A camera with the firmware version 7.8.0 8B.7C.4D . Of the additional properties has a menu item "Factory Menu". When connecting the camera to the computer the camera is defined as "Canon EOS Factory connect". There is a possibility to upload the firmware if necessary. If you tell me how to do it.
(http://thumb.ibb.co/gA3Wda/IMG_1661.jpg) (http://ibb.co/gA3Wda)
(http://thumb.ibb.co/nDnPya/IMG_1663.jpg) (http://ibb.co/nDnPya)
Are you able to use the camera even if your battery hatch is open? If that is the case I just suppose it is not a new firmware but the normal one in service mode.
QuoteAn Introduction to Service Mode
The Problem
Until now, the only way to test whether you've successfully fixed a fault on an EOS camera is to completely reassemble it, and make sure the battery and memory card doors are closed, because the camera won't switch on otherwise.
This consumes valuable time, and can tempt you into using some precarious arrangements, like leaving the back panel hanging on by just the ribbon cable, or wedging the door switches closed. These arrangements inevitably lead to broken flexi-boards, connectors, switches, or worse.
They are also susceptible to cameras being inadvertently knocked off the desk, or otherwise damaged, if you happen to touch one of the high-voltage lines of the flash charging circuitry, not to mention the physical pain!
The Solution
The Service Mode Plugin solves this problem by setting the camera to a special mode that allows it to power up in a dissassembled state. It also allows you to disable the flash charging circuitry while you perform your repair. This can save many hours of bench time, and prevent those nasty electric shocks.
Service Mode
You can use the software to place the camera in Service Mode and/or Flash Disable Mode before you start working on it. Then simply quit the software in the normal way and unplug it.
While in Service Mode, the camera ignores the on/off switch or the door switches. It will power up with the rear display panel completely removed. It will also power up with other major boards completely removed - even the lower board!
While in Flash Disable Mode, you no longer need to remember to discharge the flash capacitor after every time you've connected the battery for testing.
You can now save hours of bench time, and avoid many potential accidents:
Access the inside of the camera while powered up, for your scope probes or voltmeters - without inviting disaster by having the back panel hanging off and the door switches wedged.
Test whether you've fixed the fault before fully assembling the camera.
Access important adjustment screws, and test their effect with or without SPT software connected.
Work around the high voltage circuitry in safety
Exiting Service Mode
The camera will stay in Service Mode until you reconnect it to SPT Software again. Just press the appropriate buttons on the Service Mode plugin to switch the camera back to normal mode, or switch the flash charge back on.
SPT Software will remind you if the camera is still in Service Mode or Flash Disable Mode every time you quit, so there's no danger of returning it to the customer in the wrong mode.
When you open the battery compartment, the camera turns off. The same thing happens when you open the card slot SF.
OK. if this function is not demanded of you, then tell me how to get out of it in normal mode?
How did you get in? Did you already manage to get out of it? If yes, how?
The only method I know is by using service tool from SPT. It uses this mode for all adjustments (AF, shutter calibration etc). Pricey, as third-party service shops are their target, not standard consumers.
This area is largely unexplored, see e.g. http://magiclantern.wikia.com/wiki/Secret_menus (for 5D2)
You can enter this menu by calling StartFactoryMenuApp (look it up in the old mailing list archive), but I don't recommend calling it on a real camera; feel free to explore stuff like this in QEMU. I don't know how to close this app, other than restarting the camera. There's also ServiceMenu in bindReceiveSwitch; you can send MPU button code 0x1F00 (see button_codes.h and mpu.c in QEMU source) to enable it, but I could only get an error screen.
offtopic Q: any chance for unlocking "AF microadjustment menu" for rebels like 100D? 8) 8)
Kind of... Service mode it's way more powerful. It allows even calibration of each sensor line separately (e.g. central point may consist of 4 lines: vertical and horizontal working up to f/5.6 and two diagonal working up to f/2.8.
(https://s9.postimg.cc/x2ww8tpv3/sensorcalib.png)
This is what Canon service can do, calibrating the AF, for each camera, including the simplest 1000D or 100D. It would be a nearly universal solution to all AF problems, which is IMO pain in the ass for Canon cameras. Why "nearly" universal? Because it can't correct cases when sensor itself is mechanically too wrongly positioned (e.g. tilted) or a lens too much mechanically misaligned -- in such cases Canon sevice has to position the sensor or fix the lens (info got from a Canon guy, calling the service directly).
Got a crazy idea. Is QEMU able to utilize the USB of DIGIC processor (assuming USB is implemented in DIGIC and not any external controller), emulate it and give access to it from the host OS? Goal: the host OS would see the emulated canon FW as a real connected camera?
do you have access to the software?
No, the screenshot and description come from their documentation. Despite it's too expensive for a typical consumer, as they target at service shops (and they don't have e.g. a licencing scheme bound to a particular S/N of a camera), it seems to be worth buying to understand a bit more about the internals of the camera.
By checking out the demo it seems wifi and GPS only are locked by software.
Quote from: Sapporo on April 17, 2018, 04:35:13 PM
By checking out the demo it seems wifi and GPS only are locked by software.
Probably. It might be however, that the interface itself is located on another board (which differs physically between variants) and the mainboard has to be programmed if to use it or not. Enabling it, when the module is physically not mounted, would now work though.
i'd really love to get hands on for e.g. 600D, 7D or 5D3 to dig a bit deeper into how the camera is calibrated
Quote from: g3gg0 on April 17, 2018, 09:40:19 PM
i'd really love to get hands on for e.g. 600D, 7D or 5D3 to dig a bit deeper into how the camera is calibrated
$250. It is sure expensive https://www.spt.info/sptstore.php/canon-eos-7d-essential/software-canon-eos-7d-advanced-
Start a donation for the software and I am sure we can add some money.
Start by asking for the demo over there and check out the software.
Quote from: Sapporo on April 18, 2018, 02:38:01 PM
$250. It is sure expensive https://www.spt.info/sptstore.php/canon-eos-7d-essential/software-canon-eos-7d-advanced-
Start a donation for the software and I am sure we can add some money.
Start by asking for the demo over there and check out the software.
Good afternoon. The problem is still relevant!
If you need to turn off the factory menu, I can do that without any third party software; just ask.
Quote from: a1ex on June 13, 2019, 03:04:40 PM
If you need to turn off the factory menu, I can do that without any third party software; just ask.
Please, HELP )
Done. Also tested the "Factory Menu" on 5D3, EOS M and 70D (and many other models in QEMU). Expecting it to work on any camera running EOS firmware. None of these options are interesting for regular users, so I'm not going to enable it just because we can.
A couple of screenshots from different cameras:
(https://a1ex.magiclantern.fm/debug/factory-menu/screenshots.png)
Developer notes on request.
problem solved! Thanks
Quote from: a1ex on June 13, 2019, 10:04:56 PMDone. Also tested the "Factory Menu" on 5D3, EOS M and 70D (and many other models in QEMU). Expecting it to work on any camera running EOS firmware. None of these options are interesting for regular users, so I'm not going to enable it just because we can.
There is also a "Factory Menu" on the 400D (not sure if it's among the screenshots you posted), that could be enabled from our hack, but we took it out of our menus many years ago, as it interfered with the USB connection and was of no use to most users. Also, there is an easter egg / hidden menu, that does not seem to make anything useful at all, if you switch the camera on with two specific buttons pressed.
The color bars would be nice, but I guess that is not a pick and choose kind of thing.
color bars will be useful for connecting an external equipment
FYI, color bars were requested before (https://www.magiclantern.fm/forum/index.php?topic=4008) and they are pretty easy to implement from scratch. No need to reuse any of Canon's code.
Quote from: a1ex on June 13, 2019, 03:04:40 PM
If you need to turn off the factory menu, I can do that without any third party software; just ask.
Please, please i need so fix this, Help me please!
Quote from: a1ex on June 13, 2019, 03:04:40 PM
If you need to turn off the factory menu, I can do that without any third party software; just ask.
Please help to disable this factory menu. I bought my 7D used and cannot use it with a computer. EOS Utility does not recognize the camera. Where I live there is no Canon service and no one will help me :(
Quote from: a1ex on June 13, 2019, 03:04:40 PM
If you need to turn off the factory menu, I can do that without any third party software; just ask.
please help me exit my 6d's factory mode, many thanks!
I was being careless today and called "SetTuningFlag" with no parameters. Managed to turn on factory menu and factory USB mode. PTP didn't work.
Factory Menu: https://eggnog.danielc.dev/f/55-y740bxdh9ki5sa4zs91w6ack9nst3v.jpg
Tried a few things, didn't understand most of it.
Had to experiment in Qemu, and compared some ROM dumps. On my 1300D/T6 the flag is located at 0xfee60000+0x2c.
Default value is 0xFFFFFFFF, factory value is 0x0. Running `SetTuningFlag 0xFFFFFFFF`disabled the factory mode.
Or in Lua:
dryos.call("SetTuningFlag", 0xFFFFFFFF)