Magic Lantern Forum

Magic Lantern Releases => Camera-specific discussion => Topic started by: feedrail on June 12, 2017, 07:05:50 AM

Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: feedrail on June 12, 2017, 07:05:50 AM
Ive used ML on my t2i for years and loved it, now I want to do my part and bring ML to my t7i. Point me in the right direction and a few do's and don't s and I'll do whatever I can. I had some coding years ago vb+, c++, java. I don't know it that will be any use but I'm willing and want to try.

(was: Newbie Here wantingg to help on 800d)
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: a1ex on June 12, 2017, 10:40:26 AM
A few days ago I've tried to find the LED address on a 77D (also digic 7), on IRC, without success. If you want to try the same steps, just get in touch with me.

The good news is that we can run code on the camera. The next step would be to produce some sort of side effects (such as LED blinks, or even variations in power consumption, that can be noticed with a multimeter).

What we know about D7 can be found on the EOS M5 (https://chdk.setepontos.com/index.php?topic=13014.0) thread, but that model runs PowerShot firmware. It's very likely a dual-core Cortex A9, with MMU, and runs Thumb-2 code (therefore, we might have some luck matching code patterns from some D6 models).

Caching issues (not yet solved on D6) are probably similar (that is, once it's solved for one model, it will very likely apply to all others).
Title: Re: Newbie Here wantingg to help on 800d
Post by: GabrielJLozano on September 08, 2017, 07:59:13 AM
So I tried looking all over the forums and the only information I could find about anyone even remotely talking about working on the t7i is this thread. Is anyone trying to port it at all? I'd love to help as well so long as someone points me in the right direction.
Title: Re: Newbie Here wantingg to help on 800d
Post by: Walter Schulz on September 08, 2017, 09:24:38 AM
Read the post above yours.
Title: Re: Newbie Here wantingg to help on 800d
Post by: a1ex on September 08, 2017, 09:47:36 AM
Some of the easier things you can do to help, in order of increasing difficulty:

- wait for a firmware update
- open your camera and take high-resolution pictures of the mainboard
- hook a multimeter / Arduino / oscilloscope / whatever to an external power supply (see above)
- find some UART (https://www.magiclantern.fm/forum/index.php?topic=7531) or JTAG (https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/) port and attempt to communicate with it
- read the Cortex A9 manuals and the PowerShot ROM dumps (CHDK forum), then suggest things to try running on the camera, in order to get any kind of side effects (LED blinks, display activity, writing to SD, variations in power draw)

If you want to run your own code on the camera, I recommend starting from either recovery or digic6-dumper branches. However, you'll need to sign the code, and the tools for doing that are not public, but I can help with that - just drop me a PM.

Good luck!
Title: Canon T7I/800D
Post by: A8M on December 03, 2017, 02:40:09 AM
Okay.  Just got off the phone with Canon.  No good news.  According to their techs, the company has NO PLANS to release a firmware update for this model until 2019!!!  Could be a lie, but if it is, the company's personnel told it.  Sucks to be us I guess as the new kids on the block.

Having said that, is it still possible to go forward and try to figure out a ML for this model?  I'm somewhat skeptical it will happen since the T6i hasn't had any good luck thus far, along with other models that have been out there on the block longer than this one with the newer chipsets.  Al3x has already said he isn't going to invest the time/energy into building newer model MLs from scratch leaving the burden on others, but most of us are just not coders/assemblers/hackers like that.  At most I think you have more script kiddies at the site's disposal than actual hardcore coders that know enough C++, Python, or Linux enough to be viable.  If I had 2 of these I'd be willing to try, but with only one as my daily driver for projects I can't afford a brick tinkering with it.   

I've trolled a little bit in the forums trying to see if there were any people actively figuring this out and so far there hasn't been a lot of discussion threads about the 800D.  But from what I've seen this is all I've been able to answer:
1.  Chipset is Digic7.  Haven't found on the forums yet whether or not there is a specific dumper for this digic, as what digic6 has.
2.  Can't open the camera to take pics of the hardware; don't have the right bits for these screws and that's sad considering I tried 25 different pieces.
3.  Dont have a  multimeter / Arduino / oscilloscope / whatever to hook to an external power supply.
4.  JTAG port can't say yay or nay because of #2. 







Title: ML for Canon 200D / SL2
Post by: TheCallumP on December 29, 2017, 12:52:09 AM
Is there a version of ML that can be used with this camera? I bought this camera for content creation not realising that it doesn't offer a clean HDMI output ('clean' in the respect that it hides all of the on-screen information). I literally have everything set up, but could not for the life of me figure out a way to hide the on-screen information...until I found Magic Lantern. Sadly, I've found that my camera is not supported.

Are there any plans to support this camera, or is there a version that I can use that will work with my 200D? Sorry if either of these are dumb questions, I'm completely new to this and am grasping at straws here.

Many thanks.
Title: Re: ML for Canon 200D / SL2
Post by: Walter Schulz on December 29, 2017, 05:28:21 PM
Short A: No.

Long A:
There is no such thing as project management, masterplan, schedule in ML development. If someone takes up the task of porting a cam it's a start. But again: That's not a promise you will see a port going "full ML" at a given time or at all.
At time of writing there are serious efforts to port ML to cams housing Digic 6 processors. But 200D doesn't run on Digic 6 but Digic 7. And porting ML to an unknown processor generation is a very hard task to master.
And dev time is sparce. Devs made it pretty clear they will help in development for new ports but do not have the time to maintain newer cams. Each and every cam needs a maintainer for long time support.


My general advice: If there is no ML port for your cam act like there will be no ML for your cam ever.

Or you have a spare dev at hand: Skilled in embedded devices (preferable ARM architecture), assembler and C programming. And some time to waste.
Title: Re: ML for Canon 200D / SL2
Post by: TheCallumP on December 29, 2017, 05:52:21 PM
Thank you for taking the time to respond, I appreciate it. Bummer, but totally understandable. 

Are there any alternatives to ML that I may be unaware of? Literally all I'm looking for is a way to turn off the on-screen overlay entirely.
Title: Re: ML for Canon 200D / SL2
Post by: dfort on December 30, 2017, 01:28:52 AM
This is the least expensive of the Digic 7 DSLR's.

Would asking for a ROM dumper be unreasonable? Maybe Digic 7 code isn't all that different from Digic 6?
Title: Re: ML for Canon 200D / SL2
Post by: a1ex on December 30, 2017, 01:37:13 AM
Answered at http://www.magiclantern.fm/forum/index.php?topic=19737.
Title: Re: ML for Canon 200D / SL2
Post by: deathline on January 16, 2018, 10:38:03 PM
Answered at http://www.magiclantern.fm/forum/index.php?topic=19737.

Canon released a firmware update for eos 200d but Firload can't decrypt it.Is another solution is avaible?

http://gdlp01.c-wss.com/gds/8/0400003508/01/v101-sl2-200d-x9-win.zip (http://gdlp01.c-wss.com/gds/8/0400003508/01/v101-sl2-200d-x9-win.zip)
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: a1ex on January 20, 2018, 12:27:49 AM
Dual-core Cortex A9 (just like M5). The firmware is still based on the EOS codebase and doesn't look too different from DIGIC 6.

Main firmware: 0xE0040000, starts as Thumb, entry point code different from D6.
Bootloader: no idea how it looks like, we'll need to run some code blindly until we manage to dump its contents.
MPU (http://www.magiclantern.fm/forum/index.php?topic=17596.0) (microcontroller) present (similar to other EOS models, same interrupts as D6, didn't look further).
MMU (memory mapping unit) present (likely configured in the same way as M5).
All previous Canon models use a MPU - memory protection unit (not to be confused with the microcontroller with the same name). D7 uses a MMU instead.
Interrupt system: same as D6.
Some DryOS tasks are starting with single-core emulation (unlike 7D/7D2), even with this (incomplete) ROM.
The DryOS shell works out of the box!

Code: [Select]
K417 READY
K417 ICU Firmware Version 1.0.1 ( 5.0.2 )
ICU Release DateTime 2017.09.21 12:53:23

Open Console K417[1]>...

Dry[MusaPUX]> ?
[Kern]
 extask  memmap  meminfo  mkcfg  dminfo  exobjinfo  stdlibcfg  efatcfg
 sysvers  xd  xm  prio  resume  suspend  release  sem  mutex  event  mq  exit

Dry[MusaPUX]> sysvers
SystemIF 0.88
DRYOS version 2.3, release #0059+p4
 MACH 0.83+p1

WLAN led at 0xD2080190: 0x20D0002 (on), 0x20C0003 (off)
Could not find the SD card led yet.

There are many early tests I can run with the above knowledge, on any DIGIC 7 model:
- blink the LED
- identify the SD card LED (we did that on DIGIC 6)
- dump the bootloader using CHDK soundcard method (requires extra hardware)
- attempt to jump to main firmware (assuming it's the same as D6)

Ready to try?
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: a1ex on January 20, 2018, 10:43:18 AM
6D Mark II also has a firmware update available (just noticed it):

Code: [Select]
K406 READY
K406 ICU Firmware Version 1.0.3 ( 6.4.4 )
ICU Release DateTime 2017.08.28 12:49:25

Dry[MusaPUX]> sysvers
SystemIF 0.88
DRYOS version 2.3, release #0059+p4
 MACH 0.83+p1

WLAN led not found (does it have one?)
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: grtor on January 24, 2018, 08:01:17 PM
No, the 6dii doesn't have a WLAN led only an SD card led
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: a1ex on February 25, 2018, 10:52:59 AM
Tried scanning 0xD2080000 - 0xD2081FFC and 0xD2080000 - 0xD20BFFFC on a 77D, with led_on = 0x20D0002 and led_off = 0x20C0003 (based on the above info). No success.

Would be helpful (for all D7 models) if a 200D owner would be willing to run the LED blinking test, since it's the only model with a known LED address.
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: deathline on February 26, 2018, 05:01:05 PM
Tried scanning 0xD2080000 - 0xD2081FFC and 0xD2080000 - 0xD20BFFFC on a 77D, with led_on = 0x20D0002 and led_off = 0x20C0003 (based on the above info). No success.

Would be helpful (for all D7 models) if a 200D owner would be willing to run the LED blinking test, since it's the only model with a known LED address.

Is  this https://www.magiclantern.fm/forum/index.php?topic=2296.0 (https://www.magiclantern.fm/forum/index.php?topic=2296.0) generic one?
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: a1ex on February 26, 2018, 07:02:27 PM
No, it would be a FIR crafted specifically for this camera (I can create one on request).

Source: https://bitbucket.org/hudson/magic-lantern/src/digic6-dumper/src/reboot-dumper.c
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: gunny2k6 on March 08, 2018, 08:27:15 PM
Interesting Topic to read ML is already maybe possible on DIGIC 7... traded my 450D for a 77D and wasnt even thinking of asking about ML running on it at all as the work on the DIGI 6 is still ongoing
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: deathline on April 03, 2018, 03:57:00 PM
No, it would be a FIR crafted specifically for this camera (I can create one on request).

Source: https://bitbucket.org/hudson/magic-lantern/src/digic6-dumper/src/reboot-dumper.c

Hi alex, you can send me blink test for eos200d, i will try it :)
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: DieHertz on April 12, 2018, 01:37:27 PM
I have a 6D2, is there anything I could help with without taking the camera apart? :-)
Title: Re: ML for Canon 200D / SL2
Post by: topit1972 on April 20, 2018, 11:14:44 AM
Wish i had researched my camera, 200D, prior to buying.  This 29min is a real paid as i record and manage a band.  I had a Sony HVR 5ZE Pro cam, but having to use MiniDV tapes was a pain, so thought i'd go digital not knowing the 29min cap!

Pity there isn't a generic one for 200D

Is there a version of ML that can be used with this camera? I bought this camera for content creation not realising that it doesn't offer a clean HDMI output ('clean' in the respect that it hides all of the on-screen information). I literally have everything set up, but could not for the life of me figure out a way to hide the on-screen information...until I found Magic Lantern. Sadly, I've found that my camera is not supported.

Are there any plans to support this camera, or is there a version that I can use that will work with my 200D? Sorry if either of these are dumb questions, I'm completely new to this and am grasping at straws here.

Many thanks.
Title: Re: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)
Post by: a1ex on April 20, 2018, 12:07:22 PM
200D LED blinking test didn't work, but here's a small detail I've overlooked: bootloader seems to loads external code as Thumb (as opposed to ARM on DIGIC 6 and earlier). [ edit: confirmed, IT WORKS! ]

6D2: not much luck finding the LED address, but found out this (https://www.magiclantern.fm/forum/index.php?topic=21981) instead.

@ all DIGIC 7 EOS owners (800D, 77D, 6D2): let's retry the LED brute-forcing test (PM me if you don't mind running some blind code that pokes some GPIOs hoping to find the right one).

Source code for previous experiments committed to the digic6-dumper (https://bitbucket.org/hudson/magic-lantern/branch/digic6-dumper) branch.



Next step is to dump the bootloader with one of these methods:
- CHDK soundcard method (http://chdk.wikia.com/wiki/Obtaining_a_firmware_dump#Using_soundcard_input) (phototransistor connected to PC soundcard input)
- a photodiode/phototransistor connected to an Arduino board or similar.

Please PM me once you have the hardware ready.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on April 21, 2018, 12:21:43 PM
77D: LED address identified (https://bitbucket.org/hudson/magic-lantern/commits/8c068b8ff7cf0d0c9d217696dc5520db9bb4b110), thanks @alpha232 8)

Blinking pattern:

(https://a1ex.magiclantern.fm/bleeding-edge/77D/image.png)

Wide black bar = 1, narrow black bar = 0, pattern repeats 3 times. Scan range started at 0xD2080000, 32-bit aligned addresses only => 77D LED address is 0xD2080000 + 0b00001011011 * 4 = 0xD208016C.

Background (https://www.magiclantern.fm/forum/index.php?topic=17848.msg172321#msg172321) info (https://www.magiclantern.fm/forum/index.php?topic=16052.msg168592#msg168592).

Next step: please see previous post.



Edit: the EOS M50 appears to run EOS firmware (https://bitbucket.org/hudson/magic-lantern/commits/f6e763a002080605887dcc4a5c882b626fe97553) (other recent models, i.e. M3, M5, M6, M10 and M100, are based on PowerShot firmware). Looking for a volunteer to try the LED blinking test on this camera, too :)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: dfort on April 21, 2018, 04:20:27 PM
Edit: the EOS M50 appears to run EOS firmware (https://bitbucket.org/hudson/magic-lantern/commits/f6e763a002080605887dcc4a5c882b626fe97553) (other recent models, i.e. M3, M5, M6, M10 and M100, are based on PowerShot firmware). Looking for a volunteer to try the LED blinking test on this camera, too :)

+1
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on April 24, 2018, 10:28:49 AM
Portable ROM dumpers (https://www.magiclantern.fm/forum/index.php?topic=16534) ready 8)

77D_DUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/77D/77D_DUMP.FIR) (confirmed by alpha232)
200DDUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/200D/200DDUMP.FIR) (confirmed by deathline)
6D2_DUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/6D2/6D2_DUMP.FIR) (confirmed by DieHertz)
800DDUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/800D/800DDUMP.FIR) (confirmed by ids1024)
M50_DUMP.FIR (need a second volunteer who has either another camera to film the display, or a phototransistor connected to soundcard/arduino/whatever)

Emulation coming soon.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on April 24, 2018, 10:39:33 AM
So I don't need my STM32 Discovery and phototransistors anymore? :-( :-D
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on April 24, 2018, 10:45:12 AM
Hehe... the other testers were quicker :D

Still need that hardware setup for M50. Or maybe for initial debugging, as all these recent cameras are dual-core.

Decoding LED blinks may also be possible with a camera that has automatic LCD brightness (5D3, 5D2, 7D) and already runs ML (I can look into it if needed).
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: deathline on April 24, 2018, 04:27:56 PM
So I don't need my STM32 Discovery and phototransistors anymore? :-( :-D


Is there any working project file code?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on April 24, 2018, 09:58:21 PM
I have found a 2GiB SD card, formatted it via my 6D2 (low-level format), then dd-ed 256 MB filesystem .img over it, and copied 6D2_DUMP.FIR into SD root.
Then put the SD card into camera, turned it on, screen lit up as usual, I let it sit for a minute and then turned camera off, opened SD card bay and after 10 seconds ejected it.
There are no new files on the SD card following this procedure, did I miss something?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Walter Schulz on April 24, 2018, 10:03:05 PM
You have to "load" FIR file using Firmware Update in Canon menu!
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on April 24, 2018, 10:05:38 PM

(https://thumb.ibb.co/huLePH/IMG_20180424_230954_HDR.jpg) (https://ibb.co/huLePH)
Oh indeed, I forgot this is the firmware update file format.
Thank you!

Battery taken out, can I put it back now? :)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: alpha232 on April 27, 2018, 07:27:42 AM
I'm getting all antsy for something else to test :D

Much thanks to poor a1ex for his tolerating my odd schedule.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on April 28, 2018, 08:03:14 AM
LED number on 6d2 appears to be 0x5b.
Speaker/beeper is a bit weird, the second least significant bit seems to have some echo which makes it hard to distinguish whether it's 1 or 0, there seem to be 3 clicks per just two edges. It's either 0x40, 0x42, or both.
Maybe that explains why there are 3 clicks, rising edges coincide, while falling edges are spread apart as one of them is longer than the other.
https://youtu.be/MFp3pxfomGM

Result:
SD LED: 0xD208016C
Speaker 1: 0xD2080100
Speaker 2: 0xD2080108

P.S. 77D looks similar :)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on April 28, 2018, 10:28:42 AM
Let's try to get some CPU info (http://www.magiclantern.fm/forum/index.php?topic=17714.0):

CPUI_6D2.FIR (https://a1ex.magiclantern.fm/bleeding-edge/6D2/CPUI_6D2.FIR)

(other D7 models on request)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on April 28, 2018, 09:18:42 PM
a1ex, here's the CPU info from 6D2.
Maybe it could be easier if it wrote output to SD card, taking these photos was far from easy :-)

(https://thumb.ibb.co/dGc1Tc/IMG_20180428_221221_HDR.jpg) (https://ibb.co/dGc1Tc)

(https://thumb.ibb.co/gBmH1x/IMG_20180428_221224_HDR.jpg) (https://ibb.co/gBmH1x)

(https://thumb.ibb.co/griaoc/IMG_20180428_221228_HDR.jpg) (https://ibb.co/griaoc)

(https://thumb.ibb.co/fqWT8c/IMG_20180428_221110_HDR.jpg) (https://ibb.co/fqWT8c)


I wonder what is the level8 cache it mentions
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on April 30, 2018, 09:51:12 AM
Emulation (https://bitbucket.org/hudson/magic-lantern/commits/a20c79bcfe12867a2d62fc50e2fe628fa16f9200) ready (https://builds.magiclantern.fm/jenkins/view/QEMU/job/QEMU-tests/331/console) 8)

(https://a1ex.magiclantern.fm/bleeding-edge/qemu/77D.png)

Please refer to README.rst (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/README.rst), HACKING.rst (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst), the sticky tweet (https://twitter.com/autoexec_bin/status/913530810686418944) and the 80D (https://www.magiclantern.fm/forum/index.php?topic=17360.msg194898#msg194898)/750D (https://www.magiclantern.fm/forum/index.php?topic=17627.msg190275#msg190275) threads to get started.

Code: [Select]
./run_canon_fw.sh 77D -d debugmsg -s -S & arm-none-eabi-gdb -x 77D/debugmsg.gdb

<<<<< Musa(PU0) Boot Ver 0.21 >>>>>
BootLoader
K408 READY
K408 ICU Firmware Version 1.0.2 ( 7.3.6 )
ICU Release DateTime 2017.02.23 14:49:29
...
[SD] Name: QEMU! Size: 247(7bc00)
...
[STARTUP] ERROR WaitPU1 TimeOut
...

Next steps:
- attempt to jump to main firmware (will it work? we've got two CPUs)
- enable the boot flag (might be risky, we will reflash a small part of the ROM)
- port ML startup process (likely similar to 80D)
- run the proof of concept code from 80D thread (logging, photo capture etc)
- figure out how to print things on the screen
- start porting ML!

More about the bootflag:
- recovery branch (https://bitbucket.org/hudson/magic-lantern/branch/recovery) with CONFIG_BOOT_BOOTFLAG=y (https://bitbucket.org/hudson/magic-lantern/commits/2ed80d7cebcf7039652db278b2e4be362f34763d)
- doesn't work yet; stub autodetection routines have to be updated for Thumb (they were written for DIGIC 6 (https://www.magiclantern.fm/forum/index.php?topic=17360.msg189584#msg189584))
- the risk is more about bugs or other unexpected behavior in Canon bootloader (unlikely)
- this will let you compile ML (in these early stages) and run test code on your camera.

Have fun!

P.S. just got a cool feature request - audio output to Bluetooth headphones. Not tempting enough for me to get another camera, but if any of you is willing to look into it, I'll be here to help (at least with the reverse engineering side).
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: deathline on May 01, 2018, 03:13:12 PM
P.S. just got a cool feature request - audio output to Bluetooth headphones. Not tempting enough for me to get another camera, but if any of you is willing to look into it, I'll be here to help (at least with the reverse engineering side).

Are you sure digic7 cameras have  hardware support for Bluetooth 4.0 BR/EDR? 200d canon firmware support only bluetooth low energy and there is no profile for audio headsets.But i've found a low energy supported hid profile gamepad for playing mario :D 
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on May 01, 2018, 09:11:02 PM
Great job Alex, I guess now is the case for us, owners of 6d2 and other DIGIC 7 cameras, to continue the effort :-)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on May 01, 2018, 09:23:27 PM
You still need my help to enable the boot flag, but at least you can now debug your binaries in QEMU.

Good news - we were able to jump to main firmware without any special tricks! (confirmed by both DieHertz and deathline). In reboot-dumper.c from the digic6-dumper branch, run this:

Code: [Select]
void(*firmware_start)(void) = (void*) 0xE0040001;
firmware_start();

while(1);

That means, one can already start to port the 80D boot process (minimal.c) and debug it in QEMU. Same for the DIGIC 6 boot flag enabling code (recovery branch).

DIGIC 6 cameras require a special trick to jump to main firmware (poking register 0xD20C0084 on single-core D6). This was not needed for DIGIC 7.

Feel free to play around with the virtual machine and report your findings.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on May 01, 2018, 10:23:18 PM
I'm sure we'll need your help for much more than that :-)
Title: Re: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on May 03, 2018, 04:19:35 PM
I think it fails earlier, unless "irregular TotalSheets 0" is a known and insignificant error message.
6D2 seems to wait for startup config to finish, last flag `0x40000` isn't cleared for a couple of minutes
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on May 03, 2018, 09:43:44 PM
Is it safe to assume that most of these messages are errors?
(https://thumb.ibb.co/bXJ9PS/Screen_Shot_2018_05_03_at_22_43_16.png) (https://ibb.co/bXJ9PS)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on May 04, 2018, 11:09:24 AM
The TotalSheets and EstimatedSize errors are likely caused by wrong / incomplete MPU messages (these will have to be logged from a real camera); the WaitPU1 error is probably what's blocking right now. It appears to wait at a semaphore.

200D:

startupPrepareCapture -> take_semaphore(PU1Wait_sem, 2000) -> DebugMsg("WaitPU1 TimeOut") if failed.
This semaphore (PU1Wait) is created right after launching TaskMain (E00413E6).
The function that gives this semaphore is E0040220 -> E004053C, referenced at:
Code: [Select]
  call 0xE0426000(e0040221, 0, 0, 1000)                                          at [init:e00402dd:e004029d]
That's something named init1 / init_task1. It does a bunch of initialization, then calls give_semaphore(PU1Wait_send) at the end.
It also appears to initialize Omar (a small secondary core likely used to offload some image processing tasks).

So, one puzzle is to debug this init_task1 to see where it locks up / why it doesn't finish / whether it's starting at all.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: BHybes on May 04, 2018, 12:40:26 PM
I ran the FIR file as an update on my 800D and only got this from it:
(https://thumb.ibb.co/iHGnDn/20180504_113428.jpg) (https://ibb.co/iHGnDn)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on May 04, 2018, 01:06:08 PM
One of the ROMs is very slow, so it takes a while. Updated the binaries to skip that step.

@ 200D/6D2/77D owners: please check whether the new dumpers are still working (same link, top of the page).
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on May 04, 2018, 03:17:21 PM
I'm still figuring my way through radare2, ARM console, and probably something else. Having no IDA complicates it a bit, reading raw undecorated ASM in GDB is too hardcore for now :)
Will try the new dumper tonight
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on May 04, 2018, 06:12:14 PM
Radare2 should be the most promising one; I doubt you'll get anything useful from ARM-console on Thumb.

I find GDB useful not for step-by-step debugging (I find that too slow, and IDA crashes very often, so it doesn't help that much), but with:
- watch *0x1234 (to tell what code writes to that memory address)
- custom logging hooks (to tell when a particular sequence of code executes, and with what arguments / return values / etc)

Most of the time, I use various logging options from qemu -d (many of them are custom logging code, not found in vanilla QEMU), possibly coupled with small GDB scripts (see e.g. generic_log) and grep. The most useful ones: I/O trace with interrupts (-d debugmsg,io,int), call trace (-d calls,tail), RAM trace (-d ram, with variations, or temporary edits to source code to define filters if grep is too slow).

Back to our issue. From what I could tell, the second core (CPU1) gets stuck waiting for interrupt 0xA, early in the boot process; see the EOS M5 notes about GIC.

Code: [Select]
; 77D
ROM:E0007752  BL      gicc_setup   ; writes to 0xC1000100 and 104
ROM:E0007756  MOV     R0, #0xA
ROM:E000775E  BL      wait_some_interrupt   ; calls WFI in a loop until it gets the expected interrupt

I believe these are meant to generate a software interrupt for CPU1 (77D):
Code: [Select]
[CPU0] [GICD]   at Startup:E0152F04:E0092855 [0xC1001F00] <- 0x2000A   : ???
[CPU0] [GICD]    at RscMgr:E0152F04:E0092855 [0xC1001F00] <- 0x2000A   : ???
[CPU0] [GICD]    at RscMgr:E0152F04:000350BF [0xC1001F00] <- 0x2000C   : ???

See arm_gic_architecture_specification.pdf, 4.3.15 Software Generated Interrupt Register GICD_SGIR: lowest hex digit is the interrupt ID, and the 0x2 is CPUTargetList (second CPU).

We've got some generic GIC emulation code in QEMU (intc/arm_gic.c); would be great if that can be reused.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: t3r4n on May 04, 2018, 07:03:03 PM
I'm still figuring my way through radare2,

well maybe I've got something
try adapting the following to your specific camera layout
Code: [Select]
# Show comments at right of disassembly if they fit in screen
e asm.cmtright=true

# Shows pseudocode in disassembly. Eg mov eax, str.ok = > eax = str.ok
e asm.pseudo = true
# (Show ESIL instead of mnemonic)
# e asm.esil = true

# Selected: asm.describe (Show opcode description)
e asm.describe = false

#asm.emu (Run ESIL emulation analysis on disasm)
e asm.emu = true

# Solarized theme
eco solarized

# Use UTF-8 to show cool arrows
e scr.utf8 = true
e scr.utf8.curvy=true

# set arch and cpu type
e io.va = true
e asm.arch = arm
e asm.bits = 16
e asm.cpu=cortex
# anal.armthumb (aae computes arm/thumb changes (lot of false positives ahead))
e anal.armthumb=true

# initialize esil vm
#e esil.stack.addr = 0x20000000
#e esil.stack.size = 0x000f0000

e asm.section.sub = true
e io.va=true

#S ${esil.stack.addr} ${esil.stack.addr} ${esil.stack.size} ${esil.stack.size} ram mrwx

#00000000 - 00003FFF: eos.tcm_code
S 0x0000000 0x00000000 0x3fff 0x3fff tcmcode mrwx

#00004000 - 1FFFFFFF: eos.ram
S 0x00004000 0x00004000 0x1FFFBFFF 0x1FFFBFFF  eosram mrw-

#40000000 - 40003FFF: eos.ram_uncached0
S 0x40000000 0x40000000 0x3fff 0x3FFF  eosramuncached0 mrw-

#40004000 - 5FFFFFFF: eos.ram_uncached
S 0x40004000 0x40004000 0x1FFFBFFF 0x1FFFBFFF  eosramuncached mrw-

#80000000 - 8000FFFF: eos.tcm_data
S 0x80000000 0x80000000 0xffff 0xffff tcmram mrw-

#BFE00000 - BFFFFFFF: eos.ram_extra
S 0xBFE00000 0xBFE00000 0x1fffff 0x1fffff  eosramextra mrw-

#C0000000 - DFFFFFFF: eos.iomem
S 0xc0000000 0xc0000000 0x1fffffff 0x1fffffff  eosiomem mrw-


#FC000000 - FDFFFFFF: eos.rom1
#FE000000 - FFFFFFFF: eos.rom1_mirror
S 0xfc000000 0xfc000000 0x1fffffff 0x1fffffff  eosrom1 mr-x
S 0xfe000000 0xfe000000 0x1fffffff 0x1fffffff  eosrom1m mr-x

aa
aaa
aae
e anal.hasnext = true
# e io.sectonly = true
e search.in = io.sections.exec
#aac
dbe 0xFE020000

(taken from https://vimeo.com/211371081 (https://vimeo.com/211371081) and adapted to 750D)
then leave this open in a text editor
start qemu .... -S -s  and  radare with :
Code: [Select]
r2 -aarm -b16 -d gdb://localhost:1234
paste the commands above into radare (loading as a startup script does not seem to work with gdb option)
hit vv and start debugging.


Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: DieHertz on May 04, 2018, 09:06:04 PM
New ROM dumper on 6D2 works as intended, got different hashes, but I suppose it's because of change of settings since last dump?
@t3r4n you should consider moving these into ~/.radare2rc and not fiddle with text files and open editors :-)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: BHybes on May 05, 2018, 10:35:42 AM
800D Rom Dump didn't work, got stuck at ROM0
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on May 05, 2018, 11:06:42 AM
From the post with download links -> click on first link:

Requirements:
- a very small SD card or filesystem (important!)
- [...]

Formatting a larger card at a much lower capacity (e.g. 256MB) does the trick. For example, you can write the SD image that comes with QEMU (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/sd.img.xz) to your SD or CF card (follow this guide (https://thepihut.com/blogs/raspberry-pi-tutorials/17789160-backing-up-and-restoring-your-raspberry-pis-sd-card)).
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: deathline on May 05, 2018, 08:11:24 PM
One of the ROMs is very slow, so it takes a while. Updated the binaries to skip that step.

@ 200D/6D2/77D owners: please check whether the new dumpers are still working (same link, top of the page).

new dumper starting to work immediately, rom1.bin identically same priveous files, rom0.bin have slightly differences which has been seen all rom0.bin file.It's look like a block shifting flaws causing newlines.And you know where to find ;)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: ids1024 on May 10, 2018, 08:53:02 PM
The 800D ROM dumper seems to work, though it took me a while to figure out how to create a fatfs smaller than the card. "strings ROM0.BIN" and "strings ROM1.BIN" confirm they aren't just non-sense (I'm not sure what else to check).
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: acarboni on May 22, 2018, 05:40:24 PM
Hi! I've got an M50, a second camera, and I went out and bought a couple low-capacity SD cards. I'd love to help out with the blinking led test. Do I just use the standard one from the diagnostic tools thread (http://a1ex.magiclantern.fm/blink/autoexec.bin)? Does anyone have a link to instructions/materials that I might've missed to help me through the process?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: lovefilm on June 03, 2018, 10:46:06 PM
Portable ROM dumpers (https://www.magiclantern.fm/forum/index.php?topic=16534) ready 8)

M50_DUMP.FIR (need a second volunteer who has either another camera to film the display, or a phototransistor connected to soundcard/arduino/whatever)

Emulation coming soon.

Hello a1ex!

Also got a M50 and a 2nd camera, would be happy to help as well.

Since the M50 is running EOS firmware, would that mean its easier to port Magic Lantern to it? :)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on June 04, 2018, 04:19:01 PM
I went out and bought a couple low-capacity SD cards.

Really? You only need a small filesystem; card size doesn't matter. You can run the test on 128GB cards just as easy as on a 2GB card (in other words, both of them will have to be formatted at a smaller capacity anyway).

LED blinking FIR sent via PM.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: lovefilm on June 04, 2018, 11:04:07 PM
LED blinking FIR sent via PM.

Trying to get it working on my M50,

I used dd to write the QEMU image suggested in here https://www.magiclantern.fm/forum/index.php?topic=16534.0 to my SD-Card, this it how it looks now:
Code: [Select]
[email protected]:/home/freezer/Canon# fdisk -l /dev/sdd
Disk /dev/sdd: 59,5 GiB, 63864569856 bytes, 124735488 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start    End Sectors   Size Id Type
/dev/sdd1          99 506879  506781 247,5M  6 FAT16

And the file-structure within the FAT16:

Code: [Select]
[email protected]:/media/freezer/EOS_DIGITAL# find .
.
./autoexec.bin
./LEDIDM50.FIR
./DCIM
./DCIM/autoexec.bin
./DCIM/LEDIDM50.FIR
./DCIM/100CANON
./DCIM/EOSMISC
./MISC

filesizes:
-rw-r--r-- 1 freezer freezer   604 Jun  4 19:16 LEDIDM50.FIR
-rw-r--r-- 1 freezer freezer 25312 Jun  4 20:07 autoexec.bin

I used the autoexec.bin from the Portable ROM-Dumper thread above and the .FIR provided. Copied them to both / and /DCIM

However nothing really seems to happen when turning it on with the SD-Card inserted. As far as I understand the .FIR file is to enable the boot-flag in the Canon Firmware, is there anything special needed to do to apply it?


Thanks!

Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: ArcziPL on June 04, 2018, 11:28:58 PM
Run "firmware update" from the original menu.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: lovefilm on June 04, 2018, 11:48:06 PM
Run "firmware update" from the original menu.

Can't find any option to update firmware in the original menu.

EOS Utility seems to have an option for Firmware Update, not sure if that would work? Don't have a Windows installation right now.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: ArcziPL on June 05, 2018, 08:06:09 AM
You have to be in one of the following modes: M/Av/Tv/P. The camera manual describes it for sure. And don't use EOS Utility for that.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Walter Schulz on June 05, 2018, 08:58:52 AM
Page 299 of your manual contains a screenshot showing firmware information. Highlight/select this item and open sub-menu to access firmware update option.
@ArcziPL: Nope, Canon don't bother users with this kind of geeky stuff ...
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: lovefilm on June 05, 2018, 09:15:16 AM
Thanks,
got it now.

However when i confirm "Update firmware" with OK, the LCD screen goes black immediately with no LED blinking or anything else happening.
Have to remove the battery to revive it. 
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: ldevulder on June 10, 2018, 05:23:09 PM
Hi all,

I've got a M50 and another camera (6D). I'm ready to help any developper to port ML on this camera.

I didn't find the FIR file to perform the LED blinking test on the M50.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: dfort on June 11, 2018, 10:00:32 PM
I didn't find the FIR file to perform the LED blinking test on the M50.

You need to get it from a1ex via PM.

Also read over posts from lovefilm because he tried running the M50 LED blinking test.
Title: Re: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: overVolt on June 13, 2018, 05:38:31 PM
I have a 77d, some sort of programming skills and I'm ready to help in any way needed (if needed).

I just need to NOT brick my camera because I use it every day for work and have no other camera :)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: CanonPrimoz on June 14, 2018, 06:29:51 PM
Hi!
I just got new 6D2 and I'm ready to help... I have some coding skills with C and C++
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Rubsstar on June 27, 2018, 03:30:50 PM
Hi, I want to have magic lantern on my Canon 200D camera. I have already installed this fir document. then he says that I have to put out my battery and restart my camera. if I do that he does nothing... Is that right?

Portable ROM dumpers (https://www.magiclantern.fm/forum/index.php?topic=16534) ready 8)

77D_DUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/77D/77D_DUMP.FIR) (confirmed by alpha232)
200DDUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/200D/200DDUMP.FIR) (confirmed by deathline)
6D2_DUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/6D2/6D2_DUMP.FIR) (confirmed by DieHertz)
800DDUMP.FIR (https://a1ex.magiclantern.fm/bleeding-edge/800D/800DDUMP.FIR) (confirmed by ids1024)
M50_DUMP.FIR (need a second volunteer who has either another camera to film the display, or a phototransistor connected to soundcard/arduino/whatever)

Emulation coming soon.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: kotik on July 12, 2018, 03:41:14 PM
Firmware update 6D200104.FIR is released.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on July 12, 2018, 04:02:55 PM
Previous dumper should work; feel free to double-check the stubs (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/scripts/6D2/debugmsg.gdb).
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: kotik on July 12, 2018, 05:15:47 PM
Can confirm that 6D2_DUMP.FIR is still working on 6D2 1.0.4.
https://ibb.co/hBUQK8 (https://ibb.co/hBUQK8)

Did 3 runs, MD5 of ROM0 is inconsistent, ROM1 is even.

Did run: ./run_canon_fw.sh 6D2 -d debugmsg
FileMerge detected 69 differences between 6D2.103 and 6D2.104, all memory address related.

Tried: ./run_canon_fw.sh 6D2 -d debugmsg -s -S & arm-none-eabi-gdb -x 6D2/debugmsg.gdb
but the iMac terminal complained: -bash: arm-none-eabi-gdb: command not found.

There seems to be a Homebrew problem not installing arm-none-eabi-gdb.
Found a script to fix that, but that didn't work!

Installed arm-none-eabi-gdb with Homebrew, now I get the following error.

Python Exception <type 'exceptions.ImportError'> No module named gdb:
warning:
Could not load the Python gdb module from `/Users/ibush/bin/arm-none-eabi/share/gdb/python'.
Limited Python support is available from the _gdb module.
Suggest passing --data-directory=/path/to/gdb/data-directory.

How can I fix this? Start all over again?   :o
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: mauriciovrc on August 03, 2018, 03:30:15 AM
Hi guys! I'm new with magic lantern and don't understand so much about this. Someone can tell me how I install the firmware in 80OD? I didn't understand if I get ML just installing the firmware availably here.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Audionut on August 03, 2018, 05:38:19 AM
Someone can tell me how I install the firmware in 80OD?  I didn't understand if I get ML just installing the firmware availably here.

There is no ML currently available for the 800D.  There is a bunch of work that must be completed first before ML is available for the 800D.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Ant123 on August 07, 2018, 11:06:24 PM
Canon released firmware update (https://www.usa.canon.com/internet/portal/us/home/support/details/cameras/eos-m-series-digital-cameras/eos-m50-body?subtab=downloads-firmware) for EOS M50.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on August 08, 2018, 05:55:59 PM
Looks very much like DIGIC 7. Dual core.

Code: [Select]
EC412 READY
EC412 ICU Firmware Version 1.0.1 ( 6.8.0 )
ICU Release DateTime May 23 2018 15:50:06
...
[CPU0] [        init:e014499b ] task_create(PowerMgr, prio=20, stack=400, entry=e01448ed, arg=0)
[CPU0] [        init:e0558f51 ] task_create(DbgMgr, prio=1f, stack=0, entry=e0558ecf, arg=c81c78)
[CPU0] [        init:e0097255 ] CreateStateObject(DMState, 0xe09d49c0, inputs=22, states=2)
[CPU0] [        init:e004c24b ] task_create(EEPROM, prio=1f, stack=400, entry=e004bea5, arg=0)
[CPU0] [        init:e0044ea9 ] task_create(ROM0R, prio=11, stack=400, entry=e00448c1, arg=620004)
[CPU0] [        init:e0044ebb ] task_create(ROM1R, prio=11, stack=400, entry=e00448c1, arg=640006)
...
[CPU0] [        init:e0622337 ] register_func('EnableBootDisk', e062228b, 0)
[CPU0] [        init:e0622343 ] register_func('DisableBootDisk', e0622295, 0)
...
[CPU0] [        init:e0050521 ] task_create(Startup, prio=15, stack=2800, entry=e0050415, arg=c826a0)
[CPU0] [        init:e0040905 ] task_create(TaskMain, prio=1d, stack=0, entry=e0040525, arg=0)
[CPU0] [     Startup:e0558f51 ] task_create(PropMgr, prio=14, stack=0, entry=e0558ecf, arg=cc9264)

akashimorino
[CPU0] [    TaskMain:e00461e9 ] register_func('drysh', e07393e9, 0)
[CPU0] [    TaskMain:e00461ff ] register_func('NewTaskShell', e00461ad, 0)
[CPU0] [    TaskMain:e00461c9 ] task_create(EvShel, prio=18, stack=8000, entry=e0046105, arg=0)
[CPU0] [      EvShel:e05773eb ] task_create(LowConsole, prio=19, stack=800, entry=e005153d, arg=0)
[CPU0] [      EvShel:e05773eb ] task_create(ConsoleSvr, prio=18, stack=800, entry=e0051141, arg=0)

Open Console EC412[1]>...

EC412[1]>drysh

Dry[WarpPUX]> ?
[Kern]
 extask  memmap  meminfo  mkcfg  dminfo  exobjinfo  stdlibcfg  efatcfg
 sysvers  xd  xm  prio  resume  suspend  release  sem  mutex  event  mq  exit

Dry[WarpPUX]> memmap
e008f6c0 : Exception vector
000dc870 : Heap start
           0x00114920(1132832)
001f1190 : Heap end
001f1190 : DRYOS system object
           0x000094e0(38112)
001fa670 : DRYOS system memory
           0x000e2200(926208)
000dc070 : Error exception stack start (PU0)
           0x00000400(1024)
000dc470 : Error exception stack end (PU0)
000dc470 : Error exception stack start (PU1)
           0x00000400(1024)
000dc870 : Error exception stack end (PU1)
df000000 : IRQ exception stack start (PU0)
           0x00001000(4096)
df001000 : IRQ exception stack end (PU0)
df001000 : IRQ exception stack start (PU1)
           0x00001000(4096)
df002000 : IRQ exception stack end (PU1)

Dry[WarpPUX]> meminfo -m
Malloc Information (onetime type)
  Start Address       = 0x000dc878
  End Address         = 0x001f0ec0
  Total Size          = 0x00114648 (  1132104)
  Allocated Size      = 0x000018c8 (     6344)
  Allocated Peak      = 0x000018c8 (     6344)
  Allocated Count     = 0x00000008 (        8)
  Free Size           = 0x00112d80 (  1125760)
  Free Block Max Size = 0x00112d80 (  1125760)
  Free Block Count    = 0x00000001 (        1)

Dry[WarpPUX]> sysvers
SystemIF 0.97
DRYOS version 2.3, release #0060+p2
 MACH 0.50

TODO: figure out LED address(es), bootloader display registers and a way to dump the ROM. Currently running it from a modified 200D bootloader.

Edit: might have found the LEDs (drive values: on = 0xD0002, off = 0xC0003)
- 0: SD card LED 0xD01300E4
- 6: WLAN LED 0xD01300E4 (same LED?!)
- 7, 8, 10, 11: 0xD01300E4 (same LED?!)
- 1, 2, 3, 4, 9: unknown 0xD01301A4
- 5: ?! (no obvious MMIO activity)

Volunteers willing to run untested code are welcome.
Title: Re: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Jonn3y on August 08, 2018, 11:24:39 PM
Hey guys,

I have a 77D here and want to help making some progress :)
do you still need some rom-dumps or something else?

Hope i can help a little!


// Jonny
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: morgan20 on August 09, 2018, 07:14:17 AM
Looks very much like DIGIC 7. Dual core.

Volunteers willing to run untested code are welcome.

Hi there! I own a 6D2. Could you please tell me more about running the untested code? How dangerous is it?

If the code damages the camera, will you help to recover it if it's possible (with another code, for example)?

I'm kinda experienced Linux user and a Java (with a little C) programmer. Sadly, I'm not much into low-level programming.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on August 09, 2018, 09:02:43 AM
For DIGIC 7 models, the next step is porting the 80D startup code (https://www.magiclantern.fm/forum/index.php?topic=19737.msg200895;topicseen#msg200895) (i.e. running user code alongside Canon firmware). I expect this step to be straightforward, so it's left as an exercise to the owners of these cameras. You can debug the startup code in the emulator; once you get it working, just ask me to enable the boot flag so you can test it on the camera.

The previous post was for M50 ( DIGIC 8 ). On this camera, I don't know yet how the bootloader looks like, and the code written for DIGIC 7 didn't work, so I'll probably attempt to dump the ROM directly from main firmware. The tests you'll run are:
- jumping to Canon firmware (expecting to be identical to DIGIC 7, i.e. jumping to 0xE0040000)
- LED blinking (testing the above addresses)
- LED blinking from main firmware (if I'll get this working in QEMU)
- ROM dumping from main firmware (could not test this one in QEMU yet)
- other tests (CPU model, diagnostic logs etc)

After publishing the ROM dumper, I'll update the emulator, attempt to enable the boot flag and get some diagnostic logs. Further progress will require a developer with a camera in their hands and plenty of spare time for experiments. If that describes you, your contribution will be more than welcome. I'll be here to help if you get stuck, but please be aware I'm not interested in maintaining yet another camera port alone.

If the code damages the camera, I'll try to help, but cannot guarantee success.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: morgan20 on August 10, 2018, 06:23:04 AM
For DIGIC 7 models, the next step is porting the 80D startup code (https://www.magiclantern.fm/forum/index.php?topic=19737.msg200895;topicseen#msg200895) (i.e. running user code alongside Canon firmware). I expect this step to be straightforward, so it's left as an exercise to the owners of these cameras. You can debug the startup code in the emulator; once you get it working, just ask me to enable the boot flag so you can test it on the camera.

Hmm, given that I have no experience in reverse engineering, this one is gonna be tough. I'll see if I can do anything, but the success for me in that task is gonna be almost impossible.
Although, I've read that DIGIC 7 are quite the same as DIGIC 6, just dual core, and this kinda makes me wonder why we can't run the DIGIC 6 code on a single DIGIC 7 core?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on August 10, 2018, 07:27:06 AM
Short answer: because nobody tried yet.

Long answer: generally it won't work out of the box, even on nearly identical generations, because the code is tightly tied to Canon firmware. Being "mostly identical" just means most of the code can be reused (i.e. not rewritten from scratch), but it generally needs some adjustments.

Nearly every minor firmware update has the functions we want to call at different addresses (https://www.magiclantern.fm/forum/index.php?topic=19417.0). At least these will have to be adjusted, but this is generally the easiest step (a bit time-consuming, but can be automated to some extent).

Besides, each camera model has its own quirks; even cameras from the same generation will have differences beyond just different stubs. Some very close models are 650D and 750D, for example, but even there, not everything works just by changing the stub addresses. Other close models are 80D, 750D and 760D - in this case, I'd expect the startup code to work out of the box just by tweaking the addresses, but nobody tried. Beyond startup code, I'd expect 750D and 760D to start diverging from 80D.

Here, DIGIC 7 is definitely not the same DIGIC 6. There is a new processor, a new startup code, two cores that have to run in sync, a new memory layout, a memory mapping unit (previous models only had a memory protection unit) and so on. Overall, they are based on the same EOS codebase we are familiar with, but that doesn't mean the old code will run out of the box.

The similarity I've mentioned was at hardware level, i.e. many peripherals (things other than CPU and RAM) identified on DIGIC 6 could be used to emulate DIGIC 7 firmware either out of the box or with minor adjustments (such as different register addresses).

The screenshots you have seen were created with portable code (the recovery (https://bitbucket.org/hudson/magic-lantern/branch/recovery) branch, which is limited to bootloader experiments). This code attempts to locate firmware functions on the fly, with pattern matching, and can run from DIGIC 2 all the way to DIGIC 7. However, what can be done in a portable way is quite limited and relies on similarity between Canon firmwares. Sooner or later, you will need "if" branches with model-specific or generation-specific code.

The DIGIC 7 cameras appear to be very similar; that is, I'd expect most of the knowledge gained by analyzing one model to apply to all others in this group. DIGIC 8 starts to diverge a bit, but I still believe D7 and D8 are a lot more similar than D6 and D7 (they have the same ROM layout, the same startup code, similar - possibly the same - dual-core configuration and so on). Maybe it's best to move M50 in its own thread, but for now I'm analyzing all these models together.

One significant difference between D7 and D8: the portable code did not quite work out of the box on M50. Expecting the bootloader changes to be minor, but unable to guess them from the firmware update. The portable code ran, to some extent, so we could tell the code is running and we could change the error screen, but could not display any custom things and could not guess the LED address. Figuring things out that way would have been possible, but tedious; luckily, the firmware update came out earlier than expected.

I'm going to implement the startup code for M50, so you can compare it to 80D and see what are the parts that may need tweaking.



Edit: committed startup code for both M50 (https://bitbucket.org/hudson/magic-lantern/commits/4d8840f63b15dde45ba27272530f0e0ab0fe8372) and 200D (https://bitbucket.org/hudson/magic-lantern/commits/89262376d7de0b4828b3cc6fde444c38f5874a34), as it was easier to debug this way. Testers welcome (contact me by PM).

Porting to 6D2, 77D and 800D should now be just a matter of pattern matching (https://www.magiclantern.fm/forum/index.php?topic=12177.0) (in theory).
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: morgan20 on August 12, 2018, 05:03:40 AM
This sounds promising! Thanks for the links, I'll be checking this out.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: todd3835 on August 14, 2018, 12:51:44 PM
I have a 77D and would be willing to help test things if needed. I don't know that I have the knowledge to help further than that :(
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: critix on August 19, 2018, 08:06:48 AM
Hi.
I need ROM dump file for 200D and M50.
Thanks.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on August 20, 2018, 09:21:13 PM
Some news:

- after fixing some cache routines (https://bitbucket.org/hudson/magic-lantern/commits/b63d437586cb90dcd440c4ddfef411dcd2f576ec), the startup code was confirmed to work on 200D by two testers (vissie and deathline)
- the same startup code refused to work on M50, although it works in QEMU and the firmwares seem pretty much identical (couldn't figure out why)
- on M50, the two LED addresses mentioned earlier are both valid (green led above LCD and red led used for autofocus - confirmed by DrWeez)

That means:
- I'm ready to enable the boot flag on 200D, so you can run your own code on the camera
- we can get RAM dumps, take pictures and run other simple code sequences
- we might be able to get debug messages (not confirmed yet - confirmed by vissie)
- we might be able to save a 14-bit DNG, just like we did on 80D (https://www.magiclantern.fm/forum/index.php?topic=17360.msg200479#msg200479)
- other DIGIC 7 models can reach the same stage with minimal effort (https://www.magiclantern.fm/forum/index.php?topic=12177.0,); once that is done, I'm ready to enable the boot flag there as well
- for M50, we are going to use the CHDK soundcard method (http://chdk.wikia.com/wiki/Obtaining_a_firmware_dump#Using_soundcard_input) for "blinking" the bootloader out of the camera

That's it for today.



Edit: here's a diagnostic log from 200D, from vissie:
Code: [Select]
00000000>       init:001b6acf:00:0f: Logging started.
00000000>       init:913:00:05: [MEM] InitializePermanentMemory 0 4636784
000001B0>       init:99103:89:16:
K417 ICU Firmware Version 1.0.1 ( 5.0.2 )
000001D2>       init:99100:89:05:
ICU Release DateTime 2017.09.21 12:53:23
00000329>       init:991503:00:03: [SEQ] CreateSequencer (Startup, Num = 6)
00000372>       init:991699:00:03: [SEQ] NotifyComplete (Cur = 0, #x, Flag = #x)
000009BC>     SFRead:906091:02:05: PROPTUNEAD_CreateFROMPropertyHandleToDRAM Addr:0x416a2c00
00000A36>     SFRead:9497:02:03: PROPCOMBO_LoadProperty(395)
00000A81>    RomRead:9117:02:05: PROPAD_CreateFROMPropertyHandle DRAMAddr 0x421f8400
00005EFD>     SFRead:991699:00:03: [SEQ] NotifyComplete (Cur = 0, #x, Flag = #x)
00009579>    RomRead:991699:00:03: [SEQ] NotifyComplete (Cur = 0, #x, Flag = #x)
000095A8>    Startup:991503:00:05: [SEQ] seqEventDispatch (Startup, 0)
000095C4>    Startup:99115:89:05: startupEntry
0000ABF4>    Startup:9913009:00:03: [PWM] PWM_Initialize
0000AC65>    Startup:92125:00:03: [ADC] InitializePollingADC
0000B211>      init1:9130:d2:03: [FMID]FMID_SYS_Initialize(#x, #x)
0000D3D5>    Startup:921201:00:03: [ ADC ] Calibration Completed, #08x
0000E603>    PropMgr:997595:81:03: PROP_RegisterMultiConvert : 3, 6
0000E629>    PropMgr:997595:81:03: PROP_RegisterMultiConvert : 1, 1
0000E81D>    PropMgr:99339:81:03: @@@JudgeRestoreFlavorPC 1062
0000EB7F>    Startup:001b686f:00:0f: [0] *** mpu_send(06 04 02 00 00 00)                             ; Init group
0000ECF8>    PropMgr:9143:37:03: emSlaveChangeCBR : AUTO_POWEROFF (1)
0000ED2D>    PropMgr:91591:37:03: emSlaveChangeCBR : UILOCK (#x)
0000EF69>    PropMgr:001b68db:00:0f: [0] *** mpu_recv(06 05 01 00 03 00)                             ; PROP_SHOOTING_MODE
0000F013>    PropMgr:9934067:81:03: ChangeAEMode -> 3 @AE_MODE_DIAL
0000F070>    PropMgr:001b686f:00:0f: [1] *** mpu_send(08 06 01 a7 00 01 00 00)                       ; ???
0000F09B>    PropMgr:99601:81:03: Active Adjective & Situation 3->3
0000F0DC>    PropMgr:99753:81:03: ReqChangeCBR : Adjective 0, 0
0000F0F8>    PropMgr:997519:81:03: Not ExecMultiConvert Already None : Adjective 0, 0
0000F130>    PropMgr:997503:81:03: Not ExecMultiConvert : Situation 0
0000F18F>    PropMgr:996375:81:03: !! Convert End !!
0000F1B8>    PropMgr:001b68db:00:0f: [1] *** mpu_recv(06 05 01 99 00 00)                             ; PROP 80040057
0000F234>    PropMgr:001b68db:00:0f: [2] *** mpu_recv(06 05 01 9a 00 00)                             ; PROP 80040058
0000F259>    PropMgr:91005:02:03: DataType = 0x2000000 fModify = TRUE
0000F2DD>    PropMgr:001b68db:00:0f: [3] *** mpu_recv(06 05 01 06 30 00)                             ; PROP_APERTURE
0000F36F>    PropMgr:001b68db:00:0f: [4] *** mpu_recv(06 05 01 3f 00 00)                             ; PROP_FLASH_ENABLE
0000F707>    PropMgr:001b68db:00:0f: [5] *** mpu_recv(06 05 01 99 00 00)                             ; PROP 80040057
0000F755>    PropMgr:9970:81:03: PROP_STROBO_FIRING 0 Last 0
0000F773>    PropMgr:9970:81:03: dwLastStroboFiring = 0  stroboFiring = 0
0000F79E>    PropMgr:001b68db:00:0f: [6] *** mpu_recv(06 05 01 9a 00 00)                             ; PROP 80040058
0000F81A>    PropMgr:001b68db:00:0f: [7] *** mpu_recv(06 05 01 06 30 00)                             ; PROP_APERTURE
0000F8BB>    PropMgr:001b68db:00:0f: [8] *** mpu_recv(06 05 01 3f 00 00)                             ; PROP_FLASH_ENABLE
0000F92C>    PropMgr:993475:81:03: PROP_CHROMATISM 0 (Excluding:0)
0000F956>    PropMgr:001b68db:00:0f: [9] *** mpu_recv(06 05 01 4f 00 00)                             ; PROP_FIXED_MOVIE
0000F9E1>    PropMgr:993475:81:03: PROP_DISTORTION_COMP 0 (Excluding:0)
0000FA5D>    PropMgr:993472:81:03: PROP_LIGHT_FALLOFF_COMP 0 (Excluding:0)
0000FC2B>    PropMgr:9970:81:03: PROP_STROBO_FIRING 0 Last 0
0000FC45>    PropMgr:9970:81:03: dwLastStroboFiring = 0  stroboFiring = 0
0000FC70>    PropMgr:993409:81:03: FixedMovie New 0 Last 0
0000FDA7>    PropMgr:9934373:81:03: PROP_TOUCH_SHUTTER 1
0000FE34>    PropMgr:99343:81:03: PROP_CREATIVE_TOUCH_SHUTTER 1
0000FEB9>    PropMgr:001b686f:00:0f: [2] *** mpu_send(22 20 0e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; ???
0000FEDB>    PropMgr:9161:d6:03: LvLensDataMasterResultCBR
0000FF2D>    PropMgr:9161:d6:03: PowerZoomAdapterInfoCBR
0000FF79>    PropMgr:9161:d6:03: FactErrLensDataInfoCBR
0001021E>     NFCMgr:902297:3e:03: [BLE] BLEMGR_InitializeParam
000102BF>     NFCMgr:001b686f:00:0f: [3] *** mpu_send(06 05 03 8a 00 00)                             ; ???
0001031A>     NFCMgr:001b686f:00:0f: [4] *** mpu_send(06 04 02 14 00 00)                             ; ???
00010378>     NFCMgr:9200:3e:03:  NFCI2C_SetParam 1 3 0xa8 0x0
000103B2>     NFCMgr:9253:3e:03:  PROP_SPECIAL_OPTION Wlan off (0x0)
00010A77>   PowerMgr:001b68db:00:0f: [10] *** mpu_recv(30 2f 02 0d 00 00 00 00 01 00 00 00 00 00 00 01 00 01 02 00 00 00 00 00 01 01 00 00 00 00 00 00 00 00 00 00 01 00 01 00 0f 00 07 01 00 00 00 00) ; Card group
00010BEE>    PropMgr:910:01:03: DivideMediaEtcInit2Data[24] comID 1 dataID 91 data 0xf00
00010C1B>    PropMgr:910:01:03: DivideMediaEtcInit2Data[25] comID 1 dataID 9c data 0x700
000110F0>   PowerMgr:001b68db:00:0f: [11] *** mpu_recv(5e 5c 02 0f 01 00 00 08 01 01 00 00 00 00 00 00 00 00 00 00 09 c4 00 00 00 0c 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 00 00 02 03 01 01 00 00 00 00 00 00 00 00 00 03 01 2c 00 00 0b b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; Movie group
000111A3>    PropMgr:910:01:03: RecMovieParam 0 0 2500 12 0 3 1 0
000112C2>    PropMgr:99346:81:03: @@@ PROP_MOVIE_CFILTER 0
0001190F>   PowerMgr:001b68db:00:0f: [12] *** mpu_recv(48 46 02 10 00 00 00 00 00 00 01 00 00 00 03 03 03 03 00 00 00 00 00 00 00 5c 00 01 ba 50 00 00 00 00 00 01 ff 00 00 02 01 01 00 03 00 01 00 04 00 00 01 05 00 01 01 00 01 00 00 03 03 00 00 00 00 00 00 00 00 00 00 00) ; AF group
00011D83>   PowerMgr:001b68db:00:0f: [13] *** mpu_recv(42 40 02 11 00 01 00 00 00 00 01 00 ff 01 00 00 00 00 00 00 00 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00) ; AF2 group
00011DF5>    PropMgr:91361:01:03: DivideLensInit2Data[3] comID 1 dataID 4 data 0x0
00011E26>    PropMgr:001b68db:00:0f: [14] *** mpu_recv(06 05 01 b6 01 00)                            ; ???
00011EA5>   PowerMgr:001b68db:00:0f: [15] *** mpu_recv(06 05 01 b5 01 00)                            ; ???
00011F24>   PowerMgr:001b68db:00:0f: [16] *** mpu_recv(06 05 01 98 00 00)                            ; PROP 80040056
00012063>   PowerMgr:001b68db:00:0f: [17] *** mpu_recv(12 10 02 04 0c 00 00 00 00 00 00 43 00 00 00 00 00 00) ; PROP_CFN
00012A01>   PowerMgr:99157:00:03: [STARTUP]startupCompleteCallback 0x2
00012A22>   PowerMgr:991699:00:03: [SEQ] NotifyComplete (Cur = 1, #x, Flag = #x)
00012A9A>   PowerMgr:001b68db:00:0f: [18] *** mpu_recv(94 93 02 0e 03 03 01 00 00 00 00 00 00 00 00 00 14 50 00 00 00 00 87 00 00 01 03 00 00 01 03 00 00 01 00 00 01 00 00 0a 00 70 30 00 00 00 00 00 00 00 00 01 03 00 00 88 48 00 00 80 48 80 48 80 48 88 48 78 48 80 48 78 48 70 00 00 03 03 01 00 00 00 00 02 00) ; Mode group
00012B26>    PropMgr:001b68db:00:0f: [19] *** mpu_recv(06 05 03 37 00 00)                            ; PROP_MIRROR_DOWN_IN_MOVIE_MODE
00012BD6>    PropMgr:001b68db:00:0f: [20] *** mpu_recv(0a 08 03 2f 00 40 00 00 00 00)                ; PROP_SPECIAL_OPTION
00012C4D>    PropMgr:001b68db:00:0f: [21] *** mpu_recv(06 05 03 20 01 00)                            ; PROP_STARTUP_CONDITION
00012C90>    PropMgr:9934067:81:03: ChangeAEMode -> 3 @AE_MODE_DIAL
00012CB3>    PropMgr:996375:81:03: !! Convert End !!
00012CDB>    PropMgr:001b68db:00:0f: [22] *** mpu_recv(06 05 03 76 00 00)                            ; ???
00012E40>    PropMgr:9119:01:03: DivideDataInit2Data[4] comID 1 dataID 4 data 0x0
00012E6C>    PropMgr:9119:01:03: DivideDataInit2Data[8] comID 1 dataID b data 0x0
00012E95>    PropMgr:9119:01:03: DivideDataInit2Data[10] comID 1 dataID e data 0x1450
00012EF5>    PropMgr:9119:01:03: DivideDataInit2Data[22] comID 1 dataID 1f data 0xa
00012F6C>    PropMgr:9970:81:03: PROP_STROBO_FIRING 0 Last 0
00012F88>    PropMgr:9970:81:03: dwLastStroboFiring = 0  stroboFiring = 0
00012FE8>    PropMgr:993475:81:03: PROP_MULTIPLE_EXPOSURE_SETTING 0
0001300E>    PropMgr:993475:81:03: PROP_HDR_SETTING 0
00013046>    PropMgr:9934309:81:03: @@@ PROP_LV_CFILTER 0
0001306F>    PropMgr:993475:81:03: PROP_GIS_SETTING Func 0
0001308B>    PropMgr:9119:01:03: DivideDataInit2Data[50] comID 1 dataID 47 data 0x20a
000130AE>    PropMgr:9119:01:03: DivideDataInit2Data[51] comID 1 dataID 57 data 0x100
000130D7>    PropMgr:993425:81:03: PROP_SHUFFLE_MODE 0x0 ConvertMode 0x0
000130F3>    PropMgr:9119:01:03: DivideDataInit2Data[53] comID 1 dataID 88 data 0x3c
0001315A>    PropMgr:9119:01:03: DivideDataInit2Data[59] comID 1 dataID 9e data 0x40
000131D3>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555555, 0x55bbef(1)
0001325E>    PropMgr:9934141:81:03: StartupCondition : 1, 0
0001337D>    PropMgr:001b68db:00:0f: [23] *** mpu_recv(64 62 02 12 01 25 50 01 eb 00 10 01 2c 91 77 9a ef 08 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 04 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 00 00 00 00 00 00 00 10 3e 00 00 00 00 00 00 00 00 00 00) ; Lens group
00013402>    PropMgr:001b68db:00:0f: [24] *** mpu_recv(06 05 03 35 01 00)                            ; PROP_BATTERY_REPORT_COUNTER
00013494>    PropMgr:910:01:03: Complete WaitID = 0xd5555555, 0x55bbef(0)
000134C4>    PropMgr:910007:01:03: SpecialComplete ID = 0xd5555555, 0xd5555555 3011
0001350D>    PropMgr:001b686f:00:0f: [5] *** mpu_send(08 06 00 00 02 0e 00 00)                       ; Complete WaitID = Mode group
00013588>    Startup:991503:00:05: [SEQ] seqEventDispatch (Startup, 1)
000135B6>    Startup:9912:89:05: startupPrepareProperty
00013649>    PropMgr:001b68db:00:0f: [25] *** mpu_recv(1c 1b 03 1d 64 03 00 00 00 00 00 4c 50 2d 45 31 37 00 00 00 00 01 00 24 42 05 d2 00) ; PROP_BATTERY_REPORT
000136D4>    PropMgr:001b68db:00:0f: [26] *** mpu_recv(06 04 03 36 00 00)                            ; PROP_BATTERY_REPORT_FINISHED
00013733>    PropMgr:9915243:88:03: HotPlug TimelapseSetting = 0
00013776>    Startup:001b68db:00:0f: [27] *** mpu_recv(08 07 03 7e ff ff ff 00)                      ; ???
000137BD>    Startup:99607:88:03: # 0 0 1 1 0
000137FE>    PropMgr:001b68db:00:0f: [28] *** mpu_recv(06 05 03 38 93 00)                            ; PROP 80030035
00013872>    Startup:991566:88:03: CreateTask Master End
0001389F>    Startup:001b68db:00:0f: [29] *** mpu_recv(08 06 01 a7 00 01 00 00)                      ; ???
0001395B>    PropMgr:99193:89:03: PROP_GPS_AUTO_TIME_SETTING 0
0001398B>    Startup:99157:00:03: [STARTUP]startupCompleteCallback 0x20000000
000139AE>    Startup:991699:00:03: [SEQ] NotifyComplete (Cur = 2, #x, Flag = #x)
000139C8>    Startup:9915:89:03: startupPrepareProperty : CLASSID_FLAG_PROPAD
000139E4>    Startup:9360:19:03: FM_Initialize (0, 1, 0)
00013A53>    PropMgr:936065:19:03: fmResultCBR (#x)
00013B16>    PropMgr:001b68db:00:0f: [30] *** mpu_recv(08 06 01 a7 00 00 00 00)                      ; ???
00013BE0>    PropMgr:9360:19:03: PROP_HDD_DCIM_PATH (/)
00013CD2>    Startup:9170:1c:03: FC_Initialize [drive:0 1 0][ClassID:28]
00013CEF>    Startup:91799:1c:03: FC_Initialize [86608 655360]
00014190>     RTCMgr:976:00:05: [RTC] SPECIAL_OPTION 0x0, 0x4000
00014241>     RTCMgr:001b686f:00:0f: [6] *** mpu_send(08 07 03 6a 00 02 00 00)                       ; ???
00014296>     RTCMgr:9171:00:05: [RTC] PermitCharge already Permit 0x20
00014306>    Startup:916511:80:03: srmGetShootMemAreaAddress(): Area[4] isn't Exist.
000143A5>    PropMgr:001b686f:00:0f: [7] *** mpu_send(0a 08 03 06 00 00 00 00 00 00)                 ; PROP_AVAIL_SHOT
00014413>    PropMgr:001b686f:00:0f: [8] *** mpu_send(06 04 03 10 00 00)                             ; PROP 80030008
0001454C>    Startup:001b686f:00:0f: [9] *** mpu_send(06 05 03 07 ff 00)                             ; PROP_BURST_COUNT
00014594>    Startup:9162007:80:03: CreatePackHeapObject
000145F0>    Startup:90439:80:03: AllocateMemoryUnit For OnlyMem1
0001460B>    Startup:90439:80:03: AllocateMemoryUnit For OnlyMem1
0001461E>    Startup:90439:80:03: AllocateMemoryUnit For OnlyMem1
00014630>    Startup:90439:80:03: AllocateMemoryUnit For OnlyMem1
00014765>    Startup:99:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[1]
00014793>    Startup:99:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[2]
000147FE>    Startup:916955:80:03: RearrangeMemMgr sub 1 0 0
0001485C>    Startup:9169509:80:03: fDevDone 1, dwLvLock 0
00014877>    Startup:916960:80:03: 0 0 0
00014893>    Startup:916961:80:03: PROP_MEMORY_STATUS(SELF) (10->)13 (OTHER) 0, 5276
000148B3>    Startup:916960:80:05: Deliver PROP_MEMORY_STATUS 19
000148FB>    Startup:9163905:80:03: MemMgr(IMAGE) 0 0
00014915>    Startup:9163905:80:03: MemMgr(IMAGE) 0 0
0001492C>    Startup:9163905:80:03: MemMgr(IMAGE) 0 1
00014941>    Startup:9163905:80:03: MemMgr(IMAGE) 0 0
000149E3>     RscMgr:9957:35:03: this->dwCardStatus[0] = 0x0(474)
00014A10>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014A29>     RscMgr:916960:80:03: 0 0 0
00014A5C>     RscMgr:9957:35:03: this->dwCardStatus[1] = 0x0(474)
00014A80>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014A95>     RscMgr:916960:80:03: 0 0 0
00014AC5>     RscMgr:995:35:03: PROP_PC_HDD_STATUS = 0x1
00014B2E>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014B46>     RscMgr:916960:80:03: 0 0 0
00014B99>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014BAE>     RscMgr:916960:80:03: 0 0 0
00014BF9>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014C10>     RscMgr:916960:80:03: 0 0 0
00014CC2>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014CD9>     RscMgr:916960:80:03: 0 0 0
00014D15>     RscMgr:99223:35:03: PROP_SAVE_MODE = 0x1
00014D66>     RscMgr:9927:35:03: PROP_CARD0_FOLDER_NUMBER
00014DA4>     RscMgr:9927:35:03: PROP_CARD1_FOLDER_NUMBER
00014E46>     RscMgr:995:35:03: PROP_NUMBER_OF_CONTINUOUS_MODE BaseDcfNo 3117
00014E84>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014E9C>     RscMgr:916960:80:03: 0 0 0
00014ED4>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014EEA>     RscMgr:916960:80:03: 0 0 0
00014F51>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00014F69>     RscMgr:916960:80:03: 0 0 0
00014F7F>     RscMgr:9931:35:03: PROP_CARD_EXTENSION 0
0001513F>     RscMgr:9977:35:03: PC_CLUSTER_SIZE = 0x10000
00015221>     RscMgr:995:80:03: SetAutoIsoCode 0x83
0001523C>     RscMgr:9963:35:03: ChangeAutoIsoCode Factor:1 AutoIsoCode:131 -> 131
00015288>     RscMgr:995:80:03: SetAutoIsoCode 0x83
0001529E>     RscMgr:9963:35:03: ChangeAutoIsoCode Factor:2 AutoIsoCode:131 -> 131
000152E4>     RscMgr:99:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[3]
00015305>     RscMgr:99:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[4]
00015328>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
0001533F>     RscMgr:916960:80:03: 0 0 0
00015386>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
0001539B>     RscMgr:916960:80:03: 0 0 0
000153F1>     RscMgr:99:35:03: RealClearBusy(0x40000) 0x0->0x0,0x0(0x0)[5]
00015441>     RscMgr:99:35:03: RealClearBusy(0x40000) 0x0->0x0,0x0(0x0)[6]
0001548D>     RscMgr:99:35:03: RealClearBusy(0x40000) 0x0->0x0,0x0(0x0)[7]
000154D7>     RscMgr:99:35:03: RealClearBusy(0x40000) 0x0->0x0,0x0(0x0)[8]
0001550B>     RscMgr:995:80:03: SetAutoIsoCode 0x78
00015521>     RscMgr:9963:35:03: ChangeAutoIsoCode Factor:0 AutoIsoCode:131 -> 120
0001557C>     RscMgr:99:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[9]
00015599>     RscMgr:99:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[10]
000155BC>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
000155E4>     RscMgr:916960:80:03: 0 0 0
00015655>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
0001566F>     RscMgr:916960:80:03: 0 0 0
000156C8>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
000156DF>     RscMgr:916960:80:03: 0 0 0
000157CF>     RscMgr:9911:35:03: RU CLUSTER_SIZE[0] = 0x407BA670
0001582C>     RscMgr:9911:35:03: RU CLUSTER_SIZE[1] = 0x407BA67C
000158F9>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 0, ClassID = 53
00015930>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 11, ClassID = 53
0001594B>   EventMgr:9972:37:03: Already SW1OFF
00015985>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 14, ClassID = 53
000159AF>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 15, ClassID = 53
000159D5>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 4, ClassID = 53
00015B31>    Startup:93650:19:03: FM_RegisterSpaceNotifyCallback
00015B55>    Startup:940111:1a:05: MRK_RegisterSpaceNotifyCallback
00015B72>    Startup:9755:1a:03: RegisterSpaceNotifyCallback : DriveNo = 2
00015B91>    Startup:94933:19:03: voiRegisterSpaceNotifyCallback : DriveNo = 2
00015BAD>    Startup:929099:19:03: [GPS] gpsRegisterSpaceNotifyCallback : DriveNo = 2
00015BD2>    Startup:93267:19:03: RegisterSpaceNotifyCallback : DriveNo = 2
00015C5E>    Startup:913:15:03: @Startup FIO_RegisterSpaceNotifyCallback(1,0xe04d4b0b,0x2) L:1051
00015C8C>    Startup:91703:1c:03: FcmcRegisterSpaceNotifyCallback : DriveNo = 2
00015CA8>    Startup:93650:19:03: FM_RegisterSpaceNotifyCallback
00015D31>    Startup:9124:39:05: InitializeJobClass (ID = 3158, Num = 15)
00015D52>    Startup:9121:39:05: InitializeJobClass 12 206 0 5544
00015DBA>    PropMgr:91:39:03: [BIND] dcsResultCBR (#x)
00015F48>    PropMgr:97:39:03: PROP_GPS_INFORMATION fGPSConnect = 0x0
00015F6B>    PropMgr:909:39:03: MPU 0x0 USB 0x0 WFT 0x0 INNER 0x0
00015F8E>    PropMgr:97:39:03: PROP_MPU_GPS fGPSConnect = 0x0
00015FA6>    PropMgr:909:39:03: MPU 0x0 USB 0x0 WFT 0x0 INNER 0x0
00016022>    PropMgr:91:39:03: @@@setDefaultImgDirection
00016083>    PropMgr:001b68db:00:0f: [31] *** mpu_recv(42 40 02 11 00 01 00 00 00 00 01 00 ff 01 00 00 00 00 00 00 00 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00) ; AF2 group
000160AC>    PropMgr:91:39:03: @@@setDefaultImgDirection
000160C8>    PropMgr:90:39:03: @@@setDefaultGPSParam
000160E0>    PropMgr:9101:39:03: PROP_GPS_DEVICE_ACTIVE INNER 0x0 fGPSConnect = 0x0
00016104>    PropMgr:925:39:03: PROP_NETWORK_SYSTEM 0x0
0001612E>    PropMgr:001b68db:00:0f: [32] *** mpu_recv(08 06 01 04 00 00 00 00)                      ; PROP_AF_MODE
000161D4>    PropMgr:001b68db:00:0f: [33] *** mpu_recv(08 06 01 a2 00 00 00 00)                      ; ???
0001625B>    PropMgr:001b68db:00:0f: [34] *** mpu_recv(06 05 01 06 30 00)                            ; PROP_APERTURE
00016307>    PropMgr:001b68db:00:0f: [35] *** mpu_recv(06 05 03 23 2c 00)                            ; ???
00016664>    PropMgr:001b68db:00:0f: [36] *** mpu_recv(32 30 03 24 54 41 4d 52 4f 4e 20 31 36 2d 33 30 30 6d 6d 20 46 2f 33 2e 35 2d 36 2e 33 20 44 69 20 49 49 20 56 43 20 50 5a 44 20 42 30 31 36 00 00 00) ; PROP_LENS_NAME
000166EC>    PropMgr:001b68db:00:0f: [37] *** mpu_recv(06 04 03 25 00 00)                            ; ???
00016802>    PropMgr:001b68db:00:0f: [38] *** mpu_recv(06 05 01 99 00 00)                            ; PROP 80040057
00016883>    PropMgr:001b68db:00:0f: [39] *** mpu_recv(06 05 01 9a 00 00)                            ; PROP 80040058
000168D2>    PropMgr:9101:39:03: PROP_BTDEVICE_CONNECT WFT 0x0 fGPSConnect = 0x0
00016914>    PropMgr:001b68db:00:0f: [40] *** mpu_recv(06 05 01 06 30 00)                            ; PROP_APERTURE
000169C6>    PropMgr:001b68db:00:0f: [41] *** mpu_recv(06 05 01 3f 00 00)                            ; PROP_FLASH_ENABLE
00016A03>    PropMgr:91361:01:03: DivideLensInit2Data[3] comID 1 dataID 4 data 0x0
00016B04>    PropMgr:9970:81:03: PROP_STROBO_FIRING 0 Last 0
00016B1F>    PropMgr:9970:81:03: dwLastStroboFiring = 0  stroboFiring = 0
00016B6B>    PropMgr:001b686f:00:0f: [10] *** mpu_send(06 05 01 2e 01 00)                            ; PROP_SAVE_MODE
00016BDE>   EventMgr:99705:37:05: emLockControl (TYPE_JOBSTATE = #x)
00016C36>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00016C4F>     RscMgr:916960:80:03: 0 0 0
00016D17>    PropMgr:001b686f:00:0f: [11] *** mpu_send(0a 08 03 0b 00 00 00 00 00 00)                ; PROP 80030007
00016E49>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 20, ClassID = 57
00016E98>    Startup:917:39:05: InitializeInnerDevelopJobClass (ID = 3158, Num = 16)
00016EBE>    Startup:9163:39:05: InitializeHDRShootJobClass ( Num = 13 )
00016ED9>    Startup:91621:39:05: InitializeHDRSaveAndEndJobClass ( Num = 37 )
00016EF3>    Startup:910:39:05: InitializeGISShootJobClass ( Num = 13 )
00016F0E>    Startup:91197:39:05: InitializeGISSaveAndEndJobClass ( Num = 28, 31 )
00016F46>    Startup:9195:39:03: InitializeShufflehootJobClass (ID = 3158, Num = 15)
00016FA5>    Startup:99661:d9:03: InitializeGUILock (PUB)
00017021>    PropMgr:001b686f:00:0f: [12] *** mpu_send(06 05 03 19 01 00)                            ; PROP_TFT_STATUS
00017047>    PropMgr:9161:d9:03: [GUI] MasterResultCBR
000170A0>    PropMgr:9911235:8a:03: terminateChangeCBR : SHUTDOWN (255)
000170BB>    PropMgr:9911357:00:03: [TERMINATE] SHUTDOWN init comp
000170D8>    PropMgr:99114:8a:03: terminateChangeCBR : AUTO_POWEROFF (1)
000170F9>    PropMgr:9911103:00:03: [TERMINATE] Abort init comp
000171B1>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 0, ClassID = 150
000171E1>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 1, ClassID = 150
0001720A>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 4, ClassID = 150
000172CD>    PropMgr:993:96:03: PROP_SHOOTING_TYPE (#x->#x)
000172EC>    PropMgr:993:96:03: PROP_AF_SHIFT_AFB_INFO (#x 0)
0001745B>    Startup:001b686f:00:0f: [13] *** mpu_send(06 05 01 56 00 00)                            ; ???
0001748F>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 0, ClassID = 225
000174CF>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 11, ClassID = 225
000174F3>   EventMgr:9972:37:03: Already SW1OFF
0001751F>   MainCtrl:996139:94:03: MeteringTimerStart
0001754B>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 7, ClassID = 225
00017574>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 1, ClassID = 225
0001759B>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 4, ClassID = 225
000175C2>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 6, ClassID = 225
000175E7>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 3, ClassID = 225
0001760E>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 2, ClassID = 225
0001763A>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 20, ClassID = 225
0001766E>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 24, ClassID = 130
00017698>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 25, ClassID = 130
000176C5>   EventMgr:001b68db:00:0f: [42] *** mpu_recv(08 06 01 04 00 00 00 00)                      ; PROP_AF_MODE
00017760>    PropMgr:001b68db:00:0f: [43] *** mpu_recv(08 06 01 a2 00 00 00 00)                      ; ???
00017823>   MainCtrl:993069:94:03: PROP_DISPLAY_OFF_SENSOR 1
00017866>   MainCtrl:993069:94:03: PROP_DISPSENSOR_CTRL 1
000178CB>   MainCtrl:99621:94:03: PROP_SHOOTING_TYPE 0
000178E6>   MainCtrl:99605:94:03: set_lv_act2 : 0 -1 1 0
00017920>   MainCtrl:99625:94:03: PROP_GUI_STATE 0
00017950>   MainCtrl:996105:94:03: PROP_LV_ACTION LV_STOP
00017965>   MainCtrl:99619:94:03: judge_lv_disp_busy(mode_change): 0 0 1 1 0
00017999>   MainCtrl:993069:94:03: PROP_LV_DISPBUSY not Busy
000179C7>   MainCtrl:996297:94:03: PROP_LV_LOCK LVLOCK_PERMIT
000179DD>   MainCtrl:99605:94:03: set_lv_act2 : 0 1 1 0
000179F2>   MainCtrl:99619:94:03: judge_lv_disp_busy(mode_change): 0 0 1 1 0
00017A1C>   MainCtrl:993069:94:03: PROP_DISABLE_PLAY_IMAGE Enable Play
00017A53>   MainCtrl:9961:94:03: JobState 0
00017A67>   MainCtrl:9962769:94:03: on_digi_event start
00017A7B>   MainCtrl:99605:94:03: set_lv_act2 : 0 1 1 0
00017A8F>   MainCtrl:99619:94:03: judge_lv_disp_busy(mode_change): 0 0 1 1 0
00017ACD>   MainCtrl:996219:94:03: PROP_AE_MODE m_AeMode=0x03 m_SetTv =0x70 ,m_ModeBulb=0
00017AF8>   MainCtrl:996219:94:03: PROP_SET_TV  m_SetTv =0x70 m_AeMode=0x03 ,m_ModeBulb=0
00017BBA>    PropMgr:001b68db:00:0f: [44] *** mpu_recv(0e 0d 04 30 00 00 00 00 00 00 00 00 00 00)    ; ???
00017BDE>   MainCtrl:993069:94:03: QRTime 2
00017C38>    PropMgr:001b68db:00:0f: [45] *** mpu_recv(06 05 01 48 01 00)                            ; PROP_LIVE_VIEW_MOVIE_SELECT
00017CB0>   MainCtrl:001b68db:00:0f: [46] *** mpu_recv(06 05 01 4b 01 00)                            ; PROP_LIVE_VIEW_VIEWTYPE_SELECT
00017D53>    PropMgr:001b68db:00:0f: [47] *** mpu_recv(06 05 01 49 01 00)                            ; PROP_LIVE_VIEW_AF_SYSTEM
00017D8D>   MainCtrl:993069:94:03: PROP_VARIANGLE_GUICTRL Enable
00017DB3>   MainCtrl:9930669:94:03: PROP_HEADPHONE_VOLUME_VALUE : 0
00017E0B>    PropMgr:001b68db:00:0f: [48] *** mpu_recv(06 05 01 12 00 00)                            ; PROP_WBB_GM
00017E26>   MainCtrl:993069:94:03: PROP_MOVIE_PLAY_VOLUME : 5
00017E65>   MainCtrl:993069:94:16: PROP_LCD_OFFON_BUTTON : 1
00017E9D>   MainCtrl:993069:94:03: PROP_LV_CFILTER 0
00017EC2>   MainCtrl:001b68db:00:0f: [49] *** mpu_recv(06 05 01 13 00 00)                            ; PROP_WBB_BA
00017EE9>   MainCtrl:99605:94:03: set_lv_act2 : 0 1 1 0
00017F2B>   MainCtrl:99619:94:03: judge_lv_disp_busy(mode_change): 0 1 1 1 0
00017FBF>   MainCtrl:996294:94:03: PROP_GUIGROUND_STATE 1
00018018>   MainCtrl:996105:94:03: PROP_LV_ACTION LV_STOP
0001804C>   MainCtrl:001b68db:00:0f: [50] *** mpu_recv(10 0e 01 8f 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP_LV_CFILTER
00018066>   MainCtrl:99619:94:03: judge_lv_disp_busy(mode_change): 0 1 1 1 0
0001814E>    PropMgr:001b68db:00:0f: [51] *** mpu_recv(0e 0c 01 b1 00 00 00 00 00 00 00 00 00 00)    ; ???
000181B8>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
000181E7>     RscMgr:001b68db:00:0f: [52] *** mpu_recv(06 05 01 03 00 00)                            ; PROP_DRIVE_MODE
000181FE>     RscMgr:916960:80:03: 0 0 0
0001827C>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
00018297>     RscMgr:916960:80:03: 0 0 0
00018351>    PropMgr:001b686f:00:0f: [14] *** mpu_send(06 05 04 0e 01 00)                            ; PROP 8002000D
0001838C>    PropMgr:916:01:03: LV_CFilter : kind 0 hv 0
000183AB>    PropMgr:919:01:03: Level 0 0 0 0 0 0 0 0
000183D5>    PropMgr:9934309:81:03: @@@ PROP_LV_CFILTER 0
00018440>   MainCtrl:993069:94:03: PROP_LV_CFILTER 0
0001847B>   MainCtrl:993069:94:03: PROP_LV_DISPBUSY Busy
000184A6>   MainCtrl:993069:94:03: PROP_LV_DISPBUSY Busy
000184CE>   MainCtrl:993069:94:03: PROP_LV_DISPBUSY Busy
000184F0>    PropMgr:9197:01:03: MovieCFilter : kind 0 hv 0
00018507>    PropMgr:919709:01:03: Level 0 0 0 0 0 0
00018526>    PropMgr:99346:81:03: @@@ PROP_MOVIE_CFILTER 0
00018575>   MainCtrl:993069:94:03: PROP_LV_DISPBUSY not Busy
00018617>    PropMgr:913:15:03: @PropMgr FIO_SuspendDelayFlush(0) L:709
00018645>   MainCtrl:996100:94:03: CardCover=0
0001865F>    PropMgr:9161:94:03: regist master CardCover
00018692>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 13, ClassID = 225
000186C0>    Startup:920661:3a:03: TA10_Initialize : Start
00018743>    PropMgr:001b686f:00:0f: [15] *** mpu_send(06 05 03 40 00 00)                            ; PROP 80030040
00018866>    PropMgr:92015:3a:03: ### TA10Setting Clear (OFF->OFF) ###
0001888D>    PropMgr:920139:3a:03: ChangePropCBR ShotsPlan 2 / TotalSheets 2
00018B69>    PropMgr:001b686f:00:0f: [16] *** mpu_send(0c 0b 03 53 02 00 48 81 81 00 00 00)          ; PROP 80030058
00018C03>    Startup:9203:3a:03: TA10_Initialize : End
00018C2D>    Startup:001b686f:00:0f: [17] *** mpu_send(0c 0b 03 53 02 00 48 81 81 00 00 00)          ; PROP 80030058
00018C5B>    Startup:993529:3c:03: HDR_Initialize : Start
00018D5A>    PropMgr:993141:3c:03: ### HDRSetting Clear (OFF->OFF) ###
00018D77>    PropMgr:9931:3c:03: ChangePropCBR HDRFunc 0
00018DCB>    Startup:99710:3c:03: HDRS_Initialize
00018DED>    Startup:9972997:3c:03: CreateStageClass
00018E78>    Startup:997211:3c:03: HDRS_Initialize : End
00018E90>    Startup:993643:3c:03: HDR_Initialize : End
00018EAB>    Startup:99361:3d:03: GIS_Initialize : Start
00018F85>    PropMgr:993241:3d:03: ### GISSetting Clear (OFF->OFF) ###
00018FA1>    PropMgr:99321:3d:03: ChangePropCBR GISFunc 0
00018FF4>    Startup:997471:3d:03: GISS_Initialize
00019017>    Startup:99747:3d:03: CreateStageClass
00019090>    Startup:997497:3d:03: GISS_Initialize : End
000190A8>    Startup:993741:3d:03: GIS_Initialize : End
000190F4>    FileMgr:91:19:03: PROP_CARD1_STATUS = #x
00019147>    FileMgr:913:15:03: @FileMgr FIO_SetCardChangeFlag(0,1) L:1060
0001917B>    FileMgr:9007:19:03: PROP_CARD1_FOLDER_NUMBER = 142
000191A2>    FileMgr:944:19:03: PROP_CARD1_FILE_NUMBER = 0
000191E0>    FileMgr:939:19:03: PROP_CARD2_STATUS = #x
0001921D>    FileMgr:913:15:03: @FileMgr FIO_SetCardChangeFlag(1,1) L:1060
00019242>    FileMgr:940:19:03: PROP_CARD2_FOLDER_NUMBER = 100
0001926D>    FileMgr:9451:19:03: PROP_CARD2_FILE_NUMBER = 3117
000192A1>    FileMgr:953:19:03: PROP_FILE_NUMBERING_MODE = 1, 0
000192C3>    FileMgr:947:19:03: PROP_CARD_EXTENSION = 0
000192EB>    FileMgr:940:19:03: PROP_CURRENT_MEDIA = 2
00019312>    FileMgr:9121:19:03: PROP_USBDEVICE_CONNECT = -1
00019336>    FileMgr:954:19:03: PROP_NUMBER_OF_CONTINUOUS_MODE = 3117
00019369>    FileMgr:001b68db:00:0f: [53] *** mpu_recv(06 05 03 38 93 00)                            ; PROP 80030035
000193A0>    FileMgr:99157:00:03: [STARTUP]startupCompleteCallback 0x10
000193C0>    FileMgr:991699:00:03: [SEQ] NotifyComplete (Cur = 2, #x, Flag = #x)
000193EB>    FileMgr:953:19:03: PROP_DSDEFINE ModelId 5999913
0001941B>    FileMgr:95:19:03: PROP_APPENDMOVINFO Handle 0,205001d
0001943C>    FileMgr:95:19:03: PROP_APPENDMOVINFO VideoSnapMode 4,205001d
00019469>    FileMgr:9603:19:03: PROP_SPECIAL_OPTION = 16384
00019494>    FileMgr:001b68db:00:0f: [54] *** mpu_recv(06 05 04 29 01 00)                            ; ???
000194DA>   MainCtrl:99619:94:03: judge_lv_disp_busy(mode_change): 0 1 1 1 0
0001951A>    FileMgr:9637:19:03: PROP_SCREEN_SAVER = 0
0001953F>    FileMgr:9663:19:03: PROP_CARD1_RU_SIZE -1
0001956C>    FileMgr:001b68db:00:0f: [55] *** mpu_recv(0a 09 01 55 00 00 02 00 00 01)                ; PROP_MULTIPLE_EXPOSURE_SETTING
000195A9>    PropMgr:993475:81:03: PROP_MULTIPLE_EXPOSURE_SETTING 0
000195D0>    PropMgr:9123:01:03: Deliv WaitID = 0xd555558, 0x55bbef(1)
0001963F>     RscMgr:99:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[11]
00019664>     RscMgr:99:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[12]
0001968D>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
000196A7>     RscMgr:916960:80:03: 0 0 0
000196E5>    PropMgr:9123:01:03: Deliv WaitID = 0xd555558, 0x590575(2)
00019716>    PropMgr:9123:01:03: Deliv WaitID = 0xd555558, 0x566a7(3)
0001974F>    PropMgr:9123:01:03: Deliv WaitID = 0xd555558, 0x55b0e7(4)
0001977B>    PropMgr:92015:3a:03: ### TA10Setting Clear (OFF->OFF) ###
00019798>    PropMgr:920139:3a:03: ChangePropCBR ShotsPlan 2 / TotalSheets 2
000197B6>    PropMgr:9123:01:03: Deliv WaitID = 0xd555558, 0x5a07659(5)
000197E1>    PropMgr:9123:01:03: Deliv WaitID = 0xd555558, 0x55b8ff(6)
0001980A>    PropMgr:9123:01:03: Deliv WaitID = 0xd555558, 0x55b9fb(7)
00019838>    PropMgr:910:01:03: Complete WaitID = 0xd555558, 0x55bbef(6)
00019863>    PropMgr:910:01:03: Complete WaitID = 0xd555558, 0x590575(5)
00019890>    PropMgr:910:01:03: Complete WaitID = 0xd555558, 0x566a7(4)
000198B8>    PropMgr:910:01:03: Complete WaitID = 0xd555558, 0x55b0e7(3)
00019924>    PropMgr:910:01:03: Complete WaitID = 0xd555558, 0x5a07659(2)
00019951>    PropMgr:910:01:03: Complete WaitID = 0xd555558, 0x55b8ff(1)
0001997A>    PropMgr:910:01:03: Complete WaitID = 0xd555558, 0x55b9fb(0)
000199B1>    PropMgr:001b686f:00:0f: [18] *** mpu_send(08 06 00 00 01 55 00 00)                      ; Complete WaitID = PROP_MULTIPLE_EXPOSURE_SETTING
00019A67>    PropMgr:001b686f:00:0f: [19] *** mpu_send(0c 0b 03 53 02 00 48 81 81 00 00 00)          ; PROP 80030058
00019AF7>    FileMgr:001b686f:00:0f: [20] *** mpu_send(0c 0b 03 53 02 00 48 81 81 00 00 00)          ; PROP 80030058
00019B26>    FileMgr:9675:19:03: PROP_CARD2_RU_SIZE 524288
00019B64>    FileMgr:907:19:03: fmInitialized
00019BC6>    FileMgr:90607:1c:03: _FC_SetDirSuffix (CANON)
00019BFF>    FileMgr:90:19:03: fmPrepare
00019C4E>    FileMgr:913:15:03: @FileMgr FIO_Init(25,28,0xe069ad83) L:870
00019C73>    FileMgr:92719:13:03: CSMGR_Initialize
00019CF8>    FileMgr:001b68db:00:0f: [56] *** mpu_recv(06 05 01 2e 01 00)                            ; PROP_SAVE_MODE
00019D44>     RscMgr:99223:35:03: PROP_SAVE_MODE = 0x1
0001A181>    FileMgr:001b68db:00:0f: [57] *** mpu_recv(08 06 01 1d 87 87 00 00)                      ; PROP_PICTURE_STYLE
0001A217>    PropMgr:001b68db:00:0f: [58] *** mpu_recv(06 05 01 74 00 00)                            ; PROP_HIGHISO_NOISE_REDUCTION
0001A26C>    FileMgr:929:13:03: InitializeLogicalStorage: LStorageList = NULL
0001A28B>    FileMgr:929:13:03: SocketServiceInstall: SUCCESS
0001A2B3>    FileMgr:001b68db:00:0f: [59] *** mpu_recv(06 05 01 75 00 00)                            ; PROP_HTP
0001A315>    FileMgr:913:15:03: @FileMgr FIO_GetSupportedDriveInfo(0x2233f4) L:1102
0001A346>    FileMgr:93055:18:03: InitializeSDDriver
0001A5D2>    FileMgr:9257:13:03: RegisterClient: handler=#x 1
0001A5F1>    FileMgr:9269:13:03: RegisterClient: SUCCESS
0001A606>    FileMgr:920:13:03: CSMGR_Initialize End
0001A621>    FileMgr:9361:19:03: fmAllocDcfNo(#x)(#x)
0001A66A>     RscMgr:99:35:03: srmAllocDcfNoTable
0001A694>     RscMgr:93613:19:03: fmAllocateDcfNoCompleteCallback(#x,#x)
0001A6DE>    FileMgr:901:19:03: fmAllocDcfNo : DcfNoTable(#x)
0001A722>    FileMgr:913:15:03: @FileMgr FIO_MountDevice(1,0,0) L:901
0001A741>    FileMgr:9267:16:03: [FSUmountDevice] (#x)
0001A756>    FileMgr:921:13:03: MapPhysicToLog: StorageID=1
0001A76A>    FileMgr:9231:13:03: MapPhysicToLog: SUCCESS(#x)
0001A77F>    FileMgr:9205:13:03: CSMGR_MountCard : Message=#x, pLStorage=#x
0001A7B6>     NFCMgr:92537:3e:03:  PROP_SPECIAL_OPTION ->init (0x4000)
0001A9A4>     NFCMgr:9257511:3e:03:  nfcmgrstate_Initialize:NewsDet_R Hi
0001AA60>  CSMgrTask:9265:13:03: CSMgrTask: pMessage=#x, pLStorage=#x
0001AA7B>  CSMgrTask:92621:13:03: MapLogToPhysic: pLStorage=#x
0001AA90>  CSMgrTask:92635:13:03: MapLogToPhysic: SUCCESS(ID=1)
0001AAA7>  CSMgrTask:92621:13:03: MapLogToPhysic: pLStorage=#x
0001AABB>  CSMgrTask:92635:13:03: MapLogToPhysic: SUCCESS(ID=1)
0001AACD>  CSMgrTask:9:18:03: ---- SDEventHandler(ID=1:Event=8) ----
0001AAE9>  CSMgrTask:93063:16:03: Set StgDev:1
0001AB33>  CSMgrTask:997:18:03: SDPowerOn
0001AC21>     NFCMgr:001b68db:00:0f: [60] *** mpu_recv(06 05 01 07 00 01)                            ; PROP_ISO
0001ACB0>    PropMgr:9123:01:03: Deliv WaitID = 0xd555555b, 0x590575(1)
0001ACE4>    PropMgr:9123:01:03: Deliv WaitID = 0xd555555b, 0x566a7(2)
0001AD11>    PropMgr:910:01:03: Complete WaitID = 0xd555555b, 0x590575(1)
0001AD3E>    PropMgr:910:01:03: Complete WaitID = 0xd555555b, 0x566a7(0)
0001AD77>     NFCMgr:001b686f:00:0f: [21] *** mpu_send(08 06 00 00 01 07 00 00)                      ; Complete WaitID = PROP_ISO
0001B30B>   PowerMgr:001b68db:00:0f: [61] *** mpu_recv(0a 08 01 34 00 00 01 03 01 00)                ; PROP_CARD1_IMAGE_QUALITY
0001B38B>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
0001B3A8>     RscMgr:916960:80:03: 0 0 0
0001B3F1>    PropMgr:9123:01:03: Deliv WaitID = 0xd555557, 0x590575(1)
0001B423>    PropMgr:9123:01:03: Deliv WaitID = 0xd555557, 0x566a7(2)
0001B456>    PropMgr:910:01:03: Complete WaitID = 0xd555557, 0x590575(1)
0001B480>    PropMgr:910:01:03: Complete WaitID = 0xd555557, 0x566a7(0)
0001B4BB>   PowerMgr:001b686f:00:0f: [22] *** mpu_send(08 06 00 00 01 34 00 00)                      ; Complete WaitID = PROP_CARD1_IMAGE_QUALITY
0001B6D8>  CSMgrTask:94053:18:03: SD initialize start
0001B776>  CSMgrTask:001b68db:00:0f: [62] *** mpu_recv(0a 08 01 35 00 00 01 03 01 00)                ; PROP_CARD2_IMAGE_QUALITY
0001B7DD>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
0001B7FB>     RscMgr:916960:80:03: 0 0 0
0001B83C>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555570, 0x590575(1)
0001B86C>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555570, 0x566a7(2)
0001B89A>    PropMgr:910:01:03: Complete WaitID = 0xd5555570, 0x590575(1)
0001B8C8>    PropMgr:910:01:03: Complete WaitID = 0xd5555570, 0x566a7(0)
0001B904>  CSMgrTask:001b686f:00:0f: [23] *** mpu_send(08 06 00 00 01 35 00 00)                      ; Complete WaitID = PROP_CARD2_IMAGE_QUALITY
0001BCA4>   PowerMgr:001b68db:00:0f: [63] *** mpu_recv(0a 09 01 70 00 00 00 00 00 01)                ; PROP_HDR_SETTING
0001BCE1>    PropMgr:993475:81:03: PROP_HDR_SETTING 0
0001BD0C>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555599, 0x55bbef(1)
0001BD5C>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
0001BD76>     RscMgr:916960:80:03: 0 0 0
0001BDC2>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555599, 0x590575(2)
0001BDF6>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555599, 0x566a7(3)
0001BE3E>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555599, 0x55b0e7(4)
0001BE71>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555599, 0x5a07659(5)
0001BE9B>    PropMgr:993141:3c:03: ### HDRSetting Clear (OFF->OFF) ###
0001BEB1>    PropMgr:9931:3c:03: ChangePropCBR HDRFunc 0
0001BEC8>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555599, 0x55b8ff(6)
0001BEF9>    PropMgr:9123:01:03: Deliv WaitID = 0xd5555599, 0x55b9fb(7)
0001BF29>    PropMgr:910:01:03: Complete WaitID = 0xd5555599, 0x55bbef(6)
0001BF55>    PropMgr:910:01:03: Complete WaitID = 0xd5555599, 0x590575(5)
0001BF7E>    PropMgr:910:01:03: Complete WaitID = 0xd5555599, 0x566a7(4)
0001BFA5>    PropMgr:910:01:03: Complete WaitID = 0xd5555599, 0x55b0e7(3)
0001BFCC>    PropMgr:910:01:03: Complete WaitID = 0xd5555599, 0x5a07659(2)
0001BFF5>    PropMgr:910:01:03: Complete WaitID = 0xd5555599, 0x55b8ff(1)
0001C01E>    PropMgr:910:01:03: Complete WaitID = 0xd5555599, 0x55b9fb(0)
0001C057>  CSMgrTask:001b686f:00:0f: [24] *** mpu_send(08 06 00 00 01 70 00 00)                      ; Complete WaitID = PROP_HDR_SETTING
0001C21F>   PowerMgr:001b68db:00:0f: [64] *** mpu_recv(0a 08 01 85 00 00 00 01 01 00)                ; PROP_GIS_SETTING
0001C25B>    PropMgr:993475:81:03: PROP_GIS_SETTING Func 0
0001C281>    PropMgr:9123:01:03: Deliv WaitID = 0xd555559, 0x55bbef(1)
0001C2D0>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
0001C2EB>     RscMgr:916960:80:03: 0 0 0
0001C336>    PropMgr:9123:01:03: Deliv WaitID = 0xd555559, 0x590575(2)
0001C364>    PropMgr:9123:01:03: Deliv WaitID = 0xd555559, 0x566a7(3)
0001C39C>    PropMgr:9123:01:03: Deliv WaitID = 0xd555559, 0x55b0e7(4)
0001C3C5>    PropMgr:9123:01:03: Deliv WaitID = 0xd555559, 0x55b8ff(5)
0001C3EB>    PropMgr:993241:3d:03: ### GISSetting Clear (OFF->OFF) ###
0001C400>    PropMgr:99321:3d:03: ChangePropCBR GISFunc 0
0001C419>    PropMgr:9123:01:03: Deliv WaitID = 0xd555559, 0x55b9fb(6)
0001C447>    PropMgr:910:01:03: Complete WaitID = 0xd555559, 0x55bbef(5)
0001C474>    PropMgr:910:01:03: Complete WaitID = 0xd555559, 0x590575(4)
0001C49D>    PropMgr:910:01:03: Complete WaitID = 0xd555559, 0x566a7(3)
0001C4C4>    PropMgr:910:01:03: Complete WaitID = 0xd555559, 0x55b0e7(2)
0001C4EB>    PropMgr:910:01:03: Complete WaitID = 0xd555559, 0x55b8ff(1)
0001C514>    PropMgr:910:01:03: Complete WaitID = 0xd555559, 0x55b9fb(0)
0001C550>  CSMgrTask:001b686f:00:0f: [25] *** mpu_send(08 06 00 00 01 85 00 00)                      ; Complete WaitID = PROP_GIS_SETTING
00028E64>    CE_Main:925273:3e:03:  ce_completion payload=84 num=2
00028F7B>     NFCMgr:92579:3e:03:  nfcmgrstate_Initialize:wtime=0
000292BF>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 0, ClassID = 62
000292F9>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 7, ClassID = 62
00029327>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 11, ClassID = 62
00029344>   EventMgr:9972:37:03: Already SW1OFF
0002936F>     NFCMgr:92579:3e:03:  nfcmgrstate_Initialize End
000293B7>     NFCMgr:925497:3e:03:  PROP_AUTO_POWEROFF 1
000293F2>     NFCMgr:9253:3e:03:  PROP_NFC_APPLI_INFO jp.co.canon.ic.cameraconnect
0002940C>     NFCMgr:925309:3e:03:  PROP_NFC_APPLI_INFO a01
000294E0>     NFCMgr:925377:3e:03:  ChkRWInfo Illegal product type(pdt=dslr)
00029532>     NFCMgr:925321:3e:03:  PROP_DSDEFINE Canon%20EOS%20200D
0002954F>     NFCMgr:9254547:3e:03:  PROP_DSDEFINE 0x32cc
000295D1>     NFCMgr:9253:3e:03:  PropChange:PROP_NETWORK_NICKNAME(Vis_Cam)->(Vis_Cam)
0002960A>     NFCMgr:9254547:3e:03:  PROP_NETWORK_SYSTEM MODE_OFF 0
00029631>     NFCMgr:9254015:3e:03:  PROP_NFC_SETTING enable 1
00029657>     NFCMgr:9254037:3e:03:  PROP_FIXED_MOVIE off 0
0002967C>     NFCMgr:9254067:3e:03:  SHOOTING_TYPE_MOVIE off 0
0002969F>     NFCMgr:925407:3e:03:  PROP_TIMELAPSE_MOVIE_SETTING off 0
000296C5>     NFCMgr:925419:3e:03:  PROP_MULTIPLE_EXPOSURE_SETTING OFF 0
000296E8>     NFCMgr:925413:3e:03:  PROP_VARIANGLEDISPLAY_ONOFF ON 1
0002970B>     NFCMgr:9254509:3e:03:  PROP_VIDEOSNAP_MODE OFF 0
000297E4>     NFCMgr:925452:3e:03:  PROP_ICU_UILock OFF 0x0
0002980C>     NFCMgr:92546:3e:03:  PROP_PHYSICAL_CONNECT disconnect 0
0002982E>     NFCMgr:925351:3e:03:  PROP_STARTUP_CONDITION NOT BLE_LOCKOFF (0x1)
00029886>     NFCMgr:904507:3e:03: [BLE] Initialize : Enter
00029B85>     NFCMgr:9245:3e:03: [BLE] BLESIODRIVER_Initialize END
00029BAC>     NFCMgr:9220:3e:03: [BLE] blesiodriver_SioInitialize END
00029BF9>     NFCMgr:92772:3e:03: [BLE] BLEFirmUp_InitializeTest
00029DC1>     NFCMgr:9069:3e:03: [BLE] PROP_DSDEFINE 0x32cc
00029E38>     NFCMgr:90631:3e:03: [BLE] PROP_NETWORK_NICKNAME Vis_Cam
00029E9D>     NFCMgr:9065:3e:03:  [BLE] PROP_FIXED_MOVIE off 0
00029F01>     NFCMgr:90631:3e:03: [BLE] PROP_VIDEOSNAP_MODE OFF 0
00029F33>     NFCMgr:90659:3e:03: [BLE] PROP_BLE_SETTING OFF(0)
00029F4B>     NFCMgr:9099:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
00029F63>     NFCMgr:90901:3e:03: [BLE] Enter CheckGpsAndBleState().
00029F9E>     NFCMgr:9099:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
00029FB4>     NFCMgr:90601:3e:03: [BLE] PROP_BLE_PAIRING_INFO fSet(0 0) 2 2
00029FE7>     NFCMgr:901605:3e:03: [BLE] CheckWiFiConnect Uuid is Null
00029FFC>     NFCMgr:90179:3e:03: [BLE] CheckWiFiConnect FALSE
0002A024>     NFCMgr:906579:3e:03: [BLE] PROP_BLE_REMOTE_RESULT 0
0002A04C>     NFCMgr:9099:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
0002A061>     NFCMgr:90901:3e:03: [BLE] Enter CheckGpsAndBleState().
0002A08D>     NFCMgr:9099:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
0002A0A0>     NFCMgr:90901:3e:03: [BLE] Enter CheckGpsAndBleState().
0002A0D9>     NFCMgr:90635:3e:03: [BLE] PROP_PHYSICAL_CONNECT disconnect 0
0002A120>     NFCMgr:906619:3e:03: [BLE] PROP_BATTERY_POWER:not BAT_NONE 2
0002A13F>     NFCMgr:90415:3e:03: [BLE] InitializeChkState
0002A159>     NFCMgr:900609:3e:03: [BLE] SendCamPowerState :0x1
0004552D>     NFCMgr:907:3e:03: [BLE] Enter blemgr_SmartPhoneGps_NopEvent!!!
00045549>     NFCMgr:909:3e:03: [BLE]   Status=0, Event=13
0004556B>     NFCMgr:907:3e:03: [BLE] Enter blemgr_SmartPhoneGps_NopEvent!!!
00045582>     NFCMgr:909:3e:03: [BLE]   Status=0, Event=13
0004559D>     NFCMgr:907:3e:03: [BLE] Enter blemgr_SmartPhoneGps_NopEvent!!!
000455B2>     NFCMgr:909:3e:03: [BLE]   Status=0, Event=13
00045CD2>     NFCMgr:9011:3e:03: [BLE] ProcSpiRecvData Cat = 0x1, cmd = 0x85
00045CFD>     NFCMgr:901:3e:03: [BLE] RecvNtfBleState IDLE(1)
00045D54>     NFCMgr:90077:3e:03: [BLE] SendGetPairingInfo :0x1
000464FF>     NFCMgr:9099:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
00046F0D>     NFCMgr:9011:3e:03: [BLE] ProcSpiRecvData Cat = 0x2, cmd = 0x86
00046F3C>     NFCMgr:9017:3e:03: [BLE] JudgeBlePairInfo SD Host&BLE:None
00046F55>     NFCMgr:9001:3e:03: [BLE] CheckNextBlePairInfo:SD01->ARC
00046F6A>     NFCMgr:90077:3e:03: [BLE] SendGetPairingInfo :0x2
000480AB>     NFCMgr:9011:3e:03: [BLE] ProcSpiRecvData Cat = 0x2, cmd = 0x86
000480CA>     NFCMgr:9017:3e:03: [BLE] JudgeBlePairInfo ARC Host&BLE:None
000480E0>     NFCMgr:9097:3e:03: [BLE] CheckNextBlePairInfo:ARC->END
00052656>  CSMgrTask:947:18:03: power 18
00052671>  CSMgrTask:9963:18:16: SdSwitchVoltage 1
0005F93E>  CSMgrTask:9401:18:16: SD initialize end speed=2 clock=2 UHS=1
0005F97C>  CSMgrTask:94155:18:16: strength 1111 current 3 mode 2
0005FF38>  CSMgrTask:94315:18:16: Name:       Size: 15271(1dd3800)
0005FF64>  CSMgrTask:949:18:03: pBlkDev=#x
0005FF7A>  CSMgrTask:949:18:03: nBlocks=31275008, blksPerTrack=0, nHeads=0
0006327F>  CSMgrTask:9363:16:05: fsuGetPart: Block(8192, 31266816, 31275008)
00064301>  CSMgrTask:927717:16:16: efat_map_filesys 8192 B: 1
0006482C>  CSMgrTask:913:15:03: @CSMgrTask FIO_GetSupportedDriveInfo(0x22eca8) L:1102
00064885>  CSMgrTask:92029:16:16: AllocateMemoryStrictly For Speed Class!!!
000AC4C5>  CSMgrTask:9205:16:16: Attach SC 1 0 80 10 7632
000AC748>  CSMgrTask:913:15:03: @CSMgrTask FIO_GetProductName(1) L:1075
000AC76D>  CSMgrTask:9304:16:03: Get StgDev:1
000AC78E>  CSMgrTask:936709:19:03: EV_INSERTION_COMPLETE : ID = 1, stat = 8192
000AC7AD>  CSMgrTask:93677:19:03: bWormCard = 0
000AC7C2>  CSMgrTask:9367:19:03: bWriteOnceCard = 0
000AC7ED>    FileMgr:9095:19:03: fmNormalMountCard (ID = 2, Ret = 0)
000AC812>    FileMgr:905:19:03: fmPrepareShooting (Drive = 2)
000AC854>    FileMgr:913:15:03: @FileMgr FIO_GetDriveName(1,0x2233d0) L:883
000AC86F>    FileMgr:9304:16:03: Get StgDev:1
000AC88D>    FileMgr:90601:1c:03: _FC_PrepareCatalog (2, B:)
000AC8DA>    FileMgr:913:15:03: @FileMgr FIO_GetFileInfo(B:/DCIM,0x223240) L:351
000AC9F0>  CSMgrTask:913:15:03: @CSMgrTask FIO_IsExistFile(B:/STGDBG99.TXT) L:1118
000ACFB8>    FileMgr:913:15:03: @FileMgr FIO_GetFileInfo(B:/MISC,0x223240) L:351
000AD730>    FileMgr:913:15:03: @FileMgr FIO_FindFirstEx(B:/DCIM,0x223220) L:787
000AD767>    FileMgr:913:15:03: @FileMgr FIO_Flush(B:/DCIM) L:632
000AD787>    FileMgr:9304:16:03: Get StgDev:1
000AD7C6>    FileMgr:92770:15:03: Flush:B:/DCIM
000AD7F1>    FileMgr:913:15:03: @FileMgr FIO_SetError(0) L:852
000AD8C4>  CSMgrTask:90:18:03: ---- SDEventHandler(ID=1:< B: >) Mounted ----
000ADEE7>    FileMgr:913:15:03: @FileMgr FIO_FindCloseEx(0x979834) L:845
000ADF2C>    FileMgr:913:15:03: @FileMgr FIO_GetError( ) L:858
000ADF6D>    FileMgr:913:15:03: @FileMgr FIO_FindFirstEx(B:/DCIM/100CANON,0x223228) L:787
000ADF97>    FileMgr:913:15:03: @FileMgr FIO_Flush(B:/DCIM/100CANON) L:632
000ADFAF>    FileMgr:9304:16:03: Get StgDev:1
000ADFE1>    FileMgr:92770:15:03: Flush:B:/DCIM/100CANON
000AE009>    FileMgr:913:15:03: @FileMgr FIO_SetError(0) L:852
000AE5B7>    FileMgr:913:15:03: @FileMgr FIO_FindCloseEx(0x979834) L:845
000AE5F4>    FileMgr:913:15:03: @FileMgr FIO_GetError( ) L:858
000AE61C>    FileMgr:9026:19:03: DirNo = 100, FileNo = 0
000AE65C>    FileMgr:913:15:03: @FileMgr FIO_GetCardInfo(B:,0x223400,0x2233ec,0x2233f4,0x2233fc,0x2233e8,1) L:959
000AE6A4>    FileMgr:913:15:03: @FileMgr FIO_GetSupportedDriveInfo(0x22335c) L:1102
000AE6D2>    FileMgr:913:15:03: @FileMgr FIO_GetSCParam(1) L:1202
000AE6FE>    FileMgr:913:15:03: @FileMgr FIO_GetSupportedDriveInfo(0x22335c) L:1102
000AE723>    FileMgr:913:15:03: @FileMgr FIO_GetSCParam(1) L:1202
000AE7B7>    FileMgr:9029:19:03: Cluster = 32768, Total = 488416, Free = 488406 RU = 524288 FreeRU = 30512
000AE7FA>    FileMgr:9537:1c:03: _FC_GetNewDirDcfNo (2, 0, 0, 0)
000AE821>    FileMgr:923:19:03: fmSetInitialCardInfo (Drive = 2, 0)
000AE884>    PropMgr:001b686f:00:0f: [26] *** mpu_send(08 06 01 24 00 01 00 00)                      ; PROP_CARD2_STATUS
000AEA38>    PropMgr:001b686f:00:0f: [27] *** mpu_send(08 06 01 27 00 64 00 00)                      ; PROP_CARD2_FOLDER_NUMBER
000AEA6D>    PropMgr:001b68db:00:0f: [65] *** mpu_recv(08 06 01 24 00 01 00 00)                      ; PROP_CARD2_STATUS
000AEAA5>     RscMgr:9927:35:03: PROP_CARD1_FOLDER_NUMBER
000AEB57>     RscMgr:9957:35:03: this->dwCardStatus[1] = 0x1(474)
000AEB94>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
000AEBAC>     RscMgr:916960:80:03: 0 0 0
000AECDC>     RscMgr:9911:35:03: RU CLUSTER_SIZE[1] = 0x407BA67C
000AED4C>    FileMgr:913:15:03: @FileMgr FIO_GetDriveName(1,0x2233e4) L:883
000AED6C>    FileMgr:9304:16:03: Get StgDev:1
000AED97>    FileMgr:913:15:03: @FileMgr FIO_GetFreeRU(B:,0x2233e0) L:1010
000AEDC1>    FileMgr:913:15:03: @FileMgr FIO_GetSupportedDriveInfo(0x22339c) L:1102
000AEDEC>    FileMgr:913:15:03: @FileMgr FIO_GetSCParam(1) L:1202
000AEE7E>    FileMgr:9535:19:03: fmWrapperRU1 : DriveNo = 2 B: 30512
000AEE9D>    FileMgr:95379:19:03: fmWrapperRU : DriveNo = 2 B: 30512
000AEEB8>    FileMgr:900:19:03: fmSetInitialCardInfo (FreeRU = 30512)
000AEEED>     RscMgr:9929:35:03: Storage Space 488406, FreeRUCount 30512
000AEF94>    FileMgr:90909:19:03: pfNotifyDcfNoCBR(2:100_0000)
000AEFDA>     RscMgr:997:35:03: srmNotifyDcfNo 0x2 100 0 0 1
000AEFFD>     RscMgr:900995:35:03: srmSetDcfNoTableOrDiff 1 100 0 1
000AF017>     RscMgr:90092:35:03: Diff Dcf List
000AF02B>     RscMgr:90094:35:03: Create Diff Dcf ListItem 100
000AF043>     RscMgr:9007:35:03: fTemporary 1 pMaxDcfNoInFolder->fTemporary 1
000AF05A>     RscMgr:900:35:03: Diff Dcf Over Write 100
000AF079>     RscMgr:99953:35:03: ####### [1]DCF No 3117
000AF0E4>     RscMgr:9937:35:03: BURST 28 Enable 1319 Reserve 12107776
000AF10C>     RscMgr:99349:35:03: Burst 28 ENABLE 1319 Reserve 12107776
000AF135>     RscMgr:99:35:03: RealClearBusy(0x2100) 0x0->0x0,0x0(0x0)[13]
000AF157>     RscMgr:99157:00:03: [STARTUP]startupCompleteCallback 0x20000
000AF17A>     RscMgr:991699:00:03: [SEQ] NotifyComplete (Cur = 2, #x, Flag = #x)
000AF1EB>    PropMgr:001b686f:00:0f: [28] *** mpu_send(08 06 01 2a 0c 2d 00 00)                      ; PROP_CARD2_FILE_NUMBER
000AF289>    PropMgr:001b686f:00:0f: [29] *** mpu_send(06 05 03 07 1c 00)                            ; PROP_BURST_COUNT
000AF31E>    FileMgr:001b686f:00:0f: [30] *** mpu_send(0a 08 03 06 00 00 05 27 00 00)                ; PROP_AVAIL_SHOT
000AF343>    FileMgr:99157:00:03: [STARTUP]startupCompleteCallback 0x400000
000AF369>    FileMgr:991699:00:03: [SEQ] NotifyComplete (Cur = 2, #x, Flag = #x)
000AF3C0>    FileMgr:940:19:03: PROP_CARD2_FOLDER_NUMBER = 100
000AF3ED>    FileMgr:939:19:03: PROP_CARD2_STATUS = #x
000AF416>    FileMgr:9675:19:03: PROP_CARD2_RU_SIZE 524288
000AF443>    FileMgr:9451:19:03: PROP_CARD2_FILE_NUMBER = 3117
000AF465>    Startup:991503:00:05: [SEQ] seqEventDispatch (Startup, 2)
000AF47F>    Startup:99196:89:03: startupPrepareCapture
000AF51B>    Startup:91100:b0:05: [MNAV] MEMNAVI_Initialize
000AF6EC>    Startup:911307:b0:05: [MNAV] MEMNAVI_SetMemoryMap: 1
000AF728>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 14, ClassID = 142
000AF75F>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 2, ClassID = 142
000AF789>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 3, ClassID = 142
000AF7B1>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 15, ClassID = 142
000AF7D8>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 5, ClassID = 142
000AF800>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 6, ClassID = 142
000AF826>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 1, ClassID = 142
000AF84D>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 4, ClassID = 142
000AF876>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 8, ClassID = 142
000AF89D>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 9, ClassID = 142
000AF8C3>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 10, ClassID = 142
000AF8EA>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 17, ClassID = 142
000AF90F>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 18, ClassID = 142
000AF934>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 19, ClassID = 142
000AF959>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 21, ClassID = 142
000AF9DD> ShootCaptu:9023:8e:03: scsIgnore
000AFAA0> ShootCaptu:9200:8e:03: IsFactoryMenuMode:0
000AFAD1> ShootCaptu:907:8e:03: scsInit
000AFC63> ShootCaptu:9339:8c:03: InitializeHeadControl
000B01D6>    Startup:99157:00:03: [STARTUP]startupCompleteCallback 0x80000
000B01FF>    Startup:991699:00:03: [SEQ] NotifyComplete (Cur = 3, #x, Flag = #x)
000B0297> ShootCaptu:920:8e:03: Mem1Component Size=#x
000B03B7> ShootCaptu:904:8e:03: DarkCurrentBuffer:#lx, Size:139264
000B0D10> ShootCaptu:99:35:03: RealClearBusy(0x40) 0x0->0x0,0x0(0x0)[14]
000B0D33> ShootCaptu:99157:00:03: [STARTUP]startupCompleteCallback 0x40000
000B0D51> ShootCaptu:991699:00:03: [SEQ] NotifyComplete (Cur = 3, #x, Flag = #x)
000B0E0B> ShootBlack:996201:8f:03: sbsInit
000B0E50> ShootBlack:99623:8f:03: VShadingAddress:#lx, Size:162816
000B0EE3> ShootPreDe:902:90:03: Init
000B0F38>    Panning:947705:dd:03: panInit
000B1124>    Startup:991503:00:05: [SEQ] seqEventDispatch (Startup, 3)
000B1179>    Startup:001b686f:00:0f: [31] *** mpu_send(06 05 03 11 01 00)                            ; PROP_ICU_AUTO_POWEROFF
000B11F5>    PropMgr:001b686f:00:0f: [32] *** mpu_send(06 05 02 0a 00 00)                            ; PROP_PERMIT_ICU_EVENT
000B1218>    PropMgr:993491:81:03: PROP_PERMIT_ICU_EVENT 0x0
000B126A>    PropMgr:9915001:88:03: HDMIDetectISR 0
000B1299>    PropMgr:9915227:88:03: CreateTask Master RealEnd
000B1306>    PropMgr:001b686f:00:0f: [33] *** mpu_send(06 05 03 0d 00 00)                            ; PROP_CARD2_RECORD
000B1344>    Startup:99125:89:05: startupPrepareDevelop
000B1363>    Startup:001b686f:00:0f: [34] *** mpu_send(06 05 03 0c 00 00)                            ; PROP_CARD1_RECORD
000B1385>    Startup:9919:89:03: MovieCFilter 431A0C00 5de9f8 196000
000B1449>    Startup:001b68db:00:0f: [66] *** mpu_recv(06 05 01 2c 02 00)                            ; PROP_CURRENT_MEDIA
000B1613>     RscMgr:001b68db:00:0f: [67] *** mpu_recv(12 11 03 00 62 00 00 31 0f 00 00 00 00 00 00 00 00 00) ; PROP 80030000
000B164B>     RscMgr:9169509:80:03: fDevDone 1, dwLvLock 0
000B167D>     RscMgr:916960:80:03: 0 0 0
000B16BD>     RscMgr:001b68db:00:0f: [68] *** mpu_recv(06 05 03 04 00 00)                            ; PROP_POWER_KIND
000B173C>     RscMgr:001b68db:00:0f: [69] *** mpu_recv(06 05 03 05 02 00)                            ; PROP_POWER_LEVEL
000B1800>     RscMgr:001b68db:00:0f: [70] *** mpu_recv(06 05 03 23 2c 00)                            ; ???
000B1852>     RscMgr:99:35:03: RealClearBusy(0x2100) 0x0->0x0,0x0(0x0)[15]
000B194D>    PropMgr:9925:01:16: M:62 F:0 L:0 P:31 T:F
000B1A2E>    PropMgr:99179:89:05: update coded version.
000B1A58>    PropMgr:991735:89:05: internal version 05:00:02:62:00:00:31:0f:00:00:d0:d0:d0
000B1B81>    PropMgr:001b68db:00:0f: [71] *** mpu_recv(32 30 03 24 54 41 4d 52 4f 4e 20 31 36 2d 33 30 30 6d 6d 20 46 2f 33 2e 35 2d 36 2e 33 20 44 69 20 49 49 20 56 43 20 50 5a 44 20 42 30 31 36 00 00 00) ; PROP_LENS_NAME
000B1C0F>    PropMgr:001b68db:00:0f: [72] *** mpu_recv(06 04 03 25 00 00)                            ; ???
000B1C9F>    Startup:906091:02:05: PROPTUNEAD_CreateFROMPropertyHandleToDRAM Addr:0x42356400
000B1D1B>    Startup:9497:02:03: PROPCOMBO_LoadProperty(395)
000B1DE7>    FileMgr:940:19:03: PROP_CURRENT_MEDIA = 2
000B1F36>     NFCMgr:906619:3e:03: [BLE] PROP_BATTERY_POWER:not BAT_NONE 2
000B213F>   PowerMgr:001b68db:00:0f: [73] *** mpu_recv(32 31 03 15 01 25 50 01 eb 00 10 01 2c 91 77 9a ef 08 ff 00 00 00 00 00 00 00 00 00 00 01 00 00 04 24 00 02 00 00 00 00 00 00 00 00 00 00 00 00 01 00) ; PROP_LENS
000B23AB>    PropMgr:001b68db:00:0f: [74] *** mpu_recv(24 22 03 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP 8003003C
000B243E>    PropMgr:001b68db:00:0f: [75] *** mpu_recv(06 05 03 17 94 00)                            ; PROP_EFIC_TEMP
000B24C3>    PropMgr:001b68db:00:0f: [76] *** mpu_recv(06 05 01 3d 00 00)                            ; PROP_TEMP_STATUS
000B24F1> EFLensComT:923205:d6:03: LensAction_UpdateLensInfo
000B2539> EFLensComT:96411:d6:03: LensExist=1, AberrationVersion=0
000B2567> EFLensComT:92320:d6:03: LensPropSendIdentifyOptLensData2ByLensInfo passed
000B258E> EFLensComT:966:d6:03: LensPropUpdateLensInfo
000B25BC> EFLensComT:001b68db:00:0f: [77] *** mpu_recv(06 05 03 0d 00 00)                            ; PROP_CARD2_RECORD
000B2811>    FileMgr:913:15:03: @FileMgr FIO_SetCardChangeFlag(1,0) L:1060
000B2976>   PowerMgr:001b68db:00:0f: [78] *** mpu_recv(32 31 03 15 01 25 50 01 eb 00 10 01 2c 91 77 9a ef 08 ff 00 00 00 00 00 00 00 00 00 00 01 00 00 04 24 00 02 00 00 00 00 00 00 00 00 00 00 00 00 01 00) ; PROP_LENS
000B2A03> EFLensComT:923205:d6:03: LensAction_UpdateLensInfo
000B2A26> EFLensComT:96411:d6:03: LensExist=1, AberrationVersion=0
000B2A40> EFLensComT:92320:d6:03: LensPropSendIdentifyOptLensData2ByLensInfo passed
000B2A59> EFLensComT:966:d6:03: LensPropUpdateLensInfo
000B2BD7>   PowerMgr:001b68db:00:0f: [79] *** mpu_recv(24 22 03 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00) ; PROP 8003003C
000B2C5E>   PowerMgr:001b68db:00:0f: [0] *** mpu_recv(06 05 03 0c 00 00)                             ; PROP_CARD1_RECORD
000B2CE5>    FileMgr:913:15:03: @FileMgr FIO_SetCardChangeFlag(0,0) L:1060
000BF408> ShootFenci:90635:df:03: Init
000BF4C1> ShootDevel:94305:b1:03: sdsInit
000BF57F>    Startup:947:9a:03: sssCreateStateList Job=#x Yuv=#x
000BF5C8>    Startup:947:9a:03: sssCreateStateList Job=#x Yuv=#x
000BF63F> ShootSsDev:962:9a:03: Init
000BF6EC> DistCorrec:9225:af:03: sdcsInit
000BF881> DistCorrec:93043:af:03: sdcsProperty id:#x
000BF8B7> DistCorrec:93043:af:03: sdcsProperty id:#x
000BF8D9> DistCorrec:93395:af:03: sdcsSetPropLens Data #x #x #x #x #x
000BF8F9> DistCorrec:930:af:03: sdcsPropLensForDistCorrect
000BF91C> DistCorrec:93043:af:03: sdcsProperty id:#x
000BF93B> DistCorrec:93043:af:03: sdcsProperty id:#x
000BF952> DistCorrec:930:af:03: sdcsPropLensForDistCorrect
000BF9F2> DistCorrec:93005:af:03: sdcsPropLensForDistCorrect LensData
000BFC14>    Startup:99354:a6:03: SVS_Activate
000BFC70>   ShootVfx:9403:a6:03: shsInit
000BFCFF>   ShootVfx:94151:a6:03: shpsInit
000BFEA5>   ShootVfx:947093:a6:03: sgsInit PropRet :0
000BFF14>   ShootVfx:944509:a6:03: snpsInit PropRet :0
000BFF54>   ShootVfx:9470:a6:03: sasInit
000BFFCD>   ShootVfx:945031:a6:03: svdsInit
000C00AC>    Startup:9910:a6:03: SVS_Activate Complete
000C01BC>    Startup:901:ff:05: MAC_Initialize (nop)
000C026E>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 16, ClassID = 149
000C02BC>    Startup:9274011:3b:03: INDEV_Initialize
000C0509>    Startup:927511:3b:03: [Trimming]Tbl_Set TblAddr:9592540 Size:42
000C0645> ShootFenci:90609:df:03: Activate
000C0675> ShootFenci:9005:89:03: startupMovieCFilterXDmacCBR
000C0804> ShootFenci:90047:df:03: Property id:#x
000C0838> ShootFenci:90047:df:03: Property id:#x
000C086F> ShootFenci:90047:df:03: Property id:#x
000C0894> ShootFenci:90047:df:03: Property id:#x
000C08CE> ShootPreDe:90449:90:03: spsActivate
000CA085>    Panning:94771:dd:03: [GYRO  :2118078987,1077764206]
000CA0BA>    Panning:947:dd:03: [Offset:14741,-20509]
000CA0D7>    Panning:9479:dd:03: [DIFF  :-32352,-5486]
000D5E54> ShootPreDe:9054:90:03: spsProperty id:#x
000D5E7C> ShootPreDe:9054:90:03: spsProperty id:#x
000D5E96> ShootPreDe:9054:90:03: spsProperty id:#x
000D5EAF> ShootPreDe:9054:90:03: spsProperty id:#x
000D768A> ShootPreDe:9054:90:03: spsProperty id:#x
000D8EA8> ShootPreDe:9054:90:03: spsProperty id:#x
000DA6BC> ShootPreDe:9054:90:03: spsProperty id:#x
000DA6D5> ShootPreDe:9054:90:03: spsProperty id:#x
000DA6EB> ShootPreDe:9054:90:03: spsProperty id:#x
000DA703> ShootPreDe:9054:90:03: spsProperty id:#x
000DA719> ShootPreDe:9054:90:03: spsProperty id:#x
000DA72F> ShootPreDe:9054:90:03: spsProperty id:#x
000DA745> ShootPreDe:9054:90:03: spsProperty id:#x
000DA777> ShootDevel:944931:b1:03: sdsActivate
000DA848> ShootSsDev:965:9a:03: Activate
000DA86E> ShootSsDev:9165:b1:05: [MEM3NAVI]Initialize
000DA96E>      ShtSs:9997:9a:03: fmCreateTaskRawToYuv
000DA97B> ShootSsDev:9701:00:03: ORE_CreateTaskRawToYuvInitializeList(#x)

000DA997> ShootSsDev:999:00:03: InitializeList(#x)
000DA9AB> ShootSsDev:99:00:03: InitializeList(#x)
000DA9F1>    PropMgr:9653:9a:03: ORE create lock handle for yuv path
sssChangeCBR(PROP_DSDEFINE:#x)
000DAA53> DistCorrec:92203:af:03: sdcsActivate
000DAAE9>      ShtSs:9990:9a:03: entry = 9cb1a4 (975620)(3c)
000DAB27>      ShtSs:9911:9a:03: CORE create lock handle for raw path
000DABAC>      ShtSs:99173:9a:03: entry = 9ebf04 (975634)(10)
000DAC27>      ShtSs:99173:9a:03: entry = 9ec1c8 (975674)(17)
000DAC7D>      ShtSs:99173:9a:03: entry = 9ec388 (975634)(10)
000DACD9>      ShtSs:99173:9a:03: entry = 9ec40c (975674)(17)
000DAF79>    Startup:921347:0c:03: [IC] AUD_Initialize[PRI AUD:19,ALV:25]
000DAFB6>    Startup:9209035:0c:03: SoundDev_Initialize(dwPriority=19)
000DAFD5>    Startup:922141:0c:03: [ACTRL] ACTRL_Initialize (12, 19)
000DB039>    Startup:92097:0c:03: SoundDevRegisterNRStartCallback
000DB059>    Startup:90131:0c:03: [TEST]Audio_TestCommand
000DB43B>    Startup:9209075:0c:03: SoundDev_AprocInitialize(dwPriority 1=23,2=25,3=25,IC=0)
000DB45F>    Startup:9210377:0c:03: [APROC] AprocCtrl_Initialize
000DF003> AprocMainT:9210241:0c:03: [APROC] Aproc_PathDoneCBR [0]
000DF056>    Startup:9210409:0c:03: [APROC] AprocCtrlSetLpcParam
000DF074>    Startup:921427:0c:03: AUD_GetLPCParam
000DF091>    Startup:9210345:0c:03: [APROC] AprocCtrlSetLevelMeterMode
000DF0B0>    Startup:921050:0c:03: [APROC] Aproc_RegisterShellCommand [TEST]
000DF0C7>    Startup:921042:0c:03: AprocCtrl_Initialize : END
000DF0DA>    Startup:92090:0c:03: SoundDev_AprocInitialize END
000DF0F2>    Startup:921454:0c:03: [IC] EnableAudioIC[0]
000DF173>    Startup:9322:0c:03: ALV_Initialize (12, 25)
000DF1A1>    Startup:937:0c:03: alvCreateStateObject
000DF201>    PropMgr:9361:0c:03: alvResultCBR : #x
000DF25A>    PropMgr:9329:0c:03: alvChangeAckCBR
000DF26E>    PropMgr:9355:0c:03: alvChangeAckCBR : PROP_MOVIE_PLAY_VOLUME[#x]
000DF286>    PropMgr:935:0c:03: ALV_SetOutputVol
000DF29B>    PropMgr:930921:0c:03: _ALV_SetOutputVol
000DF2D3>    PropMgr:9329:0c:03: alvChangeAckCBR
000DF2E5>    PropMgr:9379:0c:03: alvChangeAckCBR : PROP_MOVIE_SOUND_RECORD[#x]
000DF2FA>    PropMgr:933:0c:03: ALV_SetALCMode
000DF30B>    PropMgr:933:0c:03: _ALV_SetALCMode
000DF33F>    PropMgr:9329:0c:03: alvChangeAckCBR
000DF353>    PropMgr:93:0c:03: alvChangeAckCBR : PROP_MOVIE_REC_VOLUME[#x]
000DF367>    PropMgr:9373:0c:03: ALV_SetInputVol
000DF378>    PropMgr:9373:0c:03: _ALV_SetInputVol
000DF3A5>    PropMgr:9329:0c:03: alvChangeAckCBR
000DF3B5>    PropMgr:9303:0c:03: alvChangeAckCBR : PROP_WIND_CUT(1)
000DF3C9>    PropMgr:937:0c:03: ALV_SetWindCut
000DF40E>    PropMgr:9329:0c:03: alvChangeAckCBR
000DF421>    PropMgr:93:0c:03: alvChangeAckCBR : PROP_ATTENUATOR(0)
000DF436>    PropMgr:9360:0c:03: ALV_SetAttenuator
000DF44A>    PropMgr:93065:0c:03: _ALV_SetAttenuator
000DF46A>    Startup:93161:0c:03: ALV_RegisterShellCommand
000DF4D8>    Startup:91117:0c:03: AudioSE_Initialize
000DF511>    Startup:9116:0c:03: [SE] AudioSE_Initialize (SIZE=0x1700)(ADR=0x405425c0)
000DF539>    Startup:95934:0c:03:  [MUSIC]AUDMUSIC_Initialize
000DF5E5>    Startup:92090:0c:03: SoundDev_PropInitialize
000DF601>    Startup:9221:0c:03: [ACTRL] ACTRL_InitializeProperty
000DF627>    PropMgr:922275:0c:03: actrlResultCBR : #x
000DF65A>    PropMgr:92237:0c:03: actrlChangeAckCBR :Audio Property[5990997]
000DF67B>    PropMgr:922425:0c:03: [ACTRL]  PROP_MIC_PHYSICAL_CONNECT(0)
000DF695>    PropMgr:9213303:0c:03: AUD_SetMICDetect
000DF6BD>  AudioCtrl:9294115:0c:03: [ACTRL] actrlASetConnect(0,0)
000DF724>    PropMgr:92237:0c:03: actrlChangeAckCBR :Audio Property[207001b]
000DF744>    PropMgr:92241:0c:03: [ACTRL]  PROP_AVPORT_SETTING(0)
000DF75A>    PropMgr:92134:0c:03: AUD_CHG_AvHpDetect No Use PROP_AVPORT_SETTING(0)
000DF79C>    PropMgr:92237:0c:03: actrlChangeAckCBR :Audio Property[599099]
000DF7BB>    PropMgr:92271:0c:03: [ACTRL]  PROP_HDMI_PHYSICAL_CONNECT(0)
000DF7D0>    PropMgr:9213475:0c:03: AUD_SetHdmiDetect HDMI(0)
000DF7E5>    PropMgr:920951:0c:03: SoundDevSetSpeaker
000DF811>    PropMgr:92263:0c:03: [ACTRL] _ACTRL_SetAudioParam [1](0,0,0)
000DF83B>  AudioCtrl:92933:0c:03: [ACTRL] actrlASetPlayParam : 1
000DF85D>  AudioCtrl:9595:0c:03:  [MUSIC]AUDMusic_GetUsingFlg(0)
000DF880>    PropMgr:921345:0c:03: [IC] GetAudioEnableHdmiThrough : 0
000DF8B5>    PropMgr:9215557:44:26: NotInit [PropMgr] GpclkCtrl_Off
000DF8DD>    PropMgr:92237:0c:03: actrlChangeAckCBR :Audio Property[5999992]
000DF8F9>    PropMgr:9227:0c:03: [ACTRL]  PROP_BUZZER(5)
000DF91C>  AudioCtrl:929435:0c:03:  [ACTRL] actrlAudioICSerialCommand_Send(5,2)
000DF975>    PropMgr:92237:0c:03: actrlChangeAckCBR :Audio Property[2050031]
000DF993>    PropMgr:92291:0c:03: [ACTRL]  PROP_DUAL_OUTPUT(0)
000DF9AC>    PropMgr:92237:0c:03: actrlChangeAckCBR :Audio Property[599199]
000DF9C9>    PropMgr:922:0c:03: [ACTRL]  PROP_LIVE_VIEW_MOVIE_SELECT(1)
000DF9F0>    PropMgr:92237:0c:03: actrlChangeAckCBR :Audio Property[599299]
000DFA0D>    PropMgr:9220:0c:03: [ACTRL]  PROP_LV_ACTION(1)
000DFA24>    PropMgr:9213523:0c:03: AUD_SetLvAction (VAL:1,MODE:0)
000DFA41>    PropMgr:922365:0c:03: actrlChangeAckCBR :Audio Property[5990999] ParamSize[#x]
000DFA62>    PropMgr:9223:0c:03: [ACTRL]  PROP_LENS(1eb)
000DFA7A>    PropMgr:92135:0c:03: [IC] AUD_SetNoiseChancelLensID[ID:1eb]
000DFA90>    PropMgr:921309:0c:03: [IC] AUD_SetNoiseChancelLensISsw[ID:1]
000DFAB4>    Startup:92090:0c:03: SoundDev_PropInitialize END
000DFAC8>    Startup:921397:0c:03: [IC] Test_AudioCommand
000DFDBB>    Startup:90755:97:03: PackHeap 54a9a4,54a9a4,114560
000DFE19>    Startup:936740:19:03: FM_RegisterMetaCompleteCallBack
000DFE35>    Startup:936740:19:03: FM_RegisterMetaCompleteCallBack
000DFEAA>    PropMgr:001b686f:00:0f: [35] *** mpu_send(08 06 03 18 00 00 00 00)                      ; PROP 8003000F
000DFEE1>    PropMgr:971:39:03: PROP_CONNECT_TARGET fGPSConnect = 0x0
000DFF05>    PropMgr:909:39:03: USB 0x0 MPU 0x0 WFT 0x0 INNER 0x0
000DFF7D>    Startup:001b686f:00:0f: [36] *** mpu_send(08 06 03 1f 00 00 00 00)                      ; PROP 80030019
000DFFCE>    PropMgr:001b686f:00:0f: [37] *** mpu_send(08 06 04 24 00 00 00 00)                      ; ???
000E01EE>    PropMgr:001b686f:00:0f: [38] *** mpu_send(0a 08 01 3b ff ff 00 00 00 00)                ; PROP_USBDEVICE_CONNECT
000E03AC>    Startup:001b686f:00:0f: [39] *** mpu_send(08 07 03 68 00 00 00 00)                      ; ???
000E0413>    PropMgr:001b686f:00:0f: [40] *** mpu_send(06 05 03 69 00 00)                            ; ???
000E04EA>    PropMgr:001b686f:00:0f: [41] *** mpu_send(08 07 03 89 00 00 00 00)                      ; ???
000E051F>    Startup:931:0c:03: ALV_RegisterObserveCBR[0]
000E0758>    PropMgr:001b68db:00:0f: [1] *** mpu_recv(06 05 01 58 00 00)                             ; PROP_VIDEOSNAP_MODE
000E0E0B>    PropMgr:001b68db:00:0f: [2] *** mpu_recv(06 05 01 58 00 00)                             ; PROP_VIDEOSNAP_MODE
000E1566>    PropMgr:001b68db:00:0f: [3] *** mpu_recv(06 05 01 58 00 00)                             ; PROP_VIDEOSNAP_MODE
000E1F09>    Startup:930:97:03: PackHeap 4056ac80,4056ac80,393088
000E25AD>    Startup:907099:97:03: COM_RegisterTransMission 81 0x9372
000E25E1>    Startup:9007:97:03: COM_RegisterConncectModeChange 0x9370
000E26C9>    Startup:921411:34:03:  TOM_Initialize
000E2780>    PropMgr:92147:34:03:  PROP_WFT_IMAGE_TRANS (1)
000E27E0> AudioLevel:932:0c:03: alvChangeOutputVol SetVolume(5)
000E2800> AudioLevel:920921:0c:03: SoundDevSetVolumeOut(Volume=5)
000E2829> AudioLevel:92263:0c:03: [ACTRL] _ACTRL_SetAudioParam [2](5,0,0)
000E2851>  AudioCtrl:92933:0c:03: [ACTRL] actrlASetPlayParam : 2
000E2870>  AudioCtrl:9595:0c:03:  [MUSIC]AUDMusic_GetUsingFlg(0)
000E288A>  AudioCtrl:921373:0c:03: [IC] SetAudioVolumeWithoutSendCommand
000E28C4> AudioLevel:9209273:0c:03: SoundDevSetWindCutMode(Mode=1)
000E28DE> AudioLevel:92263:0c:03: [ACTRL] _ACTRL_SetAudioParam [6](1,0,0)
000E2901>  AudioCtrl:929301:0c:03: [ACTRL] actrlASetRecParam : 6
000E2926> AudioLevel:93109:0c:03: ALC=1,LVOL=47,RVOL=47,WCT=1,ATN=0 /alvChangeWindCut
000E29DB>     ComMgr:904:97:03: PROP_CARD1_STATUS 0
000E29F8>     ComMgr:90903:97:03: comStorageSetStorageID:0,0,0
000E2A15>     ComMgr:9236639:97:03: COMS PROP_CARD1_STATUS 0
000E2A46>     ComMgr:9040:97:03: PROP_CARD2_STATUS 1
000E2A5D>     ComMgr:90903:97:03: comStorageSetStorageID:1,0,0
000E2A73>     ComMgr:9236639:97:03: COMS PROP_CARD2_STATUS 1
000E2A9F>     ComMgr:9042:97:03: PROP_CARD1_EXIST 0
000E2AB4>     ComMgr:90903:97:03: comStorageSetStorageID:0,0,0
000E2ADA>     ComMgr:90445:97:03: PROP_CARD2_EXIST 1
000E2AED>     ComMgr:90903:97:03: comStorageSetStorageID:1,0,1
000E2B39>     ComMgr:90962:97:03: comAudioLevelMeterStartEnd 0 0
000E2B81>     ComMgr:9055:97:03: PROP_CURRENT_MEDIA[2]
000E2DE6>     ComMgr:923646:97:03: PROP_SHOOTING_TYPE 0 0
000E2FF8>     ComMgr:9055:97:03: bodyID_h = #x
000E3013>     ComMgr:9061:97:03: bodyID_l = #x
000E303F>     ComMgr:9093:97:03: String = 023070047059
000E33C8>     ComMgr:905:97:03: COMMUNICATION_MODE_OFF #x #x
000E34C4>     ComMgr:90179:97:03: PROP_MWB[2c]
000E3552>     ComMgr:90607:97:03: R JobState 0x0 0x0 0x20
000E387C>     ComMgr:9072:97:03: CommunicationMode:0
000E3945>     ComMgr:905:97:03: PROP_ADAPTER_DEVICE_ACTIVE: FALSE
000E39DE>     ComMgr:907:97:03: PROP_NETWORK_NICKNAME
000E3A5B>     ComMgr:9097:97:03: LensName:TAMRON 16-300mm F/3.5-6.3 Di II VC PZD B016
000E3A75>     ComMgr:90925:97:03: LensExist 1
000E3B26>     ComMgr:90962:97:03: comAudioLevelMeterStartEnd 0 0
000E3B5B>     ComMgr:9001:26:03: PROP_SCREEN_SAVER
000E3B96>     ComMgr:9093:26:03: PROP_PUSH_TRANSFER 0
000E3C1C>     ComMgr:900:97:03: #LENS_EXCHANGE_HISTORY[3] 0[#x] 1[#x]
000E3C35>     ComMgr:90003:97:03: #LENS_EXCHANGE_HISTORY 2[#x] 3[#x] 4[#x]
000E3CF2>     ComMgr:900565:97:03: comRegisterPhysicalConnect USB 9372 56aa18
000E3D1E>     ComMgr:90053:97:03: comRegisterPhysicalConnect SDIO 9372 56aa18
000E3D44>     ComMgr:90053:97:03: comRegisterPhysicalConnect INNER 9372 56aa18
000E3EEF>     PtpMgr:94011:97:03: ptpChangeConnectMode 0x
000E3F15>     PtpMgr:9167:26:03: OverWrite Operation Function
000E3F2F>     PtpMgr:9167:26:03: OverWrite Operation Function
000E3F46>     PtpMgr:9167:26:03: OverWrite Operation Function
000E3FB3>      TOMgr:9270619:34:03:  tomSetRawJpgMode (Type = #x)
000E4029>     NFCMgr:92541:3e:03:  PROP_NETWORK_INFO 00:00:00:00:00:00:00:00
000E4049>     NFCMgr:92545:3e:03:  PROP_NETWORK_INFO MacAdder is Default or ILLEGAL
000E4175>    Startup:99157:00:03: [STARTUP]startupCompleteCallback 0x100
000E4198>    Startup:991699:00:03: [SEQ] NotifyComplete (Cur = 4, #x, Flag = #x)
000E4550>    Startup:924139:d7:03: InitializeServo
000E468C>    Startup:923075:d7:03: AF_ResetDriveAndSamplingParameter
000E4B35>    PropMgr:001b686f:00:0f: [42] *** mpu_send(06 04 0e 3a 00 00)                            ; ???
000E4BBA>   EventMgr:9977:37:03: emRegisterMulticastCallback : EventID = 20, ClassID = 215
000E4BF7>    Startup:924321:d7:03: AF_StartSampling
000E4CE9>    Startup:906105:22:03: TCM_Initialize
000E4DA1>    PropMgr:906113:22:05: TimeCode DropFrame Mode:1
000E4DE3>    PropMgr:90605:22:03: TimeCode Base:0,0,0,0
000E4E00>    PropMgr:906071:22:03: Set Time:0,0,0
000E4E4A>    Panning:94771:dd:03: [GYRO  :2118078987,1077764206]
000E4E7E>    Panning:947:dd:03: [Offset:14741,-20509]
000E4E9C>    Panning:9479:dd:03: [DIFF  :-32352,-5486]
000E4EC5>    PropMgr:9060:22:03: dwFreeRunModifyingFlags 2
000E4FB4>    PropMgr:9061:22:03: TCPreSet[00:00:00.00]
000E5041>    PropMgr:906113:22:05: TimeCode Mode:1
000E510E> TimeCodeMa:996:22:16: [TCTEST]FreeRunBase RTC:21(h)15(m)17(s)->76517
000E5132> TimeCodeMa:99:22:16: FreeRun/1 [1836408][1836408][1912925][2293214][3825850][4586428]
000E51A3>    PropMgr:906113:22:05: PROP_TIMECODE_HDMI_OUTPUT:0
000E51E1>    PropMgr:906113:22:05: PROP_TIMECODE_HDMI_REC_COMMAND:0
000E51FD>    PropMgr:906167:22:05: PROP_MOVIE_PARAM:0,0
000E522C>    Startup:906277:22:03: TCM_Initialize
000E53AD>    PropMgr:92375:22:16: card 1 0
000E53D8>    PropMgr:92375:22:16: card 2 32768
000E5468>    Startup:91359:22:16: Smac:#x Tric:#x
000E5483>    Startup:91361:22:16: AllocSize:#x S:#x T:#x
000E5672>    Startup:913:15:03: @Startup FIO_GetSupportedDriveInfo(0x205700) L:1102
000E5801>     NFCMgr:9254509:3e:03:  PROP_VIDEOSNAP_MODE OFF 0
000E583C>     NFCMgr:9254509:3e:03:  PROP_VIDEOSNAP_MODE OFF 0
000E5863>     NFCMgr:9254509:3e:03:  PROP_VIDEOSNAP_MODE OFF 0
000E58A7>     NFCMgr:90625:3e:03: [BLE] PROP_NETWORK_STATE Wi-Fi OFF
000E58D6>     NFCMgr:90644:3e:03: [BLE] PROP_NETWORK_INFO 00:00:00:00:
000E58EF>     NFCMgr:906455:3e:03: [BLE] PROP_NETWORK_INFO :00:00:00:00
000E5919>     NFCMgr:9099:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
000E5931>     NFCMgr:90901:3e:03: [BLE] Enter CheckGpsAndBleState().
000E5964>     NFCMgr:90631:3e:03: [BLE] PROP_VIDEOSNAP_MODE OFF 0
000E597F>     NFCMgr:90631:3e:03: [BLE] PROP_VIDEOSNAP_MODE OFF 0
000E599A>     NFCMgr:90631:3e:03: [BLE] PROP_VIDEOSNAP_MODE OFF 0
000E59C0>     NFCMgr:907:3e:03: [BLE] Enter blemgr_SmartPhoneGps_NopEvent!!!
000E59D6>     NFCMgr:909:3e:03: [BLE]   Status=0, Event=13
000F38C1>       dump:001b6b09:00:0f: Logging finished.
000F38E2>       dump:001b6b17:00:0f: Free memory: 3655028 bytes.

If anyone else with a 200D wants to get a similar log, here's the FIR you should run:

LOG_200D.FIR (https://a1ex.magiclantern.fm/bleeding-edge/200D/LOG_200D.FIR)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: morgan20 on August 26, 2018, 03:24:42 AM
So I was playing around with the 6D2 ROM1 dump and it seem to have failed the disassembly part.
I get a lot of lines like this in the ROM1 disassembly file:
Code: [Select]
ffffffff ; <UNDEFINED> instruction: 0xffffffff
Somewhere on the forum I read that it might be because the wrong firmware start address that I use with disassemble.pl script. Although I used exactly the same address that was given me by the Firmware Dumper: 0xE0040000. What am I doing wrong?

Another stupid question how can I identify the stub (what it actually does so I put it in stubs.S)?

Note: my dump is of the 1.0.4 firmware version.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: critix on August 26, 2018, 06:26:13 AM
Hi.
Please send to me dump from 6D2 for finding stubs.
Thanks.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on August 26, 2018, 06:29:07 AM
"Somewhere on the forum..."

- ROM0 start address: 0xE0000000 on [DIGIC 7], 0xF0000000 on [DIGIC 2..5] (data only)

Also the "reference" documentation:
https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst?#rst-header-initial-firmware-analysis

For Thumb, you will need disassemblev7.pl (http://chdk.wikia.com/wiki/User:Srsa_4c/GPL:disassemblev7.pl). Good news is that DIGIC 7 firmware is mostly Thumb, unlike DIGIC 6 which is a mix of ARM and Thumb. There are still a few ARM veneers around; so far I've only noticed direct jumps to Thumb functions.

Stubs are generally function addresses (where a function starts); the LSB is the Thumb bit. A small part of them are data pointers; these have even values, usually in RAM. Some of the stubs are already defined in */debugmsg.gdb in the QEMU directory. Some of them are even identical between 200D (D7) and M50 (D8), so...

Following a call trace in QEMU is also helpful; that's the method used by find_stubs.sh (https://www.magiclantern.fm/forum/index.php?topic=2864.msg200846#msg200846) (which helps, but only finds a small set of stubs and... doesn't work on Mac).

The autogenerated IDC files (one with -d idc from QEMU and the other from the GDB script saved by find_stubs.sh) are also very helpful.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: edoardoc on September 02, 2018, 12:36:21 PM
Hi! I own a Canon 200D, how can I help the developers? :D
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: edoardoc on September 08, 2018, 11:02:30 AM
I loaded the dump file for the EOS 200D but it get stuck on "- Dumping ROM0..." :

(https://thumb.ibb.co/hsUgh9/IMG_3619.jpg) (https://ibb.co/hsUgh9)


Here's a diagnostic log from my 200D :

Code: [Select]
00000000>       init:001b6acf:00:0f: Logging started.
00000000>       init:e04bdce7:00:05: [MEM] InitializePermanentMemory 0 4636784
0000013E>       init:e0041327:89:16:
K417 ICU Firmware Version 1.0.1 ( 5.0.2 )
00000163>       init:e0041333:89:05:
ICU Release DateTime 2017.09.21 12:53:23
000002BC>       init:e0048fd7:00:03: [SEQ] CreateSequencer (Startup, Num = 6)
00000306>       init:e00490d1:00:03: [SEQ] NotifyComplete (Cur = 0, 0x2018000, Flag = 0x10000)
00000979>     SFRead:e0139f05:02:05: PROPTUNEAD_CreateFROMPropertyHandleToDRAM Addr:0x416a2c00
000009E9>     SFRead:e01c7b0b:02:03: PROPCOMBO_LoadProperty(395)
00000A38>    RomRead:e04c14af:02:05: PROPAD_CreateFROMPropertyHandle DRAMAddr 0x421f8400
00005EB9>     SFRead:e00490d1:00:03: [SEQ] NotifyComplete (Cur = 0, 0x2008000, Flag = 0x8000)
00009537>    RomRead:e00490d1:00:03: [SEQ] NotifyComplete (Cur = 0, 0x2000000, Flag = 0x2000000)
00009571>    Startup:e0048f6d:00:05: [SEQ] seqEventDispatch (Startup, 0)
0000958B>    Startup:e004148f:89:05: startupEntry
0000ABD0>    Startup:e0046f31:00:03: [PWM] PWM_Initialize
0000AC4F>    Startup:e05452e9:00:03: [ADC] InitializePollingADC
0000B238>      init1:e0246323:d2:03: [FMID]FMID_SYS_Initialize(0x5eeefe00, 0x500000)
0000D3BD>    Startup:e05451f5:00:03: [ ADC ] Calibration Completed, 0x00000000
0000E602>    PropMgr:e00a8c09:81:03: PROP_RegisterMultiConvert : 3, 6
0000E632>    PropMgr:e00a8c09:81:03: PROP_RegisterMultiConvert : 1, 1
0000E82F>    PropMgr:e0066e11:81:03: @@@JudgeRestoreFlavorPC 1062
0000EB92>    Startup:001b686f:00:0f: [0] *** mpu_send(06 04 02 00 00 00)
0000ED0A>    PropMgr:e04e17e7:37:03: emSlaveChangeCBR : AUTO_POWEROFF (1)
0000ED3C>    PropMgr:e04e1805:37:03: emSlaveChangeCBR : UILOCK (0x0)
0000EF65>    PropMgr:001b68db:00:0f: [0] *** mpu_recv(06 05 01 00 00 00)
0000F020>    PropMgr:e006739b:81:03: ChangeAEMode -> 0 @AE_MODE_DIAL
0000F07F>    PropMgr:001b686f:00:0f: [1] *** mpu_send(08 06 01 a7 00 01 00 00)
0000F0A3>    PropMgr:e009134f:81:03: Active Adjective & Situation 0->0
0000F0E5>    PropMgr:e00a8dd7:81:03: ReqChangeCBR : Adjective 0, 0
0000F113>    PropMgr:001b68db:00:0f: [1] *** mpu_recv(06 05 01 99 00 00)
0000F132>    PropMgr:e00a8e41:81:03: Not ExecMultiConvert Already None : Adjective 0, 0
0000F16F>    PropMgr:e00a8ef7:81:03: Not ExecMultiConvert : Situation 0
0000F1B0>    PropMgr:001b68db:00:0f: [2] *** mpu_recv(06 05 01 9a 00 00)
0000F1EF>    PropMgr:e00916a9:81:03: !! Convert End !!
0000F246>    PropMgr:001b68db:00:0f: [3] *** mpu_recv(06 05 01 06 15 00)
0000F294>    PropMgr:e04bf3d9:02:03: DataType = 0x2000000 fModify = TRUE
0000F2F5>    PropMgr:001b68db:00:0f: [4] *** mpu_recv(06 05 01 3f 00 00)
0000F644>    PropMgr:001b68db:00:0f: [5] *** mpu_recv(06 05 01 99 00 00)
0000F6D7>    PropMgr:001b68db:00:0f: [6] *** mpu_recv(06 05 01 9a 00 00)
0000F766>    PropMgr:001b68db:00:0f: [7] *** mpu_recv(06 05 01 06 15 00)
0000F7AF>    PropMgr:e00afc13:81:03: PROP_STROBO_FIRING 0 Last 0
0000F7D2>    PropMgr:e00afc2d:81:03: dwLastStroboFiring = 0  stroboFiring = 0
0000F810>    PropMgr:001b68db:00:0f: [8] *** mpu_recv(06 05 01 3f 00 00)
0000F897>    PropMgr:001b68db:00:0f: [9] *** mpu_recv(06 05 01 4f 00 00)
0000F94C>    PropMgr:e0067a8f:81:03: PROP_CHROMATISM 0 (Excluding:0)
0000F9D9>    PropMgr:e0067a29:81:03: PROP_DISTORTION_COMP 0 (Excluding:0)
0000FA52>    PropMgr:e0067a5f:81:03: PROP_LIGHT_FALLOFF_COMP 1 (Excluding:0)
0000FC1E>    PropMgr:e00afc13:81:03: PROP_STROBO_FIRING 0 Last 0
0000FC39>    PropMgr:e00afc2d:81:03: dwLastStroboFiring = 0  stroboFiring = 0
0000FC66>    PropMgr:e0067321:81:03: FixedMovie New 0 Last 0
0000FD9A>    PropMgr:e00676a7:81:03: PROP_TOUCH_SHUTTER 0
0000FE27>    PropMgr:e00676cf:81:03: PROP_CREATIVE_TOUCH_SHUTTER 0
0000FEB6>    PropMgr:001b686f:00:0f: [2] *** mpu_send(22 20 0e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
0000FED7>    PropMgr:e041e9b5:d6:03: LvLensDataMasterResultCBR
0000FF2C>    PropMgr:e041e9b5:d6:03: PowerZoomAdapterInfoCBR
0000FF7D>    PropMgr:e041e9b5:d6:03: FactErrLensDataInfoCBR
00010228>     NFCMgr:e03d550b:3e:03: [BLE] BLEMGR_InitializeParam
000102CB>    PropMgr:001b686f:00:0f: [3] *** mpu_send(06 05 03 8a 00 00)
0001033D>    PropMgr:001b686f:00:0f: [4] *** mpu_send(06 04 02 14 00 00)
00010395>     NFCMgr:e05f3be3:3e:03:  NFCI2C_SetParam 1 3 0xa8 0x0
000103CB>     NFCMgr:e0586c13:3e:03:  PROP_SPECIAL_OPTION Wlan off (0x0)
000107C4>   PowerMgr:001b68db:00:0f: [10] *** mpu_recv(30 2f 02 0d 00 00 00 00 01 00 00 00 00 00 00 01 00 01 02 00 00 00 00 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0f 00 01 01 01 00 00 00)
00010949>    PropMgr:e041dfc3:01:03: DivideMediaEtcInit2Data[24] comID 1 dataID 91 data 0xf00
00010979>    PropMgr:e041dfc3:01:03: DivideMediaEtcInit2Data[25] comID 1 dataID 9c data 0x100
00010E53>   PowerMgr:001b68db:00:0f: [11] *** mpu_recv(5e 5c 02 0f 02 00 00 08 01 01 00 00 00 00 00 00 00 00 00 00 09 5e 00 00 00 0c 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 00 00 01 00 01 01 00 00 00 00 00 00 00 00 00 03 01 2c 00 00 0b b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)
00010F05>    PropMgr:e041cf2f:01:03: RecMovieParam 0 0 2398 12 0 3 1 0
00011022>    PropMgr:e00679df:81:03: @@@ PROP_MOVIE_CFILTER 0
00011335>   PowerMgr:001b68db:00:0f: [12] *** mpu_recv(48 46 02 10 00 00 00 00 00 00 01 01 00 00 03 03 03 03 00 00 00 00 00 00 00 5c 00 01 ba 50 00 00 00 00 00 01 ff 00 00 02 01 01 00 03 00 01 00 04 00 00 01 05 00 01 01 00 01 00 00 03 03 00 00 00 00 00 00 00 00 00 00 00)
00011B29>   PowerMgr:001b68db:00:0f: [13] *** mpu_recv(42 40 02 11 00 01 00 00 00 00 01 00 ff 01 00 00 00 00 00 00 00 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 00 00)
00011B96>    PropMgr:e041e695:01:03: DivideLensInit2Data[3] comID 1 dataID 4 data 0x0
00011BC8>    PropMgr:001b68db:00:0f: [14] *** mpu_recv(06 05 01 b6 01 00)
00011C45>   PowerMgr:001b68db:00:0f: [15] *** mpu_recv(06 05 01 b5 01 00)
00011CD2>   PowerMgr:001b68db:00:0f: [16] *** mpu_recv(06 05 01 98 00 00)
00011E28>   PowerMgr:001b68db:00:0f: [17] *** mpu_recv(12 10 02 04 0c 00 01 01 00 01 00 43 00 00 00 00 00 00)
000127DA>   PowerMgr:e0042c8b:00:03: [STARTUP]startupCompleteCallback 0x2
000127FC>   PowerMgr:e00490d1:00:03: [SEQ] NotifyComplete (Cur = 1, 0x2, Flag = 0x2)
0001287C>   PowerMgr:001b68db:00:0f: [18] *** mpu_recv(94 93 02 0e 00 00 03 01 00 00 00 68 01 00 00 17 14 50 00 00 00 00 81 00 00 01 03 00 00 06 04 00 00 01 00 00 01 00 00 00 00 60 15 00 00 00 00 00 00 00 00 01 03 00 00 90 48 00 00 88 48 80 48 80 48 90 48 88 48 80 48 78 48 70 00 00 00 00 01 00 00 00 00 02 00)
00012910>    PropMgr:001b68db:00:0f: [19] *** mpu_recv(06 05 03 37 00 00)
000129CA>    PropMgr:001b68db:00:0f: [20] *** mpu_recv(0a 08 03 2f 00 40 00 00 00 00)
00012A46>    PropMgr:001b68db:00:0f: [21] *** mpu_recv(06 05 03 20 01 00)
00012A6B>    PropMgr:e006739b:81:03: ChangeAEMode -> 0 @AE_MODE_DIAL
00012A92>    PropMgr:e00916a9:81:03: !! Convert End !!
00012ACE>    PropMgr:001b68db:00:0f: [22] *** mpu_recv(06 05 03 76 00 00)
00012C1D>    PropMgr:e041e141:01:03: DivideDataInit2Data[4] comID 1 dataID 4 data 0x0
00012C4C>    PropMgr:e041e141:01:03: DivideDataInit2Data[8] comID 1 dataID b data 0x0
00012C75>    PropMgr:e041e141:01:03: DivideDataInit2Data[10] comID 1 dataID e data 0x1450
00012CCA>    PropMgr:e041e141:01:03: DivideDataInit2Data[22] comID 1 dataID 1f data 0x0
00012D45>    PropMgr:e00afc13:81:03: PROP_STROBO_FIRING 0 Last 0
00012D64>    PropMgr:e00afc2d:81:03: dwLastStroboFiring = 0  stroboFiring = 0
00012DCA>    PropMgr:e0067ac9:81:03: PROP_MULTIPLE_EXPOSURE_SETTING 0
00012DF4>    PropMgr:e0067ac9:81:03: PROP_HDR_SETTING 0
00012E2C>    PropMgr:e00676f1:81:03: @@@ PROP_LV_CFILTER 0
00012E5A>    PropMgr:e0067ac9:81:03: PROP_GIS_SETTING Func 0
00012E77>    PropMgr:e041e141:01:03: DivideDataInit2Data[50] comID 1 dataID 47 data 0x20a
00012E9A>    PropMgr:e041e141:01:03: DivideDataInit2Data[51] comID 1 dataID 57 data 0x0
00012ED0>    PropMgr:e00675e9:81:03: PROP_SHUFFLE_MODE 0x0 ConvertMode 0x0
00012EEE>    PropMgr:e041e141:01:03: DivideDataInit2Data[53] comID 1 dataID 88 data 0x3c
00012F59>    PropMgr:e041e141:01:03: DivideDataInit2Data[59] comID 1 dataID 9e data 0x40
00012FD0>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000001, 0xE0066E9B(1)
00013059>    PropMgr:e0067475:81:03: StartupCondition : 1, 0
0001313D>    PropMgr:001b68db:00:0f: [23] *** mpu_recv(64 62 02 12 01 26 51 10 32 00 12 00 37 91 57 9a 7e 08 ff 00 00 00 00 00 00 00 3b 59 dc 00 00 00 17 26 00 00 00 3b 59 dc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 65 00 00 00 00 00 00 00 10 32 00 00 00 00 00 00 00 00 00 00)
000131C3>    PropMgr:001b68db:00:0f: [24] *** mpu_recv(06 05 03 35 01 00)
00013295>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000001, 0xE0066E9B(0)
000132C8>    PropMgr:e041f33b:01:03: SpecialComplete ID = 0x80000001, 0x80000001 3011
00013312>    PropMgr:001b686f:00:0f: [5] *** mpu_send(08 06 00 00 02 0e 00 00)
00013389>    Startup:e0048f6d:00:05: [SEQ] seqEventDispatch (Startup, 1)
000133B5>    Startup:e0041c5d:89:05: startupPrepareProperty
0001340F>    Startup:001b68db:00:0f: [25] *** mpu_recv(1c 1b 03 1d 64 03 00 00 00 00 00 4c 50 2d 45 31 37 00 00 00 00 01 00 23 7e 02 66 00)
0001349B>    PropMgr:001b68db:00:0f: [26] *** mpu_recv(06 04 03 36 00 00)
0001353A>    PropMgr:001b68db:00:0f: [27] *** mpu_recv(08 07 03 7e ff ff ff 00)
00013567>    PropMgr:e0048577:88:03: HotPlug TimelapseSetting = 0
000135C8>    Startup:001b68db:00:0f: [28] *** mpu_recv(06 05 03 38 9e 00)
000135F9>    Startup:e0093baf:88:03: # 0 0 1 1 0
00013675>    PropMgr:001b68db:00:0f: [29] *** mpu_recv(08 06 01 a7 00 01 00 00)
000136BD>    Startup:e004899f:88:03: CreateTask Master End
00013719>    PropMgr:001b68db:00:0f: [30] *** mpu_recv(08 06 01 a7 00 00 00 00)
0001379E>    PropMgr:e0041c07:89:03: PROP_GPS_AUTO_TIME_SETTING 0
000137E2>    Startup:e0042c8b:00:03: [STARTUP]startupCompleteCallback 0x20000000
00013805>    Startup:e00490d1:00:03: [SEQ] NotifyComplete (Cur = 2, 0x20420010, Flag = 0x20000000)
0001382D>    Startup:e0041c8f:89:03: startupPrepareProperty : CLASSID_FLAG_PROPAD
0001384B>    Startup:e0693cbd:19:03: FM_Initialize (0, 1, 0)
000138BC>    PropMgr:e0693b99:19:03: fmResultCBR (0x860348)
00013A0C>    PropMgr:e0693bbf:19:03: PROP_HDD_DCIM_PATH (/)
00013AE7>    Startup:e04a1fdf:1c:03: FC_Initialize [drive:0 1 0][ClassID:28]
00013B04>    Startup:e04a2011:1c:03: FC_Initialize [86608 655360]
00013FA7>     RTCMgr:e01ca19f:00:05: [RTC] SPECIAL_OPTION 0x0, 0x4000
00014057>     RTCMgr:001b686f:00:0f: [6] *** mpu_send(08 07 03 6a 00 01 00 00)
000140B4>     RTCMgr:e024a1d5:00:05: [RTC] PermitCharge already Permit 0x20
00014127>    Startup:e0498415:80:03: srmGetShootMemAreaAddress(): Area[4] isn't Exist.
000141C4>    PropMgr:001b686f:00:0f: [7] *** mpu_send(0a 08 03 06 00 00 00 00 00 00)
0001421A>    PropMgr:001b686f:00:0f: [8] *** mpu_send(06 04 03 10 00 00)
00014376>    Startup:001b686f:00:0f: [9] *** mpu_send(06 05 03 07 ff 00)
000143C3>    Startup:e0495ffb:80:03: CreatePackHeapObject
0001441B>    Startup:e0376221:80:03: AllocateMemoryUnit For OnlyMem1
00014434>    Startup:e0376221:80:03: AllocateMemoryUnit For OnlyMem1
00014446>    Startup:e0376221:80:03: AllocateMemoryUnit For OnlyMem1
00014458>    Startup:e0376221:80:03: AllocateMemoryUnit For OnlyMem1
00014589>    Startup:e00d2213:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[1]
000145B6>    Startup:e00d2213:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[2]
00014620>    Startup:e049088d:80:03: RearrangeMemMgr sub 1 0 0
0001467F>    Startup:e04908f1:80:03: fDevDone 1, dwLvLock 0
00014699>    Startup:e049093d:80:03: 0 0 0
000146B6>    Startup:e04909b5:80:03: PROP_MEMORY_STATUS(SELF) (10->)13 (OTHER) 0, 5276
000146D3>    Startup:e04909ff:80:05: Deliver PROP_MEMORY_STATUS 19
0001471B>    Startup:e04960f9:80:03: MemMgr(IMAGE) 0 0
00014736>    Startup:e04960f9:80:03: MemMgr(IMAGE) 0 0
0001474E>    Startup:e04960f9:80:03: MemMgr(IMAGE) 0 1
00014762>    Startup:e04960f9:80:03: MemMgr(IMAGE) 0 0
00014806>     RscMgr:e00ce18b:35:03: this->dwCardStatus[0] = 0x0(474)
0001482E>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
00014846>     RscMgr:e049093d:80:03: 0 0 0
0001487A>     RscMgr:e00ce18b:35:03: this->dwCardStatus[1] = 0x0(474)
000148A1>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
000148B9>     RscMgr:e049093d:80:03: 0 0 0
000148EB>     RscMgr:e00ce219:35:03: PROP_PC_HDD_STATUS = 0x1
00014954>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
0001496F>     RscMgr:e049093d:80:03: 0 0 0
000149C3>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
000149DD>     RscMgr:e049093d:80:03: 0 0 0
00014A30>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
00014A49>     RscMgr:e049093d:80:03: 0 0 0
00014AF8>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
00014B14>     RscMgr:e049093d:80:03: 0 0 0
00014B52>     RscMgr:e00ce557:35:03: PROP_SAVE_MODE = 0x1
00014BA8>     RscMgr:e00ce5db:35:03: PROP_CARD0_FOLDER_NUMBER
00014BE8>     RscMgr:e00ce5db:35:03: PROP_CARD1_FOLDER_NUMBER
00014C87>     RscMgr:e00cdeb9:35:03: PROP_NUMBER_OF_CONTINUOUS_MODE BaseDcfNo 2292
00014CC5>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
00014CDD>     RscMgr:e049093d:80:03: 0 0 0
00014D15>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
00014D2C>     RscMgr:e049093d:80:03: 0 0 0
00014D7D>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
00014D94>     RscMgr:e049093d:80:03: 0 0 0
00014DAB>     RscMgr:e00cec65:35:03: PROP_CARD_EXTENSION 0
00014F99>     RscMgr:e00ceadb:35:03: PC_CLUSTER_SIZE = 0x1000
0001507E>     RscMgr:e00cdb83:80:03: SetAutoIsoCode 0x83
0001509C>     RscMgr:e00cdb97:35:03: ChangeAutoIsoCode Factor:1 AutoIsoCode:131 -> 131
000150F8>     RscMgr:e00cdb83:80:03: SetAutoIsoCode 0x83
00015111>     RscMgr:e00cdb97:35:03: ChangeAutoIsoCode Factor:2 AutoIsoCode:131 -> 131
0001516C>     RscMgr:e00d2213:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[3]
00015190>     RscMgr:e00d2213:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[4]
000151B2>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
000151C8>     RscMgr:e049093d:80:03: 0 0 0
00015210>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
00015227>     RscMgr:e049093d:80:03: 0 0 0
00015285>     RscMgr:e00d2213:35:03: RealClearBusy(0x40000) 0x0->0x0,0x0(0x0)[5]
000152D5>     RscMgr:e00d2213:35:03: RealClearBusy(0x40000) 0x0->0x0,0x0(0x0)[6]
00015323>     RscMgr:e00d2213:35:03: RealClearBusy(0x40000) 0x0->0x0,0x0(0x0)[7]
0001536E>     RscMgr:e00d2213:35:03: RealClearBusy(0x40000) 0x0->0x0,0x0(0x0)[8]
000153A7>     RscMgr:e00cdb83:80:03: SetAutoIsoCode 0x88
000153BD>     RscMgr:e00cdb97:35:03: ChangeAutoIsoCode Factor:0 AutoIsoCode:131 -> 136
00015427>     RscMgr:e00d2213:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[9]
00015446>     RscMgr:e00d2213:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[10]
00015467>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
0001547E>     RscMgr:e049093d:80:03: 0 0 0
000154E4>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
000154FB>     RscMgr:e049093d:80:03: 0 0 0
00015553>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
0001556A>     RscMgr:e049093d:80:03: 0 0 0
00015676>     RscMgr:e00ce4c5:35:03: RU CLUSTER_SIZE[0] = 0x407BA6B0
000156D6>     RscMgr:e00ce4c5:35:03: RU CLUSTER_SIZE[1] = 0x407BA6BC
000157A6>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 0, ClassID = 53
000157DE>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 11, ClassID = 53
000157FD>   EventMgr:e00a2b5d:37:03: Already SW1OFF
00015839>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 14, ClassID = 53
00015862>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 15, ClassID = 53
0001588A>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 4, ClassID = 53
00015A19>    Startup:e06983bf:19:03: FM_RegisterSpaceNotifyCallback
00015A40>    Startup:e0713445:1a:05: MRK_RegisterSpaceNotifyCallback
00015A60>    Startup:e02a881d:1a:03: RegisterSpaceNotifyCallback : DriveNo = 2
00015A85>    Startup:e01c7067:19:03: voiRegisterSpaceNotifyCallback : DriveNo = 2
00015AA6>    Startup:e050f011:19:03: [GPS] gpsRegisterSpaceNotifyCallback : DriveNo = 2
00015AC8>    Startup:e065c9af:19:03: RegisterSpaceNotifyCallback : DriveNo = 2
00015B52>    Startup:e04bc1e7:15:03: @Startup FIO_RegisterSpaceNotifyCallback(1,0xe04d4b0b,0x2) L:1051
00015B88>    Startup:e04ea317:1c:03: FcmcRegisterSpaceNotifyCallback : DriveNo = 2
00015BA8>    Startup:e06983bf:19:03: FM_RegisterSpaceNotifyCallback
00015C35>    Startup:e04c2573:39:05: InitializeJobClass (ID = 2015, Num = 15)
00015C57>    Startup:e04c25c5:39:05: InitializeJobClass 12 206 0 5544
00015CBB>    PropMgr:e01b14bd:39:03: [BIND] dcsResultCBR (0x8624f0)
00015DE3>    PropMgr:001b68db:00:0f: [31] *** mpu_recv(42 40 02 11 00 01 00 00 00 00 01 00 ff 01 00 00 00 00 00 00 00 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 ff 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 00 00)
00015E90>    PropMgr:001b68db:00:0f: [32] *** mpu_recv(08 06 01 04 00 00 00 00)
00015EFD>    PropMgr:e01b1ddb:39:03: PROP_GPS_INFORMATION fGPSConnect = 0x0
00015F1C>    PropMgr:e01b1df1:39:03: MPU 0x0 USB 0x0 WFT 0x0 INNER 0x0
00015F48>    PropMgr:001b68db:00:0f: [33] *** mpu_recv(08 06 01 a2 00 00 00 00)
00015F6A>    PropMgr:e01b1ddb:39:03: PROP_MPU_GPS fGPSConnect = 0x0
00015F84>    PropMgr:e01b1df1:39:03: MPU 0x0 USB 0x0 WFT 0x0 INNER 0x0
00015FC4>    PropMgr:001b68db:00:0f: [34] *** mpu_recv(06 05 01 06 15 00)
00016034>    PropMgr:e01b14cf:39:03: @@@setDefaultImgDirection
00016052>    PropMgr:e01b24f5:39:03: PROP_GPS_DEVICE_ACTIVE INNER 0x0 fGPSConnect = 0x0
0001607E>    PropMgr:001b68db:00:0f: [35] *** mpu_recv(06 05 03 23 1d 00)
000160A3>    PropMgr:e01b2583:39:03: PROP_NETWORK_SYSTEM 0x0
000162C8>    PropMgr:001b68db:00:0f: [36] *** mpu_recv(22 21 03 24 45 46 2d 53 31 38 2d 35 35 6d 6d 20 66 2f 33 2e 35 2d 35 2e 36 20 49 53 20 53 54 4d 00 00)
00016351>    PropMgr:001b68db:00:0f: [37] *** mpu_recv(06 04 03 25 00 00)
0001662F>    PropMgr:001b68db:00:0f: [38] *** mpu_recv(06 05 01 99 00 00)
000166F2>    PropMgr:001b68db:00:0f: [39] *** mpu_recv(06 05 01 9a 00 00)
00016754>    PropMgr:e01b24f5:39:03: PROP_BTDEVICE_CONNECT WFT 0x0 fGPSConnect = 0x0
000167AE>    PropMgr:001b68db:00:0f: [40] *** mpu_recv(06 05 01 06 15 00)
0001685C>    PropMgr:e041e695:01:03: DivideLensInit2Data[3] comID 1 dataID 4 data 0x0
000168BA>    PropMgr:001b68db:00:0f: [41] *** mpu_recv(06 05 01 3f 00 00)
00016990>    PropMgr:e00afc13:81:03: PROP_STROBO_FIRING 0 Last 0
000169AD>    PropMgr:e00afc2d:81:03: dwLastStroboFiring = 0  stroboFiring = 0
000169FB>    Startup:001b686f:00:0f: [10] *** mpu_send(06 05 01 2e 01 00)
00016A6F>   EventMgr:e00a3283:37:05: emLockControl (TYPE_JOBSTATE = 0x0)
00016ACD>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
00016AE9>     RscMgr:e049093d:80:03: 0 0 0
00016B9E>    PropMgr:001b686f:00:0f: [11] *** mpu_send(0a 08 03 0b 00 00 00 00 00 00)
00016CCA>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 20, ClassID = 57
00016D1A>    Startup:e04c2bdb:39:05: InitializeInnerDevelopJobClass (ID = 2015, Num = 16)
00016D3F>    Startup:e04cd927:39:05: InitializeHDRShootJobClass ( Num = 13 )
00016D5B>    Startup:e04cd955:39:05: InitializeHDRSaveAndEndJobClass ( Num = 37 )
00016D76>    Startup:e04ce3e3:39:05: InitializeGISShootJobClass ( Num = 13 )
00016D91>    Startup:e04ce40b:39:05: InitializeGISSaveAndEndJobClass ( Num = 28, 31 )
00016DC7>    Startup:e04c2c09:39:03: InitializeShufflehootJobClass (ID = 2015, Num = 15)
00016E26>    Startup:e00929e5:d9:03: InitializeGUILock (PUB)
00016EA2>    PropMgr:001b686f:00:0f: [12] *** mpu_send(06 05 03 19 01 00)
00016ECC>    PropMgr:e041e9b5:d9:03: [GUI] MasterResultCBR
00016F28>    PropMgr:e0044569:8a:03: terminateChangeCBR : SHUTDOWN (255)
00016F44>    PropMgr:e004468b:00:03: [TERMINATE] SHUTDOWN init comp
00016F62>    PropMgr:e0044723:8a:03: terminateChangeCBR : AUTO_POWEROFF (1)
00016F83>    PropMgr:e00444f7:00:03: [TERMINATE] Abort init comp
00017044>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 0, ClassID = 150
00017077>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 1, ClassID = 150
000170A1>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 4, ClassID = 150
00017164>    PropMgr:e006bbbf:96:03: PROP_SHOOTING_TYPE (0x0->0x0)
00017183>    PropMgr:e006bc1d:96:03: PROP_AF_SHIFT_AFB_INFO (0x0 0)
000172F3>    Startup:001b686f:00:0f: [13] *** mpu_send(06 05 01 56 00 00)
0001732E>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 0, ClassID = 225
0001736D>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 11, ClassID = 225
0001738E>   EventMgr:e00a2b5d:37:03: Already SW1OFF
000173BB>   MainCtrl:e0094603:94:03: MeteringTimerStart
000173E9>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 7, ClassID = 225
00017414>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 1, ClassID = 225
0001743D>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 4, ClassID = 225
00017468>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 6, ClassID = 225
0001748F>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 3, ClassID = 225
000174B7>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 2, ClassID = 225
000174DE>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 20, ClassID = 225
00017507>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 24, ClassID = 130
00017531>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 25, ClassID = 130
00017657>    PropMgr:001b68db:00:0f: [42] *** mpu_recv(08 06 01 04 00 00 00 00)
00017685>   MainCtrl:e006f9d1:94:03: PROP_DISPLAY_OFF_SENSOR 1
000176DB>   MainCtrl:e006f9d1:94:03: PROP_DISPSENSOR_CTRL 1
00017708>   MainCtrl:001b68db:00:0f: [43] *** mpu_recv(08 06 01 a2 00 00 00 00)
0001776E>   MainCtrl:e009514d:94:03: PROP_SHOOTING_TYPE 0
0001778B>   MainCtrl:e0093eb9:94:03: set_lv_act2 : 0 -1 1 0
000177C7>   MainCtrl:e00951c9:94:03: PROP_GUI_STATE 0
000177FD>   MainCtrl:e0094fc9:94:03: PROP_LV_ACTION LV_STOP
00017816>   MainCtrl:e0094cb1:94:03: judge_lv_disp_busy(mode_change): 0 0 1 1 0
0001784B>   MainCtrl:e006f9d1:94:03: PROP_LV_DISPBUSY not Busy
0001787D>   MainCtrl:e009520b:94:03: PROP_LV_LOCK LVLOCK_PERMIT
00017895>   MainCtrl:e0093eb9:94:03: set_lv_act2 : 0 1 1 0
000178AC>   MainCtrl:e0094cb1:94:03: judge_lv_disp_busy(mode_change): 0 0 1 1 0
000178D9>   MainCtrl:e006f9d1:94:03: PROP_DISABLE_PLAY_IMAGE Enable Play
00017917>   MainCtrl:e0094eef:94:03: JobState 0
0001792E>   MainCtrl:e0095a91:94:03: on_digi_event start
00017945>   MainCtrl:e0093eb9:94:03: set_lv_act2 : 0 1 1 0
0001795A>   MainCtrl:e0094cb1:94:03: judge_lv_disp_busy(mode_change): 0 0 1 1 0
00017992>   MainCtrl:e00954b1:94:03: PROP_AE_MODE m_AeMode=0x00 m_SetTv =0x70 ,m_ModeBulb=0
000179B8>   MainCtrl:e00954b1:94:03: PROP_SET_TV  m_SetTv =0x60 m_AeMode=0x00 ,m_ModeBulb=0
00017A64>   MainCtrl:e006f9d1:94:03: QRTime 2
00017B0A>    PropMgr:001b68db:00:0f: [44] *** mpu_recv(0e 0d 04 30 00 00 00 00 00 00 00 00 00 00)
00017B8A>    PropMgr:001b68db:00:0f: [45] *** mpu_recv(06 05 01 48 01 00)
00017BF7>   MainCtrl:e006f9d1:94:03: PROP_VARIANGLE_GUICTRL Enable
00017C22>   MainCtrl:001b68db:00:0f: [46] *** mpu_recv(06 05 01 4b 01 00)
00017C45>   MainCtrl:e006f991:94:03: PROP_HEADPHONE_VOLUME_VALUE : 0
00017C95>   MainCtrl:e006f911:94:03: PROP_MOVIE_PLAY_VOLUME : 5
00017CD2>    PropMgr:001b68db:00:0f: [47] *** mpu_recv(06 05 01 49 02 00)
00017D13>   MainCtrl:e006f9d1:94:16: PROP_LCD_OFFON_BUTTON : 0
00017D50>   MainCtrl:e006f9d1:94:03: PROP_LV_CFILTER 0
00017D7A>   MainCtrl:001b68db:00:0f: [48] *** mpu_recv(06 05 01 12 00 00)
00017DA4>   MainCtrl:e0093eb9:94:03: set_lv_act2 : 0 1 1 0
00017DEE>   MainCtrl:e0094cb1:94:03: judge_lv_disp_busy(mode_change): 0 1 1 1 0
00017E38>    PropMgr:001b68db:00:0f: [49] *** mpu_recv(06 05 01 13 00 00)
00017ECA>   MainCtrl:e009507d:94:03: PROP_GUIGROUND_STATE 1
00017F24>   MainCtrl:e0094fc9:94:03: PROP_LV_ACTION LV_STOP
00017F42>   MainCtrl:e0094cb1:94:03: judge_lv_disp_busy(mode_change): 0 1 1 1 0
00017F78>   MainCtrl:001b68db:00:0f: [50] *** mpu_recv(10 0e 01 8f 00 00 00 00 00 00 00 00 00 00 00 00)
00018075>     RscMgr:001b68db:00:0f: [51] *** mpu_recv(0e 0c 01 b1 00 00 00 00 00 00 00 00 00 00)
000180BE>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
000180DD>     RscMgr:e049093d:80:03: 0 0 0
00018107>     RscMgr:001b68db:00:0f: [52] *** mpu_recv(06 05 01 03 01 00)
0001819A>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
000181B3>     RscMgr:e049093d:80:03: 0 0 0
0001825A>    PropMgr:001b686f:00:0f: [14] *** mpu_send(06 05 04 0e 01 00)
00018294>    PropMgr:e041db9d:01:03: LV_CFilter : kind 0 hv 0
000182B3>    PropMgr:e041dbc1:01:03: Level 0 0 0 0 0 0 0 0
000182DC>    PropMgr:e00676f1:81:03: @@@ PROP_LV_CFILTER 0
0001834C>   MainCtrl:e006f9d1:94:03: PROP_LV_CFILTER 0
0001838B>   MainCtrl:e006f9d1:94:03: PROP_LV_DISPBUSY Busy
000183BC>   MainCtrl:e006f9d1:94:03: PROP_LV_DISPBUSY Busy
000183E8>   MainCtrl:e006f9d1:94:03: PROP_LV_DISPBUSY Busy
0001840C>    PropMgr:e0420ad3:01:03: MovieCFilter : kind 0 hv 0
00018425>    PropMgr:e0420af1:01:03: Level 0 0 0 0 0 0
00018441>    PropMgr:e00679df:81:03: @@@ PROP_MOVIE_CFILTER 0
00018491>   MainCtrl:e006f9d1:94:03: PROP_LV_DISPBUSY not Busy
00018533>    PropMgr:e04bc1e7:15:03: @PropMgr FIO_SuspendDelayFlush(0) L:709
00018562>   MainCtrl:e0094f3d:94:03: CardCover=0
0001857F>    PropMgr:e041e9b5:94:03: regist master CardCover
000185BE>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 13, ClassID = 225
000185F1>    Startup:e05f2995:3a:03: TA10_Initialize : Start
0001867E>    PropMgr:001b686f:00:0f: [15] *** mpu_send(06 05 03 40 00 00)
0001879D>    PropMgr:e05f24c9:3a:03: ### TA10Setting Clear (OFF->OFF) ###
000187C7>    PropMgr:e05f2461:3a:03: ChangePropCBR ShotsPlan 2 / TotalSheets 2
00018AA4>    PropMgr:001b686f:00:0f: [16] *** mpu_send(0c 0b 03 53 02 00 48 81 81 00 00 00)
00018B3B>    Startup:e05f2be7:3a:03: TA10_Initialize : End
00018B66>    Startup:001b686f:00:0f: [17] *** mpu_send(0c 0b 03 53 02 00 48 81 81 00 00 00)
00018B96>    Startup:e006c851:3c:03: HDR_Initialize : Start
00018C9E>    PropMgr:e006c475:3c:03: ### HDRSetting Clear (OFF->OFF) ###
00018CBC>    PropMgr:e006c41f:3c:03: ChangePropCBR HDRFunc 0
00018D13>    Startup:e00a4fdf:3c:03: HDRS_Initialize
00018D36>    Startup:e00a500b:3c:03: CreateStageClass
00018DC1>    Startup:e00a5425:3c:03: HDRS_Initialize : End
00018DD7>    Startup:e006c977:3c:03: HDR_Initialize : End
00018DF2>    Startup:e006d94d:3d:03: GIS_Initialize : Start
00018EC8>    PropMgr:e006d575:3d:03: ### GISSetting Clear (OFF->OFF) ###
00018EE6>    PropMgr:e006d525:3d:03: ChangePropCBR GISFunc 0
00018F3C>    Startup:e00a7ab5:3d:03: GISS_Initialize
00018F5F>    Startup:e00a7adf:3d:03: CreateStageClass
00018FDB>    Startup:e00a7c0b:3d:03: GISS_Initialize : End
00018FF1>    Startup:e006da75:3d:03: GIS_Initialize : End
00019047>    FileMgr:e01c24cd:19:03: PROP_CARD1_STATUS = 0x0
00019099>    FileMgr:e04bc1e7:15:03: @FileMgr FIO_SetCardChangeFlag(0,1) L:1060
000190D4>    FileMgr:e01c23fb:19:03: PROP_CARD1_FOLDER_NUMBER = 142
000190FF>    FileMgr:e01c2773:19:03: PROP_CARD1_FILE_NUMBER = 0
00019139>    FileMgr:e01c26c1:19:03: PROP_CARD2_STATUS = 0x0
00019177>    FileMgr:e04bc1e7:15:03: @FileMgr FIO_SetCardChangeFlag(1,1) L:1060
000191A0>    FileMgr:e01c273d:19:03: PROP_CARD2_FOLDER_NUMBER = 100
000191CA>    FileMgr:e01c2785:19:03: PROP_CARD2_FILE_NUMBER = 2292
000191F9>    FileMgr:e01c2827:19:03: PROP_FILE_NUMBERING_MODE = 1, 0
00019219>    FileMgr:e01c27db:19:03: PROP_CARD_EXTENSION = 0
00019235>    FileMgr:e01c27fd:19:03: PROP_CURRENT_MEDIA = 2
00019250>    FileMgr:e01c2455:19:03: PROP_USBDEVICE_CONNECT = -1
0001926C>    FileMgr:e01c2873:19:03: PROP_NUMBER_OF_CONTINUOUS_MODE = 2292
00019286>    FileMgr:e0042c8b:00:03: [STARTUP]startupCompleteCallback 0x10
000192A1>    FileMgr:e00490d1:00:03: [SEQ] NotifyComplete (Cur = 2, 0x420010, Flag = 0x10)
000192C9>    FileMgr:e01c28c7:19:03: PROP_DSDEFINE ModelId 80000417
000192EF>    FileMgr:e01c28df:19:03: PROP_APPENDMOVINFO Handle 0,205001d
0001930C>    FileMgr:e01c28ef:19:03: PROP_APPENDMOVINFO VideoSnapMode 4,205001d
00019330>    FileMgr:e01c2937:19:03: PROP_SPECIAL_OPTION = 16384
00019350>    FileMgr:e01c296b:19:03: PROP_SCREEN_SAVER = 0
0001936E>    FileMgr:e01c2997:19:03: PROP_CARD1_RU_SIZE -1
00019388>    FileMgr:e01c29a9:19:03: PROP_CARD2_RU_SIZE 524288
000193B4>    FileMgr:e01c3ab3:19:03: fmInitialized
00019407>    FileMgr:e039fd2b:1c:03: _FC_SetDirSuffix (CANON)
00019439>    FileMgr:e01c3bc3:19:03: fmPrepare
00019479>    FileMgr:e04bc1e7:15:03: @FileMgr FIO_Init(25,28,0xe069ad83) L:870
000194A0>    FileMgr:e025ba41:13:03: CSMGR_Initialize
00019898>    FileMgr:e025c0e3:13:03: InitializeLogicalStorage: LStorageList = NULL
000198B1>    FileMgr:e025c10d:13:03: SocketServiceInstall: SUCCESS
00019903>    FileMgr:e04bc1e7:15:03: @FileMgr FIO_GetSupportedDriveInfo(0x2233f4) L:1102
00019933>    FileMgr:e02b6f89:18:03: InitializeSDDriver
00019BB9>    FileMgr:e025b8cb:13:03: RegisterClient: handler=0xe02c1dc1 1
00019BE7>    FileMgr:e025b921:13:03: RegisterClient: SUCCESS
00019BFC>    FileMgr:e025bb33:13:03: CSMGR_Initialize End
00019C17>    FileMgr:e069b4ed:19:03: fmAllocDcfNo(0x4845f8)(0x0)
00019C6B>     RscMgr:e00d1e23:35:03: srmAllocDcfNoTable
00019C95>     RscMgr:e069b4c7:19:03: fmAllocateDcfNoCompleteCallback(0x4169ec00,0x4000)
00019CEF>    FileMgr:e01c3be5:19:03: fmAllocDcfNo : DcfNoTable(0x4169ec00)
00019D47>    FileMgr:e04bc1e7:15:03: @FileMgr FIO_MountDevice(1,0,0) L:901
00019D68>    FileMgr:e015bb9b:16:03: [FSUmountDevice] (0x1)
00019D81>    FileMgr:e025bb4f:13:03: MapPhysicToLog: StorageID=1
00019D96>    FileMgr:e025bb65:13:03: MapPhysicToLog: SUCCESS(0x86b930)
00019DAF>    FileMgr:e025bfd9:13:03: CSMGR_MountCard : Message=0x1fd74, pLStorage=0x86b930
00019DED>     NFCMgr:e0586c2b:3e:03:  PROP_SPECIAL_OPTION ->init (0x4000)
00019FEB>     NFCMgr:e058a845:3e:03:  nfcmgrstate_Initialize:NewsDet_R Hi
0001A0AB>  CSMgrTask:e025b9c9:13:03: CSMgrTask: pMessage=0x1fd74, pLStorage=0x86b930
0001A0D1>  CSMgrTask:e025b955:13:03: MapLogToPhysic: pLStorage=0x86b930
0001A0EA>  CSMgrTask:e025b969:13:03: MapLogToPhysic: SUCCESS(ID=1)
0001A102>  CSMgrTask:e025b955:13:03: MapLogToPhysic: pLStorage=0x86b930
0001A11C>  CSMgrTask:e025b969:13:03: MapLogToPhysic: SUCCESS(ID=1)
0001A12E>  CSMgrTask:e02c1ded:18:03: ---- SDEventHandler(ID=1:Event=8) ----
0001A179>  CSMgrTask:e02b6397:16:03: Set StgDev:1
0001A224>     NFCMgr:001b68db:00:0f: [53] *** mpu_recv(06 05 03 38 9e 00)
0001A335>    CE_Main:001b68db:00:0f: [54] *** mpu_recv(06 05 04 29 01 00)
0001A3D5>   MainCtrl:e0094cb1:94:03: judge_lv_disp_busy(mode_change): 0 1 1 1 0
0001A410>   MainCtrl:001b68db:00:0f: [55] *** mpu_recv(0a 09 01 55 00 00 02 00 00 01)
0001A48F>    PropMgr:e0067ac9:81:03: PROP_MULTIPLE_EXPOSURE_SETTING 0
0001A53A>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000003F, 0xE0066E9B(1)
0001A5C4>     RscMgr:e00d2213:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[11]
0001A646>     RscMgr:e00d2213:35:03: RealClearBusy(0x1) 0x0->0x0,0x0(0x0)[12]
0001A67B>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
0001A694>     RscMgr:e049093d:80:03: 0 0 0
0001A6E6>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000003F, 0xE04CF021(2)
0001A720>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000003F, 0xE01B152D(3)
0001A75C>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000003F, 0xE006F9E3(4)
0001A788>    PropMgr:e05f24c9:3a:03: ### TA10Setting Clear (OFF->OFF) ###
0001A7AF>    PropMgr:e05f2461:3a:03: ChangePropCBR ShotsPlan 2 / TotalSheets 2
0001A7DB>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000003F, 0xE05F2105(5)
0001A812>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000003F, 0xE006C3AB(6)
0001A84B>    PropMgr:001b68db:00:0f: [56] *** mpu_recv(06 05 01 2e 01 00)
0001A86C>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000003F, 0xE006D4A7(7)
0001A89F>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000003F, 0xE0066E9B(6)
0001A8CE>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000003F, 0xE04CF021(5)
0001A900>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000003F, 0xE01B152D(4)
0001A92D>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000003F, 0xE006F9E3(3)
0001A994>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000003F, 0xE05F2105(2)
0001A9C0>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000003F, 0xE006C3AB(1)
0001AA1B>     RscMgr:e00ce557:35:03: PROP_SAVE_MODE = 0x1
0001AA66>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000003F, 0xE006D4A7(0)
0001AAB3>    PropMgr:001b686f:00:0f: [18] *** mpu_send(08 06 00 00 01 55 00 00)
0001AB71>    PropMgr:001b686f:00:0f: [19] *** mpu_send(0c 0b 03 53 02 00 48 81 81 00 00 00)
0001AC02>    PropMgr:001b686f:00:0f: [20] *** mpu_send(0c 0b 03 53 02 00 48 81 81 00 00 00)
0001AC85>  CSMgrTask:e02b101b:18:03: SDPowerOn
0001AE25>   PowerMgr:001b68db:00:0f: [57] *** mpu_recv(08 06 01 1d 81 81 00 00)
0001AEBF>   PowerMgr:001b68db:00:0f: [58] *** mpu_recv(06 05 01 74 01 00)
0001AF54>   PowerMgr:001b68db:00:0f: [59] *** mpu_recv(06 05 01 75 00 00)
0001B537>  CSMgrTask:e02b7387:18:03: SD initialize start
0001B8FE>   PowerMgr:001b68db:00:0f: [60] *** mpu_recv(06 05 01 07 68 01)
0001B96A>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000007, 0xE04CF021(1)
0001B99E>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000007, 0xE01B152D(2)
0001B9CE>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000007, 0xE04CF021(1)
0001B9FB>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000007, 0xE01B152D(0)
0001BA36>   PowerMgr:001b686f:00:0f: [21] *** mpu_send(08 06 00 00 01 07 00 00)
0001C1E6>   PowerMgr:001b68db:00:0f: [61] *** mpu_recv(0a 08 01 34 00 00 01 03 01 00)
0001C267>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
0001C281>     RscMgr:e049093d:80:03: 0 0 0
0001C2C3>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000002F, 0xE04CF021(1)
0001C2F6>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000002F, 0xE01B152D(2)
0001C329>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000002F, 0xE04CF021(1)
0001C358>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000002F, 0xE01B152D(0)
0001C395>  CSMgrTask:001b686f:00:0f: [22] *** mpu_send(08 06 00 00 01 34 00 00)
0001C659>  CSMgrTask:001b68db:00:0f: [62] *** mpu_recv(0a 08 01 35 00 00 06 04 01 00)
0001C6C5>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000030, 0xE04CF021(1)
0001C6F6>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000030, 0xE01B152D(2)
0001C727>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000030, 0xE04CF021(1)
0001C755>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000030, 0xE01B152D(0)
0001C790>  CSMgrTask:001b686f:00:0f: [23] *** mpu_send(08 06 00 00 01 35 00 00)
0001D74D>   PowerMgr:001b68db:00:0f: [63] *** mpu_recv(0a 09 01 70 00 00 00 00 00 01)
0001D787>    PropMgr:e0067ac9:81:03: PROP_HDR_SETTING 0
0001D7B4>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000045, 0xE0066E9B(1)
0001D805>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
0001D81F>     RscMgr:e049093d:80:03: 0 0 0
0001D857>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000045, 0xE04CF021(2)
0001D88C>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000045, 0xE01B152D(3)
0001D8CF>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000045, 0xE006F9E3(4)
0001D8FF>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000045, 0xE05F2105(5)
0001D925>    PropMgr:e006c475:3c:03: ### HDRSetting Clear (OFF->OFF) ###
0001D93A>    PropMgr:e006c41f:3c:03: ChangePropCBR HDRFunc 0
0001D951>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000045, 0xE006C3AB(6)
0001D97E>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x80000045, 0xE006D4A7(7)
0001D9AD>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000045, 0xE0066E9B(6)
0001D9DC>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000045, 0xE04CF021(5)
0001DA08>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000045, 0xE01B152D(4)
0001DA31>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000045, 0xE006F9E3(3)
0001DA5C>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000045, 0xE05F2105(2)
0001DA85>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000045, 0xE006C3AB(1)
0001DAB0>    PropMgr:e041f1df:01:03: Complete WaitID = 0x80000045, 0xE006D4A7(0)
0001DAEB>   PowerMgr:001b686f:00:0f: [24] *** mpu_send(08 06 00 00 01 70 00 00)
0001DCA7>   PowerMgr:001b68db:00:0f: [64] *** mpu_recv(0a 08 01 85 00 00 00 01 01 00)
0001DCE2>    PropMgr:e0067ac9:81:03: PROP_GIS_SETTING Func 0
0001DD08>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000004E, 0xE0066E9B(1)
0001DD56>     RscMgr:e04908f1:80:03: fDevDone 1, dwLvLock 0
0001DD70>     RscMgr:e049093d:80:03: 0 0 0
0001DDA6>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000004E, 0xE04CF021(2)
0001DDD6>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000004E, 0xE01B152D(3)
0001DE0E>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000004E, 0xE006F9E3(4)
0001DE3C>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000004E, 0xE006C3AB(5)
0001DE64>    PropMgr:e006d575:3d:03: ### GISSetting Clear (OFF->OFF) ###
0001DE79>    PropMgr:e006d525:3d:03: ChangePropCBR GISFunc 0
0001DE8F>    PropMgr:e041c56d:01:03: Deliv WaitID = 0x8000004E, 0xE006D4A7(6)
0001DEBD>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000004E, 0xE0066E9B(5)
0001DEEA>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000004E, 0xE04CF021(4)
0001DF16>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000004E, 0xE01B152D(3)
0001DF42>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000004E, 0xE006F9E3(2)
0001DF6D>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000004E, 0xE006C3AB(1)
0001DF96>    PropMgr:e041f1df:01:03: Complete WaitID = 0x8000004E, 0xE006D4A7(0)
0001DFD2>   PowerMgr:001b686f:00:0f: [25] *** mpu_send(08 06 00 00 01 85 00 00)
00028E68>    CE_Main:e0585a27:3e:03:  ce_completion payload=84 num=2
00028F81>     NFCMgr:e058acc1:3e:03:  nfcmgrstate_Initialize:wtime=0
000292C5>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 0, ClassID = 62
00029300>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 7, ClassID = 62
00029330>   EventMgr:e00a2b2b:37:03: emRegisterMulticastCallback : EventID = 11, ClassID = 62
0002934E>   EventMgr:e00a2b5d:37:03: Already SW1OFF
00029377>     NFCMgr:e058ad21:3e:03:  nfcmgrstate_Initialize End
000293C3>     NFCMgr:e058710b:3e:03:  PROP_AUTO_POWEROFF 1
000293FE>     NFCMgr:e0586ce3:3e:03:  PROP_NFC_APPLI_INFO jp.co.canon.ic.cameraconnect
00029418>     NFCMgr:e0586cf1:3e:03:  PROP_NFC_APPLI_INFO a01
000294ED>     NFCMgr:e0586aa3:3e:03:  ChkRWInfo Illegal product type(pdt=dslr)
0002953C>     NFCMgr:e0586d55:3e:03:  PROP_DSDEFINE Canon%20EOS%20200D
00029557>     NFCMgr:e058787b:3e:03:  PROP_DSDEFINE 0x32cc
000295E1>     NFCMgr:e0586bed:3e:03:  PropChange:PROP_NETWORK_NICKNAME(EOS200D)->(EOS200D)
0002961F>     NFCMgr:e058787b:3e:03:  PROP_NETWORK_SYSTEM MODE_OFF 0
00029649>     NFCMgr:e0587349:3e:03:  PROP_NFC_SETTING enable 1
00029672>     NFCMgr:e058736b:3e:03:  PROP_FIXED_MOVIE off 0
00029699>     NFCMgr:e058739b:3e:03:  SHOOTING_TYPE_MOVIE off 0
000296BF>     NFCMgr:e05873cb:3e:03:  PROP_TIMELAPSE_MOVIE_SETTING off 0
000296E5>     NFCMgr:e058740f:3e:03:  PROP_MULTIPLE_EXPOSURE_SETTING OFF 0
0002970E>     NFCMgr:e0587427:3e:03:  PROP_VARIANGLEDISPLAY_ONOFF ON 1
00029734>     NFCMgr:e0587831:3e:03:  PROP_VIDEOSNAP_MODE OFF 0
00029809>     NFCMgr:e058785f:3e:03:  PROP_ICU_UILock OFF 0x0
00029832>     NFCMgr:e058792d:3e:03:  PROP_PHYSICAL_CONNECT disconnect 0
00029856>     NFCMgr:e0586c85:3e:03:  PROP_STARTUP_CONDITION NOT BLE_LOCKOFF (0x1)
000298AD>     NFCMgr:e03d78fb:3e:03: [BLE] Initialize : Enter
00029BB1>     NFCMgr:e05c17b9:3e:03: [BLE] BLESIODRIVER_Initialize END
00029BD7>     NFCMgr:e05c153d:3e:03: [BLE] blesiodriver_SioInitialize END
00029C21>     NFCMgr:e05aea5f:3e:03: [BLE] BLEFirmUp_InitializeTest
00029DF0>     NFCMgr:e03d9cc1:3e:03: [BLE] PROP_DSDEFINE 0x32cc
00029E69>     NFCMgr:e03d96c5:3e:03: [BLE] PROP_NETWORK_NICKNAME EOS200D
00029ECD>     NFCMgr:e03d9d8d:3e:03:  [BLE] PROP_FIXED_MOVIE off 0
00029F39>     NFCMgr:e03d9e65:3e:03: [BLE] PROP_VIDEOSNAP_MODE OFF 0
00029F72>     NFCMgr:e03d91c1:3e:03: [BLE] PROP_BLE_SETTING SMARTPHONE(1)
00029F8F>     NFCMgr:e03d0d03:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
00029FA9>     NFCMgr:e03d0c35:3e:03: [BLE] Enter CheckGpsAndBleState().
00029FE6>     NFCMgr:e03d92f5:3e:03: [BLE] PROP_BLE_PAIRING_INFO fSet(1 0) 1 2
0002A01E>     NFCMgr:e03d49e9:3e:03: [BLE] CheckWiFiConnect TRUE
0002A048>     NFCMgr:e03d98a1:3e:03: [BLE] PROP_BLE_REMOTE_RESULT 0
0002A073>     NFCMgr:e03d0d03:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
0002A087>     NFCMgr:e03d0c35:3e:03: [BLE] Enter CheckGpsAndBleState().
0002A0B3>     NFCMgr:e03d0d03:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
0002A0C8>     NFCMgr:e03d0c35:3e:03: [BLE] Enter CheckGpsAndBleState().
0002A103>     NFCMgr:e03d968f:3e:03: [BLE] PROP_PHYSICAL_CONNECT disconnect 0
0002A151>     NFCMgr:e03d9941:3e:03: [BLE] PROP_BATTERY_POWER:not BAT_NONE 2
0002A170>     NFCMgr:e03d7e49:3e:03: [BLE] InitializeChkState
0002A18C>     NFCMgr:e03cf9f1:3e:03: [BLE] SendCamPowerState :0x1
000464CD>     NFCMgr:e03db2af:3e:03: [BLE] Enter blemgr_SmartPhoneGps_NopEvent!!!
000464EB>     NFCMgr:e03db2c1:3e:03: [BLE]   Status=0, Event=13
00046510>     NFCMgr:e03db2af:3e:03: [BLE] Enter blemgr_SmartPhoneGps_NopEvent!!!
00046526>     NFCMgr:e03db2c1:3e:03: [BLE]   Status=0, Event=13
00046544>     NFCMgr:e03db2af:3e:03: [BLE] Enter blemgr_SmartPhoneGps_NopEvent!!!
00046557>     NFCMgr:e03db2c1:3e:03: [BLE]   Status=0, Event=13
00046CA4>     NFCMgr:e03d44cf:3e:03: [BLE] ProcSpiRecvData Cat = 0x1, cmd = 0x85
00046CD2>     NFCMgr:e03d1243:3e:03: [BLE] RecvNtfBleState IDLE(1)
00046D29>     NFCMgr:e03cfbab:3e:03: [BLE] SendGetPairingInfo :0x1
000474D7>     NFCMgr:e03d0d03:3e:03: [BLE] Enter blemgr_SmartphoneGps_CheckState().
00047EA1>     NFCMgr:e03d44cf:3e:03: [BLE] ProcSpiRecvData Cat = 0x2, cmd = 0x86
00047ECC>     NFCMgr:e03d214b:3e:03: [BLE] JudgeBlePairInfo SD Host&BLE:Exist
00047EE4>     NFCMgr:e03d1cf5:3e:03: [BLE] CheckNextBlePairInfo:SD01->ARC
00047EFB>     NFCMgr:e03cfbab:3e:03: [BLE] SendGetPairingInfo :0x2
00049077>     NFCMgr:e03d44cf:3e:03: [BLE] ProcSpiRecvData Cat = 0x2, cmd = 0x86
0004909B>     NFCMgr:e03d214b:3e:03: [BLE] JudgeBlePairInfo ARC Host&BLE:None
000490B2>     NFCMgr:e03d1d0b:3e:03: [BLE] CheckNextBlePairInfo:ARC->END
000AF2BB>  CSMgrTask:e02b7b2b:18:03: power 18
000AF2D6>  CSMgrTask:e02b1097:18:16: SdSwitchVoltage 1
000BC4F5>  CSMgrTask:e02b73d5:18:16: SD initialize end speed=2 clock=2 UHS=1
000BC534>  CSMgrTask:e02b7489:18:16: strength 1111 current 3 mode 2
000BCE15>  CSMgrTask:e02b7649:18:16: Name: 58BGO Size: 30543(3ba7800)
000BCE40>  CSMgrTask:e02b710d:18:03: pBlkDev=0x86b95c
000BCE5A>  CSMgrTask:e02b7121:18:03: nBlocks=62552064, blksPerTrack=0, nHeads=0
000BD182>  CSMgrTask:e02b69e7:16:05: fsuGetPart: Block(2, 62552062, 62552064)
000BE20B>  CSMgrTask:e025aa4b:16:16: efat_map_filesys 2 B: 1
000BE68F>  CSMgrTask:e04bc1e7:15:03: @CSMgrTask FIO_GetSupportedDriveInfo(0x22eca8) L:1102
000BE6EE>  CSMgrTask:e025b351:16:16: AllocateMemoryStrictly For Speed Class!!!
000F411F>       dump:001b6b09:00:0f: Logging finished.
000F413C>       dump:001b6b17:00:0f: Free memory: 4168940 bytes.



Now it worked:

(https://thumb.ibb.co/gZwDUp/IMG_3622.jpg) (https://ibb.co/gZwDUp)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on September 08, 2018, 12:21:00 PM
Nice.

The next step is to enable the boot flag (it will toggle a flag in the ROM so the firmware will load and execute code from the SD card). That appears to be a diagnostic feature in Canon's bootloader, present since DIGIC 2 or maybe earlier. It's the first time we are trying this procedure on DIGIC 7; the same code was tested on 5DS first, then on 80D, 750D, 760D, and 7D2 without surprises.

Very old versions of the boot flag enabling code caused some issues in the past (years ago): when they were run from LiveView, the "erase" step of the ROM flashing procedure succeeded, but the "write" step failed; as a result, the entire boot flag area (http://magiclantern.wikia.com/wiki/Bootflags) was set to FFFFFFFF. Luckily, this was still a valid configuration with a ML card inserted, but the camera refused to boot plain Canon firmware and asked for a firmware update. Placing Canon's firmware update on the card fixed the issue.

Now we are running this code directly from bootloader. Source code is on the recovery (https://bitbucket.org/hudson/magic-lantern/branch/recovery) branch (i.e. bootloader experiments, with portable code that runs on all EOS cameras from DIGIC 2 to DIGIC 8 ), compiled from platform/portable.000 with CONFIG_BOOT_BOOTFLAG = y. You may review this code by running it in QEMU if you prefer.

If you (or anyone else) are OK with the risks, just send me a PM and I'll give you the FIR file.

In the emulator, if you run with firmware="boot=1", this option enables the boot flag, so you can see what exactly the firmware does differently. It will check the card contents at every startup, so there might be a small delay after this change. Other than that, with a regular (non-bootable) card is inserted, the camera will run plain Canon firmware.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: edoardoc on September 08, 2018, 01:29:34 PM
In the emulator ( " ./run_canon_fw.sh 60D,firmware="boot=1" " ) I got this:

(https://thumb.ibb.co/fiZZkU/Screen_Shot_2018_09_08_at_13_24_30.png) (https://ibb.co/fiZZkU)

Is it ok?

Before compiling ML ( " make -C ../magic-lantern 60D_install_qemu " )  I got the same screen of ML Rescue that I got directly from my camera.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on September 08, 2018, 04:42:22 PM
The emulation doesn't go very far; it doesn't show the GUI yet. It covers the bootloader, SD card I/O and roughly half of the startup process. At some point it times out waiting for the second CPU, as the communication between them is not well understood.

To try the boot flag enabler:
Code: [Select]
cd magic-lantern
hg up recovery -C
cd platform/portable.000
make clean && make install_qemu ML_MODULES= CONFIG_BOOT_BOOTFLAG=y # optionally CONFIG_QEMU=y for more debugging info
( cd ../../../qemu-eos && ./run_canon_fw.sh 200D,firmware="boot=1" )

In this simulation, the boot flag would be already enabled, so the above won't show anything interesting (Canon code will attempt to flash the ROM only if the flag is actually changed). You could try to disable the boot flag instead (like this (https://www.magiclantern.fm/forum/index.php?topic=17360.msg204747#msg204747)), as the emulation runs with boot flag enabled. In this case, you will see some low-level activity and the emulator will lock up. That's OK. It will print the address of the function it's going to call from Canon's bootloader, and you can look it up in the disassembly to confirm it's indeed the right one and has the correct syntax ( I already did that, but you should probably not trust me blindly :D ).
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: edoardoc on September 08, 2018, 08:03:46 PM
Which file should I edit to make this changes (https://www.magiclantern.fm/forum/index.php?topic=17360.msg204747#msg204747)?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on September 08, 2018, 09:48:32 PM
First two lines from the patch are telling you the file name:
Code: [Select]
--- a/src/reboot.c
+++ b/src/reboot.c

You should also be on the "recovery" branch.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: edoardoc on September 09, 2018, 12:33:13 PM
Thanks.

I disabled the boot flag from reboot.c and I ran the emulation with firmware="boot=1" , here's the result:

(https://thumb.ibb.co/kuZgZp/Screen_Shot_2018_09_09_at_11_56_16.png) (https://ibb.co/kuZgZp)


Reading reboot.c I noticed that ( line 842 ) :
Code: [Select]
/* DIGIC 7: the main ROM is at 0xE0000000 and there is another one at 0xF0000000, so it should be OK */
from my screenshot:
Code: [Select]
ROMBASEADDR: 0xE0040000
Why my ROM starts after the addr in the previous comment?

And... what's the next step? Loading the FIR with the bootflag enabled from a real camera?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on September 09, 2018, 04:33:13 PM
0xE0000000 is the start address of the first ROM chip (we call it ROM0).

0xE0040000 is the address of Canon's main firmware. Below that address, you can find Canon's bootloader (https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst?fileviewer=file-view-default#rst-header-overview-of-canon-eos-boot-process); they are both in the same physical ROM chip.

Yes, the next step is running the FIR on real hardware and praying things won't go wrong.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: edoardoc on September 09, 2018, 11:44:19 PM
Very old versions of the boot flag enabling code caused some issues in the past (years ago): when they were run from LiveView, the "erase" step of the ROM flashing procedure succeeded, but the "write" step failed; as a result, the entire boot flag area (http://magiclantern.wikia.com/wiki/Bootflags) was set to FFFFFFFF. Luckily, this was still a valid configuration with a ML card inserted, but the camera refused to boot plain Canon firmware and asked for a firmware update. Placing Canon's firmware update on the card fixed the issue.

Sorry for the questions but I just want to make sure what I'm doing.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on September 09, 2018, 11:54:09 PM
That's the only surprise we had so far with this procedure, but anecdote != data. Anything can happen.

Expected outcome - see e.g. for 80D (https://www.magiclantern.fm/forum/index.php?topic=17360.msg189646#msg189646).

If you copy both FIR files, Canon's bootloader will just pick one. So, you should copy only one FIR.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: edoardoc on September 11, 2018, 03:07:49 PM
Loading the FIR that enable the bootflag will avoid the warranty?

Can I reset the bootflag in the future?




Inviato dal mio iPhone utilizzando Tapatalk
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: ids1024 on September 16, 2018, 04:29:25 PM
Loading the FIR that enable the bootflag will avoid the warranty?

There is an FAQ entry for that: https://wiki.magiclantern.fm/faq#does_it_void_my_warranty

Can I reset the bootflag in the future?

Yes.

Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Dennis_K on September 30, 2018, 02:24:06 PM
I own a 77D and I would love to help the development. Is there anything I can do? Unfortunately, I have zero expereience with coding.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: aprofiti on October 01, 2018, 09:07:12 PM
I'm trying to find stubs for 77D, using 200D as a reference.

This is what I have at the moment:
Code: [Select]
/** Startup **/
NSTUB( ROMBASEADDR, firmware_entry )
NSTUB(0xE00400EC,  cstart)                 /* calls bzero32 and create_init_task(..., init_task, ...) */
NSTUB(0xDF00D285,  bzero32)                /* zeros out a data structure. From sub_E0428334
      LDR             PC, =(loc_DF00D284+1) */

NSTUB(0xDF006515,  create_init_task)       /* low-level DryOS initialization. From sub_E0427890
      LDR             PC, =(sub_DF006514+1) */
NSTUB(0xE0040215,  init_task)              /* USER_MEM size checking, dmSetup, termDriverInit, stdlibSetup etc */
NSTUB(0xe065e278,  dcache_clean)           /* loop with MCR p15 c7,c10,1; DSB */
NSTUB(0xe065e34c,  icache_invalidate)      /* loop with MCR p15 c7,c5,1; c7,c1,6; c7,c1,0; ISB */

/** Tasks **/
NSTUB(0xDF008F7E,  task_create)            /* used to start TaskMain, GuiMainTask etc */
NSTUB(0xDF0087FE,  msleep)                 /* argument is always multiple of 10 */
//NSTUB(    0x????,  current_task)           /* from task_create; pointer to the current task structure */
//NSTUB(    0x????,  current_interrupt)      /* from interrupt handler (VBAR + 0x18); where the interrupt ID is stored */

/** Dumper **/
NSTUB(0xe007fc46,  dump_file)              /* tries to save a file to either "A:/%s" or "B:/%s"; calls FIO_RemoveFile/CreateFile/WriteFile/CloseFile/Flush */

/** Memory info **/
NSTUB(0xe02640b4,  malloc_info)            /* Malloc Information */
NSTUB(0xe026414c,  sysmem_info)            /* System Memory Information */
NSTUB(0xe01eaf80,  memmap_info)            /* Exception vector, DRYOS system memory etc */
NSTUB(0xe0164ca6,  smemShowFix)            /* Common Lower, Common Upper etc */

/** Memory allocation **/
NSTUB(0xDF0079D3,  GetMemoryInformation)   /* called from AllocateMemory */

/** Debug messages **/
NSTUB(0xDF006E6D,  DryosDebugMsg)          /* lots of debug messages; format string is third argument */

/** Eventprocs (call by name) **/
NSTUB(0xe04d8aee,  call)                   /* many functions called by name (lv_start, lv_stop etc) */

/** GUI timers **/
NSTUB(0xe04d499a,  CancelTimer)            /* from error message */
NSTUB(0xe05aad76,  SetHPTimerAfterNow)     /* from error message */
NSTUB(0xe05aadca,  SetHPTimerNextTick)     /* same "worker" function as SetHPTimerAfterNow */
NSTUB(0xe04d48e4,  SetTimerAfter)          /* from error message */

/** Interrupts **/
//NSTUB(    0x????,  pre_isr_hook)
//NSTUB(    0x????,  post_isr_hook)
//NSTUB(   0x?????,  isr_table_handler)
//NSTUB(   0x?????,  isr_table_param)

/** MPU communication **/
NSTUB(0xE01E781F,  mpu_send)                  // "dwSize < TXBD_DATA_SIZE"
NSTUB(0xE058866B,  mpu_recv)                  // passed as last argument by InitializeIntercom and eventually stored into mpu_recv_cbr
NSTUB(    0x7CF4,  mpu_recv_cbr)              // mpu_recv is called indirectly through this function pointer
NSTUB(   0x887D4,  mpu_send_ring_buffer)      // ring buffer used in mpu_send
NSTUB(    0x7CD8,  mpu_send_ring_buffer_tail) // ring buffer index incremented in mpu_send
NSTUB(   0x88694,  mpu_recv_ring_buffer)      // ring buffer used in SIO3_ISR, subroutine that processes two chars at a time
NSTUB(    0x7CD0,  mpu_recv_ring_buffer_tail) // ring buffer index incremented in the above subroutine

/** Misc **/
NSTUB(0xe11f93d4,  vsnprintf)              /* called near dmstart; references "01234567", "0123456789", "0123456789abcdef" and "0123456789ABCDEF"; second arg is size; the one called by DebugMsg only knows %s */
Still missing a couple of references to data structures.
After figuring out it should be able to run the same minimal code as current state of 200D.

If someone want to double check and find the remaining stubs, please write down here your finding.

EDIT: More address found. Still missing last isr related stubs
Code: [Select]
NSTUB(    0x1020,  current_task)           /* from task_create; pointer to the current task structure */
NSTUB(    0x1008,  current_interrupt)      /* from interrupt handler (VBAR + 0x18); where the interrupt ID is stored */

/** Interrupts **/
//NSTUB(    0x????,  pre_isr_hook)
//NSTUB(    0x????,  post_isr_hook)
NSTUB(   0x6D0C0,  isr_table_handler)
//NSTUB(   0x?????,  isr_table_param)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: jack001214 on October 07, 2018, 11:23:29 AM
does ML even work for 200D?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Mikerofilm on October 07, 2018, 04:45:00 PM
Through rom dumpers are we able to expand the range of the video codec on the 6d mk2?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Walter Schulz on October 07, 2018, 06:33:32 PM
Misconception: ROM dumpers read ROM data from cam. That's a very basic step in ML development. Don't hold your breath waiting for ML files loaded from card and ML code running in the cam. Devs just taking the very first steps in a very, very long journey.

Don't know what you expect in "codec range expanding" but you may take a look into what ML enabled cams are actually able to do. You may be disappointed, though.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: jack001214 on October 10, 2018, 06:23:52 PM
What if i want to run some simple code on my 200D? Like a simple calculation and store it in the RAM or some accessible space. What can i do too access the full CPU instructions in assembler? I am not looking for fancy Screen gui's and touch or anything above those categories.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on October 10, 2018, 07:23:07 PM
You can already do that in the emulator - see e.g. reply #83. For example, a simple intervalometer coded in C would be very easy to write.

After enabling the boot flag, you will be able to do the same on real hardware. Proof of concept code was already tested and confirmed to work. I'm looking for a volunteer willing to be the first one who enables the boot flag on DIGIC 7 (see previous page); nobody took the risk yet. The FIR file for enabling the boot flag for 200D is ready, just drop me a PM if (or when) you are prepared to run it.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: jack001214 on October 11, 2018, 09:24:06 AM
I'm ready
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: shadimar69 on October 18, 2018, 04:12:32 AM
Hi all,

Just received my shiny new M50 and then rapidly proceeded to wonder how I can make it do what it 'should' be able to do. ;)

I have read through this forum, and have not seen any definitive working versions of ML(Magic Lantern) for the M50. Can someone significantly more intelligent than myself in regards to firmware code injection, please advise current status of a functioning ML for the Canon M50 on the DIGIC 8?

Please let me know if there is anything I can do to help progress/assist with the project moving forward.

Thanks in advance! :)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on October 18, 2018, 09:22:22 AM
Status:
- can run custom code (FIR files for now; I need to prepare those)
- can blink the LEDs
- can flip error screen from bootloader
- can jump to main firmware from FIR (no special tricks required)
- cannot boot main firmware with 200D code (likely easy to debug)
- can not display custom stuff on the screen, not even from bootloader (likely easy after seeing the bootloader)

I can prepare test files for #5, but not right now.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: shadimar69 on October 18, 2018, 10:14:58 AM
Thank you for the status update a1ex!

Please let me know if there is anything that I can do to help expedite any of the steps.

Thank you again! :)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: c_joerg on October 23, 2018, 09:38:54 AM
Edit: the EOS M50 appears to run EOS firmware (https://bitbucket.org/hudson/magic-lantern/commits/f6e763a002080605887dcc4a5c882b626fe97553) (other recent models, i.e. M3, M5, M6, M10 and M100, are based on PowerShot firmware). Looking for a volunteer to try the LED blinking test on this camera, too :)

Does anyone know if Canon Basic is available on the M50 or EOS R(as with the M3)?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on October 23, 2018, 10:02:27 AM
Maybe. The M50 ROM contains the following strings:

Code: [Select]
B:/script.req
uartr.req
FIO_GetFileInfo (%s) ver.req failed
(%s) ver.req Dir
for DC_scriptdisk
B:/Factory.m
B:/AutoTest.m
B:/Extend.m

I have not tested it, but it's worth trying (http://chdk.wikia.com/wiki/Canon_Basic).

There is some (different) scripting interface in DIGIC 5 DSLRs (https://www.magiclantern.fm/forum/index.php?topic=2864.msg190986#msg190986) as well, but I have not explored it (it's left as a nice exercise for the community). This scripting engine is not present on DIGIC 6 or newer "pure EOS" models, from what I could tell.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: juarez13 on October 29, 2018, 11:11:35 PM
I didnt undertand how to install the magic lantern on 77d, someone can help?
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Jonn3y on October 30, 2018, 06:18:09 PM
I didnt undertand how to install the magic lantern on 77d, someone can help?

There is no tested and working ML for 77D yet :)
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: calle2010 on November 02, 2018, 03:43:50 PM
Hi,

I've dumped the ROMs of my 77D and created a build environment that brings me up to this point:


(https://thumb.ibb.co/k2Qv00/Virtual-Box-Magic-Lantern-Build-Environment-02-11-2018-15-08-34.png) (https://ibb.co/k2Qv00)


I also did the test with changing reboot.c to disable the boot flag. Is the output of this still relevant for anybody?

I have a few questions now:
- I unterstand the next step is to collect the stubs. Is there already a more complete list than aprofiti posted on October 1st?
- Has anybody already done the steps described here? https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst?fileviewer=file-view-default#rst-header-adding-support-for-a-new-camera-model
- In branch "digic6-dumper" I see directory "platform/77D.100". Shouldn't this be "77D.102" since the current firmware version is 1.0.2?
- Is there a repository where people work together on porting to the 77D?

Thanks you so far for the good documentation. I hope I can help to get some steps further to a working port of ML for the 77D.

Cheers,
Christian.

PS: If you are interested on how I created my environment have a look at https://github.com/calle2010/magic-lantern-77d-vagrant. I use Vagrant and VirtualBox hosted on MacOs.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on November 02, 2018, 07:38:20 PM
PS: If you are interested on how I created my environment have a look at https://github.com/calle2010/magic-lantern-77d-vagrant. I use Vagrant and VirtualBox hosted on MacOs.

Very nice! Not familiar with vagrant, but if it makes easier to setup a build environment, it might be an interesting option.

I've tried Docker some time ago, but the experience wasn't straightforward. I couldn't install it on my main machine (OpenSUSE Tumbleweed), so I had to try it in a virtual machine.

Moving qemu.monitor into /tmp sounds interesting.

Quote
- I unterstand the next step is to collect the stubs. Is there already a more complete list than aprofiti posted on October 1st?

That's the most complete one. I didn't double-check them yet, only noticed the Thumb bit was not set in most of the stubs (and it should be; refer to 200D for details).

Quote
- Has anybody already done the steps described here? https://bitbucket.org/hudson/magic-lantern/src/qemu/contrib/qemu/HACKING.rst?fileviewer=file-view-default#rst-header-adding-support-for-a-new-camera-model

Emulation is at the same level as 200D and all other DIGIC 7 ports. It gets stuck as soon as the two cores expect to talk to each other.

I hope this experiment (https://bitbucket.org/hudson/magic-lantern/pull-requests/900/mmio-tracing-backend-insanely-powerful) is going to capture the info needed to understand these interactions, but it has to be adapted to the ARMv7 architecture. The two cores are talking via MMIO registers, interrupts, and they both access the same memory (flat mapping, except for a private 4K page for each core, just like EOS M5).

Quote
- In branch "digic6-dumper" I see directory "platform/77D.100". Shouldn't this be "77D.102" since the current firmware version is 1.0.2?

That's right. Initial experiments on 77D were done before Canon published a firmware update.

Quote
- Is there a repository where people work together on porting to the 77D?

The digic6-dumper branch currently covers the DIGIC 6 and newer models, so... that's pretty much it. RE notes and other findings are shared on the forum.

Some bootloader experiments can be found in the "recovery" branch. That's portable code, running on all models since DIGIC 2.

BTW, we could successfully enable the boot flag on 200D; will post the FIR files soon.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: calle2010 on November 03, 2018, 12:22:29 PM
Very nice! Not familiar with vagrant, but if it makes easier to setup a build environment, it might be an interesting option.

I do only my first steps with Vagrant. I want to automate all the manual steps and setting up the build environment on my MacOS created too much clutter for my taste.

Moving qemu.monitor into /tmp sounds interesting.

This was just the first place that came to my mind. The working directory in this setup is on the VirtualBox filesystem mounted with nodev, so creation of the socket fails with "no permission" error message.

I didn't double-check them yet, only noticed the Thumb bit was not set in most of the stubs (and it should be; refer to 200D for details).

I will check the 200D code and see if I can find the same stubs for 77D. My assembler experience is very limited, though. Also I do not yet quite understand how to test the stubs without the GUI emulation.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: a1ex on November 04, 2018, 09:09:10 AM
Also I do not yet quite understand how to test the stubs without the GUI emulation.

The emulation goes far enough to start a couple of Canon tasks; it even initializes the virtual SD card and is able to save logs. That's pretty much what can be tested at this stage.

Canon firmware even creates a DCIM directory when started from an empty card. From QEMU test results (https://builds.magiclantern.fm/jenkins/job/QEMU-tests/lastSuccessfulBuild/consoleFull):
Code: [Select]
Testing file I/O (DCIM directory)...
     [...]
    77D: OK
   200D: OK
    6D2: OK
   800D: OK

Once the startup process works, you'll be able to get logs directly from the camera and start experimenting.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: tekrevz on December 03, 2018, 08:24:27 PM
i have a 6D mark 2 how can I help out??
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: SniperJunkie on December 06, 2018, 10:10:56 PM
I have a Canon EOS M50, If you need me to do anything to help, Please feel free to ask.
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: kenthinson on December 07, 2018, 06:38:11 AM
For DIGIC 7 models, the next step is porting the 80D startup code (https://www.magiclantern.fm/forum/index.php?topic=19737.msg200895;topicseen#msg200895) (i.e. running user code alongside Canon firmware). I expect this step to be straightforward, so it's left as an exercise to the owners of these cameras. You can debug the startup code in the emulator; once you get it working, just ask me to enable the boot flag so you can test it on the camera.

The previous post was for M50 ( DIGIC 8 ). On this camera, I don't know yet how the bootloader looks like, and the code written for DIGIC 7 didn't work, so I'll probably attempt to dump the ROM directly from main firmware. The tests you'll run are:
- jumping to Canon firmware (expecting to be identical to DIGIC 7, i.e. jumping to 0xE0040000)
- LED blinking (testing the above addresses)
- LED blinking from main firmware (if I'll get this working in QEMU)
- ROM dumping from main firmware (could not test this one in QEMU yet)
- other tests (CPU model, diagnostic logs etc)

After publishing the ROM dumper, I'll update the emulator, attempt to enable the boot flag and get some diagnostic logs. Further progress will require a developer with a camera in their hands and plenty of spare time for experiments. If that describes you, your contribution will be more than welcome. I'll be here to help if you get stuck, but please be aware I'm not interested in maintaining yet another camera port alone.

If the code damages the camera, I'll try to help, but cannot guarantee success.

Hi a1ex. I'm a software engineering student. I'll be graduating the end of the month. I'm interested in working on my m50 with my spare time. I see the documentation on the site about setting up qemu dev environment. Looks exciting. Any advice you have for me before I jump in? Thanks :)

I'll be jumping in after the semester is over. For now back to writing papers  :'(
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Walter Schulz on December 07, 2018, 07:49:20 AM
I have a Canon EOS M50, If you need me to do anything to help, Please feel free to ask.

Do you have another cam with ML running on it?
If not:
Take a look into http://chdk.wikia.com/wiki/Obtaining_a_firmware_dump#Using_soundcard_input

@kenthinson: Welcome abord! Best luck for the finals!
Title: Re: DIGIC 7 & 8 development (200D/SL2, 800D/T7i, 77D, 6D2, M50)
Post by: Karim on December 07, 2018, 03:23:57 PM
I'm really so Glad that we started to dig in these models  :D

I'm going to buy a 200D in jan 2019 I wanna help in the development but without disassembly or something that may totally screw it up I'm not expert for this and I got a 60d if another body may help in the process.
ps:I have no idea about coding at all  :-[
Title: Canon Basic in DIGIC8 cams
Post by: srsa on December 08, 2018, 07:11:57 PM
After exploring the D8 disassembly I have (I was given a reconstructed M50 dump) I decided to publish my findings here.

- The camera does appear to have the scripting language we (@CHDK) refer to as Canon Basic.
- I have the impression that the card setup is the same as described here: http://chdk.wikia.com/wiki/Canon_Basic/Card_Setup
- Event procedures (short: eventproc) do exist, the eventproc handling firmware routines seem to be the same as on PowerShots.
- There seems to be support for extend.m and autotest.m scripts, but their invocation may differ from what's described here: http://chdk.wikia.com/wiki/Canon_Basic#Starting_the_script

- Now, the differences:
 - Most event procedures that appear in CHDK related scripts do not exist. That means, CHDK scripts will not work on D8 cams.
 - Many event procedures seem to be pre-registered, so registration functions such as System.Create() are not necessarily needed.
 - In file names, the card root is B:/
 - I have not yet found an eventproc to write binary files from script, or, to write text on screen.
 
Problem is, I can't say for sure whether using a prepared script card is enough to run scripts. So, everything below is speculation.

Script support seems to be enabled when the cam is in factory mode - the factory mode flag is at 0xE1FF802C.
I think it is also enabled when there's a script named "AutoTest.m" in the root of the card. The code I found loads "AutoTest.m" automatically at the end of the startup procedure.

The following minimal script should make a hex dump of the first 0x40000 bytes of ROM. I'm not certain that my WriteFileString interpretation is correct.
For a first try, name the script "AutoTest.m".

Code: [Select]
dim startadr=0xe0000000
dim romsize=0x40000
dim fname="B:/ROM.TXT"

private sub Initialize()
    p = startadr
    f = OpenFileCREAT(fname)
    do while p < (startadr+romsize)
        WriteFileString(f,"%08X: %08x %08x %08x %08x\n",p,*p,*(p+4),*(p+8),*(p+12))
        p = p + 16
    loop
    CloseFile(f)
end sub

This script is not camera specific, so it can be tried on any D8 cameras (assuming that all D8 cams share the same codebase):
EOS M50, R; PowerShot SX740, SX70

To make sure the card is correctly prepared for scripting, get any older PowerShot (2005...2017) and use the universal dumper script (http://chdk.wikia.com/wiki/Canon_Basic/Scripts/Dumper) to check.

I can't guarantee success, but I think it's worth to try this route.