10 259522560 8133999 sd.img
Error: please unmount the SD image.
dans-MacBook-Pro:qemu-eos dan$Now let´s run this:dans-MacBook-Pro:qemu-eos dan$ ./run_canon_fw.sh 100D,firmware=boot=1@a1ex
Trying some older stuff:Code: [Select](
> sleep 3; echo "akashimorino";
> sleep 1; echo "dumpf";
> ) | (
> ./run_canon_fw.sh 80D -serial stdio -s -S &
> arm-none-eabi-gdb -x 80D/patches.gdb
> )
-bash: arm-none-eabi-gdb: command not found
iMac-27:qemu-eos $ qemu-system-arm 25643 12u REG 1,10 259522560 8133999 sd.img
Error: please unmount the SD image.
export PATH=~/gcc-arm-none-eabi-whatever/bin:$PATH
cd ~
echo 'export PATH=~/gcc-arm-none-eabi-5_4-2016q3/bin:$PATH' >> .profile
source .profile
cd magic-lantern
hg update qemu -C
cd contrib/qemu/
./install.shLast login: Thu May 31 10:14:30 on ttys001
dans-MacBook-Pro:~ dan$ arm-none-eabi-gdb
GNU gdb (GNU Tools for Arm Embedded Processors 7-2017-q4-major) 8.0.50.20171128-git cd ~
if ! grep 'export PATH=~/gcc-arm-none-eabi-5_4-2016q3/bin:$PATH' <<< $(cat .bash_profile)
then
echo 'export PATH=~/gcc-arm-none-eabi-5_4-2016q3/bin:$PATH' >> .bash_profile
fi
source .bash_profile
cd magic-lantern
hg update qemu -C
cd contrib/qemu/
./install.sh
./run_canon_fw.sh 80D,firmware="boot=0" -d debugmsg 2>&1 | grep -E --text Notify.*Cur
[ init:fe0dc20d ] (00:03) [SEQ] NotifyComplete (Cur = 0, 0x2018000, Flag = 0x10000)
[ SFRead:fe0dc20d ] (00:03) [SEQ] NotifyComplete (Cur = 0, 0x2008000, Flag = 0x8000)
[ RomRead:fe0dc20d ] (00:03) [SEQ] NotifyComplete (Cur = 0, 0x2000000, Flag = 0x2000000)
[ PowerMgr:fe0dc20d ] (00:03) [SEQ] NotifyComplete (Cur = 1, 0x2, Flag = 0x2)
[ Startup:fe0dc20d ] (00:03) [SEQ] NotifyComplete (Cur = 2, 0x20420010, Flag = 0x20000000)
[ FileMgr:fe0dc20d ] (00:03) [SEQ] NotifyComplete (Cur = 2, 0x420010, Flag = 0x10)
[ FileMgr:fe0dc20d ] (00:03) [SEQ] NotifyComplete (Cur = 2, 0x420000, Flag = 0x400000)-bash: syntax error near unexpected token `&'
gcc --version
Configured with: --prefix=/Applications/Xcode.app/Contents/Developer/usr --with-gxx-include-dir=/usr/include/c++/4.2.1
Apple LLVM version 8.1.0 (clang-802.0.38)
Target: x86_64-apple-darwin16.4.0
Thread model: posix
InstalledDir: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin cd ~
#check for native gcc version(if less than version 8 use ongoing version)
gcc=$(echo $(gcc --version | tail -n +1 | head -1 | cut -d ' ' -f4 | cut -d '.' -f1))
if (( $gcc > 8))
then
if ! grep 'export PATH=~/gcc-arm-none-eabi-5_4-2016q3/bin:$PATH' <<< $(cat .bash_profile)
then
echo 'export PATH=~/gcc-arm-none-eabi-5_4-2016q3/bin:$PATH' >> .bash_profile
source .bash_profile
fi
fi
cd magic-lantern
hg update qemu -C
cd contrib/qemu/
./install.sh
gcc --version
Configured with: --prefix=/Library/Developer/CommandLineTools/usr --with-gxx-include-dir=/usr/include/c++/4.2.1
Apple LLVM version 9.1.0 (clang-902.0.39.2)
Target: x86_64-apple-darwin17.5.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin$ bash --version
3.2.57(1)-release
brew install bash
sudo chsh -s /usr/local/bin/bash
bash --version
GNU bash, versie 4.4.19(1)-release (x86_64-apple-darwin17.3.0)
Copyright (C) 2016 Free Software Foundation, Inc.-bash: syntax error near unexpected token `&'./run_canon_fw.sh 80D,firmware="boot=0" -d debugmsg | grep -E --text Notify.*Cur
...
[DM] FROM Write Complete!!!
[ DbgMgr:fe5336b5 ] (00:01) [PM] Enable (ID = 18, cnt = 0/2)@Danne: you don't need to run native GDB (that's used to debug host programs; in your case, Mac programs). You need to run arm-none-eabi-gdb. Version 8.0.50.20171008-git is known not to work (https://www.magiclantern.fm/forum/index.php?topic=2864.msg200882#msg200882), version 8.1 is known to work (https://www.magiclantern.fm/forum/index.php?topic=2864.msg200989#msg200989). I did not test intermediate versions.Ok, thanks.
There is a reason why the user has to type that PATH command. A subshell cannot change environment variables of the parent shell. Don't hide it.
No idea what to do about terminal lock-ups (aka problems from 1998 (https://www.magiclantern.fm/forum/index.php?topic=2864.msg201023#msg201023)). Run Linux in a VM?
iMac-27:qemu-eos $ c
-bash: c: command not foundAnd I'm able to use the same Terminal window as usual.
make clean && make install_qemu ML_MODULES= CONFIG_QEMU=y
make clean && make install ML_MODULES=
hg up --clean 22476f9
hg backout --no-commit 4a8d74a
mpu_send(06 04 02 00 00 00) ; Init group
mpu_recv(06 05 01 00 03 00) ; PROP_SHOOTING_MODE
mpu_recv(06 05 01 4f 00 00) ; PROP_FIXED_MOVIE
mpu_recv(06 05 01 99 00 00) ; PROP 80040057
mpu_recv(06 05 01 9a 00 00) ; PROP 80040058
mpu_recv(06 05 01 06 18 00) ; PROP_APERTURE
mpu_recv(06 05 01 3f 00 00) ; PROP_FLASH_ENABLE
mpu_send(08 06 01 a7 00 01 00 00) ; ???
mpu_send(08 06 01 a7 00 01 00 00) ; ???
mpu_recv(30 2f 02 0d 03 03 00 00 01 00 00 00 00 01 00 01 00 01 02 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 01 00 01 00 0f 00 07 01 00 00 00 00) ; Card group
mpu_recv(5a 59 02 0f 01 02 00 08 01 01 00 00 00 00 00 00 00 00 00 00 17 6a 00 00 00 0f 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 03 01 2c 00 00 0b b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; Movie group
mpu_recv(48 46 02 10 00 00 00 00 00 00 00 00 00 00 ff 03 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff 00 00 02 01 01 00 03 00 01 00 04 00 00 01 05 00 01 01 00 00 00 00 47 47 00 02 00 00 00 00 00 00 00 00 00) ; AF group
mpu_send(06 04 0e 4c 00 00) ; ???
mpu_send(24 22 0e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(2a 28 0e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(0c 0a 0e 2c 00 00 00 00 00 00 00 00) ; ???
mpu_send(06 05 0e 30 00 00) ; ???
mpu_send(06 04 0e 31 00 00) ; ???
mpu_send(06 04 0e 35 00 00) ; ???
mpu_send(0c 0a 0e 38 00 00 00 00 00 00 00 00) ; ???
mpu_send(46 44 0e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(70 6f 0e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(12 10 0e 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_recv(42 40 02 11 00 17 00 00 00 00 17 00 ff ff ff ff ff f8 00 00 00 ff ff ff ff ff f8 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 ff ff ff ff ff f8 00 00 00 00 00 00 00 00 00 00 18 00 00 00 00 00) ; AF2 group
mpu_recv(06 05 01 af 02 00) ; ???
mpu_recv(10 0e 02 05 07 00 00 00 01 00 00 03 05 03 00 00) ; PROP_CFN_1
mpu_recv(2e 2c 02 07 11 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 03 08 47 03 0f 00 11 10 03 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_CFN_3
mpu_send(12 10 0e 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_send(26 24 0e 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_recv(1e 1d 02 08 05 c3 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_CFN_4
mpu_recv(06 05 01 95 02 00) ; PROP 8004005C
mpu_recv(2e 2c 02 07 11 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 03 08 47 03 0f 00 11 10 03 00 00 00 f6 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_CFN_3
mpu_send(0a 08 0e 3f fe ff ff ea 00 00) ; ???
mpu_send(08 06 0e 40 fe ff 00 00) ; ???
mpu_send(06 05 0e 49 fe 00) ; ???
mpu_send(06 05 0e 4b fe 00) ; ???
mpu_recv(8e 8d 02 0e 03 03 03 04 00 00 00 5d 00 00 00 00 0e 10 00 00 00 00 21 00 00 01 03 00 00 06 04 00 00 01 00 01 00 00 03 84 00 65 18 00 00 00 00 00 00 00 00 01 03 00 00 83 48 00 00 70 48 80 48 80 48 83 48 58 48 90 01 00 03 03 01 00 01 00 00 03 00 00 00 00 01) ; Mode group
mpu_recv(06 05 03 37 00 00) ; PROP_MIRROR_DOWN_IN_MOVIE_MODE
mpu_recv(0a 08 03 2f 00 40 00 00 00 00) ; PROP_SPECIAL_OPTION
mpu_recv(06 05 03 20 01 00) ; PROP_STARTUP_CONDITION
mpu_recv(06 05 03 76 00 00) ; ???
mpu_recv(08 06 01 a7 00 01 00 00) ; ???
mpu_recv(64 62 02 12 01 10 50 00 c6 00 32 00 32 81 04 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 43 43 7e 7e 7e 43 43 01 70 01 70 01 70 00 96 00 96 00 96) ; Lens group
mpu_recv(06 05 03 35 01 00) ; PROP_BATTERY_REPORT_COUNTER
mpu_recv(1c 1b 03 1d 35 02 00 00 00 e7 00 4c 50 2d 45 36 4e 00 00 00 00 01 00 00 65 16 15 00) ; PROP_BATTERY_REPORT
mpu_recv(06 04 03 36 00 00) ; PROP_BATTERY_REPORT_FINISHED
mpu_recv(08 07 03 7e 91 99 ff 00) ; ???
mpu_recv(08 06 01 a7 00 00 00 00) ; ???
mpu_recv(06 05 04 06 05 00) ; PROP_DEFAULT_LV_MANIP
mpu_recv(0e 0d 04 30 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_recv(06 05 01 48 01 00) ; PROP_LIVE_VIEW_MOVIE_SELECT
mpu_recv(06 05 01 4b 01 00) ; PROP_LIVE_VIEW_VIEWTYPE_SELECT
mpu_recv(06 05 01 49 01 00) ; PROP_LIVE_VIEW_AF_SYSTEM
mpu_recv(06 05 01 12 00 00) ; PROP_WBB_GM
mpu_recv(06 05 01 13 00 00) ; PROP_WBB_BA
mpu_recv(10 0e 01 8f 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_LV_CFILTER
mpu_recv(0e 0c 01 b1 00 00 00 00 00 00 00 00 00 00) ; ???
mpu_recv(06 05 01 03 04 00) ; PROP_DRIVE_MODE
mpu_recv(08 06 01 a7 00 01 00 00) ; ???
mpu_recv(08 06 01 a7 00 00 00 00) ; ???
mpu_recv(06 05 04 29 01 00) ; ???
mpu_recv(06 05 01 01 03 01) ; PROP_SHOOTING_MODE_CUSTOM
mpu_recv(06 05 01 2e 01 00) ; PROP_SAVE_MODE
mpu_recv(46 44 09 00 00 c6 00 32 00 32 81 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 10 50 49 02 59 88 88 00 88 88 00 32 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_LV_LENS
mpu_recv(06 05 01 2c 02 00) ; PROP_CURRENT_MEDIA
mpu_recv(12 10 03 00 9d 00 00 84 0b 00 00 00 00 00 00 00 00 00) ; PROP 80030000
mpu_recv(06 05 03 23 11 00) ; ???
mpu_recv(16 15 03 24 45 46 35 30 6d 6d 20 66 2f 31 2e 34 20 55 53 4d 00 00) ; PROP_LENS_NAME
mpu_recv(06 05 03 04 00 00) ; PROP_POWER_KIND
mpu_recv(06 05 03 05 04 00) ; PROP_POWER_LEVEL
mpu_recv(06 04 03 25 00 00) ; ???
mpu_recv(06 05 01 3d 00 00) ; PROP_TEMP_STATUS
mpu_recv(06 05 03 0d 00 00) ; PROP_CARD2_RECORD
mpu_recv(06 05 03 0c 00 00) ; PROP_CARD1_RECORD
mpu_recv(30 2e 03 15 01 10 50 00 c6 00 32 00 32 81 04 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_LENS
mpu_recv(24 22 03 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP 8003003C
mpu_recv(06 05 03 17 9c 00) ; PROP_EFIC_TEMP
mpu_recv(06 05 03 6c 9b 00) ; PROP 80030073
mpu_recv(30 2e 03 15 01 10 50 00 c6 00 32 00 32 81 04 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_LENS
mpu_recv(24 22 03 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP 8003003C
mpu_recv(0a 09 01 55 00 00 03 00 00 01) ; PROP_MULTIPLE_EXPOSURE_SETTING
mpu_recv(0a 09 01 70 00 00 01 00 00 01) ; PROP_HDR_SETTING
mpu_recv(0a 08 01 85 00 00 00 01 01 00) ; PROP_GIS_SETTING
mpu_recv(0c 0a 0e 2d 65 00 00 04 50 01 00 00) ; ???
mpu_recv(06 05 01 58 00 00) ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 01 58 00 00) ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 01 58 00 00) ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 01 58 00 00) ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 03 5c 00 00) ; PROP 80030061
mpu_recv(06 05 01 59 01 00) ; PROP_MOVIE_SERVO_AF
mpu_recv(06 05 01 59 01 00) ; PROP_MOVIE_SERVO_AF
mpu_send(0a 08 09 24 00 00 00 00 00 00) ; ???
mpu_send(08 07 03 6a 00 02 00 00) ; ???
mpu_send(0a 08 03 06 00 00 00 00 00 00) ; PROP_AVAIL_SHOT
mpu_send(06 04 03 10 00 00) ; PROP 80030008
mpu_send(06 05 03 07 ff 00) ; PROP_BURST_COUNT
mpu_send(06 05 01 2e 01 00) ; PROP_SAVE_MODE
mpu_send(0a 08 03 0b 00 00 00 00 00 00) ; PROP 80030007
mpu_send(06 05 03 19 01 00) ; PROP_TFT_STATUS
mpu_send(06 05 01 56 00 00) ; ???
mpu_send(06 05 04 0e 01 00) ; PROP 8002000D
mpu_send(06 05 03 40 00 00) ; PROP 80030040
mpu_send(0c 0b 03 53 03 00 48 81 81 00 00 00) ; PROP 80030058
mpu_send(0c 0b 03 53 03 00 48 81 81 00 00 00) ; PROP 80030058
mpu_send(08 06 01 2a 05 68 00 00) ; PROP_CARD2_FILE_NUMBER
mpu_send(06 05 03 07 14 00) ; PROP_BURST_COUNT
mpu_send(0a 08 03 06 00 00 00 ea 00 00) ; PROP_AVAIL_SHOT
mpu_send(06 05 03 11 01 00) ; PROP_ICU_AUTO_POWEROFF
mpu_send(06 05 02 0a 00 00) ; PROP_PERMIT_ICU_EVENT
mpu_send(06 05 03 0d 00 00) ; PROP_CARD2_RECORD
mpu_send(06 05 03 0c 00 00) ; PROP_CARD1_RECORD
mpu_recv(06 05 01 58 00 00) ; PROP_VIDEOSNAP_MODE
mpu_recv(06 05 01 58 00 00) ; PROP_VIDEOSNAP_MODE
It seems that emulation goes little further.
Just 1 Flash of LED then Dead Cam, Batt' Removal Necessary. Tried 6 Times, all same.
Hopefully these photo's (https://magiclantern.wikia.com/wiki/Circuit_boards) will help with something.
AD80334BBCZ
4 CHANNEL, 14 bit , 50MSPS AFETG+PPP
Hopefully these photo's (https://magiclantern.wikia.com/wiki/Circuit_boards) will help with something.
...
I'm surprised to see that there is a button cell there, but it cannot be changed by the user...
The MS614 is a rechargeable button cell, probably there only for timekeeping when there is no battery in the camera.
Since it's rechargeable, no need for user replacement...