Magic Lantern Forum

Developing Magic Lantern => Camera-specific Development => Topic started by: SpenceM on September 05, 2018, 03:09:27 PM

Title: Canon EOS R / RP
Post by: SpenceM on September 05, 2018, 03:09:27 PM
Today Canon showed us the new EOS R. Unfortunately, they're crippling it. 4k video is heavily cropped, and can't even get 120fps @ 1080p. Also only 1 SD card slot.

So it's up to the awesome people of MagicLantern to unlock this camera's true potential!  ;)
Title: Re: Canon EOS R
Post by: a1ex on September 07, 2018, 01:31:20 PM
If you've got one and don't mind running a couple of tests, just ask.

Expecting to get blank screen with M50 code, i.e. hopefully able to run a while(1). Maybe also LED blinks if lucky.
Title: Re: Canon EOS R
Post by: Walter Schulz on September 07, 2018, 01:53:57 PM
Quote from: SpenceM on September 05, 2018, 03:09:27 PM
Also only 1 SD card slot.
UHS-II interface, though. First time in consumer/prosumer line-up.
Lens interface protocol redesigned. Means work for devs.
No third party lenses for RF mount, only EF/EF-S with adapter. Seriously, Canon?
Menu control redesign.
New HDMI modes.

Sounds like lot of fun and navigation towards HC SVNT DRACONES.
Full code ahead, argh!



Seriously, a1ex: Your twitter account sounds like you'r not absolutely against sending you a specimen. It's nonetheless twitter. So: Where are we heading, cap'n?
Title: Re: Canon EOS R
Post by: kitor on September 07, 2018, 02:09:25 PM
I'm looking forward to see it in person, at the moment I really think about going back to Canon from A7s1. Body seems to win in terms of ergonomic with both Nikon Z and A7/A9. ISO performance (at least on photos I saw, unfortunately jpegs only) is not too bad, and I think up to 40k after Lightroom it will be comparable with a7s in 1080/2.5k resolution that I usually export my photos.

I will miss rear dial. However with new ring on lenses (set this to aperture control) and using camera dials for ISO/exposure seems to be a good idea.

As for 4K, IIRC Kai tried with 10-18mm EF-S on adapter and it worked perfectly. So there are some workarounds to this crop factor other than on 5d4.

QuoteNo third party lenses for R mount,
I missed that info, where they stated it? Remember there are not too many third party lenses for Sony FE too. AFAIR Sigma announced first E-mounts this year...

In terms of lenses with my a7s I use 16-35/4 and 24-240 which is perfect (but heavy) all-around lens. Here will probably go back for 70-200 on adapter and native 24-105, sadly there was no wide zoom like 16-35 or 17-40 announced...
Title: Re: Canon EOS R
Post by: Walter Schulz on September 07, 2018, 02:42:22 PM
[RF mount and third party]
Quote from: kitor on September 07, 2018, 02:09:25 PM
I missed that info, where they stated it?

No quote from Canon itself. Problem seems to exist because of a (at least one) Canon patent covering RF mount and no word given about licensing to third parties.
Nothing heard from Sigma, Tamron, Tokina (to name the most usual suspects) about it.

I think/hope there will be some interviews at Photokina trying to get a solid statement about this.
Title: Re: Canon EOS R
Post by: a1ex on September 07, 2018, 04:19:39 PM
Quote from: Walter Schulz on September 07, 2018, 01:53:57 PM
Seriously, a1ex: Your twitter account sounds like you'r not absolutely against sending you a specimen. It's nonetheless twitter. So: Where are we heading, cap'n?

Well, since the other DIGIC 6/7 ports appear to be a little different from what we are used to (DIGIC 4/5), and simply waiting for others to jump in apparently wasn't exactly the best idea for these models, I've considered getting a recent camera and making a reference port, that others could easily adapt to other "new" cameras. Was thinking at M50, as it seems close enough to all other DIGIC 7 models, yet different enough to be challenging (its firmware is a strange mix between EOS and PowerShot codebases, and the sensor looks a bit faster than on older Canons).

Then noticed the giveaway and got tempted by the full-frame dual pixel RAW (some unfinished notes I've started to write a while ago here (https://a1ex.magiclantern.fm/bleeding-edge/5D4/5d4-dual-pixel.html)). Didn't expect anything to come up from that, but looks like some folks took it (maybe a bit too) seriously.

EOS R is also DIGIC 8. No idea what's inside, but expecting its firmware to be similar to M50. Whether we'll be able to run code on it, remains to be seen.
Title: Re: Canon EOS R
Post by: dfort on September 07, 2018, 04:28:47 PM
Quote from: Walter Schulz on September 07, 2018, 01:53:57 PM
Your twitter account...

You mean we should be following someone other than just @autoexec_bin for the latest ML news?
Title: Re: Canon EOS R
Post by: Walter Schulz on September 07, 2018, 05:34:31 PM
Quote from: a1ex on September 07, 2018, 04:19:39 PMDidn't expect anything to come up from that, but looks like some folks took it (maybe a bit too) seriously.

Friendly forces may be among the hardest to endure. (Source: Fortune cookie of the day)

With that thought in mind:
I think there are some people happy to hear about your change of heart and willing to express their happiness through donations. If you drop a word I'm convinced there will be no troubles getting you a EOS R (+ RF lens + EF/EF-S-Adapter) or a M50.

Title: Re: Canon EOS R
Post by: kitor on September 15, 2018, 07:14:43 PM
I just pre-ordered R + 24-105. So @a1ex if you have any ideas for rom dumping feel free to contact me.

Hope to get it on time as I'm going for a week to Chernobyl Exclusion Zone just day after release. So either new toy (and opportunity to compare it against A7s) for this trip, or will have to wait until I'm back.
Title: Re: Canon EOS R
Post by: KelvinK on September 18, 2018, 11:34:13 AM
Price tag for RF lenses is non adequate (you get body and 28-70 5.5k$) making whole system kinda strange. And for this price you have 50mm in 4k.
Title: Re: Canon EOS R
Post by: kitor on September 18, 2018, 09:38:39 PM
Depends on what you want. I'll probably add 70-200 2.8L IS II + something wide like mentioned 16-35 on EF and leave 24-105 for trips where I don't have time/want to play with lenses.
Yup, I'm not shooting much video, and just before my 5d2 hit the floor (in accident) I worked mostly as photojournalist. After two years break (done only ~3000 shoots on a7s during those 2 years, half of them on two visits in the Zone) i'm getting back into it, and lastly most shots are either on 16-35 or on 100+mm.

With all the 'paradoxes' that R presents, I still decided to buy it. For Canon skintones, EF lenses and body ergonomics (waited for a7sIII but I consider even a9 too small for my hands).
Many people talk about single SD card and IBIS - I don't consider them a problem, but to be fair - none of my previous cameras had those. And would probably buy again 5dc as backup body.
After you go mirrorless, seems there's no going back. I still borrow 5D2 and Nikon D7000 from mum, but after I got used to EVF I always missed exposure on first few shots as on EVF WYSIWYG ;)
Title: Re: Canon EOS R
Post by: lovelybead on October 01, 2018, 03:26:08 AM
I ordered one too. I work in tech and am happy to help with however I can once it arrives!

Theoretically speaking: Would it possible with ML to shoot 120fps in 1080p or would the limit still be 720p? That's the main gripe I have with this camera. The 4k crop I don't mind so much.
Title: Re: Canon EOS R
Post by: kitor on October 01, 2018, 12:27:21 PM
QuoteTheoretically speaking:
We don't have any ideas about internals, and you're asking questions.

Nobody from dev team have it, and what's worse it's not just an iteration of DSLR, some things for sure had changed.
The best expectation is no expectations.
Title: Re: Canon EOS R
Post by: a1ex on October 01, 2018, 07:10:18 PM
If it's like 5D4, it's very unlikely, as 1080p60 appears to be pushed to the limit (https://www.magiclantern.fm/forum/index.php?topic=17695.msg206730#msg206730). That's an unexpected limitation, since on both models, the sensor appears to be fast enough (https://twitter.com/autoexec_bin/status/1037487068870520833) for 1080p120, assuming no readout overhead for lower resolutions.

5D3:

5936x3950x7.65 = 179 Mp/s (full size, including black bars, in photo mode)
5796x3870x7.65 = 171 Mp/s (active area size)

3744x1382x31.5 = 163 Mp/s (full size, including black bars, 1:1 crop x5)
3596x1320x31.5 = 149 Mp/s (active area size)

2080x1320x40 = 109 Mp/s (full size, including black bars, 3x3 binning 1080p FPS override)
1936x1280x40 = 99 Mp/s (active area size)

2080x1040x48 = 104 Mp/s (active size, 3x3 binning crop_rec)
1936x1040x48 = 97 Mp/s (active size)

700D (LiveView figures from the bleeding-edge crop_rec (https://www.magiclantern.fm/forum/index.php?topic=19300.msg205546#msg205546)):

5280x3529x6.45 = 120 Mp/s (full size)
5208x3476x6.45 = 117 Mp/s (active size)

2592x1107x33.3 = 95 Mp/s (full size, 1:1 crop x5)
2520x1080x33.3 = 91 Mp/s (active size)

1808x1189x43.3 = 109 Mp/s (full size, including black bars)
1736x1160x43.3 = 98 Mp/s (active size)

In other words:
- 5D3 1080p (1936x1280) was pushed to 40 FPS, i.e. about 100 Mp/s out of 170 in photo mode (what limits it? no idea)
- 700D 1080p (1736x1160) was pushed to 43 FPS with a slower sensor, i.e. about 100 Mp/s out of 120

Take it with a grain of salt, i.e. as pure speculation or CR0 if you prefer; I did not see the EOS R firmware.
Title: Re: Canon EOS R
Post by: a1ex on October 16, 2018, 08:48:32 PM
Tried to run some initial tests on the EOS R; unfortunately, this is all we've got:

(https://a1ex.magiclantern.fm/bleeding-edge/R/r.jpg)

The error screen looks just like on previous models, which is encouraging. The camera recognized there was a FIR file on the card, for the correct model, otherwise it would have printed "Update file cannot be found". The error message means it could not verify the checksum; Canon might have changed the FIR file format, or maybe also the encryption.




Edit: progress - apparently it doesn't like tiny FIR files, but otherwise it accepts them:

(https://a1ex.magiclantern.fm/bleeding-edge/R/progres.jpg)

Edit (February 2019): turns out it was just the decryption code locking up with some FIR files.
Encryption changed - we can no longer create FIR files for this camera.
Title: Re: Canon EOS R
Post by: kitor on October 21, 2018, 09:06:00 AM
Nice to see that something is going on!
This green screen is a problem with graphics runtime, or it hanged in this state? Just wonder, as graphics is not really needed to have a rom dump...
Title: Re: Canon EOS R
Post by: a1ex on October 21, 2018, 03:56:45 PM
Every single accepted FIR file (that did not print an error) hanged in the green screen state.

Otherwise, the error message was always the one from the screenshot.

My hypothesis:
- Canon does some more checks to decide whether the file format is valid or not (possibly some data structure where the old FIR files had executable code)
- that green screen might be the result of some incomplete display shutdown from the bootloader:
   - test video: https://vimeo.com/295449758
   - while loading a FIR, Canon bootloader prints "Loading..."
   - after that, on previous models it turns off the display and the SD card, then it runs the firmware update program
   - that firmware update will turn on the display again; that means, you would see a short flicker (https://youtu.be/WzMTZr_Zef0?t=280) (display turning off and on for a split second)
   - in the test video, I do not see the display turning off, which is why I believe the bootloader maybe "forgot" to turn it off before running the FIR code
   - maybe just the image stream was turned off, and the display controller (which is likely "smarter" than in previous models) timed out and displayed some green screen.

The above is just speculation.

Easiest way to figure it out: wait for a firmware update.
Harder way: perform some more blind tests, hoping to get some different outcome (other than green screen or error message).

I'm not 100% sure we actually executed code on the camera, but the lack of error message hopefully means the FIR file was accepted (i.e. encryption was not changed).
Title: Re: Canon EOS R
Post by: kitor on October 31, 2018, 01:05:49 PM
As I finally got my hands on R (arrived just yesterday), some photos comparing to 5D2 and A7s1: https://imgur.com/a/8rHgjoI

First impressions:
- grip ergonomy is wonderful. It's smaller than 5D2, but due to a bit different shape it's similar in comfort of holding it.
- where's back dial ?!
- touch bar is a joke. Was disabled factory default and I kept it disabled.
- control ring is interesting feature. Not sure why was also factory default disabled.
- mode dial is not that bad (how often do you switch modes?). However there's so much wasted space in power switch location.
- AF is fast AF ( ;) ). I was amazed after using A7s for last two years.
- 24-105 is quite heavy lens.
- LP-E6N! Took two spare LP-E6 from mum's 5D2 (btw, 10 years anniversary!) and now I have three. Eat this, Sony!
- I'm amazed so far with EVF quality. Much better than A7s1, which was the first EVF that convinced me that mirrorless may substitute DSLR.
- A few more programmable buttons wouldn't hurt.
Title: Re: Canon EOS R
Post by: a1ex on November 17, 2018, 10:53:12 PM
EOS R users might be interested in the following numbers (thanks @kitor for test images):

Quote from: a1ex on November 17, 2018, 10:45:02 PM
Silent still: 17.47 μs/line, 78.25 ms full readout at 6720x4480 => 385 MPix/second readout speed?
4K24/23.98/25/30: 14.45 +/- 0.019 μs/line, 31.2 ms at 3840x2160
1080p24/25/30/50/60: 14.12 +/- 0.067 μs/line, 15.3 ms at 1920x1080
720p25/30/50/60: 21.20 +/- 0.087 μs/line, 15.3 ms at 1280x720
720p100/120: 9.47 +/- 0.204 μs/line, 6.8 ms at 1280x720
Title: Re: Canon EOS R
Post by: Walter Schulz on December 13, 2018, 10:15:44 AM
Most readers may be aware of Lensrental's tear-down/disssembly of an RF 50/1.2:
https://www.lensrentals.com/blog/2018/12/disassembly-of-the-canon-rf-50mm-f1-2l/

Well, R system really seems to be a hard nut to crack ...
Title: Re: Canon EOS R
Post by: kitor on December 17, 2018, 08:41:44 AM
After some time spent with R I have some more conclusions:

- AF works great with EF lenses (I use 100-400 atm)
- Grip is expensive as hell, but worth it - since it will charge both batteries inside
- quirks: grip has separate USB-C for charging, will charge only with LP-E6N, won't charge any with both E6 and E6N inserted.
- where's back dial ?! ( ;) )

Yesterday I (finally!) bought 5DIII as spare body... with respectable 258k shutter count :P Yep, it was so cheap I can replace shutter twice before hit "usual" price, and it has so signs of failing.
Anyway, to the point. When I was shooting with 5D2 and 100-400 (had a7 16-35, r 24-105 and 5d2 100-400 on last trip to cover all scenarios) I noticed i somehow like R grip better. Now I confirmed this - due to it's grip depth, R with 100-400 on adapter seems more comfortable to me. Feels more secure in my hands, and that's an interesting observation as I was looking to jump to 1 series for bigger body while I had my first 5D2...
Title: Re: Canon EOS R
Post by: Dmytro_ua on December 17, 2018, 10:34:47 AM
This question is directed more to ML developers then to R owners.
Is R have any potential advantages for ML video possibilities over 5d4, except eye tracking?
Title: Re: Canon EOS R
Post by: KelvinK on December 17, 2018, 01:23:06 PM
Quote from: Dmytro_ua on December 17, 2018, 10:34:47 AM
This question is directed more to ML developers then to R owners.
Is R have any potential advantages for ML video possibilities over 5d4, except eye tracking?

No. But image quality can differ. For some reason, 4K on 5D4 is sharper then on R.
Title: Re: Canon EOS R
Post by: Dmytro_ua on December 17, 2018, 03:49:55 PM
Quote from: KelvinK on December 17, 2018, 01:23:06 PM
No.

What about DIGIC 6+ vs DIGIC 8,  CF bus vs SDXC UHS-II bus?
Title: Re: Canon EOS R
Post by: kitor on January 10, 2019, 08:13:25 AM
Interesting quirks:
- Battery grip has ability to upgrade it's firmware (additional option in firmware update menu).
- Toshiba M4EBF10XBG inside (may be wrong about F). Google gives no results, but A1ex found another uC with very similar name.
- Shutter and AF pins are directly available on grip connector. Ground them for action.
- There's a single (unused in grip) pin that shows some digital communication on camera start, photo shots and sometimes random "messages" on idle. Signal is active-low 3.3v, around 50kHz, but no luck trying to treat is as 57600 serial communication. Will borrow logical analyzer and try to dump this.

(https://i.ibb.co/FgnmgJ1/49759127-1882742475181896-2832192286425612288-n.jpg) (https://ibb.co/FgnmgJ1)

USB-C in grip seems to be used only for charging grip batteries. USB-C in body is used for communication and charge of internal battery when no grip is attached.
Both work only with LP-E6N (won't charge E6) and with USB-PD adapters only. No luck with standard 5V chargers and QC/PE ones.
Title: Re: Canon EOS R
Post by: a1ex on January 10, 2019, 08:57:57 AM
Quote from: kitor on January 10, 2019, 08:13:25 AM
- There's a single (unused in grip) pin that shows some digital communication on camera start, photo shots and sometimes random "messages" on idle. Signal is active-low 3.3v, around 50kHz, but no luck trying to treat is as 57600 serial communication.

Here's my attempt at manually identifying the message format and timings. It appears to be UART (https://tutorial.cytron.io/2012/02/16/uart-universal-asynchronous-receiver-and-transmitter/), bit time about 18.5-19 microseconds, so about 52000-54000 baud. Couldn't identify any plain text in these short fragments, though.

(https://a1ex.magiclantern.fm/bleeding-edge/R/r-uart2.jpg) (https://a1ex.magiclantern.fm/bleeding-edge/R/r-uart4.jpg)
Title: Re: Canon EOS R
Post by: TiagoSilva1987 on January 28, 2019, 06:55:29 PM
Hello, Where can i download the Magic lantern firmware update for EOS R?
Title: Re: Canon EOS R
Post by: Walter Schulz on January 28, 2019, 07:58:57 PM
You have to find the tree ... (https://www.magiclantern.fm/forum/index.php?topic=17695.msg207023#msg207023)
Title: Re: Canon EOS R
Post by: TiagoSilva1987 on January 29, 2019, 10:19:51 AM
It´s under development?
Title: Re: Canon EOS R
Post by: Walter Schulz on January 29, 2019, 10:26:40 AM
What difference does it make? ML development follows no schedule.
2 years ago a generous offer was made: A 750D (free of charge) for anyone willing and able to port it. Nobody claimed it ...

My advice:
If there is no ML for your cam act like there will be no ML for your cam ever.
Title: Re: Canon EOS R
Post by: TiagoSilva1987 on January 29, 2019, 02:32:44 PM
Where can i download RLEDID14.FIR  ?
Title: Canon EOS R Firmware
Post by: jga on February 12, 2019, 07:23:45 AM
Firmware 1.1 has been released: https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware
Title: Re: Canon EOS R
Post by: civita on February 12, 2019, 08:43:03 AM
A new firmware regarding EOS R was released!

https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware
(https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware)
Canon EOS R Firmware v.1.1.0 changes:
Title: Re: Canon EOS R
Post by: Sapporo on February 12, 2019, 11:32:06 AM
Firmware 1.1.0 is release from Canon now https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware&firmwaredetailid=tcm:13-1776855
Title: Re: Canon EOS R
Post by: kitor on February 12, 2019, 05:47:18 PM
Grip communication was my mistake, this pin is used by grip itself unfortunately.
Anyway,
Battery close!
RSTFLG : 0010
E1ON
openBattery
/USB_DET undetected
setCCSnkRst

MON>>>All task Initialize
================SD send recode 0 0
WakeupReason from ICU: 0x67,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,

Hello from MPU  8)
Title: Re: Canon EOS R
Post by: a1ex on February 12, 2019, 10:17:56 PM
... the "behind the scenes" picture:

(https://a1ex.magiclantern.fm/bleeding-edge/R/rr.jpg)

The firmware update... unfortunately wasn't helpful. None of my previous tricks worked with it. I'm still wondering why some of my previous test FIRs resulted in green screen, but I'm now 100% sure we did not execute any code on the camera. The green screen was likely a bug in Canon's FIR loading routine, or something like that.

The good news - kitor identified two UART ports: one at 3.3V, used by the MPU (outputs the log from above) and another at 1.8V, likely used by the main CPU (same voltage level on DIGIC 6 (https://www.magiclantern.fm/forum/index.php?topic=7531.msg200763#msg200763)). The latter needs some level shifting (https://electronics.stackexchange.com/questions/333229/1-8v-uart-with-3-3v-uart), but - at least on previous models - it has everything we need to enable the boot flag and explore around.

Worst case - ML on EOS R may require some hardware hacking in order to install it (like in the above picture). No big deal, right? I mean, you need a lot more knowledge to be able to use it (https://www.eoshd.com/comments/topic/28683-how-do-i-get-ml-crop-recording-going-on-my-5d3/?tab=comments#comment-273299) ;)

Also forgot to mention - I've got high-res PCB pictures from the Lensrentals teardown (https://www.lensrentals.com/blog/2018/10/teardown-of-the-canon-eos-r-mirrorless-camera/). If any of you can identify anything from here, please write it down.

(https://a1ex.magiclantern.fm/bleeding-edge/R/1S7A7943-small.JPG) (https://a1ex.magiclantern.fm/bleeding-edge/R/1S7A7943.JPG) (https://a1ex.magiclantern.fm/bleeding-edge/R/1S7A7944-small.JPG) (https://a1ex.magiclantern.fm/bleeding-edge/R/1S7A7944.JPG)
Title: Re: Canon EOS R
Post by: kitor on February 13, 2019, 05:24:04 PM
Oh hello!

Dry[WarpPUX]> sysvers
SystemIF 1.01
DRYOS version 2.3, release #0060+p4
MACH 0.51
Title: Re: Canon EOS R
Post by: kitor on February 14, 2019, 08:03:51 AM
If you missed the news:
https://twitter.com/_kitor/status/1095807058358796290

However executed via bootloader CLI, and took a lot of pain to debug this for Alex and me. Would be much easier if I had proper FPC for this debug connector; had to hold needle to TX pad all the time by hand.
Title: Re: Canon EOS R
Post by: Danne on February 14, 2019, 08:12:18 AM
Geniuses.
Title: Re: Canon EOS R
Post by: a1ex on February 14, 2019, 06:21:17 PM
Initial notes:

- Encryption changed. Wasn't able to look inside the firmware update. Unable to create FIR files for this camera.
- Other than that, bootloader and overall code structure look familiar.
- Portable ROM dumper worked (https://bitbucket.org/hudson/magic-lantern/commits/b6ec71d104dcb66f48802707467fd7e8036816ac?at=recovery) after (https://bitbucket.org/hudson/magic-lantern/commits/230b4fdd1ad3f31c3e4c93155e4504d83cc1c657?at=recovery) some (https://bitbucket.org/hudson/magic-lantern/commits/5b87791d9c225bb6c7a2feefed570f8b955317db?at=recovery) minor (https://bitbucket.org/hudson/magic-lantern/commits/1ff7677fcababfbbebd44d386aa5f312656e404a?at=recovery) tweaking (https://bitbucket.org/hudson/magic-lantern/commits/19f18f0492eaa4ea86c4550e33f24733aeb54fe5?at=recovery).
- Display buffer in bootloader context: 1024x682, otherwise like M50 (UYVY).
- LED address: 0xD01300D4 (0xD01300D8/DC maybe also valid).
- CPU info: identical to M50/SX70.
- Early startup: identical to M50 (yes, this entire block (https://bitbucket.org/hudson/magic-lantern/src/digic6-dumper/platform/M50.101/consts.h?fileviewer=file-view-default#consts.h-9) is identical, same stub addresses).
- Can jump to main firmware (with this trick (https://bitbucket.org/hudson/magic-lantern/commits/7d4d8bbd3b0257eb7cc893777f6e47d7684b3970?at=digic6-dumper)). Autoexec.bin is loaded on both CPU cores (https://bitbucket.org/hudson/magic-lantern/commits/0f8fc984f719c52d3be1749be20133e643f0bdd6?at=digic6-dumper) (maybe there are more?)
- Can save log files and dump ROM from main firmware.
- Overall, very similar to M50, but closer to "classic" EOS firmware (i.e. less of a PowerShot). Also has a MPU.
- Most of the code runs from ROM, very much like M50.
- Source code committed to digic6-dumper (https://bitbucket.org/hudson/magic-lantern/branch/digic6-dumper) branch (initial platform directory) and recovery (https://bitbucket.org/hudson/magic-lantern/branch/recovery) branch (portable ROM dumper, CPU info).

Quote from: kitor on February 14, 2019, 08:03:51 AM... and took a lot of pain to debug this for Alex and me.

It's true, it took us many hours of debugging, but compared to other models, this was quite easy. It definitely wasn't a matter of staring at the code for hours or days with no idea what to do next (cough 7D, EOSM shutter bug, 80D io_trace and many others). Yes, the camera was stubborn, but there was visible progress every few dozens of minutes (except during our breaks).

That was partly because most of the hard work was already done for M50 and all other earlier models, so it was mostly a matter of identifying what to tweak. And because Canon didn't change *that* much (except for the FIR encryption). And I didn't have to hold any needle on the UART connector :D
Title: Re: Canon EOS R
Post by: Walter Schulz on February 14, 2019, 06:39:23 PM
Quote from: a1ex on February 14, 2019, 06:21:17 PM
- Encryption changed.

Boy, really hate to read that!
Title: Re: Canon EOS R
Post by: Indy on February 14, 2019, 11:34:15 PM
Quote from: Walter Schulz on February 14, 2019, 06:39:23 PM
Boy, really hate to read that!
Working on it with Alex :-)
Title: Re: Canon EOS R
Post by: kitor on February 15, 2019, 07:31:14 AM
Quote from: a1ex on February 14, 2019, 06:21:17 PMInitial notes:

I'll add here
- LV is taking so many resources, that it's loosing input on UART. Going into menu makes it reliable + camera output is a few times faster.

For adventurous (as it need's 1v8 UART or 3v3 with voltage divider on TX), simple bootloader dumper:
import serial
import sys

start = int('0xE0000000',16)
end = int('0xE0040000',16)
step = int('0x1000',16)
current = start

with serial.Serial('/dev/ttyS6', 115200, timeout=1) as ser, open("dump2.log", 'w', encoding='utf-8') as logfile:
  while True:
    line = ser.readline()
    if line is not b'':     #skip timeouts
      decoded = line.replace(b'\r\n',b'').decode("UTF-8") #bytes to string
      print(decoded)
      logfile.write(decoded + '\n')

    if b"Mode ON" in line:       #enter interactive shell
      ser.write(b'akashimorino\r\n')
    elif b"K424[1]>" in line:    #prompt, start data dump
      if current > end:
        sys.exit(0)
      ser.write(str.encode("d " + hex(current) + " " + hex(step) + "\r\n"))
      current += step


Of course you need to reassemble this data into binary form yourself.

UART location/pinout is here (https://www.magiclantern.fm/forum/index.php?topic=7531.msg212071#msg212071).


QuoteAnd I didn't have to hold any needle on the UART connector
Yup. Fortunately with bootflag enabled, now RX is sufficient.
Title: Re: Canon EOS R
Post by: a1ex on February 15, 2019, 05:05:15 PM
This camera has 2 GiB (https://www.magiclantern.fm/forum/index.php?topic=5071.msg212085#msg212085) of RAM 8)

Canon already struggled to pack this amount of RAM into the 32-bit address space: only the first GiB is visible as regular ("cacheable") memory. The second GiB is only visible as "uncacheable", and - just a guess - probably used exclusively by DMAs (image processing etc). Then, there are 512 MiB reserved from peripherals (addresses starting with C and D), 256 for the main ROM (starting with E), 256 for the slow (serial?) flash (starting with F, but apparently unused on R), and a couple of small regions overlapped here and there (DF - probably some sort of TCM; BFE - something with special meaning, etc).

MMU configuration is very similar to DIGIC 7:

00001000-00001FFF -> 00000000-00000FFF (-1000) O:NCACH I:WB,WA  P:RW       [ CPU0 only ]
00001000-00001FFF -> 00001000-00001FFF (   +0) O:NCACH I:WB,WA  P:RW       [ CPU1 only ]
00002000-3FFFFFFF -> 00002000-3FFFFFFF (   +0) O:NCACH I:WB,WA  P:RW       [ cacheable RAM - only the first GiB ]
40000000-BFFFFFFF -> 40000000-BFFFFFFF (   +0) O:NCACH I:NCACH  P:RW       [ uncacheable RAM - 2 GiB ]
C0000000-C2FFFFFF -> C0000000-C2FFFFFF (   +0) Device           P:RW XN    [ MMIO area ]
C4000000-C4FFFFFF -> C4000000-C4FFFFFF (   +0) Device           P:RW XN
C8000000-CAFFFFFF -> C8000000-CAFFFFFF (   +0) Device           P:RW XN
CC000000-CDFFFFFF -> CC000000-CDFFFFFF (   +0) Device           P:RW XN
D0000000-D0FFFFFF -> D0000000-D0FFFFFF (   +0) Device           P:RW XN
D2000000-D2FFFFFF -> D2000000-D2FFFFFF (   +0) Device           P:RW XN
D4000000-D5FFFFFF -> D4000000-D5FFFFFF (   +0) Device           P:RW XN
D7000000-D9FFFFFF -> D7000000-D9FFFFFF (   +0) Device           P:RW XN
DE000000-DEFFFFFF -> DE000000-DEFFFFFF (   +0) Device           P:RW XN
DF000000-DFFFFFFF -> DF000000-DFFFFFFF (   +0) O:NCACH I:WB,WA  P:RW       [ TCM? ]
E0000000-E7FFFFFF -> E0000000-E7FFFFFF (   +0) O:WB,WA I:WB,WA  P:R        [ main ROM ]
E8000000-EFFFFFFF -> E8000000-EFFFFFFF (   +0) Strongly-ordered P:R  XN    [ ? ]
F0000000-F7FFFFFF -> F0000000-F7FFFFFF (   +0) O:WB,WA I:WB,WA  P:R        [ only used on M50; at least on DIGIC 7, it's much slower than main ROM ]
F8000000-FFFFFFFF -> F8000000-FFFFFFFF (   +0) Strongly-ordered P:R  XN    [ ? ]


i.e.
- 00000000-00000FFF virtual: unavailable (likely used to catch null pointer errors)
- 00001000-00001FFF virtual: private page for each of the two cores (mapped to either 00000000-00000FFF or 00001000-00001FFF physical)
- other than that, flat mapping everywhere (with different permissions and attributes)
- some regions in the MMIO (Device) areas are unavailable; minor differences from DIGIC 7 in the C0000000 - DEFFFFFF range.
- anything above 0x40000000 (until BFDFFFFF) is uncacheable; this is the main RAM
- the first GiB of RAM is also visible as cacheable: 00002000-3FFFFFFF
Title: Re: Canon EOS R
Post by: Mike Tornado on February 15, 2019, 07:00:54 PM
Quote from: kitor on February 15, 2019, 07:31:14 AM
I'll add here
- LV is taking so many resources, that it's loosing input on UART. Going into menu makes it reliable + camera output is a few times faster.

For adventurous (as it need's 1v8 UART or 3v3 with voltage divider on TX), simple bootloader dumper:
import serial
import sys

start = int('0xE0000000',16)
end = int('0xE0040000',16)
step = int('0x1000',16)
current = start

with serial.Serial('/dev/ttyS6', 115200, timeout=1) as ser, open("dump2.log", 'w', encoding='utf-8') as logfile:
  while True:
    line = ser.readline()
    if line is not b'':     #skip timeouts
      decoded = line.replace(b'\r\n',b'').decode("UTF-8") #bytes to string
      print(decoded)
      logfile.write(decoded + '\n')

    if b"Mode ON" in line:       #enter interactive shell
      ser.write(b'akashimorino\r\n')
    elif b"K424[1]>" in line:    #prompt, start data dump
      if current > end:
        sys.exit(0)
      ser.write(str.encode("d " + hex(current) + " " + hex(step) + "\r\n"))
      current += step


Of course you need to reassemble this data into binary form yourself.

UART location/pinout is here (https://www.magiclantern.fm/forum/index.php?topic=7531.msg212071#msg212071).

Yup. Fortunately with bootflag enabled, now RX is sufficient.

Did you try sht_memoryread2 B:/K424_00.bin 0xE0000000 0x00040000 ?
Title: Re: Canon EOS R
Post by: kitor on February 15, 2019, 07:11:48 PM
No, was working with what Alex provided to me. While I have *some* background in hw hacking (was working on jlime linux port to bsquare power handheld... 10 years ago), that's my first entry into Canon's world (only messed with ML 5d2 audio code before).
Printing things over serial seems to be safer too (considering still have 4/5 of loan to pay and disassembled camera already  ;) )

[e]
sht_memoryread2 is missing :(
Title: Re: Canon EOS R
Post by: civita on March 08, 2019, 05:40:16 PM
Quote from: civita on February 12, 2019, 08:43:03 AM
A new firmware regarding EOS R was released!

https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware
(https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-r.aspx?type=firmware)
Canon EOS R Firmware v.1.1.0 changes:

  • Support for "continuous shooting" is available when "silent shutter" has been enabled.
  • Corrects a phenomenon in which an error may occur if there is a large number of files in a specific format on the memory card.
  • Corrects a phenomenon in which an error may occur when silent shutter has been enabled.
  • Corrects a phenomenon in which horizontal linear noise may occur when using specific lenses together with certain recording image quality settings.
  • Corrects a phenomenon in which the information displayed in the viewfinder may become abnormal.

Not sure is it helpful or not: Canon has already updated the firmware for the RP. Ver. 1.1.0  for windows and MAC

1. Support for Camera Control API (CCAPI)* function, for software developers, has been added.


https://www.usa.canon.com/internet/portal/us/home/support/details/cameras/eos-dslr-and-mirrorless-cameras/mirrorless/eos-rp?subtab=downloads-firmware (https://www.usa.canon.com/internet/portal/us/home/support/details/cameras/eos-dslr-and-mirrorless-cameras/mirrorless/eos-rp?subtab=downloads-firmware)
Title: Re: Canon EOS R / RP
Post by: kitor on March 09, 2019, 10:36:43 PM
If anyone already had his hands on RP and have USB UART that's able to work with 1v8 levels, you may try to dump the bootloader using my previous code.
https://twitter.com/_kitor/status/1095956664287555584
UART will be probably hidden under thumb rubber, as it has same style connector and very similar location to R.

So far I had no time to play more with R unfortunately.
BTW - if anyone knows where I can get my hands on 0.4mm pitch FFC cable (8 pin is needed for R and probably RP UART), please send me PM. Other devices that may use this internally are also a valid option (to harvest from dead / get spare parts).
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on March 10, 2019, 01:07:06 AM
Are you sure about 0.4mm?
Title: Re: Canon EOS R / RP
Post by: kitor on March 10, 2019, 01:55:15 PM
Almost. Standard 0.5mm is too wide, I wasn't able to connect both TX and RX without shorting one of them to next pin (GND). I measured piece of FPC cut to fit into connector and divided into 8 pins, got roughly this 0.4mm pitch.
Title: Re: Canon EOS R / RP
Post by: paulleavitt on April 13, 2019, 11:49:05 PM
Hey all! I have a GH5 now so I've been out of the ML world for a while, but I'm glad you guys are still at it!

My business partner has an EOS R that he's said he's willing to run some tests on if that's helpful for y'all (and if the likelihood of bricking is reasonably low). If that would be helpful, just let me know!

Paul

Title: Re: Canon EOS R / RP
Post by: kitor on April 14, 2019, 02:21:17 PM
At the moment it's impossible to run anything without enabling bootflag via UART first. Something like this:
https://twitter.com/_kitor/status/1095729715284008960
Title: Re: Canon EOS R / RP
Post by: aprofiti on April 18, 2019, 01:35:17 PM
Canon released a new 1.2.0 firmware (https://www.canonwatch.com/canon-eos-r-firmware-ver-1-2-0-available-to-download/amp/) update for Eos R.
Title: Re: Canon EOS R / RP
Post by: kitor on April 26, 2019, 06:29:44 PM
Can someone with working toolchain checkout this repo/branch: https://bitbucket.org/kitorPL/magic-lantern/branch/kitor/eosr_120
and compile for me minimal hello world?

cd minimal/hello-world
make MODEL=R


On 1.1.0 hello_world gave me LV crashes instead of text printed, but at least it worked.
Between updating, dumping 1.2.0 and updating stubs I updated my WSL distro (Ubuntu 16.04 to 19.04) and linker stopped working:
Using /usr/bin/arm-none-eabi-gcc (from PATH).
[ VERSION  ]   ../../platform/R.120/version.bin
[ CPP      ]   magiclantern.lds
(...)
[ LD       ]   magiclantern
arm-none-eabi-ld:magiclantern.lds:1: syntax error
make: *** [../../src/Makefile.src:224: magiclantern] Error 1

indeed magiclantern.lds is generated broken :( https://i.imgur.com/iLLqR2B.png

So i setup toolchain on another machine (this time Debian testing), built it and camera lockups completely, even before any print from ICU on UART:
BootLoadNow jump to AUTOEXEC.BIN(0x00800000)!!
//and dead...


ML Rescue as autoexec.bin still works from the same card...

Not sure if that's my toolchain problem or what. For new stubs I even compared them against M50 ROM and I'm sure they are right.
Title: Re: Canon EOS R / RP
Post by: dfort on April 27, 2019, 01:03:21 AM
Compiled fine here in Costa Rica -- no errors but no testing either.

On my downloads page. (https://bitbucket.org/daniel_fort/magic-lantern/downloads/)
Title: Re: Canon EOS R / RP
Post by: kitor on April 27, 2019, 08:44:42 AM
Thanks. Same behavior unfortunately  :(
Time to dig into ML code then.
Title: Re: Canon EOS R / RP
Post by: aprofiti on April 27, 2019, 12:08:24 PM
It probably locked due to firmware signature (https://www.magiclantern.fm/forum/index.php?topic=23296.msg215053#msg215053) not corresponding.
I saw you didn't updated (https://bitbucket.org/kitorPL/magic-lantern/commits/248f71a0c267956894cc9c23747f1b804933d856) it yet in your repo.

You can also replace qprintf messages to print using uart if you prefer to not use qemu
Title: Re: Canon EOS R / RP
Post by: kitor on April 27, 2019, 01:59:06 PM
Hmm, I was sure that digic6 branch had no signature testing. At least it was the case at some moment just when 1.1.0 update arrived ;)

Then I'll remove signature check as I don't have qemu working for R yet (got path from Alex for m50, however this needs mods for R), and on-camera computation won't work at the moment (guess why :) )
Title: Re: Canon EOS R / RP
Post by: dfort on April 27, 2019, 03:14:49 PM
Just saw this article (https://www.thephoblographer.com/2019/04/25/canon-eos-rp-is-capable-of-being-controlled-by-user-generated-apps/) about Canon's CCAPI (Camera Control Application Program Interface) software developer's kit. Don't know anything about it or if the R is one of the supported cameras but the RP is.

[EDIT] Looks like the cameras supported at this time are the RP, Canon 200D II / SL3 and Powershot SX70 HS.
Title: Re: Canon EOS R / RP
Post by: kitor on April 27, 2019, 08:13:30 PM
Quote from: aprofiti on April 27, 2019, 12:08:24 PM
It probably locked due to firmware signature (https://www.magiclantern.fm/forum/index.php?topic=23296.msg215053#msg215053) not corresponding.
And bingo! After skipping check it runs like before (crashes LV). Added some blinking, LV crashes on bmp_vram_raw() as I have 4 blinks and then crash :)
static void hello_world()
{
    blink_led(1000);
    blink_led(1000);
    blink_led(1000);
    blink_led(1000);

    while (!bmp_vram_raw())
    {
        blink_led(200);
    }

    while(1)
    {
        blink_led(500);
        font_draw(100, 75, COLOR_WHITE, 3, "Hello, World!");
    }
}


Unfortunately when tracing bmp_vram_raw() i saw dark magic :(
Title: Re: Canon EOS R / RP
Post by: kitor on April 27, 2019, 09:04:02 PM
At least I was able to get firmware signature updated and collect stack dump for Alex when he's back.

Would create MR, however I don't have rights for official repo...

Is there any built-in way to send some prints to log on card? Without qemu and still no display, UART using needle (literally as I still don't have proper cable) is quite annoying...
Title: Re: Canon EOS R / RP
Post by: histor on April 27, 2019, 09:25:17 PM
Simple registering here - https://developers.canon-europe.com/developers/s/login/SelfRegister
gives you enough information.
Latest CCAPI supports EOS 250D, EOS RP (firmware 1.1.0 is required), PowerShot SX70 HS (firmware 1.1.0). Usual SDK support Eos R from version EDSDK v3.9.0, EOS RP – from EDSDK v13.10.0, EOS 250D – from EDSDK v13.10.20. These are consequent releases.
There were rumors that you can complete registration, fill the profile and get access to it after awhile.
If somebody needs version 2.14 (models up to EOS Kiss X70 / EOS 1200D / EOS REBEL T5 / EOS Hi / EOS M2) – it's available in the net.
Title: Re: Canon EOS R / RP
Post by: srsa on April 27, 2019, 09:54:36 PM
Quote from: histor on April 27, 2019, 09:25:17 PM
Simple registering here (...)
gives you enough information.
Those who wish to work on ML in the future may want to read the terms & conditions, especially the section "Confidentiality". Their stuff is not open source.
Title: Re: Canon EOS R / RP
Post by: dfort on April 27, 2019, 11:06:22 PM
Quote from: kitor on April 27, 2019, 09:04:02 PM
Would create MR, however I don't have rights for official repo...

Anyone can create a pull request on the main repo. I'm good with merging it as long as it doesn't disturb the other platforms.
Title: Re: Canon EOS R / RP
Post by: kitor on April 27, 2019, 11:22:50 PM
Nevermind, tried to create PR from master repo instead of mine  :'( But I'll wait a bit, since...

In the meantime I traced the problem to bmp_vram_info. I was able to hand-draw some lines on display using code from here:

https://www.magiclantern.fm/forum/index.php?topic=17360.510
and display buffers from RAM dump: 1100100 12ffc00

No related picture as I was too lazy to make one, however now I understand mostly that this structure holds addresses of both buffers
struct bmp_vram_info
{   
    struct MARV * vram1;        /* one of the two bitmap buffers - statically allocated? */
    struct MARV * vram2;        /* the other bitmap buffer */
    struct MARV * back_vram;    /* we need to write to the other one */
};


but I still don't know how to find this pointer from stubs.C / how Alex got one:
/** Bitmap **/
DATA_PTR(    0xFB1C,  bmp_vram_info)

Funny enough, when set to exactly the same value as on M50 LV won't crash, but drawing won't work either.
DATA_PTR is relative to RAM?
Title: Re: Canon EOS R / RP
Post by: aprofiti on April 27, 2019, 11:50:43 PM
Don't know if it's a valid way to find bump buffer without a ram dump or MMIO logs, but found the "SetDrawWait" (https://bitbucket.org/aprofiti/magic-lantern/commits/d9d813cf507eb4f4858336c2f422331da4fce5db) reference while looking for 6d2 and 800d stubs.

Pointer inside the function's body appears to match the 200D and 77D dumps. Maybe you can try with EOS R?
Title: Re: Canon EOS R / RP
Post by: kitor on April 28, 2019, 12:00:03 AM
Got another RAM dump and this makes sense, those are buffers I drawn into myself (dump starts from 0x40000000):

kitor@kitor-pc:Desktop$ xxd -e -s 0x0000FB1C -l 0x0C RAM.BIN     #bmp_vram_info
0000fb1c: 412ff900 414ff400 414ff400           ../A..OA..OA      #vram1, vram2, back_vram

kitor@kitor-pc:Desktop$ xxd -e -s 0x002ff900 -l 0x2C RAM.BIN    #MARV for 2ff900
002ff900: 5652414d 41100100 00000000 11060200  MARV...A........
002ff910: 00000400 000002aa 412ff91c 4d454d50  ........../APMEM
002ff920: 00000010 00000000 41100000           ...........A

kitor@kitor-pc:Desktop$ xxd -e -s 0x004ff400 -l 0x2C RAM.BIN    #MARV for 4ff400
004ff400: 5652414d 412ffc00 00000000 11060200  MARV../A........
004ff410: 00000400 000002aa 414ff41c 4d454d50  ..........OAPMEM
004ff420: 00000010 00000000 412ffadc           ........../A


So the problem seems to be somewhere deeper, as LV hangs (and ML throws exception) directly on bmp_vram_raw() call

[e] I don't understand something:

  uart_printf("bmp_vram_info %p \n", bmp_vram_info);
    uart_printf("bmp_vram_info[0] %p \n", bmp_vram_info[0]);
    uart_printf("vram1 %p \n", bmp_vram_info[0].vram1);
    uart_printf("vram2 %p \n", bmp_vram_info[0].vram2);
    uart_printf("back_vram %p \n", bmp_vram_info[0].back_vram);
    uart_printf("bmp_marv, should match above %p \n", bmp_marv());


bmp_vram_info 0xfb1c
bmp_vram_info[0] 0x1
vram1 0x1
vram2 0x4fc0278
back_vram 0x41100000
bmp_marv, should match above 0x1
Title: Re: Canon EOS R / RP
Post by: kitor on April 28, 2019, 12:55:12 PM
Oh, Hai!

(https://i.imgur.com/syCi8Nx.jpg)
https://twitter.com/_kitor/status/1122454369235079169

I don't understand this at all. Seems that dump_file shifts down ram offsets by 0X10?! explanation below
bmp_vram_info sits at 0xFB2C, not 0xFB1C. How I found this?

for(uint32_t * i = 0x40000000; i < 0x80000000; i+=1){
        if(*i == 0x412ff900) uart_printf("vram1 %p \n", i);
        if(*i == 0x414ff400 ) uart_printf("vram2 %p \n", i);
    }


and a few moments later
vram1 0x4000fb2c
vram2 0x4000fb30
vram2 0x4000fb34


But what's werid MARV structures sits exactly where I found them in a dump:

bmp_vram_info 0xfb2c
bmp_vram_info[0] 0x412ff900
vram1 0x412ff900
vram2 0x414ff400
back_vram 0x414ff400


yup, that's shows my desperation  8)

@dfort - new MR coming in a moment :)

[edit]
OK, now I know what happened. Our initial dump on 1.1.0 has been shifted. I got MARVs from new dump, bmp_vram_info I was checking on old one all the time... working on pointers at 2AM is a bad idea.
Title: Re: Canon EOS R / RP
Post by: dfort on April 28, 2019, 01:37:03 PM
Great work @kitor -- PR merged.
Title: Re: Canon EOS R / RP : new FIR version
Post by: Indy on May 04, 2019, 01:20:19 PM
Hi,

FYI, Canon has changed the way signature and encryption is done for EOS R and EOS RP (FIR version 5).

Previous versions were:
https://magiclantern.fandom.com/wiki/Firmware_file
https://magiclantern.fandom.com/wiki/Fir_Security

As soon as debugging EOS R or RP will be possible within QEmu, I'll continue my investigations started with Alex. He owns holidays after giving years of time to ML.

Kind regards
Indy
Title: Re: Canon EOS R / RP
Post by: kitor on May 04, 2019, 02:15:42 PM
A bit of ML offtopic:

1.2.0 seems to remove banding issues:
https://www.canonrumors.com/firmware-v1-2-0-seems-to-have-solved-a-banding-issue-that-was-present-in-the-canon-eos-r/
QuoteLadies and Gentlemen! WE HAVE DONE IT!! Thank you so much to the many of you who gave feedback, shared my videos, posted in forums and relayed the information you received from Canon, I can confirm that Firmware update 1.2.0 resolves the banding issue I reported back in November on the Canon EOS R!

Tamron 70-200 G2 works great with R
Tired of waiting for RF 70-200 (and in need for one soon) I wanted to pick used 2.8L IS II USM. But found that Tamron presented not so long ago 2nd gen of their lineup (and new SP 70-200mm F/2.8 Di VC USD G2 is roughly the same price as used 2.8L IS II). As I have good contact with one camera store, I played a little with this lens via basic EF-RF adapter and it worked flawlessly, AF was fast and accurate, no problems with VR (shots like 1/30 on 200mm).
Interesting (and not found in manual) feature is that tripod mount will mount directly to Arca Swiss compatibile Quick Releases, what I found by accident.

Sample full-res jpeg (from raw, without LR lens corrections; 200mm/2.8 ISO 100): https://kitor.pl/eos_r/img/r_tamron_example.jpg
This is how this combo looks:
(https://kitor.pl/eos_r/img/r_tamron.jpg)

As for missing control ring on EF lenses, I'm using back-button focus, thus I have exposure lock on half-shutter. So i set exp-lock button + upper dial as ISO change. Works much better than fighting with touch bar and saves a lot of money on adapter with control ring.
Title: Re: Canon EOS R / RP : new FIR version
Post by: kitor on May 04, 2019, 02:39:32 PM
Quote from: Indy on May 04, 2019, 01:20:19 PMAs soon as debugging EOS R or RP will be possible within QEmu, I'll continue my investigations started with Alex. He owns holidays after giving years of time to ML.

https://www.magiclantern.fm/forum/index.php?topic=2864.msg215604#msg215604
Quote from: a1ex on April 23, 2019, 04:39:43 PM
There is a patch for M50 here (https://www.magiclantern.fm/forum/index.php?topic=23296.msg210088#msg210088); IIRC it worked on R with minimal changes. Will clean them up for committing, but I think it will happen after bringing the current state into mainline.

I'm not competent enough to do those 'minimal changes' myself unfortunately, at least not without any hints where to look.
Title: Re: Canon EOS R / RP
Post by: oc_masta on May 05, 2019, 06:29:29 PM
Can someone with far more intelligence than me, explain the high level concept of what needs doing and how it works.

Is it a hunt for the memory addresses than respond to the things we need. LED at address xxxxxxx, memory for sensor data at xxxxxx ??

I'm genuinely very curious and would love to learn more if someone can break it down just a little.
Cool Stuff!
Title: Re: Canon EOS R / RP
Post by: kitor on May 05, 2019, 07:26:20 PM
Up to now, mostly like you described.
QuoteIs it a hunt for the memory addresses than respond to the things we need. LED at address xxxxxxx, memory for sensor data at xxxxxx ??

But not only for hardware memory addresses, but also for location of needed DryOS functions that we need to call. In 'normal' programming you just include headers for some library and use it. Here you need to find that stuff in disassembled ROM first, understand how it works, what parameters it can take (and thus how to call it). This is already mostly done with previous cameras, so you just need to find proper memory location that holds your needed function. Later also find how to 'hook' into Canon tasks to get data from them, etc.

And DryOS (and low level stuff - new Digic processors) changes with time. That's why Alex did 'fishy' M50 port that allows ML menu access, but it breaks things for older devices so he decided not to push code until he sorts this out.
Title: Re: Canon EOS R / RP
Post by: sast on May 18, 2019, 08:52:46 PM
Hello,
is there somebody, who is still working on ML for Canon EOS R?  >:(

Before I was using ML on the Canon 5D III. ML gave me an perfectin handling of the camera.
I don't now how to do all the things on the EOS R without ML (f. e. Intervalometer, Motion detection, the modules). 

Best regards from Germany
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on May 18, 2019, 09:10:34 PM
It's mantra time again ...

If there is no ML for your cam act like there will be no ML for your cam ever.
Title: Re: Canon EOS R / RP
Post by: kitor on May 18, 2019, 11:17:17 PM
Quote from: sast on May 18, 2019, 08:52:46 PM
Hello,
is there somebody, who is still working on ML for Canon EOS R?  >:(

Refer to this (https://www.magiclantern.fm/forum/index.php?topic=19737.msg216007#msg216007). No posts = no news.

Quotef. e. Intervalometer, Motion detection,
So we have something in common (had to bring notebook with me last time I suddenly needed intervalometer). However I risked a lot to my camera (as seen in this thread) to at least try to make it happen.
Title: Re: Canon EOS R / RP
Post by: sast on May 24, 2019, 07:06:44 PM
Hello kitor,
thanx for your work to make it happen.
Everyday I take a look in this forum to see the development.
Best regards from Germany
Title: Re: Canon EOS R / RP
Post by: DaGentooBoy on June 25, 2019, 03:38:39 PM
I have been using/watching ML for years on several different cameras. I love the flexibility that ML provides and I am really excited about the 4k options that ML has brought to the newer cameras.

I recently upgraded to an EOS R and I was trying to find the version of QEMU that works with the R as well as the current progress mapping functions. I have a background in embedded programming and hardware design. If someone can help me get caught up I can try to lend a hand.
Title: Re: Canon EOS R / RP
Post by: johannjr2 on July 13, 2019, 04:05:16 PM
Is there a patreon page where we can support the development of certain cameras like the EOS R/ RP or even 5d mark IV (any newer canon with dual pixel autofocus). Thanks in advance!
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on July 14, 2019, 08:07:56 PM
No
Title: Re: Canon EOS R / RP
Post by: sast on July 16, 2019, 10:14:25 PM
Warum so eine unfreundliche Antwort auf eine gute Frage?
Title: Re: Canon EOS R / RP
Post by: kitor on July 17, 2019, 07:45:04 AM
Quote from: sast on July 16, 2019, 10:14:25 PM
Warum so eine unfreundliche Antwort auf eine gute Frage?
Która odpowiedź jest niegrzeczna?*

English, please.  ::)

Sorry, had to.
Title: Re: Canon EOS R / RP
Post by: reddeercity on July 17, 2019, 07:56:00 AM
Quote from: sast on July 16, 2019, 10:14:25 PM
Warum so eine unfreundliche Antwort auf eine gute Frage?
Google say it's German -  the translation  "why such a rude answer to a good question"
not sue what there are referring to thou
Title: Re: Canon EOS R / RP
Post by: kitor on July 17, 2019, 09:18:35 AM
Thats why I asked my question - in Polish :) (I understand German enough for his post)
For 'when' question (https://www.magiclantern.fm/forum/index.php?topic=23927.0) no wonder answer was rude. For donations, it was short but not rude.
Maybe it's better to remove those posts asking for dates, instead of replying like this every time...
Title: Re: Canon EOS R / RP
Post by: Ant123 on July 17, 2019, 12:14:00 PM
2 Walter Schulz and other moderators

Why don't you oblige new users to read the FAQ before they can post? And then delete dumb messages / ban them.
There is no advertising on this forum. So why do we need to see their useless posts?
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on July 17, 2019, 08:51:18 PM
First: I'm not a moderator (and have no intention to be one, better for the forum and me).

I cannot imagine a foolproof system to avoid such messages. You will always have an amount of people not reading FAQs or unable to grab the concepts of ML development or just feeling entitled (list not complete) or really, really believing they are helping. And such issues are not exclusive to newbies.

Noise by such users is bearable IMO. In "slow" forum times like this it may appear like an increase. No need for drastic measures (again: IMO).
Title: Re: Canon EOS R / RP
Post by: vlasena on August 05, 2019, 11:24:20 AM
Also would love to see ML for EOS R. Any info on signature and decryption of these cameras?

Thanks!
Title: Re: Canon EOS R / RP
Post by: 71m363nd3r on August 07, 2019, 12:00:07 AM
Quote from: vlasena on August 05, 2019, 11:24:20 AM
Also would love to see ML for EOS R. Any info on signature and decryption of these cameras?

Thanks!

How much bucks would you donate for ML contribution for EOS R?
Title: Re: Canon EOS R / RP
Post by: sast on August 13, 2019, 06:31:19 AM
150 € - 200 €
Title: Re: Canon EOS R / RP
Post by: jga on August 16, 2019, 05:21:48 PM
Quote from: sast on August 13, 2019, 06:31:19 AM
150 € - 200 €

Me too.
Title: Re: Canon EOS R / RP
Post by: 71m363nd3r on August 17, 2019, 08:34:06 PM
Quote from: sast on August 13, 2019, 06:31:19 AM
150 € - 200 €
Quote from: jga on August 16, 2019, 05:21:48 PM
Me too.

You can start with 50€ the link is here https://magiclantern.fm/donate.html
when you see progress you can pay another 50€
And when is finally out you can use it first, before others by donating the rest.
And now show it that you meant it for real with donating.
Title: Re: Canon EOS R / RP
Post by: Travis on August 20, 2019, 11:44:17 PM
It would be absolutely incredible ML came to the RP. It'd be a game changer in terms of price / performance for a full frame. They seem very protective of their cinema line though.

Too bad you can't fork the firmware and charge money for it without running into issues
Title: Re: Canon EOS R / RP
Post by: kitor on August 23, 2019, 12:12:22 PM
R firmware 1.3: https://www.canon.co.uk/support/consumer_products/products/cameras/digital_slr/eos-r.html?type=firmware
QuoteFirmware Version 1.3.0 incorporates the following enhancement:
1. Support for the RF24-240mm F4-6.3 IS USM lens has been added.

RP firmware 1.2: https://www.canon.co.uk/support/consumer_products/products/cameras/digital_slr/eos-rp.html?type=firmware
QuoteFirmware Version 1.2.0 incorporates the following enhancement and fix:
1. Support for the RF24-240mm F4-6.3 IS USM lens has been added.
2. Corrects a phenomenon in which the top of some captured images may be dark during high-speed sync shooting with an external flash.

No mentions about fixes for recent vulnerabilities.
Title: Re: Canon EOS R / RP
Post by: Sapporo on August 24, 2019, 10:07:12 AM
Quote from: kitor on August 23, 2019, 12:12:22 PM
R firmware 1.3: https://www.canon.co.uk/support/consumer_products/products/cameras/digital_slr/eos-r.html?type=firmware
RP firmware 1.2: https://www.canon.co.uk/support/consumer_products/products/cameras/digital_slr/eos-rp.html?type=firmware
No mentions about fixes for recent vulnerabilities.
Not fixed. https://www.magiclantern.fm/forum/index.php?topic=24385.msg219582#msg219582
"EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier"
Title: Re: Canon EOS R / RP
Post by: kitor on August 24, 2019, 11:41:15 PM
This info was published before those firmware were even mentioned elsewhere, so I assumed it was an error.
But yes, that makes sense.
Title: Re: Canon EOS R / RP
Post by: Sapporo on August 25, 2019, 08:23:37 AM
Quote from: kitor on August 24, 2019, 11:41:15 PM
This info was published before those firmware were even mentioned elsewhere, so I assumed it was an error.
But yes, that makes sense.
CVE-2019-6001 published 6 August, firmware 1.3.0 published 7 August. 1.3.0 was already ready.
Title: Re: Canon EOS R / RP
Post by: DeafEyeJedi on September 01, 2019, 07:15:10 PM
Just a heads up... I currently have an EOS R kit in my hands. It's a loaner. Good thing this came with an adapter to go from R to EF mount.

Let me know if there's anything I can contribute while we're at it. Will probably have access to this for a week or so.

That 4K crop is a joke but doable w Tokina 11-20mm 2.8 from what I've seen so far. Such a weird animal though.  :o
Title: Re: Canon EOS R / RP
Post by: gtemp on October 01, 2019, 08:56:12 PM
Hi, I really only need one single feature from ML for the EOS R, and that's the ability to auto-restart video when it reaches the file size/time limit (30 mins, as I understand it.) Can ML currently allow this on the EOS R? My 5DMkII can do this with ML, and I'd love to upgrade but I need continuous video without having to return to the camera. Multiple files is A-OK. Any insight appreciated!
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on October 04, 2019, 08:15:09 AM
Get yourself a cam suitable for your needs.
Title: Re: Canon EOS R / RP
Post by: kitor on October 04, 2019, 11:57:30 AM
QuoteCan ML currently allow this on the EOS R?

Is ML for R mentioned anywhere?

I need to upgrade (and dump) 1.3 and 1.4 and hopefully update stubs for 1.4. Yup, I'm still on 1.2.
Title: Re: Canon EOS R / RP
Post by: vlasena on November 09, 2019, 11:45:12 PM
Quote from: 71m363nd3r on August 07, 2019, 12:00:07 AM
How much bucks would you donate for ML contribution for EOS R?
100 bucks
Title: Re: Canon EOS R / RP
Post by: kotik on November 21, 2019, 04:21:00 PM
Quote from: gtemp on October 01, 2019, 08:56:12 PM
Hi, I really only need one single feature from ML for the EOS R, and that's the ability to auto-restart video when it reaches the file size/time limit (30 mins, as I understand it.) Can ML currently allow this on the EOS R? My 5DMkII can do this with ML, and I'd love to upgrade but I need continuous video without having to return to the camera. Multiple files is A-OK. Any insight appreciated!

With an external recorder like the Atoms Ninja V, you can do 10-bit continues recording through the HDMI output port.
Title: Re: Canon EOS R
Post by: Ireversible on December 05, 2019, 02:53:52 PM
Quote from: a1ex on October 16, 2018, 08:48:32 PM
Tried to run some initial tests on the EOS R; unfortunately, this is all we've got:

(https://a1ex.magiclantern.fm/bleeding-edge/R/r.jpg)

The error screen looks just like on previous models, which is encouraging. The camera recognized there was a FIR file on the card, for the correct model, otherwise it would have printed "Update file cannot be found". The error message means it could not verify the checksum; Canon might have changed the FIR file format, or maybe also the encryption.




Edit: progress - apparently it doesn't like tiny FIR files, but otherwise it accepts them:

(https://a1ex.magiclantern.fm/bleeding-edge/R/progres.jpg)

Edit (February 2019): turns out it was just the decryption code locking up with some FIR files.
Encryption changed - we can no longer create FIR files for this camera.

Hi
I just bought a Canon R and I hope in the future to install a magic lantern firmware on it, but what wrote A1ex is not very encouraging...Is there still hope or will we never see ML on canon r?
Thanks

Title: Re: Canon EOS R / RP
Post by: Mariiiik on December 05, 2019, 06:38:30 PM
Is it possible to create another way of donations besides bitcoin? It may be to make a separate account for the team that is working on EOS R, it seems to me that this will greatly accelerate the collection of donations. Sorry for my english
Title: Re: Canon EOS R / RP
Post by: DoctorJones on December 08, 2019, 11:00:08 AM
I know it's a faux pas asking annoying questions about ML release features, so firstly; thank you so much to all ML developers. If I ever get the pleasure of using ML on one of my cameras I will certainly donate anything I can.

Does anyone know if ML for EOS R is expected to enable 10bit recording in 1080p over HDMI? I love the look of 10bit in C-log, but I don't have the hardware for 4K.
Title: Re: Canon EOS R / RP
Post by: kitor on December 16, 2019, 06:23:04 PM
Quote from: DoctorJones on December 08, 2019, 11:00:08 AM
Does anyone know if ML for EOS R is expected to enable 10bit recording in 1080p over HDMI? I love the look of 10bit in C-log, but I don't have the hardware for 4K.

ML for R (or anything Digic 7+ (https://www.magiclantern.fm/forum/index.php?topic=19737.275)) is not expected to exist any time soon (https://www.magiclantern.fm/forum/index.php?topic=22770.msg216715#msg216715), and you're asking about specific features...

So far we have only proven that it's possible to run custom code.
I guess @a1ex that  "Magic lantern rescue" is misleading and should be replaced with another name for early development ports. Just a string swap may keep people a little less excited.
Title: Re: Canon EOS R / RP
Post by: IDA_ML on December 16, 2019, 07:31:17 PM
Quote from: DoctorJones on December 08, 2019, 11:00:08 AM
If I ever get the pleasure of using ML on one of my cameras ...

Indeed, ML is a lot of pleasure and fun to use.  If you don't have a camera that supports it, please don't wait forever.  Just consider spending 100-200 US$ for a used EOS-M or 100D body.  Both cameras are ML capable and work miracles with the entire lens arsenal of Canon and with almost any lens that you can imagine using cheap adapters.  Soon you will realize that these are the best 100-200 $ that you have spent in your life.  Good luck!     
Title: Re: Canon EOS R / RP
Post by: Lbs26 on February 25, 2020, 02:06:29 PM
Hi to all,i am new in this forum...i wanted to ask a question about Canon Eos R - banding stripes problems.
I have Eos R with the latest 1.6 firmware update,the banding is fixed in the faster shutter speeds at 100%,but in the longer shutter speeds it is till a big issue....
it occurs from 2-3 sec above in the darkest underexposed shadows,where in the shoter shutter speed even if i bring the exposure in post to +5 stops there is no banding.
Title: Re: Canon EOS R / RP
Post by: jo.meatloaf on March 15, 2020, 06:07:00 PM
Такая же проблема и на моем m6 mk ii. Похоже что жто проблема прошивки
Title: Re: Canon EOS R / RP
Post by: kitor on May 08, 2020, 12:15:11 PM
https://www.canonrumors.com/canon-announces-100-firmware-update-for-stop-motion-photography/

Wow, $100 for increase in LV resolution. With no HDMI output, and no focus peaking in many scenarios, so camera is basically useless for other things than stop-motion.
Title: Re: Canon EOS R / RP
Post by: coon on August 13, 2020, 11:10:31 PM
Hi,
I just got an EOS RP as my first camera recently. After watching some youtube videos about photography I've found out about magic lantern as a way to hack canon cameras. I have some experience with embedded software development (Arduino / AVR and STM32F4 / ARM) and I've also some knowledge about reverse engineering (x86/x64 on Windows). I've good knowledge in C / C++.

With the help of names_are_hard on discord I am already able to compile ML and qemu for the 50D, which meight help me getting familiar with ML development. Luckily a friend of mine has a 50D laying around which I can use for playing around, since he has a newer camera and doesn't need it right now.

Is there a way I can help? Is it possible to dump the firmware of the RP so I can take a look with Ghidra on it?
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on August 16, 2020, 10:12:12 PM
Canon changed encryption/signature in RP. There is no Portable ROM Dumper (https://www.magiclantern.fm/forum/index.php?topic=16534.0) available ATM.
See https://www.magiclantern.fm/forum/index.php?topic=22770.msg215961#msg215961

Looks a little bit hackish: https://twitter.com/autoexec_bin/status/1095731428388716546
Title: Re: Canon EOS R / RP
Post by: a1ex on August 17, 2020, 11:29:41 AM
Actually, the portable ROM dumper (autoexec.bin version) worked on EOS R, but only after enabling the boot flag via UART.
Title: Re: Canon EOS R / RP
Post by: kitor on September 01, 2020, 11:05:46 PM
(https://i.imgur.com/5RvCuUd.png)

Nothing to be excited about, just (finally) upgraded from 1.2.0 to 1.7.0 and checked that bootflag is still there, and dumper still works.
I have no plans for updating stubs in near future, as I tend to take to many projects at once.
Title: Re: Canon EOS R / RP
Post by: kitor on September 02, 2020, 10:28:19 AM
Cross-post from R5/R6 thread:

Quote from: kitor on September 02, 2020, 10:16:34 AM
Canon basic dumper works on R! Not sure if without bootflag enabled too.

I created the files with Unix line endings (LF only). I made card by using EOScard, with only option "script" selected.
Both files (extend.m and script.req) you can download here: https://kitor.pl/eos_r/cbasic_dumper.zip

Of course credits for dumper goes to @srsa as I took his code directly from this post (https://www.magiclantern.fm/forum/index.php?topic=23296.msg227190#msg227190)

After I put card into camera, I went into playback mode, pressed Q/Set button and red light turned on. A minute later it was done, ROM.txt was saved to card root!
Title: Re: Canon EOS R / RP
Post by: coon on September 04, 2020, 06:07:17 PM
I can confirm that the Canon Basic dumper also works on the EOS RP.

ROM size is 32MB. Dumping takes about ~2 hours and 15 minutes so you better have your battery charged before dumping :).
You don't have to set the bootflag for that so this can be done without opening the case at all.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on September 04, 2020, 06:20:53 PM
Coon, can you retry with the code supplied by srsa? And compare time required?
https://www.magiclantern.fm/forum/index.php?topic=25305.msg230434#msg230434
Title: Re: Canon EOS R / RP
Post by: coon on September 04, 2020, 06:32:15 PM
Just tried that. It also worked out of the box and only took about 10 seconds.

Got two files: gang100.bin and gang200.bin which both have a size of 32MB.
This dump looks more reliable so this is the way to go I guess :)
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on September 04, 2020, 06:34:59 PM
Thanks! This is really fast!
Title: Re: Canon EOS R / RP
Post by: coon on September 05, 2020, 11:11:59 AM
I can also confirm that enabling the bootflag via


private sub Initialize()
  EnableBootDisk()
end sub


does work aswell.

I've tried booting the portable ROM dumper (https://www.magiclantern.fm/forum/index.php?topic=16534.0) on the RP.
As soon as I close the battery lid, it loads in a glitchy way and crashes or aborts with an error message, since there is some text written in red.

https://www.youtube.com/watch?v=IZB5uWNAREI
Title: Re: Canon EOS R / RP
Post by: coon on September 05, 2020, 01:35:25 PM
After I've done some little adjustments in the display source code of the portable dumper, I am now able to see a clear picture :).

(https://i.imgur.com/Vm45eFr.jpg)

LCD of EOS RP has a resolution of 736x480. Next step is finding the stubs in the firmware.
Title: Re: Canon EOS R / RP
Post by: yourboylloyd on September 05, 2020, 07:21:45 PM
Quote from: coon on September 05, 2020, 01:35:25 PM
After I've done some little adjustments in the display source code of the portable dumper...

Can you create an image of the card? Or share the autoexec.bin file?

Nevermind. That won't do anything for me.
Title: Re: Canon EOS R / RP
Post by: coon on September 05, 2020, 08:49:26 PM
I could upload my autoexec.bin but the code it is based on is a bit behind. Better wait until a1ex merges it into the official build.
It doesen't do anything useful anyways beside displaying the error message more nicely on the RP :).
Title: Re: Canon EOS R / RP
Post by: coon on September 07, 2020, 01:01:51 AM
names_are_hard and I did some first research on the RP. With his help I am now able to run its firmware in QEMU partially.

I've added the RP into models_list.c file of qemu by just copying 200D definitions and renaming to EOSRP. I've also added a EOSRP rom folder and renamed gang100.bin -> ROM0.BIN, gang200.bin -> ROM1.BIN.
Then started emulation with:

./run_canon_fw.sh EOSRP,firmware="boot=0" -d romcpy

It runs but locks up early.

QEMU log:


00000000 - 1FFFFFFF: eos.ram
40000000 - 5FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F0FFFFFF: eos.rom1
F1000000 - F1FFFFFF: eos.rom1_mirror
F2000000 - F2FFFFFF: eos.rom1_mirror
F3000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F4FFFFFF: eos.rom1_mirror
F5000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F6FFFFFF: eos.rom1_mirror
F7000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F8FFFFFF: eos.rom1_mirror
F9000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FAFFFFFF: eos.rom1_mirror
FB000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FCFFFFFF: eos.rom1_mirror
FD000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FEFFFFFF: eos.rom1_mirror
FF000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] enabling memory access logging (RW).
[EOS] loading './EOSRP/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './EOSRP/ROM1.BIN' (expected size 0x01000000, got 0x02000000) to 0xF0000000-0xF0FFFFFF
[MPU] FIXME: using generic MPU spells for EOSRP.
[MPU] FIXME: no MPU button codes for EOSRP.
Start address: 0xE0000000
Setting BOOTDISK flag to FFFFFFFF
[CPU0] E0008450: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0008460: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E000848C: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0008482: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E000848C: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B62: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B62: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU0] E0004B62: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[ROMCPY] 0xE0008634 -> 0xDF001000 size 0x600      at 0xE000699C
Logging ROM-copied blocks to EOSRP/romcpy.sh.

[CPU0] E00084D8: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004B86: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU0] E0004C50: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] E0004B86: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B96: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0004AE2: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU0] E0004AEA: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004800
[CPU0] E0004AEE: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU0] E0004AF2: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x0       
[CPU0] E0004AF6: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU0] E0004AFE: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU0] E0004B06: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B06: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU0] E0008546: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU0] E0008546: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0008546: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU0] E000855E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU0] E000855E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU0] E000856A: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU0] E000856A: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45     
[CPU0] E000856A: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU0] E000856A: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU0] E000858A: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU0] E000858A: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000 
[CPU0] E0004900: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E00049A6: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xDF000000
[ROMCPY] 0xE0008C34 -> 0xDF000000 size 0x100      at 0xE0004966
BootL[ROMCPY] 0xE0008D50 -> 0x40100000 size 0x116D4    at 0xE0007F4C
[ROMCPY] 0xE0000000 -> 0x40700000 size 0x4900     at 0x10F46C 


romcpy.sh contains:


dd if=ROM0.BIN of=EOSRP.0xDF001000.bin bs=1 skip=$((0x8634)) count=$((0x600))
dd if=ROM0.BIN of=EOSRP.0xDF000000.bin bs=1 skip=$((0x8C34)) count=$((0x100))
dd if=ROM0.BIN of=EOSRP.0x40100000.bin bs=1 skip=$((0x8D50)) count=$((0x116D4))
dd if=ROM0.BIN of=EOSRP.0x40700000.bin bs=1 skip=$((0x0)) count=$((0x4900))


But it seems to be incomplete. Boot process seems to lock up here.
When running QEMU like this:

./run_canon_fw.sh EOSRP,firmware="boot=1"

I will get the following message in red color before it locks up:


BootLoadCard Read Error!!!
e

Title: Re: Canon EOS R / RP
Post by: coon on September 07, 2020, 08:45:48 PM
I've applied the M50 DIGIC8 QEMU draft patch by alex (https://www.magiclantern.fm/forum/index.php?topic=23296.msg210088#msg210088) and used the M50 instead of 200D as a template for the RP.
It immediately crashed on the first try with the following error:


qemu-system-arm: /home/nimble-test/ML/qemu-eos/qemu-2.5.0/hw/arm/../eos/eos.c:2568: eos_handle_card_led: Assertion `s->card_led' failed.


After changing the RPs LED Address in model_list.c from M50 to 200D it is now booting even further. It is now booting the second core of the CPU and locks up a little bit later then before:


00000000 - 3FFFFFFF: eos.ram
40000000 - 7FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F1FFFFFF: eos.rom1
F2000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] enabling memory access logging (RW).
[EOS] loading './EOSRP/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './EOSRP/ROM1.BIN' to 0xF0000000-0xF1FFFFFF
[MPU] FIXME: using generic MPU spells for EOSRP.
[MPU] FIXME: no MPU button codes for EOSRP.
Start address: 0xE0000000
Setting BOOTDISK flag to 0
[CPU0] E0008450: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0008460: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E000848C: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0008482: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E000848C: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B62: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B62: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU0] E0004B62: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[ROMCPY] 0xE0008634 -> 0xDF001000 size 0x600      at 0xE000699C
Logging ROM-copied blocks to EOSRP/romcpy.sh.

[CPU0] E00084D8: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004B86: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU0] E0004C50: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] E0004B86: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B96: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0004AE2: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU0] E0004AEA: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004800
[CPU0] E0004AEE: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU0] E0004AF2: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x0       
[CPU0] E0004AF6: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU0] E0004AFE: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU0] E0004B06: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B06: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU0] E0008546: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU0] E0008546: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0008546: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU0] E000855E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU0] E000855E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU0] E000856A: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU0] E000856A: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU0] E000856A: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU0] E000856A: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU0] E000858A: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU0] E000858A: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU0] E0004900: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E00049A6: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xDF000000
[ROMCPY] 0xE0008C34 -> 0xDF000000 size 0x100      at 0xE0004966
BootL[ROMCPY] 0xE0008D50 -> 0x40100000 size 0x116D4    at 0xE0007F4C
[ROMCPY] 0xE0000000 -> 0x40700000 size 0x4900     at 0x10F46C 
oade[CPU0] 001008F6: MCR p15, ...          : CACHEMAINT x584 (omitted)
[CPU0] E0040000: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE073A000
[CPU0] E004000A: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
Wake up CPU1
Wake up CPU1
[ROMCPY] 0xE12F43EC -> 0x4000     size 0x247CC    at 0xE004003C
[CPU1] E0008450: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000001
[CPU1] E0008460: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU1] E000848C: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU1] E0008482: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E000848C: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004B62: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004B62: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU1] E0004B62: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878
[CPU1] E0004B86: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU1] E0004C40: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU1] E0004B86: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU1] E0004B96: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0004AE2: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU1] E0004AEA: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004880
[CPU1] E0004AEE: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU1] E0004AF2: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x1       
[CPU1] E0004AF6: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU1] E0004AFE: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU1] E0004B06: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU1] E0004B06: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU1] E0008546: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU1] E0008546: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU1] E0008546: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU1] E000855E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU1] E000855E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU1] E000856A: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU1] E000856A: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU1] E000856A: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU1] E000856A: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU1] E000858A: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU1] E000858A: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU1] E0004AA2: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C5187D
[CPU1] E0004AA2: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5107D
[ROMCPY] 0xE1318BB8 -> 0x223B000  size 0xD1748    at 0xE0040050
[CPU0] E0040104: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[ROMCPY] 0xE13EA300 -> 0xDF002800 size 0xB94      at 0xE0040088
K433 READY
        4:4294966.271 [EEP] InstEEP: Rng_MDS(0x0 != 0x8000)
        5:4294966.271 [EEP] InstEEP: Srvc_MDS(0x0 != 0x100)
        8:4294966.271 [EEP] Rng_EEPH_RDS Invalid:0x0
        9:4294966.271 [EEP] Srvc_EEPH_RDS Invalid:0x0
       12:4294966.271 [STARTUP] K433 ICU Firmware Version 1.5.0 ( 3.8.7 )


romcpy does now generate a few more address:


dd if=ROM0.BIN of=EOSRP.0xDF001000.bin bs=1 skip=$((0x8634)) count=$((0x600))
dd if=ROM0.BIN of=EOSRP.0xDF000000.bin bs=1 skip=$((0x8C34)) count=$((0x100))
dd if=ROM0.BIN of=EOSRP.0x40100000.bin bs=1 skip=$((0x8D50)) count=$((0x116D4))
dd if=ROM0.BIN of=EOSRP.0x40700000.bin bs=1 skip=$((0x0)) count=$((0x4900))
dd if=ROM0.BIN of=EOSRP.0x4000.bin bs=1 skip=$((0x12F43EC)) count=$((0x247CC))
dd if=ROM0.BIN of=EOSRP.0x223B000.bin bs=1 skip=$((0x1318BB8)) count=$((0xD1748))
dd if=ROM0.BIN of=EOSRP.0xDF002800.bin bs=1 skip=$((0x13EA300)) count=$((0xB94))


This is my current EOSRP definition in models_list.c:


{
        .name                   = "EOSRP",
        .digic_version          = 8,
        .ram_size               = 0x40000000,   /* 1GB */
        .card_led_address       = 0xD208016C,   // 200D /* WLAN LED 0xD2080190 */
        .current_task_addr      = 0x28,         /* fixme: read from virtual memory */
        .uart_rx_interrupt      = 0x15D,
        .uart_tx_interrupt      = 0x16D,
        .rom0_size              = 0x02000000,   /* 32MB (main ROM) */
        .rom1_size              = 0x02000000,   /* 32MB (secondary ROM) */
        .dedicated_movie_mode   = 0, // camera has support for it. Set to 1 later.
    },
Title: Re: Canon EOS R / RP
Post by: coon on September 07, 2020, 10:39:27 PM
Not sure if it helps, but when executing qemu with firmware="boot=1" with a bootflag enabled sd card image with Magic Lantern on it, I get some SDIO errors and I can see that it is trying to execute AUTOEXEC.BIN before it locks up:


00000000 - 3FFFFFFF: eos.ram
40000000 - 7FFFFFFF: eos.ram_uncached
DF000000 - DFFFFFFF: eos.ram_extra
E0000000 - E1FFFFFF: eos.rom0
E2000000 - E3FFFFFF: eos.rom0_mirror
E4000000 - E5FFFFFF: eos.rom0_mirror
E6000000 - E7FFFFFF: eos.rom0_mirror
E8000000 - E9FFFFFF: eos.rom0_mirror
EA000000 - EBFFFFFF: eos.rom0_mirror
EC000000 - EDFFFFFF: eos.rom0_mirror
EE000000 - EFFFFFFF: eos.rom0_mirror
F0000000 - F1FFFFFF: eos.rom1
F2000000 - F3FFFFFF: eos.rom1_mirror
F4000000 - F5FFFFFF: eos.rom1_mirror
F6000000 - F7FFFFFF: eos.rom1_mirror
F8000000 - F9FFFFFF: eos.rom1_mirror
FA000000 - FBFFFFFF: eos.rom1_mirror
FC000000 - FDFFFFFF: eos.rom1_mirror
FE000000 - FFFFFFFF: eos.rom1_mirror
BFE00000 - DEFFFFFF: eos.mmio
[EOS] loading './EOSRP/ROM0.BIN' to 0xE0000000-0xE1FFFFFF
[EOS] loading './EOSRP/ROM1.BIN' to 0xF0000000-0xF1FFFFFF
[MPU] FIXME: using generic MPU spells for EOSRP.
[MPU] FIXME: no MPU button codes for EOSRP.
Start address: 0xE0000000
Setting BOOTDISK flag to FFFFFFFF
[CPU0] E0008450: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0008460: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xE000001D
[CPU0] E000848C: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x8C50078
[CPU0] E0008482: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E000848C: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B62: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B62: MCR p15, ...          : CACHEMAINT x2 (omitted)
[CPU0] E0004B62: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51878

[CPU0] E00084D8: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E0004B86: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51878
[CPU0] E0004C50: MCR p15, ...          : CACHEMAINT x512 (omitted)
[CPU0] E0004B86: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50878
[CPU0] E0004B96: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0004AE2: MCR p15,0,Rd,cr3,cr0,0:       DACR <- 0x55555555
[CPU0] E0004AEA: MCR p15,0,Rd,cr2,cr0,0:  TTBR0_EL1 <- 0xE0004800
[CPU0] E0004AEE: MCR p15,0,Rd,cr2,cr0,1:  TTBR1_EL1 <- 0xE0000080
[CPU0] E0004AF2: MCR p15,0,Rd,cr13,cr0,1: CONTEXTIDR(S) <- 0x0       
[CPU0] E0004AF6: MCR p15,0,Rd,cr2,cr0,2:      TTBCR <- 0x7       
[CPU0] E0004AFE: MCR p15,0,Rd,cr8,cr7,0:    TLBIALL <- 0x0       
[CPU0] E0004B06: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50878
[CPU0] E0004B06: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C50879
[CPU0] E0008546: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C50879
[CPU0] E0008546: MCR p15, ...          : CACHEMAINT x1 (omitted)
[CPU0] E0008546: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C51879
[CPU0] E000855E: MRC p15,0,Rd,cr1,cr0,0:      SCTLR -> 0x48C51879
[CPU0] E000855E: MCR p15,0,Rd,cr1,cr0,0:      SCTLR <- 0x48C5187D
[CPU0] E000856A: MRC p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 -> 0x45
[CPU0] E000856A: MCR p15,0,Rd,cr1,cr0,1:  ACTLR_EL1 <- 0x45       
[CPU0] E000856A: MRC p15,0,Rd,cr15,cr0,0:  A9_PWRCTL -> 0x0
[CPU0] E000856A: MCR p15,0,Rd,cr15,cr0,0:  A9_PWRCTL <- 0x1       
[CPU0] E000858A: MRC p15,0,Rd,cr15,cr0,1:    A9_DIAG -> 0x0
[CPU0] E000858A: MCR p15,0,Rd,cr15,cr0,1:    A9_DIAG <- 0x400000   
[CPU0] E0004900: MRC p15,0,Rd,cr0,cr0,5:      MPIDR -> 0x80000000
[CPU0] E00049A6: MCR p15,0,Rd,cr12,cr0,0:       VBAR <- 0xDF000000
BootLoad[SDIO] Error
[SDIO] Error
Now jump to AUTOEXEC.BIN(0x00800000)!!


I think I am now at a point where I have to dive deeper into how the initialization process works and how to find out the proper device addresses / RAM size etc. to get even further on the boot process.
Title: Re: Canon EOS R / RP
Post by: aprofiti on September 08, 2020, 04:26:30 PM
I suggest you to start reading posts from Digic 7 (https://www.magiclantern.fm/forum/index.php?topic=19737.0) development thread, it has very useful information on how progress was made by other users to make digic6-dumper branch to work on D7 cameras and will help you to have an idea on what to do to start porting ML for EOS RP.

Starting from here (https://www.magiclantern.fm/forum/index.php?topic=19737.msg206736#msg206736) there are some of my previous posts of me understanding how to port code to 77D using only emulator as I don't have a real camera, also looks for posts from calle2010 who kept progressing the work.

After that you will like to print an Hello World on EOS RP and share a picture!

Quote from: coon on September 07, 2020, 10:39:27 PM
I think I am now at a point where I have to dive deeper into how the initialization process works and how to find out the proper device addresses / RAM size etc. to get even further on the boot process.
Does the emulation looks like it keep running or instead it hangs up?

You can also try to improve emulation for Digic X camera to have Canon GUI to render and navigate from QEMU, here you would certainly like some hints from a1ex to address you into the right direction :)
Title: Re: Canon EOS R / RP
Post by: coon on September 08, 2020, 08:01:41 PM
Will check the Digic 7 thread out, thanks for that advice!
Actually I am already able to print hello world on the physical RP since ML recovery already boots. It just doesen't run in the emulator yet.

QEMU doesn't segfault but seems to wait for something after it has passed the bootloader and gets stuck when executing the actual firmware:

(https://i.ibb.co/RNVysmJ/qemu-ml.png) (https://i.ibb.co/RNVysmJ/qemu-ml.png)

Maybe I should do a dump of both UART interfaces of the physical RP to have an idea what should happen next. But for that I need a 0.4mm 8pin FPC cable first. It is like impossible getting such... At least in an affordable way. :/.
Title: Re: Canon EOS R / RP
Post by: coon on September 09, 2020, 09:30:31 PM
Just found out that AUTOEXEC.BIN is actually executed and Magic Lantern Rescue code does already run on RP firmware within QEMU.
Emulated display does work, which meight help in finding stubs. :)

(https://i.ibb.co/gj9dn4G/rp-qemu.png) (https://i.ibb.co/gj9dn4G/rp-qemu.png)

A first milestone I want to achieve is getting the portable dumper running. Even if technically not necessary due to the possibility of dumping via canon basic it will give me some practice in finding stubs hopefully.
After that I'll try getting the cpuinfo code running, do a dump of it on the real hardware and post its output here.
Title: Re: Canon EOS R / RP
Post by: srsa on September 09, 2020, 10:26:16 PM
Quote from: coon on September 09, 2020, 09:30:31 PM
After that I'll try getting the cpuinfo code running, do a dump of it on the real hardware and post its output here.
If you do that, please use the updated code from CHDK svn. The old Cortex R4 specific code is not very useful on Cortex A9.
Title: Re: Canon EOS R / RP
Post by: nikfreak on September 09, 2020, 10:30:02 PM
some auto-method to find / extract stubs would be handy now
Title: Re: Canon EOS R / RP
Post by: coon on September 09, 2020, 11:05:22 PM
Quote from: srsa on September 09, 2020, 10:26:16 PM
If you do that, please use the updated code from CHDK svn. The old Cortex R4 specific code is not very useful on Cortex A9.

Good to know, I will do that, thx!

Quote from: nikfreak on September 09, 2020, 10:30:02 PM
some auto-method to find / extract stubs would be handy now

Back in the days when I have written some Gametrainers I have used a simple pattern matching algorithm for an almost game version independent way to apply a code injection to a specific code location. Maybe I can modify and use that for ML as an automated way to find stubs. However, the found stubs should always be reviewed by a developer before running them on real HW since pattern matching meight not always work 100% correct.
Title: Re: Canon EOS R / RP
Post by: names_are_hard on September 09, 2020, 11:19:33 PM
For automating stub hunting...  Ghidra has a Python scripting engine (well, Jython.  Or native Java).  That gives you access not just to the disassembly, but the decompiled forms.  I believe you can also access Ghidra's IL, Pcode.  So you can in theory do some pretty cool searches and comparisons.  You can do this from the CLI, you can spin up Ghidra without needing to start the frontend.
Title: Re: Canon EOS R / RP
Post by: coon on September 14, 2020, 07:55:28 PM
Got CPU info of RP dumped via Canon Basic Dumper script (https://www.magiclantern.fm/forum/index.php?topic=25305.msg230668#msg230668) and parsed via x86 port of CHDK cpuinfo tool (https://www.magiclantern.fm/forum/index.php?topic=25305.msg230850#msg230850):


ID         0x414FC091
  Revision             0x1 1
  Part                 0xC09 3081
  ARM Arch             0xF 15
  Variant              0x4 4
  Implementor          0x41 65
Cache type 0x83338003
  Icache min words/line 0x3 3 [8]
  (zero)               0x0 0
  L1 Icache policy     0x2 2
  Dcache min words/line 0x3 3 [8]
  Exclusives Reservation Granule 0x3 3 [8]
  Cache Writeback Granule 0x3 3 [8]
  (zero)               0x0 0
  (register format)    0x4 4
TCM type   0x00000000
  (raw value)          0x0 0
TLB type   0x00000404
  TLB                  0x0 0 [Unified TLB]
  TLB entries          0x2 2 [256]
  -                    0x0 0
  Lockable unified or data entries 0x4 4
  Lockable instruction entries 0x0 0
  (zero)               0x0 0
TTBCR      0x00000007
  N                    0x7 7 [TTBR0 table size 128 bytes]
  (zero)               0x0 0
  TTBR0 walks disabled 0x0 0
  TTBR1 walks disabled 0x0 0
  (zero)               0x0 0
  Long descriptors     0x0 0
TTBR0      0xE0004800
  IRGN[1]              0x0 0
  Shareable            0x0 0
  (impl. defined)      0x0 0
  RGN (Outer cacheability) 0x0 0
  NOS (Inner shareable) 0x0 0
  IRGN[0]              0x0 0
  Table address        0x1C00090 29360272 [0xe0004800]
TTBR1      0xE0000000
  IRGN[1]              0x0 0
  Shareable            0x0 0
  (impl. defined)      0x0 0
  RGN (Outer cacheability) 0x0 0
  NOS (Inner shareable) 0x0 0
  IRGN[0]              0x0 0
  Table address        0x1C00000 29360128 [0xe0000000]
Multiprocessor ID 0x80000000
  (raw value)          0x80000000 -2147483648
Revision ID 0x00000000
  (raw value)          0x0 0
Processor feature 0 0x00001231
  ARM inst set         0x1 1
  Thumb inst set       0x3 3
  Jazelle inst set     0x2 2
  ThumbEE inst set     0x1 1
  -                    0x0 0
Processor feature 1 0x00000011
  Programmers' model   0x1 1
  Security extensions  0x1 1
  Microcontr. prog model 0x0 0
  Virt. extensions     0x0 0
  Generic timer ext.   0x0 0
  -                    0x0 0
Debug feature 0x00010444
  Coproc. dbg model    0x4 4
  Coproc. secure dbg model 0x4 4
  Memory-mapped dbg model 0x4 4
  Coproc. trace model  0x0 0
  Memory-mapped trace model 0x1 1
  Debug model M        0x0 0
  Perf. monitors       0x0 0
  -                    0x0 0
Aux feature 0x00000000
  (raw value)          0x0 0
Mem model feature 0 0x00100103
  VMSA support         0x3 3
  PMSA support         0x0 0
  Cache coherence      0x1 1
  Outer shareable      0x0 0
  TCM support          0x0 0
  Auxiliary registers  0x1 1
  FCSE support         0x0 0
  -                    0x0 0
Mem model feature 1 0x20000000
  L1 Harvard cache VA  0x0 0
  L1 unified cache VA  0x0 0
  L1 Harvard cache s/w 0x0 0
  L1 unified cache s/w 0x0 0
  L1 Harvard cache     0x0 0
  L1 unified cache     0x0 0
  L1 cache test & clean 0x0 0
  Branch predictor     0x2 2
Mem model feature 2 0x01230000
  L1 Harvard fg prefetch 0x0 0
  L1 Harvard bg prefetch 0x0 0
  L1 Harvard range     0x0 0
  Harvard TLB          0x0 0
  Unified TLB          0x3 3
  Mem barrier          0x2 2
  WFI stall            0x1 1
  HW access flag       0x0 0
Mem model feature 3 0x00102111
  Cache maintain MVA   0x1 1 [Supported]
  Cache maintain set/way 0x1 1 [Supported]
  Branch predictor maintenance 0x1 1 [Invalidate all]
  Maintenance broadcast 0x2 2
  -                    0x0 0
  Transl. table coherent walk 0x1 1
  Cached memory size   0x0 0 [4 GByte]
  Supersection support 0x0 0 [Supported]
ISA feature 0 0x00101111
  Swap instrs          0x1 1
  Bitcount instrs      0x1 1
  Bitfield instrs      0x1 1
  CmpBranch instrs     0x1 1
  Coproc instrs        0x0 0
  Debug instrs         0x1 1
  Divide instrs        0x0 0
  -                    0x0 0
ISA feature 1 0x13112111
  Endian instrs        0x1 1
  Exception instrs     0x1 1
  Exception AR instrs  0x1 1
  Extend instrs        0x2 2
  IfThen instrs        0x1 1
  Immediate instrs     0x1 1
  Interwork instrs     0x3 3
  Jazelle instrs       0x1 1
ISA feature 2 0x21232041
  LoadStore instrs     0x1 1
  Memhint instrs       0x4 4
  MultiAccess Interruptible instructions 0x0 0
  Mult instrs          0x2 2
  MultS instrs         0x3 3
  MultU instrs         0x2 2
  PSR AR instrs        0x1 1
  Reversal instrs      0x2 2
ISA feature 3 0x11112131
  Saturate instrs      0x1 1
  SIMD instrs          0x3 3
  SVC instrs           0x1 1
  SynchPrim instrs     0x2 2
  TabBranch instrs     0x1 1
  ThumbCopy instrs     0x1 1
  TrueNOP instrs       0x1 1
  T2 Exec Env instrs   0x1 1
ISA feature 4 0x00011142
  Unprivileged instrs  0x2 2
  WithShifts instrs    0x4 4
  Writeback instrs     0x1 1
  SMC instrs           0x1 1
  Barrier instrs       0x1 1
  SynchPrim_instrs_frac 0x0 0
  PSR_M instrs         0x0 0
  -                    0x0 0
ISA feature 5 0x00000000
  -                    0x0 0
Cache level ID 0x09200003
  Cache type, level1   0x3 3 [Separate Icache, Dcache]
  Cache type, level2   0x0 0 [no cache]
  Cache type, level3   0x0 0 [no cache]
  Cache type, level4   0x0 0 [no cache]
  Cache type, level5   0x0 0 [no cache]
  Cache type, level6   0x0 0 [no cache]
  Cache type, level7   0x0 0 [no cache]
  Level of unification Inner Shareable 0x1 1
  Level of coherency   0x1 1
  Level of unification 0x1 1
  (zero)               0x0 0
Cache size ID reg (data, level0) 0x700FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x1 1
  Read allocation      0x1 1
  Write back           0x1 1
  Write through        0x0 0
Cache size ID reg (inst, level0) 0x200FE019
  Line size in words   0x1 1 [8]
  Associativity        0x3 3 [4]
  Number of sets       0x7F 127 [128]
  Write allocation     0x0 0
  Read allocation      0x1 1
  Write back           0x0 0
  Write through        0x0 0
SCTLR      0x40C5187D
  MMU Enable           0x1 1
  Strict Align         0x0 0
  Data or Unified Cache Enable 0x1 1
  CP15 Barrier Enable  0x1 1
  - (SBO)              0x7 7
  - (SBZ)              0x0 0
  SWP/SWPB Enable      0x0 0
  Branch Pred Enable   0x1 1
  ICache Enable        0x1 1
  High Vector          0x0 0
  Round Robin          0x0 0
  - (SBZ)              0x0 0
  - (SBO)              0x1 1
  HA flag              0x0 0
  - (SBO)              0x1 1
  WXN (virt. ext. only) 0x0 0
  UWXN (virt. ext. only) 0x0 0
  FIQ Enable           0x0 0
  - (SBO)              0x3 3
  VE                   0x0 0
  CPSR E               0x0 0
  - (SBZ)              0x0 0
  NMFI                 0x0 0
  TRE                  0x0 0
  AFE                  0x0 0
  Thumb exceptions     0x1 1
  - (SBZ)              0x0 0
ACTLR      0x00000045
  Cache & TLB maint. broadcast 0x1 1
  L2 prefetch enable   0x0 0
  L1 prefetch enable   0x1 1
  Write full line of zeroes 0x0 0
  (zero)               0x0 0
  SMP                  0x1 1
  Exclusive cache      0x0 0
  Alloc in one way     0x0 0
  Parity on            0x0 0
  -                    0x0 0
ACTLR2     0x00000701
  (raw value)          0x701 1793
CPACR      0xC0000000
  (zero)               0x0 0
  CP10 access permission 0x0 0
  CP11 access permission 0x0 0
  (zero)               0x0 0
  D32DIS               0x1 1
  ASEDIS               0x1 1
DACR       0x0000C000
  (raw value)          0xC000 49152
NSACR (sec. ext. only) 0x55555555
  (raw value)          0x55555555 1431655765
DBGDIDR    0x35137041
  Revision             0x1 1
  Variant              0x4 4
  - (RAZ)              0x70 112
  Version              0x3 3 [v7 full]
  Context              0x1 1 [2]
  BRP                  0x5 5 [6]
  WRP                  0x3 3 [4]
DBGDRAR    0x00000000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x0 0 [0x00000000]
DBGDSAR    0x00030000
  Valid                0x0 0
  - (UNK)              0x0 0
  Address              0x30 48 [0x00030000]
DBGDSCR    0x03000002
  HALTED               0x0 0
  RESTARTED            0x1 1
  MOE                  0x0 0
  SDABORT_l            0x0 0
  ADABORT_l            0x0 0
  UND_l                0x0 0
  FS                   0x0 0
  DBGack               0x0 0
  INTdis               0x0 0
  UDCCdis              0x0 0
  ITRen                0x0 0
  HDBGen               0x0 0
  MDBGen               0x0 0
  SPIDdis              0x0 0
  SPNIDdis             0x0 0
  NS                   0x0 0
  ADAdiscard           0x0 0
  ExtDCCmode           0x0 0
  - (SBZ)              0x0 0
  InstrCompl_l         0x1 1
  PipeAdv              0x1 1
  TXfull_l             0x0 0
  RXfull_l             0x0 0
  - (SBZ)              0x0 0
  TXfull               0x0 0
  RXfull               0x0 0
  - (SBZ)              0x0 0
Config base addr reg 0xC1000000
  (raw value)          0xC1000000 -1056964608
PLEIDR     0x00000000
  (raw value)          0x0 0
TLB lockdown reg 0x00000000
  (raw value)          0x0 0
PRRR       0x00098AA4
  (raw value)          0x98AA4 625316
NMRR       0x44E048E0
  (raw value)          0x44E048E0 1155549408

Title: Re: Canon EOS R / RP
Post by: Corallaro on September 16, 2020, 01:13:12 PM
Great work!! Wonderful!!
I also have an EOS RP and I am available to test.
I've been using ML on EOS M for a while
Thank you
Giovanni
Title: Re: Canon EOS R / RP
Post by: coon on September 18, 2020, 11:07:39 AM
Like already mentioned here: https://www.magiclantern.fm/forum/index.php?topic=25305.msg231013#msg231013

I've ran this Canon Basic script on my RP:


private sub Initialize()
    System.Create()
    CamInfo_Debug(1)
end sub


Which has generated a CAM_INFO.XML file with the following content:


<?xml version="1.0"?>
<Canon>
    <CameraInfo>
        <Serial>xxxxxxxxxxxx</Serial>
        <FirmwareVer>
            <Internal>0.3.8.7</Internal>
            <Major>1.5.0</Major>
        </FirmwareVer>
        <ErrorList></ErrorList>
        <TotalShoot>1780</TotalShoot>
        <TotalShutter>1086948659</TotalShutter>
        <PowerOnCount>229</PowerOnCount>
        <TotalRunningTime>148394</TotalRunningTime>
    </CameraInfo>
</Canon>


TotalShutter value seems to be invalid here. Could someone else with an RP run that script too and post the results here?
Title: Re: Canon EOS R / RP
Post by: kitor on September 18, 2020, 12:43:50 PM
Unless it counts every movie frame as one shot  8)
Suspicious is that looks like just signed 32 bit integer.
Using only half MSB gives 8393 base 10, which is more realistic, but still huge compared to total shots.
I'll try later on R.
Title: Re: Canon EOS R / RP
Post by: Corallaro on September 18, 2020, 01:49:01 PM
Hi
if you tell me step by step instruction how to execute script with my EOS RP, i can make the test.
Ciao
Giovanni
Title: Re: Canon EOS R / RP
Post by: kitor on September 18, 2020, 01:53:40 PM
<?xml version="1.0" encoding="UTF-8"?>
<Canon>
   <CameraInfo>
      <Serial>xxxxxxx</Serial>
      <FirmwareVer>
         <Internal>0.7.3.5</Internal>
         <Major>1.7.0</Major>
      </FirmwareVer>
      <ErrorList>
         <Kind>
            <ID>E01</ID>
            <Count>4</Count>
            <ErrorLog>
               <BatTemperature>max:0 min:0</BatTemperature>
               <FirstOccurTime>2019.07.26 19:26:06</FirstOccurTime>
               <LastOccurTime>2019.07.27 08:52:14</LastOccurTime>
               <Log>
                  <DateTime>2019.07.27 08:52:14</DateTime>
                  <Reason>DS-EID:061</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>000000a0</LensID>
                  <ReleaseCount>2228</ReleaseCount>
               </Log>
               <Log>
                  <DateTime>2019.07.27 08:51:47</DateTime>
                  <Reason>DS-EID:061</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>000000a0</LensID>
                  <ReleaseCount>2224</ReleaseCount>
               </Log>
               <Log>
                  <DateTime>2019.07.26 19:26:19</DateTime>
                  <Reason>DS-EID:064</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>000000a0</LensID>
                  <ReleaseCount>2204</ReleaseCount>
               </Log>
               <Log>
                  <DateTime>2019.07.26 19:26:06</DateTime>
                  <Reason>DS-EID:063</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>000000a0</LensID>
                  <ReleaseCount>2204</ReleaseCount>
               </Log>
            </ErrorLog>
         </Kind>
         <Kind>
            <ID>E70</ID>
            <Count>1</Count>
            <ErrorLog>
               <BatTemperature>max:0 min:0</BatTemperature>
               <FirstOccurTime>2020.09.02 15:03:04</FirstOccurTime>
               <LastOccurTime>2020.09.02 15:03:04</LastOccurTime>
               <Log>
                  <DateTime>2020.09.02 15:03:04</DateTime>
                  <Reason>DS-EID:101</Reason>
                  <BatTemperature>0</BatTemperature>
                  <LensID>0102eefe</LensID>
                  <ReleaseCount>3018</ReleaseCount>
               </Log>
            </ErrorLog>
         </Kind>
      </ErrorList>
      <TotalShoot>3019</TotalShoot>
      <TotalShutter>2845</TotalShutter>
      <PowerOnCount>890</PowerOnCount>
      <TotalRunningTime>115710</TotalRunningTime>
   </CameraInfo>
</Canon>


There are some interesting logs here :D

Quote from: Corallaro on September 18, 2020, 01:49:01 PM
Hi
if you tell me step by step instruction how to execute script with my EOS RP, i can make the test.
Ciao
Giovanni

Look at linked topic. There's everything explained in first post.
Title: Re: Canon EOS R / RP
Post by: c_joerg on September 18, 2020, 01:53:47 PM
https://www.magiclantern.fm/forum/index.php?topic=25305.0

Quote from: coon on September 18, 2020, 11:07:39 AM
TotalShutter value seems to be invalid here. Could someone else with an RP run that script too and post the results here?
Have you tried to make one shoot and  a second dump?     
Title: Re: Canon EOS R / RP
Post by: c_joerg on September 18, 2020, 01:57:19 PM
Quote from: kitor on September 18, 2020, 01:53:40 PM
There are some interesting logs here :D
Du you use original Batterie?
BatTemperature is always 0.
Title: Re: Canon EOS R / RP
Post by: kitor on September 18, 2020, 02:00:11 PM
Yes and no. I have two 100% original LP-E6N, and two LP-E6 that looks original but were bought in China a few years ago. Still holds charge properly and I never had problems with those in 5D2, 5D3 and now in R.

But IIRC I fixed some old non-Canon battery that had cold solder joints inside, this may be it. I can't put it exactly in time, but this was for sure not when I played with ML.
ERR70 was a result of my broken Basic script.
Title: Re: Canon EOS R / RP
Post by: c_joerg on September 18, 2020, 02:04:34 PM
Quote from: kitor on September 18, 2020, 02:00:11 PM
ERR70 was a result of my broken Basic script.
Then try it again with original LP-E6N, ;)
Title: Re: Canon EOS R / RP
Post by: kitor on September 18, 2020, 02:11:53 PM
No, it was an actual error in script code. I made a rom dump just before that (and on those LP-E6's as N were discharged so bad I had to charge them externally), and started experimenting with calling some functions :)
Title: Re: Canon EOS R / RP
Post by: coon on September 18, 2020, 03:11:30 PM
Quote from: c_joerg on September 18, 2020, 01:53:47 PM
https://www.magiclantern.fm/forum/index.php?topic=25305.0
Have you tried to make one shoot and  a second dump?     

I'll give it a shot (pun intended).
Title: Re: Canon EOS R / RP
Post by: coon on September 18, 2020, 03:18:33 PM

<?xml version="1.0"?>
<Canon>
    <CameraInfo>
        <Serial>xxxxxxxxxxxx</Serial>
        <FirmwareVer>
            <Internal>0.3.8.7</Internal>
            <Major>1.5.0</Major>
        </FirmwareVer>
        <ErrorList></ErrorList>
        <TotalShoot>1781</TotalShoot>
        <TotalShutter>1086948660</TotalShutter>
        <PowerOnCount>232</PowerOnCount>
        <TotalRunningTime>148548</TotalRunningTime>
    </CameraInfo>
</Canon>


Counter increased by one but is still invalid.
It should be below 1781 since I have done some bracketing shots which are taken by electronic shutter.
Title: Re: Canon EOS R / RP
Post by: c_joerg on September 18, 2020, 03:37:30 PM
Quote from: coon on September 18, 2020, 03:18:33 PM
Counter increased by one but is still invalid.
Intresting...
Maybe the memory is brocken.
Would be intresting to see a dump from an other RP.
Title: Re: Canon EOS R / RP
Post by: coon on September 18, 2020, 03:40:18 PM
Quote from: kitor on September 18, 2020, 12:43:50 PM
Unless it counts every movie frame as one shot  8)
...

I have recorded a video for a few seconds, just to be sure. ShutterCount stays the same here.
Title: Re: Canon EOS R / RP
Post by: Corallaro on September 18, 2020, 06:59:22 PM
Hi
this is the CAM_INFO.XML of my RP


<?xml version="1.0"?><Canon>
<CameraInfo>
<Serial>xxxxxxxxxxxx</Serial>
<FirmwareVer>
<Internal>0.3.8.7</Internal>
<Major>1.5.0</Major>
</FirmwareVer>
<ErrorList><Kind><ID>E60</ID><Count>1</Count><ErrorLog><BatTemperature>max:0 min:0</BatTemperature><FirstOccurTime>2020.02.02 17:40:00</FirstOccurTime><LastOccurTime>2020.02.02 17:40:00</LastOccurTime><Log><DateTime>2020.02.02 17:40:00</DateTime><Reason>DS-EID:067</Reason><BatTemperature>0</BatTemperature><LensID>010aeefe</LensID><ReleaseCount>7759</ReleaseCount></Log></ErrorLog></Kind></ErrorList>
<TotalShoot>12292</TotalShoot>
<TotalShutter>1086959388</TotalShutter>
<PowerOnCount>1127</PowerOnCount>
<TotalRunningTime>441761</TotalRunningTime>
</CameraInfo>
</Canon>
Title: Re: Canon EOS R / RP
Post by: coon on September 18, 2020, 07:21:02 PM
Interesting. Shutter count also broken here or has some encoding scheme.
Thanks for providing this!

Could you edit your post and wrap the XML output into code blocks like this?

[code]
<xml code here>
[/code]

It's easier to read like this.

It meight be interesting getting a dump of a fresh RP with 0 shots taken to find out the origin value. But it will be very hard to find such I guess...
Title: Re: Canon EOS R / RP
Post by: c_joerg on September 18, 2020, 07:41:48 PM
Quote from: coon on September 18, 2020, 07:21:02 PM
Interesting. Shutter count also broken here or has some encoding scheme.
Looks like this...
But only on RP.


Quote from: coon on September 18, 2020, 07:21:02 PM
It meight be interesting getting a dump of a fresh RP with 0 shots taken to find out the origin value.
Yes, would be intresting...
All my M's and 6D had 0 on the biginning.
Title: Re: Canon EOS R / RP
Post by: coon on September 19, 2020, 07:57:31 PM
Executed the following Canon Basic script from srsa on EOS RP (https://www.magiclantern.fm/forum/index.php?topic=25305.msg231075#msg231075):


private sub Initialize()
  ExecuteEventProcedure("smemShowFix")
  dumpf()
end sub


Got the following memory map:


[RSC] --- Common Lower ----
[RSC] LIME_HEAP                0x00000000 0x00000000         0 [Cacheable!
[RSC] MOVIE_CFILTER_SEED       0x00000000 0x00000000         0 [Cacheable!
[RSC] OMAR COM                 0x00000000 0x00000000         0 [Cacheable!
[RSC] ENGINE_MIRROR            0x00000000 0x00000000         0 [Cacheable!
[RSC] SITTERVCODEC WORK        0x4048C000 0x00207000   2125824
[RSC] DCFNO                    0x40693000 0x00004000     16384
[RSC] FILE HEADER              0x40698400 0x00100000   1048576
[RSC] DAF_WORK                 0x40798400 0x00051000    331776
[RSC] FACTORY/TVAFDEBUG        0x41585000 0x00080000    524288
[RSC] VSHADING_COMP_WORK       0x41682000 0x0002CC00    183296
[RSC] DARKCUR_COMP_WORK        0x416AEC00 0x00025400    152576
[RSC] LIME                     0x41800000 0x00500000   5242880
[RSC] NETWORK_HEAP             0x41D00000 0x00300000   3145728
[RSC] ZICO                     0x42000000 0x00180000   1572864
[RSC] APROC                    0x42180000 0x00021000    135168
[RSC] ARIMA                    0x421A1000 0x0006C000    442368
[RSC] SHIRAHAMA                0x4220D000 0x0002E000    188416
[RSC] RENDERING WORK           0x4233B000 0x00D00000  13631488
[RSC] JOB OBJECT               0x430D1000 0x00320000   3276800
[RSC] FIX                      0x43D18400 0x00200000   2097152
[RSC] TUNE                     0x43F18400 0x00200000   2097152
[RSC] TUNE2                    0x44118400 0x00600000   6291456
[RSC] FANCING_WORK             0x44718400 0x001C2000   1843200
[RSC] CAPTURE_WORK             0x449DA400 0x056E0000  91095040
[RSC] DAF_RAW                  0x7F4BB000 0x0083B800   8632320
[RSC] DANCING                  0x7FCF6800 0x00309800   3184640

[RSC] --- Normal ----
[RSC] LV_SERVO_WORK            0x00000000 0x00000000         0 [Cacheable!
[RSC] LV_AE_WORK               0x41605000 0x0007D000    512000
[RSC] EXMEM3_AREA              0x4A0BA400 0x04455C00  71654400
[RSC] TWAIN_AREA_L             0x5B710000 0x00300000   3145728
[RSC] YUV 2nd_L                0x5BA10000 0x04520000  72482816
[RSC] SS_U                     0x60000000 0x077B0000 125501440
[RSC] YUV 1st_U                0x677B0000 0x03D40000  64225280
[RSC] YUV 2nd_U                0x6B4F0000 0x04520000  72482816
[RSC] SUSANYUV                 0x6FA10000 0x048C0000  76283904
[RSC] YUV Thumb                0x742D0000 0x02B93000  45690880
[RSC] DECMEM1_AREA_U           0x76E63000 0x03480000  55050240
[RSC] EXMEM3_AREA_2            0x7A2E3000 0x051D8000  85819392
[RSC] TWAIN_AREA_U             0x80000000 0x00300000   3145728
[RSC] CAPMEM1_AREA_U           0x80300000 0x03480000  55050240
[RSC] ALGS_AREA_1U             0x83780000 0x03480000  55050240
[RSC] ALGS_AREA_2U             0x86C00000 0x03480000  55050240
[RSC] EXALGS_AREA_U            0x9A700000 0x032A0000  53084160
[RSC] SS_L                     0xA0000000 0x077B0000 125501440
[RSC] YUV 1st_L                0xA77B0000 0x03D40000  64225280
[RSC] CAPMEM1_AREA_L           0xAB4F0000 0x03480000  55050240
[RSC] DECMEM1_AREA_L           0xAE970000 0x03480000  55050240
[RSC] EXALGS_AREA_L            0xB5270000 0x032A0000  53084160
[RSC] ALGS_AREA_2L             0xB8510000 0x03480000  55050240
[RSC] ALGS_AREA_1L             0xBB990000 0x03480000  55050240

[RSC] --- Movie ----
[RSC] CINEMA_FILTER_WORK       0x00000000 0x00000000         0 [Cacheable!
[RSC] MOVIE_RECYUV             0x00000000 0x00000000         0 [Cacheable!
[RSC] AUDIO WORK               0x435C0400 0x00258000   2457600
[RSC] MOVIE_STREAM             0x4E510000 0x0FC00000 264241152
[RSC] LV_WORK_L                0x5E150000 0x01EB0000  32178176
[RSC] LV_WORK_U                0x60000000 0x04F00000  82837504
[RSC] MOVIE_RECWORK_U          0x64F00000 0x01A00000  27262976
[RSC] MOVIE_RECWORK_L          0xAB4F0000 0x0FC40000 264503296

[RSC] --- Play ----
[RSC] SLIDE_SHOW_WORK          0x5DEDA800 0x01FA4000  33177600
[RSC] IMGPLAY_WORK             0x60000000 0x05400000  88080384
[RSC] MOVIE_PLAYWORK           0xA0000000 0x176D0000 393019392

[RSC] --- Multishot ----
[RSC] HDR/GIS_MOVIE_RECWORK    0x00000000 0x00000000         0 [Cacheable!
[RSC] HDR/GIS_MOVIE_RECYUV     0x00000000 0x00000000         0 [Cacheable!
[RSC] HDR/GIS_KAITO_YUV        0x00000000 0x00000000         0 [Cacheable!
[RSC] HDR/GIS_LV_SERVO_WORK    0x00000000 0x00000000         0 [Cacheable!
[RSC] HDR/GIS_FLEXIBLE_MEM3_1  0x00000000 0x00000000         0 [Cacheable!
[RSC] HDR/GIS_FLEXIBLE_MEM3_2  0x00000000 0x00000000         0 [Cacheable!
[RSC] HDR/GIS_AUDIO WORK       0x435C0400 0x00258000   2457600
[RSC] HDR/GIS_EXMEM3_AREA      0x4A0BA400 0x04455C00  71654400
[RSC] HDR/GIS_MOVIE_STREAM     0x4E510000 0x0FC00000 264241152
[RSC] HDR/GIS_COMP_WORK        0x505F0000 0x28A00000 681574400
[RSC] HDR/GIS_YUV 2nd-1        0x5BAE0000 0x04520000  72482816
[RSC] HDR/GIS_SLIDE_SHOW_WORK  0x5DEDA800 0x01FA4000  33177600
[RSC] HDR/GIS_LV_WORK_L        0x5E150000 0x01EB0000  32178176
[RSC] HDR/GIS_LV_WORK_U        0x60000000 0x04F00000  82837504
[RSC] HDR/GIS_SS-2             0x60000000 0x077B0000 125501440
[RSC] HDR/GIS_IMGPLAY_WORK     0x60000000 0x05400000  88080384
[RSC] HDR/GIS_YUV 1st-2        0x677B0000 0x03D40000  64225280
[RSC] HDR/GIS_YUV 2nd-2        0x6B4F0000 0x04520000  72482816
[RSC] HDR/GIS_SUSAN_YUV        0x6FA10000 0x048C0000  76283904
[RSC] HDR/GIS_YUV Thumb        0x742D0000 0x02B93000  45690880
[RSC] HDR/GIS_EXMEM3_2         0x7A2E3000 0x051D8000  85819392
[RSC] HDR/GIS_WORK4            0x80300000 0x03480000  55050240
[RSC] HDR/GIS_WORK2            0x80300000 0x03480000  55050240
[RSC] HDR/GIS_MOVIE_PLAYWORK   0xA0000000 0x176D0000 393019392
[RSC] HDR/GIS_SS-1             0xA0000000 0x077B0000 125501440
[RSC] HDR/GIS_YUV 1st-1        0xA77B0000 0x03D40000  64225280
[RSC] HDR/GIS_WORK3            0xAB4F0000 0x03480000  55050240
[RSC] HDR/GIS_WORK1            0xAB4F0000 0x03480000  55050240

[RSC] --- Indev ----
[RSC] INDEV_SS-1               0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_YUV 1st-1          0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_YUV 2nd-1          0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_BASIC              0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_SS-2               0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_YUV 1st-2          0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_YUV 2nd-2          0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_YUV Thumb          0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_SUSAN_YUV          0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_KAITO_YUV          0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_MOVIE_REC_YUV      0x00000000 0x00000000         0 [Cacheable!
[RSC] INDEV_EXMEM3_AREA        0x4A0BA400 0x04455C00  71654400
[RSC] INDEV_YUV_OUT            0x51486000 0x047C7000  75264000
[RSC] INDEV_TRIMING_VIEW_WORK  0x56550000 0x02200000  35651584
[RSC] INDEV_YUV_IN             0x58750000 0x05780000  91750400
[RSC] INDEV_SLIDE_SHOW_WORK    0x5DEDA800 0x01FA4000  33177600
[RSC] INDEV_IMGPLAYWORK        0x60000000 0x05400000  88080384
[RSC] INDEV_WORK               0x65400000 0x10B00000 279969792
[RSC] INDEV_EXMEM3_AREA        0x7A2E3000 0x051D8000  85819392

[RSC] --- DP ----
[RSC] DP_SS-1                  0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_YUV 1st-1             0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_YUV 2nd-1             0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_YUV_IN                0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_YUV_OUT               0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_MULTI_CHUNK           0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_WORK                  0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_SINGLE_CHUNK          0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_SS-2                  0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_YUV 1st-2             0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_YUV 2nd-2             0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_YUV Thumb             0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_SLIDE_SHOW_WORK       0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_SUSAN_YUV             0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_KAITO_YUV             0x00000000 0x00000000         0 [Cacheable!
[RSC] DP_MOVIE_REC_YUV         0x00000000 0x00000000         0 [Cacheable!


(https://i.ibb.co/Sc4gW4J/RP.png)

RP has 2GB of RAM.
Title: Re: Canon EOS R / RP
Post by: coon on September 22, 2020, 12:48:48 AM
Got portable dumper working on RP by finding the card init stub (thx to names_are_hard for some help!):

(https://cdn.discordapp.com/attachments/754146111987646464/757722386576441414/unknown.png)

Interestingly the firmware file sizes compared to Canon Basic dumper are different.

Portable Dumper:
ROM0.bin: 32MB
ROM1.bin: 16MB

Canon Basic Dumper:
gang100.bin: 32MB
gang200.bin: 32MB

However, both firmware dumps are binary equal. (ROM0.bin == gang100.bin, ROM1.bin == gang200.bin), while ROM0.bin / gang100.bin have some usual noise in the last section of the files.

File content of gang200.bin from 16MB on does only consist of 0xFF values so the real size of it seems to be 16MB.
Title: Re: Canon EOS R / RP
Post by: coon on October 01, 2020, 10:06:07 PM
I am now able to blink the SD card LED of RP v1.5.0 via Canon Basic:


private sub Initialize()
    System.Create()

    ExportToEventProcedure("LedOn",0xE0587BC5)
    ExportToEventProcedure("LedOff",0xE0587BE5)

    For i = 1 To 3
      LedOn(1)
      SleepTask(500)
      LedOff(1)
      SleepTask(500)
    Next
end sub



However, if I try to use LedOn and LedOff stubs on the portable dumper like this:


void (*LedOn)(int unknown)  = 0xE0587BC5;
void (*LedOff)(int unknown) = 0xE0587BE5;

while (true) {
  LedOn(1);
  busy_wait(500);
  LedOff(1);
  busy_wait(500);
}


It will crash on LedOn() call. It seems these functions do need some initialization before they can be used.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on October 01, 2020, 10:24:59 PM
IANAP but are you able to run Canon Basic scripts in QEMU?
Title: Re: Canon EOS R / RP
Post by: coon on October 01, 2020, 10:29:40 PM
I don't know how. Canon basic may be initialized as well before. We are not very far with qemu yet. We are only able to run the portable dumper and we can run the dump_task of digic6 dumper. d6 dumper does not run on real hw yet.
Title: Re: Canon EOS R / RP
Post by: coon on October 01, 2020, 11:43:10 PM
We just had a breakthrough. Digic 6 dumper does work on RP! We can now start tasks and run our own code side by side to canon gui:



The code I am executing:


static void DUMP_ASM dump_task()
{
  void (*LedOn)(int unknown)  = 0xE0587BC5;
  void (*LedOff)(int unknown) = 0xE0587BE5;

  while (true) {
    LedOn(1);
    msleep(500);
    LedOff(1);
    msleep(500);
  }
}
Title: Re: Canon EOS R / RP
Post by: IDA_ML on October 02, 2020, 07:42:16 AM
This is very exciting news.  Congratulations!
Title: Re: Canon EOS R / RP
Post by: kitor on October 02, 2020, 09:53:17 AM
We have a blink. I repeat, we have a blink!

Hello world coming soon confirmed?  ;)
Title: Re: Canon EOS R / RP
Post by: coon on October 02, 2020, 08:34:57 PM
Of course. :) Next task is getting control over the display. Shouldn't be too hard, since portable dumper already guesses the required addresses correctly.
Title: Re: Canon EOS R / RP
Post by: Nigel95 on October 02, 2020, 08:54:42 PM
Amazing keep up the good work!!
Title: Re: Canon EOS R / RP
Post by: reddeercity on October 03, 2020, 01:44:23 AM
I haven't bought a camera yet but the EOS R with this break though is looking tempting to bought one , great job !
Title: Re: Canon EOS R / RP
Post by: kitor on October 03, 2020, 10:43:55 AM
Quote from: reddeercity on October 03, 2020, 01:44:23 AM
I haven't bought a camera yet but the EOS R with this break though is looking tempting to bought one , great job !

Not that I had Hello World running on R a year ago ;)
https://www.magiclantern.fm/forum/index.php?topic=22770.msg215750#msg215750

Just porting it further is 'above my paygrade'.

However, if there's a progress made on RP (and I have high hopes in @coon work, considering his experience as listed on twitter), I will attempt to port his work to R.
Title: Re: Canon EOS R / RP
Post by: coon on October 04, 2020, 01:28:11 PM
I have also some issues on finding the vram_info struct location at the moment. I have found the location where it *should* be, based on the code of 200D but I cannot see valid pointers to MARV structs there so I am still investigating...

Quote from: kitor on April 28, 2019, 12:55:12 PM
[...] explanation below bmp_vram_info sits at 0xFB2C, not 0xFB1C. How I found this?


for(uint32_t* i = 0x40000000; i < 0x80000000; i+=1) {
  if(*i == 0x412ff900) uart_printf("vram1 %p \n", i);
  if(*i == 0x414ff400 ) uart_printf("vram2 %p \n", i);
}


Wow, now that's an aggressive method :). Dereferencing thousands of invalid pointers didn't crash your cam?
If nothing helps and if I should lose all of my hope I also meight doing it that way. Just want to mention that calling


dump_file("RAM41.BIN", 0x80000000, 0x40000000);


Didnt started to dump and made my led blink in a different pattern suddenly, so it brought my camera in some glitched state which was fixed after a battery pull.
Title: Re: Canon EOS R / RP
Post by: srsa on October 04, 2020, 01:54:04 PM
Quote from: coon on October 04, 2020, 01:28:11 PM

dump_file("RAM41.BIN", 0x80000000, 0x40000000);


Didnt started to dump and made my led blink in a different pattern suddenly, so it brought my camera in some glitched state which was fixed after a battery pull.
Try dumping it in a buffered way, not directly.
Title: Re: Canon EOS R / RP
Post by: coon on October 05, 2020, 12:56:42 AM
Quote from: coon on October 04, 2020, 01:28:11 PM
Dereferencing thousands of invalid pointers didn't crash your cam?

Nevermind, I read your code wrong. You are basically scanning the whole memory for the MARV pointers. I've also done that but "offline" on a 1GB RAM dump and found a structure which meight be the vram_info struct. However, the backbuffer pointer does always seem to be zero!? I need to do some deeper investigation here.

Addresses in this struct seem always to be the same, even after battery pull:

0x41100100
0x41340400


By inspecting the buffers at that place I have verified, that I am on the right track. Both buffers contain the same images and have a resolution of 736x480, which matches the resolution of the LCD screen. names_are_hard did some analysis on the image format and found out that it is UYVYAA with JFIF colourspace:

(https://cdn.discordapp.com/attachments/754146111987646464/762441266335711262/test.jpg)


By searching the memory for more MARV signatures I have found two other buffers with a resolution of 960x540, which matches the resolution of the EVF. For some reason the image format is BGRA here:


0x2C1E100
0x2E18600


The first buffer is for menu and general overlays:
(https://cdn.discordapp.com/attachments/754146111987646464/762443301369675806/test.png)

The second buffer holds the focus point overlay:
(https://cdn.discordapp.com/attachments/754146111987646464/762445638469943356/test.png)

names_are_hard has written some python scripts to decode the different vram buffer format. I will merge them into some auto vram image finder / extractor tool and publish it somewhere. Probably here.

There is still a 736x480 buffer left at

0x9F624800


Which I haven't dumped yet, because lack of time. I will let you know what's inside soon.
Title: Re: Canon EOS R / RP
Post by: coon on October 06, 2020, 12:30:25 AM
I don't get the colors right yet, but I can draw proper shapes on the screen. We have debug output now. :)

(https://i.ibb.co/K9C1j12/debug-output2.jpg)
Title: Re: Canon EOS R / RP
Post by: nikfreak on October 06, 2020, 08:17:38 PM
Keep up the good work.
Title: Re: Canon EOS R / RP
Post by: garry23 on October 06, 2020, 08:33:02 PM
I've been watching these developments with interest and much ignorance, but with high hopes.

What I think I see is a 'quick' way to get a scripting environment running, ie before, hopefully, we have a rich/full ML environment up and running, ie with menus etc.

Assuming, once again in ignorance, a Basic scripting API can access/control, ie set/get, key functions, eg shutter, aperture, ISO and, ideally, focus distance etc, such a scripting environment will be very handy for photographers.

I could imagine converting major parts of my DOFIS Lua script to a Basic script, ie giving focus DoF and focus bracketing feedback. Crude, but, I suggest, useful low hanging fruit.

But, as I say, I may be talking in ignorance of what is achievable via a Basic scripting feature.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on October 06, 2020, 08:54:07 PM
Huh? I thought coon and his supporters left scripting and going towards full scale ML coding right now ...
Clarification, please!
Title: Re: Canon EOS R / RP
Post by: garry23 on October 06, 2020, 08:58:24 PM
Yes, I get that, but I have no idea of the time/effort to get a useful Basic scripting API up and running, vs a 'stable' full ML environment.

I was only thinking out loud.
Title: Re: Canon EOS R / RP
Post by: names_are_hard on October 06, 2020, 10:17:50 PM
You could certainly get Basic to do pretty much anything, but for anything complicated it's harder than C (anything where Basic doesn't have a function already given to you).  For simple stuff, if you don't want menus, or maybe even keys, possibly Basic would be easier.  But which tasks are simpler?  That's not easy to tell in advance.

Additionally, time spent making things work in Basic doesn't progress ML at all.  And, it's a different language, that most of the ML devs won't have used before, so they have to learn it first.  If it's the same devs working on it, it takes time away from ML dev, so it's a tradeoff.  If you want to learn Canon Basic and work on it, that would be great!  There's a lot you can do with it and CHDK documents some of it, with examples.
Title: Re: Canon EOS R / RP
Post by: garry23 on October 06, 2020, 11:09:38 PM
@names_are_hard

I didn't make myself clear enough.

I was suggesting that maybe having access to Basic might 'satisfy' those of us that script, rather than waiting for a Lua implementation.

As I say, I was thinking out load and will now stop thinking  ;) :)
Title: Re: Canon EOS R / RP
Post by: srsa on October 06, 2020, 11:30:16 PM
Quote from: garry23 on October 06, 2020, 11:09:38 PM
I was suggesting that maybe having access to Basic might 'satisfy' those of us that script, rather than waiting for a Lua implementation.
I don't think so.
A Basic script can only be started once.
It locks the Canon UI while it runs.
I tried making a shooting script on PowerShots with some tricks (multi-threading, basically), but those tricks crash dual core cameras. The language (its interpreter) is most likely not thread-safe.
Canon Basic scripting is a great tool for early development, dumping memory, setting bootflag, trying things out while running native code isn't working yet on a camera. That's all.
Title: Re: Canon EOS R / RP
Post by: garry23 on October 06, 2020, 11:35:17 PM
@srsa

Thanks for the insight.

BTW I looked over on the CHDK site and now understand the limitations of Canon Basic.

Cheers

Garry
Title: Re: Canon EOS R / RP
Post by: Nigel95 on October 06, 2020, 11:38:08 PM
Quote from: coon on October 06, 2020, 12:30:25 AM
I don't get the colors right yet, but I can draw proper shapes on the screen. We have debug output now. :)

(https://i.ibb.co/K9C1j12/debug-output2.jpg)
Great to see progress. As a noob I am wondering. In terms of any basic first version that requires testing. Is the current stage at something like 5% progress, 20%?
Is it possible at all to tell?

In no way I'm trying to push just curious how to interpret some posts over here as a noob. I will just think like there will never be a ML on this cams :) Thanks for the hard work.
Title: Re: Canon EOS R / RP
Post by: names_are_hard on October 07, 2020, 01:03:17 AM
Early, 1% perhaps.  There is no real way to tell.  This is a puzzle game, you don't know how many levels there are, and you don't know if one of the levels will be a puzzle that is too hard for you to solve.
Title: Re: Canon EOS R / RP
Post by: coon on October 07, 2020, 11:14:18 AM
All what we have done so far (and are still doing) is preparatory work so we will have a fundament for beginning the actual ML port.

What happened until now:
- FIR encryption on newer models has changed so we had no easy option anymore (only UART) to set the boot flag, which is required for ML to boot. Luckily Canon Basic support has been added which allowed it again, so we used it.

- Portable dumper was bootable after finding some required routines in the original firmware and after a little fix in the display code. This showed that we can execute arbitrary code in general. However, portable dumper starts before the firmware has booted and all hardware is initialized. Most of the cameras functions cannot be used at this stage. Therefore our next goal was to boot digic6-dumper, which is a minimal version of ML.

- After finding some more routines in the firmware we were able to boot digic6-dumper and let the SD card access LED blink. We can now execute arbitrary code while hardware is initialized. We can also use the LED to give us some feedback of what our code does.

- We found out where the frame buffers are and what their image format is. We are now able to draw on the screen and can use it for a very convenient debug output.

What happens next:
- Find out how the buttons work, so we can interact with our code and don't have to compile a new firmware every time if we want to test something. Maybe implementing some interactive RAM dumper where target address and dump size can be set by user for example. We could also use that to write to specific RAM addresses, to test if we found correct hardware addresses.
- Get stock firmware of RP run in QEMU.


Quote from: Nigel95 on October 06, 2020, 11:38:08 PM
Great to see progress. As a noob I am wondering. In terms of any basic first version that requires testing. Is the current stage at something like 5% progress, 20%?
Is it possible at all to tell?

In no way I'm trying to push just curious how to interpret some posts over here as a noob. I will just think like there will never be a ML on this cams :) Thanks for the hard work.

I don't expect anything usable before mid 2021.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on October 07, 2020, 11:30:57 AM
What you wrote:

Quote from: coon on October 07, 2020, 11:14:18 AM
I don't expect anything usable before mid 2021.

What average user reads
Quote
You have the right to go ballistic if there isn't a full working ML at 01.07.2021 00:00:01.
Title: Re: Canon EOS R / RP
Post by: coon on October 07, 2020, 11:59:03 AM
And then what? I am doing this in my free time. I am doing this to make my fancy camera even more fancy. Other people may profit from that as well. Nobody pays me so I don't owe someone something.

What I have meant: An unstable ML with minimal features, which I wouldn't recommend for daily use, could be available at the earliest mid 2021 for alpha testing, if we are very very lucky.
Title: Re: Canon EOS R / RP
Post by: theBilalFakhouri on October 07, 2020, 12:34:59 PM
Quote from: coon on October 07, 2020, 11:59:03 AM
I don't owe someone something.

Of course, some users might build their dreams in that date you gave, like We will have 4K RAW capability on EOS RP in mid 2021! or something like that, they would think you gave a promise at that date, be prepared for some aggressive users :P

Otherwise the most users understand what porting ML is, and they understand what you mean.

Nice work by the way! :D
Title: Re: Canon EOS R / RP
Post by: Nigel95 on October 07, 2020, 01:40:38 PM
Good to clarify this up indeed. Work on the project whenever you want and try to enjoy it as much as possible. If you and others ever succeed to put ML on this camera that would be amazing! And if it doesn't get to that stage. Well at least you had fun in it if you work on it when you want and you also learned something along the way.

BTW is there a reason why ML is free? Has this something to do with Canon to avoid any law suits?

If it takes so much work for developers I think it would be fair to compensate them for firmware that works properly. (if it's stable and sort of reliable). Maybe people don't like to donate in advance in the hope there ever will be ML on a cam. Although for 'stable firmware' I think people would like to pay some money? This would be nice for developers to earn a bit of money by doing their hobby. It's probably not enough for all the hours that go into it. But it's always nice to gain a little bit of money by doing what you love.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on October 07, 2020, 01:49:43 PM
Quote from: Nigel95 on October 07, 2020, 01:40:38 PM
If it takes so much work for developers I think it would be fair to compensate them for firmware that works properly. (if it's stable and sort of reliable). Maybe people don't like to donate in advance in the hope there ever will be ML on a cam. Although for 'stable firmware' I think people would like to pay some money?

Lookup your fallacy here (https://en.wikipedia.org/wiki/List_of_fallacies). Poll result: https://mobile.twitter.com/autoexec_bin/status/1182941915337150464
Title: Re: Canon EOS R / RP
Post by: Nigel95 on October 07, 2020, 03:09:12 PM
Quote from: Walter Schulz on October 07, 2020, 01:49:43 PM
Lookup your fallacy here (https://en.wikipedia.org/wiki/List_of_fallacies). Poll result: https://mobile.twitter.com/autoexec_bin/status/1182941915337150464

To lazy to read it all. Based on what I know about fallacies. I would assume you mean faulty generalization. Good one, it was my own opinion and shouldn't sell it as the opinion of a larger sample :)

Your comments make me laugh sometimes on the forum here. To the point although a bit cocky. Maybe it's the result of all the noob questions here. Maybe it's the way you are as a person. Or both?
Title: Re: Canon EOS R / RP
Post by: coon on October 11, 2020, 06:21:01 PM
Finding button states in RAM is not an easy task (at least for me) so after hours of searching I have given up that route for now and did some research on the MPU instead.
I have used this post from a1ex as a reference: https://magiclantern.fm/forum/index.php?topic=2864.msg169517#msg169517

By reading mpu_recv_ring_buffer and using the LCD to display all received mpu messages I have retreived almost all button codes of RP:


Power Switch:               0x00 => params: on: 0x01, off: 0x00
half shutter:               0x05
shutter:                    0x06
* AE-Lock/FE-Lock           0x07
AF-ON:                      0x08
AF Point/Index/Magnify:     0x0B
M-Fn:                       0x0C
Q/set:                      0x0D
menu:                       0x0E
Playback:                   0x0F
info:                       0x10
Trashcan:                   0x11
movie shooting:             0x14
up:                         0x15
down:                       0x16
right:                      0x17
left:                       0x18
Main dial:                  0x19 => params: clockwise: 0x01, anti clockwise: 0xFF
Quick control dial:         0x1A => params: clockwise: 0xFF, anti clockwise: 0x01
multi-function lock switch: 0x1B
Mode dial:                  0x23 => params:
  0x01: C3
  0x02: Tv
  0x05: Movie
  0x06: P
  0x07: SCN
  0x08: Manual
  0x09: C2
  0x0A: Av
  0x0C: Bulb
  0x0D: C1
  0x0E: Fv
  0x0F: Auto


Reading mpu ring buffer via polling should make simple helper menus for convenient developing possible now.
Title: Re: Canon EOS R / RP
Post by: 71m363nd3r on October 12, 2020, 05:24:04 AM
nice work coon!  8)
Title: Re: Canon EOS R / RP
Post by: coon on October 22, 2020, 12:11:57 AM
As already mentioned in Battery grip pins / UART (https://www.magiclantern.fm/forum/index.php?topic=7531.msg232097#msg232097) Thread, I've managed to get access to physical UART on RP without the need of disassembling the camera. I have found out the following pinout so far:


1: (Unknown traffic on boot) (1v8)
2: Maybe RXICU (1v8)
3: TXICU (1v8)
4: GND
5: Maybe RXMPU (3v3)
6: TXMPU (3v3)
7: Unknown (3v3)
8: Unknown (3v3)


Here is some UART traffic I have received:

MPU output when switching on camera:

RSTFLG : 0010
E0ON
E1ON
openBattery

MON>>>sw task Initialize Complete
/USB_DET undetected
batt task Initialize Complete
adapter task Initialize Complete
temp_task.c:356 I2C Comm Error ret=1
disp task Initialize Complete
acc task Initialize Complete
setCCSnkRst
temp task Initialize Complete
Main Task receive from ICU ptr(0x20003940) size=0x04 cmmand=0x01 dataId=0x00
================SD send recode 0 0
Main Task receive from ICU ptr(0x20003940) size=0x0A cmmand=0x02 dataId=0x10
temp_task.c:421 I2C Comm Error ret=1
Main Task receive from ICU ptr(0x20003940) size=0x0B cmmand=0x0C dataId=0x00
Main Task receive from ICU ptr(0x20003940) size=0x0B cmmand=0x0C dataId=0x00
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1
temp_task.c:421 I2C Comm Error ret=1


I don't know why there are so many I2C errors. Maybe because I didn't had any lens attached.

ICU output when switching on camera:

BootLoade[00]K433 READY
       31:      8.828 [STARTUP] K433 ICU Firmware Version 1.5.0 ( 3.8.7 )
      169:    116.237 [BATCHK] ERROR PROP_ACTIVE_SWEEP_STATUS : 0
      178:    116.696 [BATCHK] ERROR PROP_ACTIVE_SWEEP_STATUS : 0
      570:    155.915 [PA] WARN EventDispatch Current=1,dwEventID=3,dwParam=0x0
      980:    250.283 [PROPAD] ERROR GetPropertyData ID (0) = 0x0E090000
      981:    250.289 [PRP] ERROR NotFoundID:0x0E090000,Func:0xE0447AA4
     2002:    497.515 [GUI] ERROR m_hThisBDialog NULL !!
     2003:    497.645 [GUI] ERROR RefreshAfFrameSelectDialog NULL !!
     2083:    634.894 [FM] EV_INSERTION_COMPLETE : ID = 1(0), stat = 8192
     2337:    853.225 ------------------------------
     2338:    853.233 Camera Flag Current Setting
     2339:    853.238 ------------------------------
     2340:    853.242       14 Mode ON
     2341:    853.266 ------------------------------
     2427:    900.955 [GUI] ERROR RefreshAfFrameSelectDialog NULL !!
     2514:    948.596 ERROR [MEM] Over Permanet Memory cache 48 18100


Now this is a bit disappointing. I was expecting a more detailed output here. When using QEMU with gdb attached I can see some NotifyComplete messages. These would be interesting to see on real HW. Is there a way to enable those?
Title: Re: Canon EOS R / RP
Post by: deviousfusion on October 30, 2020, 12:41:13 PM
Quote from: coon on September 18, 2020, 07:21:02 PM
Interesting. Shutter count also broken here or has some encoding scheme.
Thanks for providing this!

Could you edit your post and wrap the XML output into code blocks like this?

[code]
<xml code here>
[/code]

It's easier to read like this.

It meight be interesting getting a dump of a fresh RP with 0 shots taken to find out the origin value. But it will be very hard to find such I guess...

Not sure if this is still applicable or needed, but I just bought a RP and have taken a single shot. Here is my XML:

<?xml version="1.0"?>
  <Canon>
    <CameraInfo>
      <Serial>XXXXX</Serial>
      <FirmwareVer>
        <Internal>0.3.8.7</Internal>
        <Major>1.5.0</Major>
      </FirmwareVer>
      <ErrorList></ErrorList>
      <TotalShoot>1</TotalShoot>
      <TotalShutter>1086947310</TotalShutter>
      <PowerOnCount>16</PowerOnCount>
      <TotalRunningTime>1829</TotalRunningTime>
    </CameraInfo>
  </Canon>


Based on this the origin value appears to be 1086947309
Title: Re: Canon EOS R / RP
Post by: coon on November 20, 2020, 08:58:09 PM
Canon has released Firmware Update 1.6.0 (https://www.canon-europe.com/support/consumer_products/products/cameras/digital_slr/eos-rp.html?type=firmware&firmwaredetailid=tcm:13-2038522&os=windows%2010%20%2864-bit%29&language=en) for RP recently which I have applied today. Canon Basic does still work. I have taken a dump already.

I also got some E70 errors in the error log, which I have triggered in the past by my code accidentally:


<ErrorList>
  <Kind>
  <ID>E70</ID>
  <Count>4</Count>
  <ErrorLog>
    <BatTemperature>max:0 min:0</BatTemperature>
    <FirstOccurTime>2020.10.03 00:28:07</FirstOccurTime>
    <LastOccurTime>2020.11.20 21:05:14</LastOccurTime>
    <Log>
      <DateTime>2020.11.20 21:05:14</DateTime>
      <Reason>DS-EID:101</Reason>
      <BatTemperature>0</BatTemperature>
      <LensID>00000000</LensID>
      <ReleaseCount>1844</ReleaseCount>
    </Log>
    <Log>
      <DateTime>2020.10.24 00:47:12</DateTime>
      <Reason>DS-EID:101</Reason>
      <BatTemperature>0</BatTemperature>
      <LensID>00000000</LensID>
      <ReleaseCount>1833</ReleaseCount>
    </Log>
    <Log>
      <DateTime>2020.10.24 00:46:04</DateTime>
      <Reason>DS-EID:101</Reason>
      <BatTemperature>0</BatTemperature>
      <LensID>00000000</LensID>
      <ReleaseCount>1833</ReleaseCount>
    </Log>
    <Log>
      <DateTime>2020.10.03 00:28:07</DateTime>
      <Reason>DS-EID:101</Reason>
      <BatTemperature>0</BatTemperature>
      <LensID>00000000</LensID>
      <ReleaseCount>1830</ReleaseCount>
    </Log>
  </ErrorLog>
  </Kind>
</ErrorList>


I have triggered them when trying to read from memory >= 0x8000000 via DMA access. I think these memory regions may be read via buffered reads.

Downgrade back to 1.5.0 was possible out of the box. No battery door trick or similiar was needed.
Title: Re: Canon EOS R / RP
Post by: coon on November 27, 2020, 08:49:11 PM
Quote from: deviousfusion on October 30, 2020, 12:41:13 PM
Not sure if this is still applicable or needed, but I just bought a RP and have taken a single shot. Here is my XML:

<?xml version="1.0"?>
  <Canon>
    <CameraInfo>
      <Serial>XXXXX</Serial>
      <FirmwareVer>
        <Internal>0.3.8.7</Internal>
        <Major>1.5.0</Major>
      </FirmwareVer>
      <ErrorList></ErrorList>
      <TotalShoot>1</TotalShoot>
      <TotalShutter>1086947310</TotalShutter>
      <PowerOnCount>16</PowerOnCount>
      <TotalRunningTime>1829</TotalRunningTime>
    </CameraInfo>
  </Canon>


Based on this the origin value appears to be 1086947309

Sorry, I have overlooked your answer until now. Thanks for that interesting information! Yes, it seems the shutter count starts at 1086947309 for some reason.
Title: Re: Canon EOS R / RP
Post by: kitor on December 15, 2020, 08:48:56 PM
If you were wondering where the missing posts went:

DIGIC 8 DryOS Shell (drysh) investigation (https://www.magiclantern.fm/forum/index.php?topic=25662.0)
DIGIC 8 MPU investigation (https://www.magiclantern.fm/forum/index.php?topic=25661.0)
Title: Re: Canon EOS R / RP
Post by: DeafEyeJedi on December 18, 2020, 09:01:57 AM
Damn @coon, Great work and Keep it up!  ;D
Title: Re: Canon EOS R / RP
Post by: coon on December 22, 2020, 04:11:04 PM
All information in this post do refer to EOS RP with firmware 1.6.0.

I have done some further investigations on VRAM handling and it seems that Canon has changed it on newer models. On my initial investigations (https://www.magiclantern.fm/forum/index.php?topic=22770.msg231637#msg231637) I have done a full RAM dump and searched for the MARV signatures manually to find the VRAM buffers. This worked fine as a first entry point to draw simple things on the LCD but drawing in EVF or HDMI output did not work properly with this method. Therefore I have analysed the SaveVRAM event procedure to find out some more information about the buffer handling.

In the past the structure of struct bmp_vram_info was like this:


struct bmp_vram_info
{   
    struct MARV * vram1;        /* one of the two bitmap buffers - statically allocated? */
    struct MARV * vram2;        /* the other bitmap buffer */
    struct MARV * back_vram;    /* we need to write to the other one */
};


vram1 and vram2 are two buffers which are written in an alternating way to prevent flicker.
back_vram points to the back buffer.

On RP Canon has changed it to this:


struct bmp_vram_info
{   
    struct MARV * vram1;        /* one of the two bitmap buffers - statically allocated? */
    struct MARV * vram2;        /* the other bitmap buffer */
};


Plus now there is a global buffer index at 0xFF6C with the index of the current back buffer. It is either 0 or 1.

There are 3 YUV (UYVYAA) buffer pairs in total. One back and one front buffer each. Only one of the three buffer pairs seems to used:


vramBufferPairNo = 0: Final image displayed on LCD or EVF without sensor image
vramBufferPairNo = 1: Nullptr (Unknown)
vramBufferPairNo = 2: Nullptr (Unknown)


I don't know if buffer pairs 1 and 2 are ever used.

Formular for getting YUV buffers:


DAT_e0255238 + vramBufferPairNo * 0x28 + (1 - vram_current_buffer) * 4 - 0x5c


DAT_e0255238 is the dereferenced value on address 0xE0255238 which is 0x722B0.
vramBufferPairNo selects the buffer pair. Valid values are 0 to 2. It seems that buffer 1 and 2 are unused.
vram_current_buffer is the dereferenced value of 0xFF6C and is either 0 or 1.

There are 6 BGRA buffers in total. They are not double buffered and only two them are used in practice:


vramBufferNo = 0: Menu and Live View Overlays
vramBufferNo = 1: Focus point overlay
vramBufferNo = 2: Nullptr (Unknown)
vramBufferNo = 3: Nullptr (Unknown)
vramBufferNo = 4: Nullptr (Unknown)
vramBufferNo = 5: Nullptr (Unknown)


Formular for getting BGRA buffers:

DAT_e0331888 + vramBufferNo * 0xc



With this information I am now able to draw proper images on LCD, EVF and HDMI output. However, due to the pixel wise "software" rendering via CPU the current rendering performance with about 3 fps is quite bad.
I assume that actual rendering by Canon code is done in the BGRA buffers and are then composited and converted to YUV by some coprocessor. I don't know how to trigger that conversion in Canon firmware. Once I have found that out rendering speed should increase significantly. Until full ML does not run on RP, speed is not in focus so I will keep it like that for now.

Bad news are, that the new VRAM handling does require some adjustment in ML code. Good news are that R5 and R6 do also seem to use this new rendering method so they will profit from these changes as well. EOS R does still use the old method.
Title: Re: Canon EOS R / RP
Post by: sombree on December 27, 2020, 07:32:03 PM
This Canon Basic script enables silent shutter on RP:
private sub Initialize()
    ExecuteEventProcedure("sht_EnableManualSilent")
end sub

Works in M, Av, Tv and P both in single and continuous modes. Works fine with interval timer. Fails with ERR70 in bulb.
Title: Re: Canon EOS R / RP
Post by: c_joerg on December 27, 2020, 08:26:55 PM
Would be interesting to know whether you could also switch off the crop mode for EFS lenses.
Title: Re: Canon EOS R / RP
Post by: coon on December 28, 2020, 06:56:59 PM
Quote from: sombree on December 27, 2020, 07:32:03 PM
This Canon Basic script enables silent shutter on RP:
private sub Initialize()
    ExecuteEventProcedure("sht_EnableManualSilent")
end sub

Works in M, Av, Tv and P both in single and continuous modes. Works fine with interval timer. Fails with ERR70 in bulb.

Nice finding! It seems we have a first feature for RP :). Usually silent shutter is only possible in SCN mode or when performing a focus bracketing shoot but not in any other modes.
When do you get ERR70 in bulb? Directly after shutter press or when it tries to close the shutter?
Title: Re: Canon EOS R / RP
Post by: coon on December 28, 2020, 08:24:25 PM
I have found a firmware version independent and read only method to find LED GPIO addresses of newer camera models and created a little Canon Basic script for that.
Sample usage for RP:


'LED GPIO dumper for EOS RP
dim gpio_base      = 0xD0130000
dim led_obj_ptr    = 0x4E28
dim led_obj_offset = 0x28
dim led_count_max  = 15

private sub save_led_gpio_addresses(fileName)
  RemoveFile(fileName)

  f = OpenFileCREAT(fileName)
  CloseFile(f)

  f = OpenFileWR(fileName)
  pLedObjectBase = *led_obj_ptr

  ledKind = 0

  do while ledKind < led_count_max
    pLedObject = pLedObjectBase + ledKind * led_obj_offset
    ledGpioOffset = pLedObject + 8

    WriteFileString(f, "[0x%08X] LED %d: 0x%08X\n", pLedObject, ledKind, gpio_base + *ledGpioOffset)
    ledKind = ledKind + 1
  loop

  CloseFile(f)
end sub

private sub Initialize()
  save_led_gpio_addresses("B:/LED_GPIOS.TXT")
end sub


The script saves the following content:


[0x00D2DE8C] LED 0: 0xD01300D4
[0x00D2DEB4] LED 1: 0xD0130000
[0x00D2DEDC] LED 2: 0xD01300D8
[0x00D2DF04] LED 3: 0xD0130000
[0x00D2DF2C] LED 4: 0xD0130000
[0x00D2DF54] LED 5: 0xD0130000
[0x00D2DF7C] LED 6: 0xD01300DC
[0x00D2DFA4] LED 7: 0xD0130000
[0x00D2DFCC] LED 8: 0xD0130000
[0x00D2DFF4] LED 9: 0xD0130000
[0x00D2E01C] LED 10: 0xD0130000
[0x00D2E044] LED 11: 0xD0130000
[0x00D2E06C] LED 12: 0xD0130000
[0x00D2E094] LED 13: 0xD0130000
[0x00D2E0BC] LED 14: 0xD0130000


The output suggests that there are three LEDs on RP (four LEDs if you also count the addresses ending with 0).


LED 0: 0xD01300D4 - Card LED
LED 2: 0xD01300D8 - Auto Focus Assist LED
LED 6: 0xD01300DC - Unknown / Nothing happens
Other LEDs: 0xD0130000 - Unknown / Nothing happens


Writing to these addresses will toggle the LEDs.
Values to toggle GPIOs on RP are:


LED_ON_BITMASK:  0x4D0002
LED_OFF_BITMASK: 0x4C0003


The script can also be run on other newer models. One has to find and set the following parameters for their camera model:


gpio_base
led_obj_ptr
led_obj_offset
led_count_max


The parameters can be found by inspecting led.set.directly function which can be found at 0xE0697DAA on RP 1.6.0 firmware. The function may also be named LEDDrv_SetLEDDirectly on other models.

Function signature is:


int led_set_directly(uint ledKind, int controlId)


Parameters for EOS R are:


'LED GPIO dumper for EOS R
dim gpio_base      = 0xD0130000
dim led_obj_ptr    = 0x4DDC
dim led_obj_offset = 0x24
dim led_count_max  = 13


Script from above with these values produces:


[0x00D7D7B4] LED 0: 0xD01300D4
[0x00D7D7D8] LED 1: 0xD0130000
[0x00D7D7FC] LED 2: 0xD01300D8
[0x00D7D820] LED 3: 0xD0130000
[0x00D7D844] LED 4: 0xD0130000
[0x00D7D868] LED 5: 0xD0130000
[0x00D7D88C] LED 6: 0xD0130000
[0x00D7D8B0] LED 7: 0xD0130000
[0x00D7D8D4] LED 8: 0xD0130000
[0x00D7D8F8] LED 9: 0xD0130000
[0x00D7D91C] LED 10: 0xD0130000
[0x00D7D940] LED 11: 0xD0130000
[0x00D7D964] LED 12: 0xD0130000


GPIO addresses are similiar to RP but LED 6 does also end with 0 here.

However, it's not trivial to get the values for R6 since the value for gpio_base is stored in RAM.
Could someone with an R6 execute this and tell me the result?


'Get R6 LED base

private sub save_led_base(fileName)
  RemoveFile(fileName)

  f = OpenFileCREAT(fileName)
  CloseFile(f)

  f = OpenFileWR(fileName)

  pLedBase = 0x4F54
  WriteFileString(f, "LED base 1: [0x%08X]: 0x%08X\n", pLedBase, *pLedBase)

  pLedBase = 0x4F5C
  WriteFileString(f, "LED base 2: [0x%08X]: 0x%08X\n", pLedBase, *pLedBase)

  CloseFile(f)
end sub

private sub Initialize()
  save_led_base("B:/LED_BASE.TXT")
end sub


Title: Re: Canon EOS R / RP
Post by: sombree on December 28, 2020, 10:11:54 PM
Quote from: coon on December 28, 2020, 06:56:59 PM
Nice finding! It seems we have a first feature for RP :). Usually silent shutter is only possible in SCN mode or when performing a focus bracketing shoot but not in any other modes.
When do you get ERR70 in bulb? Directly after shutter press or when it tries to close the shutter?

Directly after shutter button press although it seems that camera starts taking picture - I can hear lens iris moving and card LED lights up (but no image saved on the card).
Title: Re: Canon EOS R / RP
Post by: coon on December 28, 2020, 10:15:22 PM
I have found a function which is used to set some GPIO pins at 0xE03B4FDC.

Signature is:


void gpioSet(int gpioOffset, int onOffBitmask)


gpioOffset is added to the fixed address 0xD0130000.
onOffBitmask is mostly 0x4D0002 to set the GPIO and 0x4C0003 to reset the GPIO. Bitmasks are different on some addresses.

The function is used to toggle GPIO pins, and some chip enable pins. It is also used to toggle some GPIO pin to low at the end of send_mpu which meight be an interrupt pin for MPU. This function may be used to identify several GPIOs.
Title: Re: Canon EOS R / RP
Post by: coon on December 29, 2020, 12:09:30 AM
Executing sht_EnableManualSilent on UART gives the following output:


K433[1]>sht_EnableManualSilent
Enable Names
    "SHOOT"
    "LV"
    "MECHA"
    "LENS"
    "EF"
    "APEX"
    "DC_MECHA"
    "FA"
    "IS"
    "LVAF"
    "EOSAF"
    "EOSAE"
    "EDET"
    "ALL"

Stab Status
    SHOOT : respect
    LV : respect
    MECHA : ignore
    LENS : respect
    EF : respect
    APEX : respect
    DC_MECHA : ignore
    FA : ignore
    IS : ignore
    LVAF : respect
    EOSAF : ignore
    EOSAE : ignore
    EDET : respect

sht_EnableManualSilent returned 0(0x0)


When pressing the shutter button in manual mode an image is taken but shutter does not close. Camera is in electronic shutter mode.

Executing sht_DisableManualSilent on UART gives the following output:


K433[1]>sht_DisableManualSilent
Enable Names
    "SHOOT"
    "LV"
    "MECHA"
    "LENS"
    "EF"
    "APEX"
    "DC_MECHA"
    "FA"
    "IS"
    "LVAF"
    "EOSAF"
    "EOSAE"
    "EDET"
    "ALL"

Stab Status
    SHOOT : respect
    LV : respect
    MECHA : respect
    LENS : respect
    EF : respect
    APEX : respect
    DC_MECHA : ignore
    FA : ignore
    IS : ignore
    LVAF : respect
    EOSAF : ignore
    EOSAE : ignore
    EDET : respect

sht_DisableManualSilent returned 0(0x0)


Shutter does close again in manual mode.

When pressung shutter button in Bulb mode while beeing in Silent Shutter mode camera crashes with Err70 and asserts on UART:


K433[1]>    45024: 711030.598 [STARTUP] ERROR <7>ASSERT : ImageController::ImageControllerShootCommon.c
    45025: 711030.621 [STARTUP] <7>ASSERT : Task = ShootCapture
    45026: 711030.626 [STARTUP] <7>ASSERT : Core 0
    45027: 711030.633 [STARTUP] <7>ASSERT : Line 813
    45028: 711030.640 [STARTUP] < StackDump >
    45029: 711030.644 [STARTUP] SP: 0x00245174
    45030: 711030.674 [STARTUP] 0xFFFFFFFF
    45031: 711030.679 [STARTUP] 0x00000064
    45032: 711030.682 [STARTUP] 0x00000000
    45033: 711030.693 [STARTUP] 0x40D65130
...


When pressing the shutter button in Bulb mode while in normal shutter mode you can hear some mechanical movement inside the camera before the image capturing starts, even when having the lens on the widest possible aperture and also when not having a lens attached at all. I don't know what is exactly happing here but I assume that the camera cannot move the required part for bulb mode when beeing in silent shutter mode. It does detect that and does crash.
Title: Re: Canon EOS R / RP
Post by: sombree on December 29, 2020, 09:52:12 AM
Same mechanical movement is hearable when shooting in M (or any other) mode, yet only in bulb camera errors out :)
Title: Re: Canon EOS R / RP
Post by: coon on December 29, 2020, 03:22:02 PM
If I don't have a lens attached or when lens is at widest possible aperture I don't hear anything when pressing the shutter button.
Title: Re: Canon EOS R / RP
Post by: sombree on December 29, 2020, 03:36:35 PM
I meant that same mechanical sound is hearable when shooting with normal shutter even in other modes than bulb.
Title: Re: Canon EOS R / RP
Post by: coon on January 09, 2021, 10:56:08 PM
I have found some debug function which prints the whole interrupt vector table of the RPs ICU to UART (firmware version 1.6.0):


0xe0136920: void printInterruptVectorTable(void)


It produces the following output:


<=-=-=- Vector Start -=-=-=>
0,-noise-
1,EDOMAIN_OPERA_OPEKICK0
2,EDOMAIN_EDMAC_5_WR_S1
3,EDOMAIN_EDMAC_1_RD_L0
4,EDOMAIN_VITON
5,EDOMAIN_OPERA0
6,SYNC_irq_intb60v
7,SYNC_vi_out7
8,TMU_int_SWA
9,TMU_int_pulc
10,INTC_XINT *IRQEXT
11,TCU_T0OUT *IRQEXT
12,postman_RCVINT0
13,postman_FIFOINT0
14,Eeko_TIMER_OC0_INT*ASYMMETRIC
15,Eeko_TIMER_IC0_INT*ASYMMETRIC
16,EDOMAIN_SYNGEN_1
17,EDOMAIN_OPERA_OPEKICK1
18,EDOMAIN_EDMAC_6_WR_S0
19,EDOMAIN_EDMAC_1_RD_M0
20,EDOMAIN_AFFINE
21,EDOMAIN_OPERA_ERR0
22,SYNC_irq_intb59v
23,SYNC_vi_out8
24,TMU_int_SWB
25,TMU_int_occh0SP
26,INTC_XINT *IRQEXT
27,TCU_T1OUT *IRQEXT
28,postman_RCVINT1
29,postman_FIFOINT1
30,Eeko_TIMER_OC1_INT*ASYMMETRIC
31,Eeko_TIMER_IC1_INT*ASYMMETRIC
32,EDOMAIN_SYNGEN_2
33,EDOMAIN_OPERA_OPEKICK2
34,EDOMAIN_EDMAC_6_WR_SS0
35,EDOMAIN_EDMAC_1_RD_S0
36,EDOMAIN_AFFINE_OVR_ERR
37,EDOMAIN_OPERA_ABORT0
38,SYNC_irq_intb50v
39,SYNC_vi_out9
40,TMU_int_ocall
41,TMU_int_occh0EP
42,INTC_XINT *IRQEXT
43,TCU_T2OUT *IRQEXT
44,postman_RCVINT2
45,postman_FIFOINT2
46,Eeko_TIMER_OC2_INT*ASYMMETRIC
47,Eeko_TIMER_IC2_INT*ASYMMETRIC
48,EDOMAIN_SYNGEN_3
49,EDOMAIN_OPERA_OPEKICK3
50,EDOMAIN_EDMAC_6_WR_SS1
51,EDOMAIN_EDMAC_1_RD_S1
52,EDOMAIN_SARIDON
53,EDOMAIN_OPERA1
54,SYNC_irq_intb49v
55,SYNC_vi_out10
56,TMU_int_pulgenCEI
57,TMU_int_occh1SP
58,INTC_XINT *IRQEXT
59,TCU_T3OUT *IRQEXT
60,postman_RCVINT3
61,postman_FIFOINT3
62,Eeko_TIMER_OC3_INT*ASYMMETRIC
63,Eeko_TIMER_IC3_INT*ASYMMETRIC
64,EDOMAIN_SYNGEN_4
65,EDOMAIN_OPERA_OPEKICK4
66,EDOMAIN_EDMAC_6_WR_SS2
67,EDOMAIN_EDMAC_1_RD_SS0
68,EDOMAIN_KURABO
69,EDOMAIN_OPERA_ERR1
70,SYNC_irq_intl60v
71,SYNC_vi_out11
72,TMU_int_icapCE1
73,TMU_int_occh1EP
74,INTC_XINT *IRQEXT
75,TCU_T4OUT *IRQEXT
76,postman_RCVINT4
77,postman_FIFOINT4
78,Eeko_TIMER_OC4_INT*ASYMMETRIC
79,Eeko_TIMER_IC4_INT*ASYMMETRIC
80,EDOMAIN_SYNGEN_STP
81,EDOMAIN_OPERA_OPEKICK5
82,EDOMAIN_EDMAC_6_WR_SS3
83,EDOMAIN_EDMAC_1_RD_SS1
84,EDOMAIN_MESSI
85,EDOMAIN_OPERA_ABORT1
86,SYNC_irq_intl60v_st1
87,SYNC_irq_intvi4
88,TMU_pulc_ch0
89,TMU_int_occh2SP
90,INTC_XINT *IRQEXT
91,TCU_T5OUT *IRQEXT
92,postman_RCVINT5
93,postman_FIFOINT5
94,Eeko_TIMER_OC5_INT*ASYMMETRIC
95,Eeko_TIMER_IC5_INT*ASYMMETRIC
96,EDOMAIN_SYNGEN_FRM
97,EDOMAIN_OPERA_OPEKICK6
98,EDOMAIN_EDMAC_6_WR_SS4
99,EDOMAIN_EDMAC_1_RD_SS2
100,EDOMAIN_DANCING_FEN
101,EDOMAIN_HAIDI_PNL_WR
102,SYNC_irq_intl59v
103,SYNC_irq_vi4_set_1
104,TMU_pulc_ch1
105,TMU_int_occh2EP
106,INTC_XINT *IRQEXT
107,TCU_IPCOUT4
108,postman_RCVINT6
109,postman_FIFOINT6
110,Eeko_TIMER_OC6_INT*ASYMMETRIC
111,Eeko_TIMER_IC6_INT*ASYMMETRIC
112,EDOMAIN_SYNGEN_1_A
113,EDOMAIN_EDMAC_1_WR_L0
114,EDOMAIN_EDMAC_DAN_WR
115,EDOMAIN_EDMAC_1_RD_SS3
116,EDOMAIN_DANCING_SURF
117,EDOMAIN_HAIDI_LINE_WR
118,SYNC_irq_intl59v_st1
119,SYNC_irq_vi4_set_2
120,TMU_pulc_ch2
121,TMU_int_occh3SP
122,INTC_XINT *IRQEXT
123,TCU_T4F_INT
124,postman_RCVINT7
125,postman_FIFOINT7
126,Eeko_TIMER_OC7_INT*ASYMMETRIC
127,Eeko_TIMER_IC7_INT*ASYMMETRIC
128,EDOMAIN_SYNGEN_2_A
129,EDOMAIN_EDMAC_1_WR_M0
130,EDOMAIN_EDMAC_7_WR_S0
131,EDOMAIN_EDMAC_2_RD_M0
132,EDOMAIN_DANCING_RACI
133,EDOMAIN_SHREK
134,SYNC_irq_intl50v
135,SYNC_irq_vi4_set_3
136,TMU_pulc_ch3
137,TMU_int_occh3EP
138,INTC_XINT *IRQEXT
139,TCU_IPCOUT5
140,postman_DIRECTINT0
141,postman_Semaphore0
142,Eeko_TIMER_ICOC_OC0INT*ASYMMETRIC
143,Eeko_TIMER_ICOC_IC0INT*ASYMMETRIC
144,EDOMAIN_SYNGEN_3_A
145,EDOMAIN_EDMAC_1_WR_M1
146,EDOMAIN_EDMAC_7_WR_S1
147,EDOMAIN_EDMAC_2_RD_S0
148,EDOMAIN_WOMBAT_INTEG
149,EDOMAIN_SUSAN
150,SYNC_irq_intl50v_st1
151,SYNC_irq_intvi4b
152,Camif
153,TMU_int_occh4SP
154,INTC_XINT *IRQEXT
155,TCU_T5F_INT
156,postman_DIRECTINT1
157,postman_Semaphore1
158,Eeko_TIMER_ICOC_OC1INT*ASYMMETRIC
159,Eeko_TIMER_ICOC_IC1INT*ASYMMETRIC
160,EDOMAIN_SYNGEN_4_A
161,EDOMAIN_EDMAC_1_WR_M2
162,EDOMAIN_EDMAC_7_WR_SS0
163,EDOMAIN_EDMAC_2_RD_SS0
164,EDOMAIN_WOMBAT_BLOCK
165,EDOMAIN_OHYITG
166,SYNC_irq_intlssdv
167,SYNC_irq_vi4b_set_1
168,Camif
169,TMU_int_occh4EP
170,INTC_XINT *IRQEXT
171,Aproc_irq_aproc
172,postman_DIRECTINT2
173,postman_Semaphore2
174,rem_REM_INT
175,zico_timer_irq
176,EDOMAIN_SYNGEN_STP_A
177,EDOMAIN_EDMAC_1_WR_M3
178,EDOMAIN_EDMAC_ATO_WR_SS0
179,EDOMAIN_EDMAC_3_RD_M0
180,EDOMAIN_WOMBAT_AE
181,EDOMAIN_HIP
182,SYNC_irq_intlssdv_st1
183,SYNC_irq_vi4b_set_2
184,Camif
185,TMU_int_occh5SP
186,INTC_XINT *IRQEXT
187,Aproc_irq_aproc
188,postman_DIRECTINT3
189,postman_Semaphore3
190,SDDomain_ADMAC0
191,HDMAC0_IntrReq1
192,EDOMAIN_SYNGEN_FRM_A
193,EDOMAIN_EDMAC_1_WR_M4
194,EDOMAIN_EDMAC_ATO_WR_SS1
195,EDOMAIN_EDMAC_3_RD_OPT_RICH
196,EDOMAIN_COMBAT_INTEG
197,EDOMAIN_RASH
198,SYNC_irq_intp
199,SYNC_irq_vi4b_set_3
200,Camif
201,TMU_int_occh5EP
202,INTC_XINT *IRQEXT
203,Aproc_irq_aproc
204,postman_DIRECTINT4
205,postman_fifi_err0
206,SDDomain_ADMAC1
207,HDMAC0_IntrReq2
208,EDOMAIN_SYNGEN_1_B
209,EDOMAIN_EDMAC_1_WR_S0
210,EDOMAIN_EDMAC_ATO_WR_SS2
211,EDOMAIN_EDMAC_3_RD_OPT_LITE
212,EDOMAIN_COMBAT_BLOCK
213,EDOMAIN_RSHD
214,SYNC_irq_intp_st1
215,SYNC_vi_out12
216,Camif
217,TMU_int_icapch0
218,INTC_XINT *IRQEXT
219,Aproc_irq_aproc
220,postman_DIRECTINT5
221,SATA_irq_sata
222,SDDomain_ADMAC2
223,HDMAC0_IntrReq3
224,EDOMAIN_SYNGEN_2_B
225,EDOMAIN_EDMAC_1_WR_SS0
226,EDOMAIN_ORCA_1
227,EDOMAIN_EDMAC_DAF_RD_M0
228,EDOMAIN_WEABER1
229,(reserved)
230,SYNC_irq_inte
231,Camif
232,Camif
233,TMU_int_icapch1
234,INTC_XINT *IRQEXT
235,Aproc_irq_aproc
236,postman_DIRECTINT6
237,PCIe_irq_pcie
238,SDDomain_SDCON0
239,HDMAC0_IntrReq4
240,EDOMAIN_SYNGEN_3_B
241,EDOMAIN_EDMAC_1_WR_SS1
242,EDOMAIN_ORCA_2
243,EDOMAIN_EDMAC_DAF_RD_S0
244,EDOMAIN_WEABER2
245,(reserved)
246,SYNC_irq_inte_st1
247,Camif
248,Camif
249,TMU_int_icapch2
250,INTC_XINT *IRQEXT
251,Aproc_irq_aproc
252,postman_DIRECTINT7
253,PCIe_irq_pcie
254,SDDomain_SDCON1
255,HDMAC0_IntrReq5
256,EDOMAIN_SYNGEN_4_B
257,EDOMAIN_EDMAC_1_WR_SS2
258,EDOMAIN_ORCA_3
259,EDOMAIN_EDMAC_DAF_RD_S1
260,EDOMAIN_HISTORY
261,(reserved)
262,SYNC_-
263,SSIO_SSIOINT
264,Camif
265,TMU_int_icapch3
266,INTC_XINT *IRQEXT
267,Aproc_irq_aproc
268,cclime_msgcom_int0
269,PCIe_irq_pcie
270,SDDomain_SDCON2
271,HDMAC0_IntrReq6
272,EDOMAIN_SYNGEN_STP_B
273,EDOMAIN_EDMAC_1_WR_SS3
274,EDOMAIN_ORCA_4
275,EDOMAIN_EDMAC_MAP_RD_S0
276,EDOMAIN_HISTORY2_1
277,(reserved)
278,SYNC_-
279,SIO0_SIO0INT
280,Camif
281,TMU_int_icapch4
282,INTC_XINT *IRQEXT
283,Aproc_irq_aproc
284,cclime_msgcom_int1
285,UHS2_irq_uhs2
286,XDMAC_XDMAC_0
287,HDMAC0_IntrReq7
288,EDOMAIN_SYNGEN_FRM_B
289,EDOMAIN_EDMAC_1_WR_SS4
290,EDOMAIN_ORCA_5
291,EDOMAIN_EDMAC_5_RD_M0
292,EDOMAIN_HISTORY2_2
293,(reserved)
294,SYNC_-
295,SIO1_SIO1INT
296,Camif
297,TMU_int_icapch5
298,INTC_XINT *IRQEXT
299,Aproc_irq_aproc
300,cclime_msgcom_int2
301,UHS2_irq_uhs2
302,XDMAC_XDMAC_1
303,irq_mdomain_i2i_0
304,EDOMAIN_HEAD_ERR/ATOMIC_ERR
305,EDOMAIN_EDMAC_1_WR_SS5
306,EDOMAIN_ORCA_6
307,EDOMAIN_EDMAC_5_RD_M1
308,EDOMAIN_HISTORY2_3
309,(reserved)
310,SYNC_-
311,SIO2_SIO2INT
312,Camif
313,TMU_int_icapch6
314,INTC_XINT *IRQEXT
315,Aproc_irq_aproc
316,cclime_msgcom_int3
317,USB_hibiki_h
318,XDMAC_XDMAC_2
319,irq_mdomain_i2i_1
320,EDOMAIN_HEAD_ERR2
321,EDOMAIN_EDMAC_2_WR_M0
322,EDOMAIN_ORCA_7
323,EDOMAIN_EDMAC_5_RD_S0
324,EDOMAIN_HISTORY2_4
325,(reserved)
326,SYNC_irq_lss
327,SIO3_SIO3INT
328,Camif
329,TMU_int_icapch7
330,INTC_XINT *IRQEXT
331,adomain_xmon0
332,cclime_msgcom_int4
333,USB_hibiki_d
334,XDMAC_XDMAC_3
335,irq_mdomain_i2i_2
336,EDOMAIN_HEAD_ERR3
337,EDOMAIN_EDMAC_2_WR_S0
338,EDOMAIN_ORCA_8
339,EDOMAIN_EDMAC_5_RD_SS0
340,EDOMAIN_BIKING
341,TSENS_irq_tsens
342,SYNC_irq_lss_st1
343,SIO4_SIO4INT
344,Camif
345,TMU_int_icapch8
346,INTC_XINT *IRQEXT
347,adomain_xmon1
348,cclime_msgcom_int5
349,UART0 RX_IntReqRx
350,DSI_irq_dsi
351,irq_mdomain_a2i_cclime
352,EDOMAIN_HEAD_ERR4
353,EDOMAIN_EDMAC_2_WR_SS0
354,EDOMAIN_ORCA_9
355,EDOMAIN_EDMAC_5_RD_SS1
356,EDOMAIN_CAPTAIN
357,XDMAC_XDMAC_ABORT
358,SYNC_vi_out0
359,SIO5_SIO5INT
360,Camif
361,TMU_int_icapch9
362,INCT_XINT *IRQEXT
363,adomain_xmon2
364,cclime_msgcom_int6
365,UART0 TX_IntReqTx
366,HDMI_irq_hdmi
367,SROMC0_oIRQ_TX
368,EDOMAIN_HEAD_ERR5
369,EDOMAIN_EDMAC_3_WR_M0
370,EDOMAIN_SWAN_GV_END
371,EDOMAIN_EDMAC_5_RD_SS2
372,EDOMAIN_OPTI0
373,SYNC_vi_out13
374,SYNC_vi_out1
375,SIO6_SIO6INT
376,mario_mario
377,TMU_int_icapch10
378,INTC_XINT *IRQEXT
379,adomain_xmon3
380,cclime_msgcom_int7
381,UART1 RX_IntReqRx
382,HDMI_irq_hdmi
383,SROMC0_oIRQ_RX
384,EDOMAIN_HEAD_ERR6
385,EDOMAIN_EDMAC_3_WR_S0
386,EDOMAIN_PLANET_WR_0
387,EDOMAIN_EDMAC_6_RD_S0
388,EDOMAIN_OPTI1
389,SYNC_vi_out14
390,SYNC_vi_out2
391,SIO7_SIO7INT
392,mario_mario
393,TMU_int_icapch11
394,INTC_XINT *IRQEXT
395,cclime_citron_int
396,cclime_sdcon_int
397,UART1 TX_IntReqTx
398,PMU_irq_pmu
399,SROMC0_oIRQ_FAULT
400,EDOMAIN_SAP1
401,EDOMAIN_EDMAC_3_WR_SS0
402,EDOMAIN_PLANET_WR_1
403,EDOMAIN_EDMAC_6_RD_S1
404,EDOMAIN_DAFIGARO
405,SYNC_vi_out15
406,SYNC_vi_out3
407,swimmy_irq_sitter
408,mario_mario
409,TMU_INT_SWA_ONLY
410,INTC_XINT *IRQEXT
411,cclime_tdmac0_int
412,cclime_others_int
413,UART2 RX_IntReqRx
414,HARB_harbInt
415,SROMC0_oERR_COLLECT
416,EDOMAIN_SAP2
417,EDOMAIN_EDMAC_DAF_WR_S0
418,EDOMAIN_PLANET_RD_0
419,EDOMAIN_EDMAC_6_RD_SS0
420,EDOMAIN_EDMAC_6_RD_SS5
421,SYNC_irq_intvi5
422,SYNC_vi_out4
423,swimmy_irq_endev
424,mario_mario
425,TMU_INT_SWB_ONLY
426,INCT_XINT *IRQEXT
427,cclime_tdmac1_int
428,cclime_slotb_sddat1_int *IRQEXT
429,UART2 TX_IntReqTx
430,RSTGEN_WDTINT
431,SROMC1_oIRQ_TX
432,EDOMAIN_SAP3
433,EDOMAIN_EDMAC_MAP_WR_SS0
434,EDOMAIN_PLANET_RD_1
435,EDOMAIN_EDMAC_6_RD_SS1
436,EDOMAIN_EDMAC_6_RD_SS6
437,dolphin
438,SYNC_vi_out5
439,swimmy_irq_sven
440,mario_mario
441,TMU_INT_SWC_ONLY
442,INTC_XINT *IRQEXT
443,cclime_tdmac2_int
444,cclime_slotd_sddat1_int *IRQEXT
445,I2C0_TIRQ
446,I2C1_TIRQ
447,SROMC1_oIRQ_RX
448,EDOMAIN_ATOMIC_LIP
449,EDOMAIN_EDMAC_MAP_WR_SS1
450,EDOMAIN_JP52
451,EDOMAIN_EDMAC_6_RD_SS2
452,EDOMAIN_EDMAC_6_RD_SS7
453,dolphin
454,SYNC_vi_out6
455,ALGS_irq_algs
456,mario_mario
457,TMU_INT_SWD_ONLY
458,INTC_IRQ_soft_out*ASYMMETRIC
459,cclime_tdmac3_int
460,(reserved)
461,I2C0_RIRQ
462,I2C1_RIRQ
463,SROMC1_oIRQ_FAULT
464,EDOMAIN_PENTA
465,EDOMAIN_EDMAC_5_WR_M0
466,EDOMAIN_EDMAC_OPERA_WR
467,EDOMAIN_EDMAC_6_RD_SS3
468,EDOMAIN_EDMAC_DAN_RD
469,dolphin
470,int_tm_misc_cpu_handshake0*ASYMMETRIC
471,ALGS_irq_algs
472,mario_mario
473,irq_mcpu_SCUEVABORT *IRQEXT
474,irq_mcpu_SLVERRINTR
475,irq_mcpu
476,(reserved)
477,I2C0_SIRQ
478,I2C1_SIRQ
479,SROMC1_oERR_COLLECT
480,EDOMAIN_SANTA
481,EDOMAIN_EDMAC_5_WR_S0
482,EDOMAIN_EDMAC_OPERA_RD
483,EDOMAIN_EDMAC_6_RD_SS4
484,EDOMAIN_EDMAC_7_RD_S0
485,dolphin
486,int_tm_misc_cpu_handshake1*ASYMMETRIC
487,GLDA_irq_glda
488,mario_mario
489,irq_mcpu_DECERRINTR
490,irq_mcpu_L2CCINTR
491,irq_mcpu
492,MONI_moniout(0)*IRQEXT
493,MONI_moniout(1)*IRQEXT
494,MONI_moniout(2)*IRQEXT
495,MONI_moniout(3)*IRQEXT
496,INTC_ANDINT(0)*ASYMMETRIC
497,INTC_ANDINT(1)*ASYMMETRIC
498,INTC_ANDINT(2)*ASYMMETRIC
499,INTC_ANDINT(3)*ASYMMETRIC
500,INTC_ANDINT(4)*ASYMMETRIC
501,INTC_ANDINT(5)*ASYMMETRIC
502,DEBSIO
503,XIMR_irq_ximr
504,mario_mario
505,irq_mcpu_ECNTRINTR
506,INTC_ANDINT(0)*ASYMMETRIC
507,INTC_ANDINT(1)*ASYMMETRIC
508,INTC_ANDINT(2)*ASYMMETRIC
509,INTC_ANDINT(3)*ASYMMETRIC
510,INTC_ANDINT(4)*ASYMMETRIC
511,INTC_ANDINT(5)*ASYMMETRIC
512,GIC_SGI(0)
513,GIC_SGI(1)
514,GIC_SGI(2)
515,GIC_SGI(3)
516,GIC_SGI(4)
517,GIC_SGI(5)
518,GIC_SGI(6)
519,GIC_SGI(7)
520,GIC_SGI(8)
521,GIC_SGI(9)
522,GIC_scheduling
523,GIC_timer
524,GIC_suspend
525,GIC_SGI(13)
526,GIC_SGI(14)
527,GIC_SGI(15)
528,GIC_PPI(16)
529,GIC_PPI(17)
530,GIC_PPI(18)
531,GIC_PPI(19)
532,GIC_PPI(20)
533,GIC_PPI(21)
534,GIC_PPI(22)
535,GIC_PPI(23)
536,GIC_PPI(24)
537,GIC_PPI(25)
538,GIC_PPI(26)
539,GIC_GlobalTimer
540,GIC_LegacyFiq
541,GIC_PrivateTimer
542,GIC_WatchdogTimer
543,GIC_LegacyIrq
544,GIC_MariusIntc
545,GIC_OmarIntc
546,GIC_SPI(34)
547,GIC_SPI(35)
548,GIC_SPI(36)
549,GIC_SPI(37)
550,GIC_SPI(38)
551,GIC_SPI(39)
552,GIC_SPI(40)
553,GIC_SPI(41)
554,GIC_SPI(42)
555,GIC_SPI(43)
556,GIC_SPI(44)
557,GIC_SPI(45)
558,GIC_SPI(46)
559,GIC_SPI(47)
560,GIC_SPI(48)
561,GIC_SPI(49)
562,GIC_SPI(50)
563,GIC_SPI(51)
564,GIC_SPI(52)
565,GIC_SPI(53)
566,GIC_SPI(54)
567,GIC_SPI(55)
568,GIC_SPI(56)
569,GIC_SPI(57)
570,GIC_SPI(58)
571,GIC_SPI(59)
572,GIC_SPI(60)
573,GIC_SPI(61)
574,GIC_SPI(62)
575,GIC_SPI(63)
<=-=-=- Vector End -=-=-=>


We do now know the meaning of all interrupt sources. This should help to improve qemu support. Vector table is the same on R and M50 so I assue that this table is valid for all DIGIC 8 models.

I have created a canon basic script which saves the interrupt names to SD card and can easily be adjusted for other models. Vectors are stored as hex instead of decimal here:


'Get RP Interrupt Vector Table

dim pIvt_table_1 = 0x1ba48
dim vector1_len = 0x200

dim pIvt_table_2 = 0x1c3ec
dim vector2_len = 0x40

private sub write_table(hFile, pVectorTable, startVector, numElements)
  isrVector = startVector

  do while isrVector < numElements
    ppIrqName = pVectorTable + isrVector * 4
    WriteFileString(hFile, "0x%03X: %s\n", isrVector, *ppIrqName)

    isrVector = isrVector + 1
  loop
end sub

private sub save_ivt(fileName)
  RemoveFile(fileName)

  hFile = OpenFileCREAT(fileName)
  CloseFile(hFile)

  hFile = OpenFileWR(fileName)

  write_table(hFile, pIvt_table_1, 0, vector1_len)
  write_table(hFile, pIvt_table_2, vector1_len, vector2_len)

  CloseFile(hFile)
end sub

private sub Initialize()
  save_ivt("B:/RP_IVT.TXT")
end sub


Output on RP is:

0x000: -noise-
0x001: EDOMAIN_OPERA_OPEKICK0
0x002: EDOMAIN_EDMAC_5_WR_S1
0x003: EDOMAIN_EDMAC_1_RD_L0
0x004: EDOMAIN_VITON
0x005: EDOMAIN_OPERA0
0x006: SYNC_irq_intb60v
0x007: SYNC_vi_out7
0x008: TMU_int_SWA
0x009: TMU_int_pulc
0x00A: INTC_XINT *IRQEXT
0x00B: TCU_T0OUT *IRQEXT
0x00C: postman_RCVINT0
0x00D: postman_FIFOINT0
0x00E: Eeko_TIMER_OC0_INT*ASYMMETRIC
0x00F: Eeko_TIMER_IC0_INT*ASYMMETRIC
0x010: EDOMAIN_SYNGEN_1
0x011: EDOMAIN_OPERA_OPEKICK1
0x012: EDOMAIN_EDMAC_6_WR_S0
0x013: EDOMAIN_EDMAC_1_RD_M0
0x014: EDOMAIN_AFFINE
0x015: EDOMAIN_OPERA_ERR0
0x016: SYNC_irq_intb59v
0x017: SYNC_vi_out8
0x018: TMU_int_SWB
0x019: TMU_int_occh0SP
0x01A: INTC_XINT *IRQEXT
0x01B: TCU_T1OUT *IRQEXT
0x01C: postman_RCVINT1
0x01D: postman_FIFOINT1
0x01E: Eeko_TIMER_OC1_INT*ASYMMETRIC
0x01F: Eeko_TIMER_IC1_INT*ASYMMETRIC
0x020: EDOMAIN_SYNGEN_2
0x021: EDOMAIN_OPERA_OPEKICK2
0x022: EDOMAIN_EDMAC_6_WR_SS0
0x023: EDOMAIN_EDMAC_1_RD_S0
0x024: EDOMAIN_AFFINE_OVR_ERR
0x025: EDOMAIN_OPERA_ABORT0
0x026: SYNC_irq_intb50v
0x027: SYNC_vi_out9
0x028: TMU_int_ocall
0x029: TMU_int_occh0EP
0x02A: INTC_XINT *IRQEXT
0x02B: TCU_T2OUT *IRQEXT
0x02C: postman_RCVINT2
0x02D: postman_FIFOINT2
0x02E: Eeko_TIMER_OC2_INT*ASYMMETRIC
0x02F: Eeko_TIMER_IC2_INT*ASYMMETRIC
0x030: EDOMAIN_SYNGEN_3
0x031: EDOMAIN_OPERA_OPEKICK3
0x032: EDOMAIN_EDMAC_6_WR_SS1
0x033: EDOMAIN_EDMAC_1_RD_S1
0x034: EDOMAIN_SARIDON
0x035: EDOMAIN_OPERA1
0x036: SYNC_irq_intb49v
0x037: SYNC_vi_out10
0x038: TMU_int_pulgenCEI
0x039: TMU_int_occh1SP
0x03A: INTC_XINT *IRQEXT
0x03B: TCU_T3OUT *IRQEXT
0x03C: postman_RCVINT3
0x03D: postman_FIFOINT3
0x03E: Eeko_TIMER_OC3_INT*ASYMMETRIC
0x03F: Eeko_TIMER_IC3_INT*ASYMMETRIC
0x040: EDOMAIN_SYNGEN_4
0x041: EDOMAIN_OPERA_OPEKICK4
0x042: EDOMAIN_EDMAC_6_WR_SS2
0x043: EDOMAIN_EDMAC_1_RD_SS0
0x044: EDOMAIN_KURABO
0x045: EDOMAIN_OPERA_ERR1
0x046: SYNC_irq_intl60v
0x047: SYNC_vi_out11
0x048: TMU_int_icapCE1
0x049: TMU_int_occh1EP
0x04A: INTC_XINT *IRQEXT
0x04B: TCU_T4OUT *IRQEXT
0x04C: postman_RCVINT4
0x04D: postman_FIFOINT4
0x04E: Eeko_TIMER_OC4_INT*ASYMMETRIC
0x04F: Eeko_TIMER_IC4_INT*ASYMMETRIC
0x050: EDOMAIN_SYNGEN_STP
0x051: EDOMAIN_OPERA_OPEKICK5
0x052: EDOMAIN_EDMAC_6_WR_SS3
0x053: EDOMAIN_EDMAC_1_RD_SS1
0x054: EDOMAIN_MESSI
0x055: EDOMAIN_OPERA_ABORT1
0x056: SYNC_irq_intl60v_st1
0x057: SYNC_irq_intvi4
0x058: TMU_pulc_ch0
0x059: TMU_int_occh2SP
0x05A: INTC_XINT *IRQEXT
0x05B: TCU_T5OUT *IRQEXT
0x05C: postman_RCVINT5
0x05D: postman_FIFOINT5
0x05E: Eeko_TIMER_OC5_INT*ASYMMETRIC
0x05F: Eeko_TIMER_IC5_INT*ASYMMETRIC
0x060: EDOMAIN_SYNGEN_FRM
0x061: EDOMAIN_OPERA_OPEKICK6
0x062: EDOMAIN_EDMAC_6_WR_SS4
0x063: EDOMAIN_EDMAC_1_RD_SS2
0x064: EDOMAIN_DANCING_FEN
0x065: EDOMAIN_HAIDI_PNL_WR
0x066: SYNC_irq_intl59v
0x067: SYNC_irq_vi4_set_1
0x068: TMU_pulc_ch1
0x069: TMU_int_occh2EP
0x06A: INTC_XINT *IRQEXT
0x06B: TCU_IPCOUT4
0x06C: postman_RCVINT6
0x06D: postman_FIFOINT6
0x06E: Eeko_TIMER_OC6_INT*ASYMMETRIC
0x06F: Eeko_TIMER_IC6_INT*ASYMMETRIC
0x070: EDOMAIN_SYNGEN_1_A
0x071: EDOMAIN_EDMAC_1_WR_L0
0x072: EDOMAIN_EDMAC_DAN_WR
0x073: EDOMAIN_EDMAC_1_RD_SS3
0x074: EDOMAIN_DANCING_SURF
0x075: EDOMAIN_HAIDI_LINE_WR
0x076: SYNC_irq_intl59v_st1
0x077: SYNC_irq_vi4_set_2
0x078: TMU_pulc_ch2
0x079: TMU_int_occh3SP
0x07A: INTC_XINT *IRQEXT
0x07B: TCU_T4F_INT
0x07C: postman_RCVINT7
0x07D: postman_FIFOINT7
0x07E: Eeko_TIMER_OC7_INT*ASYMMETRIC
0x07F: Eeko_TIMER_IC7_INT*ASYMMETRIC
0x080: EDOMAIN_SYNGEN_2_A
0x081: EDOMAIN_EDMAC_1_WR_M0
0x082: EDOMAIN_EDMAC_7_WR_S0
0x083: EDOMAIN_EDMAC_2_RD_M0
0x084: EDOMAIN_DANCING_RACI
0x085: EDOMAIN_SHREK
0x086: SYNC_irq_intl50v
0x087: SYNC_irq_vi4_set_3
0x088: TMU_pulc_ch3
0x089: TMU_int_occh3EP
0x08A: INTC_XINT *IRQEXT
0x08B: TCU_IPCOUT5
0x08C: postman_DIRECTINT0
0x08D: postman_Semaphore0
0x08E: Eeko_TIMER_ICOC_OC0INT*ASYMMETRIC
0x08F: Eeko_TIMER_ICOC_IC0INT*ASYMMETRIC
0x090: EDOMAIN_SYNGEN_3_A
0x091: EDOMAIN_EDMAC_1_WR_M1
0x092: EDOMAIN_EDMAC_7_WR_S1
0x093: EDOMAIN_EDMAC_2_RD_S0
0x094: EDOMAIN_WOMBAT_INTEG
0x095: EDOMAIN_SUSAN
0x096: SYNC_irq_intl50v_st1
0x097: SYNC_irq_intvi4b
0x098: Camif
0x099: TMU_int_occh4SP
0x09A: INTC_XINT *IRQEXT
0x09B: TCU_T5F_INT
0x09C: postman_DIRECTINT1
0x09D: postman_Semaphore1
0x09E: Eeko_TIMER_ICOC_OC1INT*ASYMMETRIC
0x09F: Eeko_TIMER_ICOC_IC1INT*ASYMMETRIC
0x0A0: EDOMAIN_SYNGEN_4_A
0x0A1: EDOMAIN_EDMAC_1_WR_M2
0x0A2: EDOMAIN_EDMAC_7_WR_SS0
0x0A3: EDOMAIN_EDMAC_2_RD_SS0
0x0A4: EDOMAIN_WOMBAT_BLOCK
0x0A5: EDOMAIN_OHYITG
0x0A6: SYNC_irq_intlssdv
0x0A7: SYNC_irq_vi4b_set_1
0x0A8: Camif
0x0A9: TMU_int_occh4EP
0x0AA: INTC_XINT *IRQEXT
0x0AB: Aproc_irq_aproc
0x0AC: postman_DIRECTINT2
0x0AD: postman_Semaphore2
0x0AE: rem_REM_INT
0x0AF: zico_timer_irq
0x0B0: EDOMAIN_SYNGEN_STP_A
0x0B1: EDOMAIN_EDMAC_1_WR_M3
0x0B2: EDOMAIN_EDMAC_ATO_WR_SS0
0x0B3: EDOMAIN_EDMAC_3_RD_M0
0x0B4: EDOMAIN_WOMBAT_AE
0x0B5: EDOMAIN_HIP
0x0B6: SYNC_irq_intlssdv_st1
0x0B7: SYNC_irq_vi4b_set_2
0x0B8: Camif
0x0B9: TMU_int_occh5SP
0x0BA: INTC_XINT *IRQEXT
0x0BB: Aproc_irq_aproc
0x0BC: postman_DIRECTINT3
0x0BD: postman_Semaphore3
0x0BE: SDDomain_ADMAC0
0x0BF: HDMAC0_IntrReq1
0x0C0: EDOMAIN_SYNGEN_FRM_A
0x0C1: EDOMAIN_EDMAC_1_WR_M4
0x0C2: EDOMAIN_EDMAC_ATO_WR_SS1
0x0C3: EDOMAIN_EDMAC_3_RD_OPT_RICH
0x0C4: EDOMAIN_COMBAT_INTEG
0x0C5: EDOMAIN_RASH
0x0C6: SYNC_irq_intp
0x0C7: SYNC_irq_vi4b_set_3
0x0C8: Camif
0x0C9: TMU_int_occh5EP
0x0CA: INTC_XINT *IRQEXT
0x0CB: Aproc_irq_aproc
0x0CC: postman_DIRECTINT4
0x0CD: postman_fifi_err0
0x0CE: SDDomain_ADMAC1
0x0CF: HDMAC0_IntrReq2
0x0D0: EDOMAIN_SYNGEN_1_B
0x0D1: EDOMAIN_EDMAC_1_WR_S0
0x0D2: EDOMAIN_EDMAC_ATO_WR_SS2
0x0D3: EDOMAIN_EDMAC_3_RD_OPT_LITE
0x0D4: EDOMAIN_COMBAT_BLOCK
0x0D5: EDOMAIN_RSHD
0x0D6: SYNC_irq_intp_st1
0x0D7: SYNC_vi_out12
0x0D8: Camif
0x0D9: TMU_int_icapch0
0x0DA: INTC_XINT *IRQEXT
0x0DB: Aproc_irq_aproc
0x0DC: postman_DIRECTINT5
0x0DD: SATA_irq_sata
0x0DE: SDDomain_ADMAC2
0x0DF: HDMAC0_IntrReq3
0x0E0: EDOMAIN_SYNGEN_2_B
0x0E1: EDOMAIN_EDMAC_1_WR_SS0
0x0E2: EDOMAIN_ORCA_1
0x0E3: EDOMAIN_EDMAC_DAF_RD_M0
0x0E4: EDOMAIN_WEABER1
0x0E5: (reserved)
0x0E6: SYNC_irq_inte
0x0E7: Camif
0x0E8: Camif
0x0E9: TMU_int_icapch1
0x0EA: INTC_XINT *IRQEXT
0x0EB: Aproc_irq_aproc
0x0EC: postman_DIRECTINT6
0x0ED: PCIe_irq_pcie
0x0EE: SDDomain_SDCON0
0x0EF: HDMAC0_IntrReq4
0x0F0: EDOMAIN_SYNGEN_3_B
0x0F1: EDOMAIN_EDMAC_1_WR_SS1
0x0F2: EDOMAIN_ORCA_2
0x0F3: EDOMAIN_EDMAC_DAF_RD_S0
0x0F4: EDOMAIN_WEABER2
0x0F5: (reserved)
0x0F6: SYNC_irq_inte_st1
0x0F7: Camif
0x0F8: Camif
0x0F9: TMU_int_icapch2
0x0FA: INTC_XINT *IRQEXT
0x0FB: Aproc_irq_aproc
0x0FC: postman_DIRECTINT7
0x0FD: PCIe_irq_pcie
0x0FE: SDDomain_SDCON1
0x0FF: HDMAC0_IntrReq5
0x100: EDOMAIN_SYNGEN_4_B
0x101: EDOMAIN_EDMAC_1_WR_SS2
0x102: EDOMAIN_ORCA_3
0x103: EDOMAIN_EDMAC_DAF_RD_S1
0x104: EDOMAIN_HISTORY
0x105: (reserved)
0x106: SYNC_-
0x107: SSIO_SSIOINT
0x108: Camif
0x109: TMU_int_icapch3
0x10A: INTC_XINT *IRQEXT
0x10B: Aproc_irq_aproc
0x10C: cclime_msgcom_int0
0x10D: PCIe_irq_pcie
0x10E: SDDomain_SDCON2
0x10F: HDMAC0_IntrReq6
0x110: EDOMAIN_SYNGEN_STP_B
0x111: EDOMAIN_EDMAC_1_WR_SS3
0x112: EDOMAIN_ORCA_4
0x113: EDOMAIN_EDMAC_MAP_RD_S0
0x114: EDOMAIN_HISTORY2_1
0x115: (reserved)
0x116: SYNC_-
0x117: SIO0_SIO0INT
0x118: Camif
0x119: TMU_int_icapch4
0x11A: INTC_XINT *IRQEXT
0x11B: Aproc_irq_aproc
0x11C: cclime_msgcom_int1
0x11D: UHS2_irq_uhs2
0x11E: XDMAC_XDMAC_0
0x11F: HDMAC0_IntrReq7
0x120: EDOMAIN_SYNGEN_FRM_B
0x121: EDOMAIN_EDMAC_1_WR_SS4
0x122: EDOMAIN_ORCA_5
0x123: EDOMAIN_EDMAC_5_RD_M0
0x124: EDOMAIN_HISTORY2_2
0x125: (reserved)
0x126: SYNC_-
0x127: SIO1_SIO1INT
0x128: Camif
0x129: TMU_int_icapch5
0x12A: INTC_XINT *IRQEXT
0x12B: Aproc_irq_aproc
0x12C: cclime_msgcom_int2
0x12D: UHS2_irq_uhs2
0x12E: XDMAC_XDMAC_1
0x12F: irq_mdomain_i2i_0
0x130: EDOMAIN_HEAD_ERR/ATOMIC_ERR
0x131: EDOMAIN_EDMAC_1_WR_SS5
0x132: EDOMAIN_ORCA_6
0x133: EDOMAIN_EDMAC_5_RD_M1
0x134: EDOMAIN_HISTORY2_3
0x135: (reserved)
0x136: SYNC_-
0x137: SIO2_SIO2INT
0x138: Camif
0x139: TMU_int_icapch6
0x13A: INTC_XINT *IRQEXT
0x13B: Aproc_irq_aproc
0x13C: cclime_msgcom_int3
0x13D: USB_hibiki_h
0x13E: XDMAC_XDMAC_2
0x13F: irq_mdomain_i2i_1
0x140: EDOMAIN_HEAD_ERR2
0x141: EDOMAIN_EDMAC_2_WR_M0
0x142: EDOMAIN_ORCA_7
0x143: EDOMAIN_EDMAC_5_RD_S0
0x144: EDOMAIN_HISTORY2_4
0x145: (reserved)
0x146: SYNC_irq_lss
0x147: SIO3_SIO3INT
0x148: Camif
0x149: TMU_int_icapch7
0x14A: INTC_XINT *IRQEXT
0x14B: adomain_xmon0
0x14C: cclime_msgcom_int4
0x14D: USB_hibiki_d
0x14E: XDMAC_XDMAC_3
0x14F: irq_mdomain_i2i_2
0x150: EDOMAIN_HEAD_ERR3
0x151: EDOMAIN_EDMAC_2_WR_S0
0x152: EDOMAIN_ORCA_8
0x153: EDOMAIN_EDMAC_5_RD_SS0
0x154: EDOMAIN_BIKING
0x155: TSENS_irq_tsens
0x156: SYNC_irq_lss_st1
0x157: SIO4_SIO4INT
0x158: Camif
0x159: TMU_int_icapch8
0x15A: INTC_XINT *IRQEXT
0x15B: adomain_xmon1
0x15C: cclime_msgcom_int5
0x15D: UART0 RX_IntReqRx
0x15E: DSI_irq_dsi
0x15F: irq_mdomain_a2i_cclime
0x160: EDOMAIN_HEAD_ERR4
0x161: EDOMAIN_EDMAC_2_WR_SS0
0x162: EDOMAIN_ORCA_9
0x163: EDOMAIN_EDMAC_5_RD_SS1
0x164: EDOMAIN_CAPTAIN
0x165: XDMAC_XDMAC_ABORT
0x166: SYNC_vi_out0
0x167: SIO5_SIO5INT
0x168: Camif
0x169: TMU_int_icapch9
0x16A: INCT_XINT *IRQEXT
0x16B: adomain_xmon2
0x16C: cclime_msgcom_int6
0x16D: UART0 TX_IntReqTx
0x16E: HDMI_irq_hdmi
0x16F: SROMC0_oIRQ_TX
0x170: EDOMAIN_HEAD_ERR5
0x171: EDOMAIN_EDMAC_3_WR_M0
0x172: EDOMAIN_SWAN_GV_END
0x173: EDOMAIN_EDMAC_5_RD_SS2
0x174: EDOMAIN_OPTI0
0x175: SYNC_vi_out13
0x176: SYNC_vi_out1
0x177: SIO6_SIO6INT
0x178: mario_mario
0x179: TMU_int_icapch10
0x17A: INTC_XINT *IRQEXT
0x17B: adomain_xmon3
0x17C: cclime_msgcom_int7
0x17D: UART1 RX_IntReqRx
0x17E: HDMI_irq_hdmi
0x17F: SROMC0_oIRQ_RX
0x180: EDOMAIN_HEAD_ERR6
0x181: EDOMAIN_EDMAC_3_WR_S0
0x182: EDOMAIN_PLANET_WR_0
0x183: EDOMAIN_EDMAC_6_RD_S0
0x184: EDOMAIN_OPTI1
0x185: SYNC_vi_out14
0x186: SYNC_vi_out2
0x187: SIO7_SIO7INT
0x188: mario_mario
0x189: TMU_int_icapch11
0x18A: INTC_XINT *IRQEXT
0x18B: cclime_citron_int
0x18C: cclime_sdcon_int
0x18D: UART1 TX_IntReqTx
0x18E: PMU_irq_pmu
0x18F: SROMC0_oIRQ_FAULT
0x190: EDOMAIN_SAP1
0x191: EDOMAIN_EDMAC_3_WR_SS0
0x192: EDOMAIN_PLANET_WR_1
0x193: EDOMAIN_EDMAC_6_RD_S1
0x194: EDOMAIN_DAFIGARO
0x195: SYNC_vi_out15
0x196: SYNC_vi_out3
0x197: swimmy_irq_sitter
0x198: mario_mario
0x199: TMU_INT_SWA_ONLY
0x19A: INTC_XINT *IRQEXT
0x19B: cclime_tdmac0_int
0x19C: cclime_others_int
0x19D: UART2 RX_IntReqRx
0x19E: HARB_harbInt
0x19F: SROMC0_oERR_COLLECT
0x1A0: EDOMAIN_SAP2
0x1A1: EDOMAIN_EDMAC_DAF_WR_S0
0x1A2: EDOMAIN_PLANET_RD_0
0x1A3: EDOMAIN_EDMAC_6_RD_SS0
0x1A4: EDOMAIN_EDMAC_6_RD_SS5
0x1A5: SYNC_irq_intvi5
0x1A6: SYNC_vi_out4
0x1A7: swimmy_irq_endev
0x1A8: mario_mario
0x1A9: TMU_INT_SWB_ONLY
0x1AA: INCT_XINT *IRQEXT
0x1AB: cclime_tdmac1_int
0x1AC: cclime_slotb_sddat1_int *IRQEXT
0x1AD: UART2 TX_IntReqTx
0x1AE: RSTGEN_WDTINT
0x1AF: SROMC1_oIRQ_TX
0x1B0: EDOMAIN_SAP3
0x1B1: EDOMAIN_EDMAC_MAP_WR_SS0
0x1B2: EDOMAIN_PLANET_RD_1
0x1B3: EDOMAIN_EDMAC_6_RD_SS1
0x1B4: EDOMAIN_EDMAC_6_RD_SS6
0x1B5: dolphin
0x1B6: SYNC_vi_out5
0x1B7: swimmy_irq_sven
0x1B8: mario_mario
0x1B9: TMU_INT_SWC_ONLY
0x1BA: INTC_XINT *IRQEXT
0x1BB: cclime_tdmac2_int
0x1BC: cclime_slotd_sddat1_int *IRQEXT
0x1BD: I2C0_TIRQ
0x1BE: I2C1_TIRQ
0x1BF: SROMC1_oIRQ_RX
0x1C0: EDOMAIN_ATOMIC_LIP
0x1C1: EDOMAIN_EDMAC_MAP_WR_SS1
0x1C2: EDOMAIN_JP52
0x1C3: EDOMAIN_EDMAC_6_RD_SS2
0x1C4: EDOMAIN_EDMAC_6_RD_SS7
0x1C5: dolphin
0x1C6: SYNC_vi_out6
0x1C7: ALGS_irq_algs
0x1C8: mario_mario
0x1C9: TMU_INT_SWD_ONLY
0x1CA: INTC_IRQ_soft_out*ASYMMETRIC
0x1CB: cclime_tdmac3_int
0x1CC: (reserved)
0x1CD: I2C0_RIRQ
0x1CE: I2C1_RIRQ
0x1CF: SROMC1_oIRQ_FAULT
0x1D0: EDOMAIN_PENTA
0x1D1: EDOMAIN_EDMAC_5_WR_M0
0x1D2: EDOMAIN_EDMAC_OPERA_WR
0x1D3: EDOMAIN_EDMAC_6_RD_SS3
0x1D4: EDOMAIN_EDMAC_DAN_RD
0x1D5: dolphin
0x1D6: int_tm_misc_cpu_handshake0*ASYMMETRIC
0x1D7: ALGS_irq_algs
0x1D8: mario_mario
0x1D9: irq_mcpu_SCUEVABORT *IRQEXT
0x1DA: irq_mcpu_SLVERRINTR
0x1DB: irq_mcpu
0x1DC: (reserved)
0x1DD: I2C0_SIRQ
0x1DE: I2C1_SIRQ
0x1DF: SROMC1_oERR_COLLECT
0x1E0: EDOMAIN_SANTA
0x1E1: EDOMAIN_EDMAC_5_WR_S0
0x1E2: EDOMAIN_EDMAC_OPERA_RD
0x1E3: EDOMAIN_EDMAC_6_RD_SS4
0x1E4: EDOMAIN_EDMAC_7_RD_S0
0x1E5: dolphin
0x1E6: int_tm_misc_cpu_handshake1*ASYMMETRIC
0x1E7: GLDA_irq_glda
0x1E8: mario_mario
0x1E9: irq_mcpu_DECERRINTR
0x1EA: irq_mcpu_L2CCINTR
0x1EB: irq_mcpu
0x1EC: MONI_moniout(0)*IRQEXT
0x1ED: MONI_moniout(1)*IRQEXT
0x1EE: MONI_moniout(2)*IRQEXT
0x1EF: MONI_moniout(3)*IRQEXT
0x1F0: INTC_ANDINT(0)*ASYMMETRIC
0x1F1: INTC_ANDINT(1)*ASYMMETRIC
0x1F2: INTC_ANDINT(2)*ASYMMETRIC
0x1F3: INTC_ANDINT(3)*ASYMMETRIC
0x1F4: INTC_ANDINT(4)*ASYMMETRIC
0x1F5: INTC_ANDINT(5)*ASYMMETRIC
0x1F6: DEBSIO
0x1F7: XIMR_irq_ximr
0x1F8: mario_mario
0x1F9: irq_mcpu_ECNTRINTR
0x1FA: INTC_ANDINT(0)*ASYMMETRIC
0x1FB: INTC_ANDINT(1)*ASYMMETRIC
0x1FC: INTC_ANDINT(2)*ASYMMETRIC
0x1FD: INTC_ANDINT(3)*ASYMMETRIC
0x1FE: INTC_ANDINT(4)*ASYMMETRIC
0x1FF: INTC_ANDINT(5)*ASYMMETRIC
Title: Re: Canon EOS R / RP
Post by: Corallaro on January 13, 2021, 01:21:58 PM
Quote from: sombree on December 27, 2020, 07:32:03 PM
This Canon Basic script enables silent shutter on RP:
private sub Initialize()
    ExecuteEventProcedure("sht_EnableManualSilent")
end sub

Works in M, Av, Tv and P both in single and continuous modes. Works fine with interval timer. Fails with ERR70 in bulb.

Hi sombree
where did you find this command? (sht_EnableManualSilent)
I couldn't find any documentation.
Thanks
Giovanni
Title: Re: Canon EOS R / RP
Post by: kitor on January 13, 2021, 03:30:29 PM
QuoteThis Canon Basic script enables silent shutter on RP:

You quoted all the keywords you need to find proper thread on this forum ;)
Title: Re: Canon EOS R / RP
Post by: Corallaro on January 13, 2021, 04:23:23 PM
Quote from: kitor on January 13, 2021, 03:30:29 PM
You quoted all the keywords you need to find proper thread on this forum ;)
Hi
FOUND
Many thanks!
Title: Re: Canon EOS R / RP
Post by: Capture.cr2 on February 06, 2021, 08:22:44 PM
Hi there,
I am a 17-year old guy from Germany who loves the RP cause he's to broke for an C-Series Cam.

I just wanted to ask if I somehow can help in the development process, due to me (and you all I think...) wanting a ML for it. Especially I am hoping for an 120p option in FHD. I expect removing the 4K Crop or adding 60p in 4K not beein possible ?

Regard
Johannes
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 07, 2021, 01:13:46 PM
ML project has never been able to enhance built-in fps by a margin of 2.
And our magic balls have all been confiscated by the llluminati.

Join the unofficial (but kind of official) ML Discord server.
Coon has begun to document some findings here: https://wiki.magiclantern.fm/cams:rp
Title: Re: Canon EOS R / RP
Post by: 2blackbar on February 07, 2021, 04:32:58 PM
(http://www.quickmeme.com/img/0a/0a2b76fd6d6ef6b4fe0abbff1b45d0469e4baad1f8576f08798b81cc6b1e4fb7.jpg)
Title: Re: Canon EOS R / RP
Post by: coon on February 12, 2021, 12:14:25 AM
I've got a spare mainboard of RP and took some high res pictures of it:

(https://i.ibb.co/WBdQScN/rp-mobo-icu.jpg)

(https://i.ibb.co/8YdPhQG/rp-mobo-mpu.jpg)

I am planning to use this for some experiments which are too dangerous for me doing on cam.
If I can find JTAG somewhere we might be able to unbrick the cam in case of a mistake which would give us more freedom for exploring things.

I've connected a USB-C cable and watched the output on UART:

(https://cdn.discordapp.com/attachments/754146111987646464/808838358344269834/IMG_20210210_001426544_HDR.jpg)

MPU does some output on console but doesn't boot.
When plugging USB-C cable in:


RSTFLG : 0009
Battery Door Open
clearBattery


When closing the battery door switch:

RSTFLG : 0010
No Battery
enableBattUVLOInt
Reg04: 48/68, Reg0D: 00/20, Reg14: 5F/5F
RSTFLG : 0010
Battery Door Open
clearBattery


Real RP does also not boot with only having USB-C connected since it is only meant for charging but not powering the cam.

Next goal is powering this board up and boot into canon firmware. For that I believe I need to connect a genuine battery.
I think the connector for the battery is that one on the top right on ICU side:

(https://cdn.discordapp.com/attachments/754146111987646464/808970280097284116/unknown.png)

If this should work I'll try to find JTAG after that. I assume it is on this pads above the UART connector:

(https://cdn.discordapp.com/attachments/754146111987646464/809368689442684996/unknown.png)
Title: Re: Canon EOS R / RP
Post by: Roddius on February 15, 2021, 10:25:06 PM
Hello Brothers!
I have been following your post and I find it fascinating the amount of knowledge you have. Although, and quite honestly, I don't understand anything.
I wonder if there is any way to speed up the process of getting ML for Canon EOS R. Some sort of donation, or unexperienced help...

I'm quite open to discussion.

All I need for now is to be able to put a custom overlay in live view as a guide to shoot portraits and it seems ML is the only option.

Thanks a lot!
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 16, 2021, 07:49:23 AM
Quote from: Roddius on February 15, 2021, 10:25:06 PM
I wonder if there is any way to speed up the process of getting ML for Canon EOS R. Some sort of donation,
ATM only bitcoins accepted. May change over the next few months (or not) but it is unlikely you will be able to donate for a particular cam to get ported.

Quote from: Roddius on February 15, 2021, 10:25:06 PM
or unexperienced help...
Specific for R: No and not for at least a few months. Maybe years.

Quote from: Roddius on February 15, 2021, 10:25:06 PM
I'm quite open to discussion.
Long answers linked in this tweet: https://twitter.com/autoexec_bin/status/1360638872116469766


Quote from: Roddius on February 15, 2021, 10:25:06 PM
All I need for now is to be able to put a custom overlay in live view as a guide to shoot portraits and it seems ML is the only option.
Sounds like you have to live with transparent display cover/foil and a marker. Sorry!
Title: Re: Canon EOS R / RP
Post by: Roddius on February 16, 2021, 10:03:04 AM
Sounds like you have to live with transparent display cover/foil and a marker. Sorry!
[/quote]

You made me laugh as I just bought some printable transparent stickers. lol

Thank you so much for your quick and complete answer.
Title: Re: Canon EOS R / RP
Post by: coon on February 24, 2021, 10:17:53 PM
I have analyzed how the ExecuteEventProcedure function calls functions by name and I have found the location where names and function pointers are stored. Thus I was able to dump 2133 stubs from cam:


0x022CC52D: [AECOM_DispFLK]
0x022CC53D: [AECOM_SetFLK]
0x022478D3: [AEITG_]
0x0225A305: [APEX.DebugPropStillPhoto]
0x0225A339: [APEX.DebugSceneMode]
0x0225A411: [APEX.LogLevel]
0x0225A473: [APEX.LogOnly]
0x0225A51B: [APEX.ManualExposureMode]
0x0225A365: [APEX.PoLogLevel]
0x0225A4DD: [APEX.ReCalcStillPhotoParam]
0x0225A4A1: [APEX.RewriteMode]
0x0225A2CD: [APEX.Test1]
0x0225A2C9: [APEX.Test2]
0xE00A854D: [ATest_RegistEventProc]
0xE05D7A95: [ActivateDL]
0xE03AFA87: [ActivateDOS]
0xE05AADD1: [ActivateHotPlug]
0xE005E253: [ActivateImager]
0xE05F4C67: [ActivateRTC]
0xE0420EE7: [AddNoiseFilter]
0xE0092B75: [AddTransMemory]
0xE0092B75: [AddTransparentMemory]
0xE005E309: [AllocateFactoryProgramMemoryArea]
0xE005E2F7: [AllocateFactoryWorkMemoryArea]
0xE0050F37: [AllocateMemory]
0xE0092B69: [AttachToTransMemory]
0xE0092B69: [AttachToTransparentMemory]
0xE052C80F: [BusyChk]
0xE00994D9: [CUCreateTask]
0xE009948F: [CUInitialize]
0xE0099515: [CUOldTsmStart]
0xE05F333F: [CUOldTsmStop]
0xE0099505: [CUPrintTSMonitor]
0xE00994C7: [CUSetBuffer]
0xE00994D3: [CUSetMode]
0xE0099525: [CUSetPrefix]
0xE00994F7: [CUSetPrint]
0xE00994A1: [CUStart]
0xE00994B5: [CUStop]
0xE0099493: [CUTerminate]
0xE005E3D3: [CalcLowBatteryOffsetValue]
0xE05D8509: [CalculateBatSenseOffsetCADET]
0xE05D8505: [CalculateBatSenseOffsetSubCPU]
0xE05D8501: [CalculateBatSenseOffset]
0xE0049405: [CamInfo_Debug]
0xE005E253: [CancelImager]
0xE005E253: [Capture.Create]
0xE005E253: [ChangeDistortionSetForLiveImage]
0xE0050EC7: [CheckAllEventFlag]
0xE03315B3: [CheckAnti]
0xE0050EBB: [CheckAnyEventFlag]
0xE00C64BF: [CheckLCR]
0xE06D7CB7: [CheckSumOfCamif]
0xE05F31D9: [CheckSumOfFixData]
0xE06D7CDD: [CheckSumOfGUIResource]
0xE06D7D29: [CheckSumOfLensData2]
0xE06D7D03: [CheckSumOfLensData]
0xE05F31BD: [CheckSumOfProgramArea]
0xE06D7D4F: [CheckSumOfRasenData]
0xE06D7D75: [CheckSumOfRingData]
0xE06D7DC1: [CheckSumOfTuneData2]
0xE06D7DF3: [CheckSumOfTuneData4]
0xE06D7E19: [CheckSumOfTuneDataMap]
0xE06D7D9B: [CheckSumOfTuneData]
0xE005E381: [ClearDUIDFixFlag]
0xE004939B: [ClearErrHistory]
0xE0050EF3: [ClearEventFlag]
0xE005E3EB: [ClearFactoryMasterFlag]
0xE005E3F3: [ClearFactoryMasterROMProtection]
0xE005E27D: [ClearFactoryMenu]
0xE005E289: [ClearFactoryMode]
0xE0050FA5: [CloseFile]
0xE04F7F4F: [CloseSession]
0xE0063DC1: [Clr_AllMWBMode]
0xE0063DED: [Clr_PartMWBMode]
0xE05F32F3: [CmplForwardData]
0xE05F32F1: [CmplForwardSize]
0xE01BFB5D: [CompTestHDMI]
0xE0420EC9: [CopyNoiseFilter]
0xE005E253: [CreateAdjustmentTableMirror]
0xE05A5A97: [CreateCountingSemaphore]
0xE005E253: [CreateDefectTableMirror]
0xE0050EAD: [CreateEventFlag]
0xE05961CD: [CreateProxyOfEventProcedure]
0xE05DA6C3: [CreateTask]
0xE0789515: [CtrlSrvQueue]
0xE035BC57: [DAFMonitor.DetectFocus]
0xE035BAE5: [DAFMonitor.Initiate]
0xE035BC03: [DAFMonitor.Terminate]
0xE017EF2F: [DISP_Evf_GetCurrentTemp]
0xE017EF29: [DISP_Evf_GetStartupTemp]
0xE017EDC5: [DISP_Evf_ReceiveData]
0xE017EDAB: [DISP_Evf_SendData]
0xE017EDE3: [DISP_Evf_StopOrbit]
0xE0133DF9: [DISP_Panel_SendData]
0xE03B00F5: [DOSDebugOff]
0xE03B00EB: [DOSDebugOn]
0xE03AFAD9: [DOSOff]
0xE03AFAD7: [DOSOn]
0xE08E52BD: [DP_WriteDebugFile]
0xE0139171: [DebugSTG_1SectorRead]
0xE01391B1: [DebugSTG_1SectorWrite]
0xE013A46D: [DebugSTG_BatchTest]
0xE013A2B1: [DebugSTG_CacheUnCache]
0xE0138BA1: [DebugSTG_ChangeNews]
0xE013A541: [DebugSTG_CheckUHS2Mode]
0xE0183E47: [DebugSTG_CheckUHSIIHW]
0xE0183BF9: [DebugSTG_ChgSDSpeedMode]
0xE013A4FD: [DebugSTG_ClearSusAddr]
0xE049FF6B: [DebugSTG_CreateDesignateFile]
0xE013989D: [DebugSTG_EasyMount]
0xE01398AF: [DebugSTG_EasyUnMount]
0xE013A2A5: [DebugSTG_EndChain]
0xE049FFDB: [DebugSTG_EngineDriver]
0xE013A3B5: [DebugSTG_ExtendDir]
0xE016D5C3: [DebugSTG_GetCFASTCardInfo]
0xE013A399: [DebugSTG_GetClusterSize]
0xE013A25D: [DebugSTG_GetEmptyInfo]
0xE0138C57: [DebugSTG_GetFatData]
0xE013A375: [DebugSTG_GetFreeCluster]
0xE016B8A5: [DebugSTG_GetSDCardInfo]
0xE0139433: [DebugSTG_GetSDWriteSpeed]
0xE0183D15: [DebugSTG_GetSusAddr]
0xE0139B73: [DebugSTG_GetUHS2CardCapability]
0xE0138BBB: [DebugSTG_Getdriveinfo]
0xE049FDA1: [DebugSTG_InitTSM]
0xE04A05A3: [DebugSTG_IsScriptMode]
0xE0183CFD: [DebugSTG_IsUHS2Card]
0xE0183CE1: [DebugSTG_IsUHSCard]
0xE013A4B9: [DebugSTG_MemorySpeed]
0xE013A417: [DebugSTG_MonPinActivate]
0xE0138BB5: [DebugSTG_NewsGpoRead]
0xE0184195: [DebugSTG_PowerOnFromNoCard]
0xE049FFD3: [DebugSTG_PrintfLogEnable]
0xE0139211: [DebugSTG_RandomWrite]
0xE0183DE3: [DebugSTG_ReadDummyData]
0xE0138B8D: [DebugSTG_ReadReg]
0xE013A409: [DebugSTG_ResetMemAddr]
0xE013A2AB: [DebugSTG_SDPreInit]
0xE018379F: [DebugSTG_SDUhs2Dormant]
0xE018370F: [DebugSTG_SDWRNative]
0xE0183B6B: [DebugSTG_SetSDPowerLimit]
0xE0139B93: [DebugSTG_SetSDRMode]
0xE013A577: [DebugSTG_SetSSCG]
0xE0183CD9: [DebugSTG_SetSleepMode]
0xE01398C7: [DebugSTG_SplitPerformance]
0xE013A29F: [DebugSTG_StartChain]
0xE0139B2D: [DebugSTG_StartInfWrite]
0xE0139B6B: [DebugSTG_StopInfWrite]
0xE0183C93: [DebugSTG_SwitchPll]
0xE01398C1: [DebugSTG_UnMountDevice]
0xE0139D05: [DebugSTG_VFatOpen]
0xE013A0AF: [DebugSTG_VFatSC]
0xE0139ECB: [DebugSTG_VFatSearch]
0xE0183D79: [DebugSTG_WriteDummyData]
0xE0138B65: [DebugSTG_WriteRegData]
0xE013AE29: [DebugSTG_d]
0xE0139399: [DebugSTG_dfile]
0xE0139809: [DebugSTG_fileio]
0xE0138AC3: [DebugSTG_getautable]
0xE0165EC3: [DebugTch_AlterPanelSence]
0xE01BE115: [DebugTch_DebugTSMInit]
0xE0165EC9: [DebugTch_Firmup]
0xE061D745: [DebugTch_GetICVer]
0xE0166183: [DebugTch_JDI_LAM_Cmd_StartScan]
0xE016618D: [DebugTch_JDI_LAM_Cmd_StopScan]
0xE0193E71: [DebugTch_JDI_LAM_ReadProductID]
0xE016608D: [DebugTch_JDI_LAM_Read]
0xE01660FB: [DebugTch_JDI_LAM_Write]
0xE0165FBD: [DebugTch_LargeObject]
0xE016605D: [DebugTch_RES_TFT]
0xE0165EB1: [DebugTch_RegNotifyTouch]
0xE016613B: [DebugTch_Rhoge]
0xE0165F87: [DebugTch_SetINTC]
0xE0165EB7: [DebugTch_StartInform]
0xE0165EBD: [DebugTch_StopInform]
0xE0165FF5: [DebugTch_TerminalColor2]
0xE016601F: [DebugTch_TerminalColor3]
0xE0165FC9: [DebugTch_TerminalColor]
0xE0165FA3: [DebugTch_WaitInt]
0xE0165F59: [DebugTch_WhichDrive]
0xE0166163: [DebugTch_Whoge]
0xE0050EB5: [DeleteEventFlag]
0xE0596205: [DeleteProxyOfEventProcedure]
0xE05A5AD1: [DeleteSemaphore]
0xE0092B5D: [DetachToTransMemory]
0xE0092B5D: [DetachToTransparentMemory]
0xE005E3AB: [DeviceUniqueIDCheckSum]
0xE0788D09: [DisableBootDisk]
0xE00E75FF: [DisableCardNoiseChk]
0xE0788D31: [DisableFirmware]
0xE06A8631: [DisableFnoCorrect]
0xE005E3FF: [DisableISDriveError]
0xE03DE00F: [DisableISTripod]
0xE062A825: [DisableLinearOffset]
0xE06D3207: [DisableLvAccumGain]
0xE06D31EB: [DisableLvFnoCorrect]
0xE06D31FD: [DisableLvLinearOffset]
0xE0788D65: [DisableMainFirm]
0xE05AA37D: [DisablePowerSaveWithID]
0xE05AA11B: [DisablePowerSave]
0xE05AA385: [DisableSelfRefreshWithID]
0xE00EA4CB: [DispColor]
0xE005DB19: [DispCon_ColorBarForShowYuv]
0xE005DBB9: [DispCon_ConnectHDMI]
0xE005DBD7: [DispCon_DisconnectHDMI]
0xE005DC3F: [DispCon_GetCurrentVRAM]
0xE005DBB5: [DispCon_GetLcdGainAdjParameter]
0xE005DBDB: [DispCon_PrepareDramCheck]
0xE005DC3D: [DispCon_SaveLcdGainAdjParameter]
0xE005DC8D: [DispCon_SetBackLightWhite]
0xE005D9B7: [DispCon_SetDisplayTypeLCD]
0xE005D8C5: [DispCon_SetDisplayType]
0xE005D9D1: [DispCon_SetExEvfBackLight]
0xE005DBB7: [DispCon_SetLcdGainAdjParameter]
0xE005D987: [DispCon_SetMaxBackLightBrightness]
0xE005D9E9: [DispCon_ShowBlackChart]
0xE005DA37: [DispCon_ShowBlueChart]
0xE005DA6B: [DispCon_ShowColorBar]
0xE005D2B9: [DispCon_ShowColorChart]
0xE005D8EF: [DispCon_ShowCustomColorBar]
0xE005D93D: [DispCon_ShowFiveStep]
0xE005DA1D: [DispCon_ShowGreenChart]
0xE005DAB3: [DispCon_ShowNStepsChart]
0xE005DA03: [DispCon_ShowRedChart]
0xE005DA51: [DispCon_ShowWhiteChart]
0xE005DB79: [DispCon_ShowYuvData]
0xE005DC45: [DispCon_ShowYuvFileForExEVF]
0xE005D8B3: [DispCon_TurnOffDisplay]
0xE005DAF9: [DispCon_TurnOnBackLightForCheckVoltage]
0xE005D8AF: [DispCon_TurnOnDisplay]
0xE005E253: [DispDev.Create]
0xE00EA7DF: [DispLayerOff]
0xE00EA73F: [DispLayerOn]
0xE00EAAFF: [DispMarker]
0xE032D74D: [DispOpe_FixDisplayTypeEVF]
0xE032D741: [DispOpe_FixDisplayTypeTFT]
0xE0405DAB: [DispRealFrame]
0xE00EABA5: [DispSaveProperty]
0xE00EAA05: [DispSioMon]
0xE00EAB2D: [DlphWriteReg]
0xE005E253: [Driver.Create]
0xE00EAB6D: [DumpEvfReg]
0xE00EAB37: [DumpPanelReg]
0xE0194651: [DumpSinkSupport]
0xE005E2EF: [DumpSlaveLogData]
0xE005E2F3: [DumpSlaveOldLogData]
0xE005E2EB: [DumpSubCPULogData]
0xE0092AF5: [DumpTransparentMemory]
0x0229E271: [EF.2]
0x0225DD85: [EF.Activate]
0x0225DB9F: [EF.BltEttlAdj]
0x0225DB57: [EF.BltEttlFlash]
0x0225D7BF: [EF.BuiltInFlashChargeStop]
0x0225D8B9: [EF.BuiltInFlashCharge]
0x0225D5FB: [EF.BuiltInFlashFlashWirelessData]
0x0225D63D: [EF.BuiltInFlashFlashWirelessPulse]
0x0225D7F5: [EF.BuiltInFlashFlash]
0x0225D7CB: [EF.BuiltInFlashFullFlash]
0x0225D681: [EF.BuiltInFlashGetFlashAdValue]
0x0225D879: [EF.BuiltInFlashReady]
0x0225D7AB: [EF.BuiltInFlashSetAdjFlashTime]
0x0225D77F: [EF.BuiltInFlashSetFlashVolume]
0x0225DB0F: [EF.BuiltInFlashSetMainFlashTime]
0x0225D653: [EF.BuiltInFlashSetWirelessParam]
0x0225D6A1: [EF.BuiltInFlashTrigger]
0x0225D5B1: [EF.ChangeState_to_HotShoeState]
0x0225DD73: [EF.EFTest]
0x0225DC3D: [EF.ETAD_Test]
0x0225D585: [EF.ExtFlashFlash]
0x0225D565: [EF.ExtFlashNotifyRearCurtainDriveEnd]
0x0225D56F: [EF.ExtFlashNotifyRearCurtainStartTime]
0x0225D55B: [EF.ExtFlashPostProcess]
0x0225D5A7: [EF.ExtFlashPreProcess]
0x0225D537: [EF.ExtFlashSingleComm]
0x0225D5CB: [EF.ExtFlashTest]
0x0225D5C7: [EF.ExtGetIntegValue]
0x0225DC87: [EF.GetChar]
0x0225DB49: [EF.HookPreFlashResult]
0x0225DD77: [EF.IsActivated]
0x0225D511: [EF.MCellFlashCheck]
0x0225DB37: [EF.PreFlashReady]
0x0225D5BB: [EF.RenewCommOperate]
0x0225D5D7: [EF.SetFlashRestrictionState]
0x0225DC4D: [EF.SetState]
0x0225DC8D: [EF.Shoot]
0x0225DC17: [EF.TempAdj]
0x0225D51D: [EF.XOutControl]
0x0225EE85: [EF.]
0x0225D501: [EF.test_spi]
0x0225DD9B: [EF_]
0xE03B35AD: [EIS_SubPrintEnable]
0xE03B357F: [EIS_TestShmemRead]
0xE05F36BD: [EepromRingWriteTime]
0xE004F761: [ElectricCurrentFirm]
0xE0788CF7: [EnableBootDisk]
0xE00E75F7: [EnableCardNoiseChk]
0xE05AB183: [EnableExternalMIC]
0xE0788D19: [EnableFirmware]
0xE06A8639: [EnableFnoCorrect]
0xE05AB0E9: [EnableHDMI]
0xE05AB123: [EnableHeadPhoneOut]
0xE005E3FB: [EnableISDriveError]
0xE03DE005: [EnableISTripod]
0xE05AB15F: [EnableInternalMIC]
0xE062A825: [EnableLinearOffset]
0xE06D3207: [EnableLvAccumGain]
0xE06D31D9: [EnableLvFnoCorrect]
0xE06D31FD: [EnableLvLinearOffset]
0xE0788D57: [EnableMainFirm]
0xE03DD3C1: [EnableMovieVectorFB]
0xE05AA381: [EnablePowerSaveWithID]
0xE05AA195: [EnablePowerSave]
0xE05AA389: [EnableSelfRefreshWithID]
0xE0421065: [EndGraphics]
0xE03DDDA1: [EndGyroAdjust]
0xE004986D: [ErrorHandlerDevelopMode]
0xE0595C2F: [ExecuteEventProcedure]
0xE005E295: [ExecuteTestRecDevelopProcess]
0xE005E291: [ExecuteTestRec]
0xE05DA8B1: [ExitTask]
0xE0595D5D: [ExportToEventProcedure]
0xE005E301: [FA.Create]
0xE00929AF: [FAC_LensRegist]
0xE005E2D5: [FADBGPrintf]
0xE005B5DD: [FAE_AdKizDetPath]
0xE005B7AD: [FAE_AddSubPath]
0xE005B739: [FAE_DefoePath]
0xE005B623: [FAE_DetectDefectMarge]
0xE005B5E1: [FAE_DetectDefect]
0xE005B837: [FAE_FurikakePath]
0xE005B65D: [FAE_GetSensDefect]
0xE005B687: [FAE_OrbbenPath]
0xE005E2BD: [FAPrintf]
0xE005E319: [FA_ActivateModule]
0xE0091049: [FA_AddProperty]
0xE005E513: [FA_AdjustLowBattValue]
0xE00923C5: [FA_AdjustWhiteBalance]
0xE005E353: [FA_AllActivate]
0xE00936ED: [FA_AudApplyICReg]
0xE00936E5: [FA_AudChangeFilParam]
0xE00936E9: [FA_AudChangeMicGainParam]
0xE00936D5: [FA_AudGetAudioParam]
0xE0093A57: [FA_AudGetBalanceData]
0xE00935BD: [FA_AudGetHPDetect]
0xE00935C1: [FA_AudGetHdmiDetect]
0xE00936E1: [FA_AudGetICReg]
0xE00935C5: [FA_AudGetInLevel]
0xE0093A69: [FA_AudGetInPut]
0xE0093A95: [FA_AudGetOutPut]
0xE00935C9: [FA_AudGetRecLevel]
0xE00939E7: [FA_AudInitVolume]
0xE00936CD: [FA_AudSetAudioParam]
0xE0093A5B: [FA_AudSetBalanceData]
0xE0093A77: [FA_AudSetICAmp]
0xE0093A6D: [FA_AudSetICDrive]
0xE00936D9: [FA_AudSetICReg]
0xE0093A89: [FA_AudSetOutPut]
0xE00939D1: [FA_AudSetSignalProc]
0xE0093A45: [FA_AudSetVolBeepSp]
0xE0093A33: [FA_AudSetVolBeep]
0xE0093A0F: [FA_AudSetVolBuzzer]
0xE0093A21: [FA_AudSetVolTouch]
0xE00939E1: [FA_AudSetVolumeDial]
0xE00935CF: [FA_AudStartPlayWaveData]
0xE00935D3: [FA_AudStopPlayWaveData]
0xE0093ACD: [FA_Aud_ATT]
0xE00935DB: [FA_Aud_ClearRec]
0xE0093AB7: [FA_Aud_ExtractFixData]
0xE0093AF9: [FA_Aud_In_VolumeReg]
0xE0093AE1: [FA_Aud_In_Volume]
0xE0093A99: [FA_Aud_OnlyBlockStart]
0xE0093AA9: [FA_Aud_OnlyBlockStop]
0xE0093AFF: [FA_Aud_Out_Volume]
0xE0093B05: [FA_Aud_PlayWaveVolume]
0xE00935D7: [FA_Aud_PrepareRec]
0xE0093ABB: [FA_Aud_SetFromConf]
0xE00935DF: [FA_Aud_StartRec]
0xE0093633: [FA_Aud_StopRec]
0xE0093AC1: [FA_Aud_WindCut]
0xE0093A05: [FA_AudioBeepFileStart]
0xE00939EB: [FA_AudioBeepStart]
0xE00939F9: [FA_AudioBeepStop]
0xE00939DD: [FA_AudioGetMicDetect]
0xE00936B9: [FA_AudioInitialize]
0xE0093B39: [FA_AudioNoise]
0xE00936A1: [FA_AudioPlayStartEx]
0xE00936AB: [FA_AudioPlayStart]
0xE00936B5: [FA_AudioPlayStop]
0xE0093B33: [FA_AudioPrint]
0xE0093637: [FA_AudioRecStartEx]
0xE0093691: [FA_AudioRecStart]
0xE009369D: [FA_AudioRecStop]
0xE00936C3: [FA_AudioTerminate]
0xE08F787B: [FA_BLECheckBLEAssembly]
0xE08F77F9: [FA_BLEEndFactoryMode]
0xE08F78D9: [FA_BLEFirmUp]
0xE08F7811: [FA_BLEGetBdAddr]
0xE08F788F: [FA_BLEGetModuleNum]
0xE08F77E1: [FA_BLEStartFactoryMode]
0xE08F7853: [FA_BLEStartScanBdAddr]
0xE08F7867: [FA_BLEStopScanBdAddr]
0xE005D52F: [FA_COM_SetCamera]
0xE005E53B: [FA_CalculateLowBattAdjValue]
0xE00909E1: [FA_ClearBitProperty32]
0xE005B097: [FA_ClearReleaseModeForSR]
0xE005AFAF: [FA_ConvertTv2AEAccumH]
0xE08F7019: [FA_CopyAVoltageBoardInf]
0xE08F7049: [FA_CopySecurityBoardInf]
0xE08F7131: [FA_CopyVistaUniqueID]
0xE005CE61: [FA_CreateCenterColor]
0xE009267D: [FA_CreateClrAdjustShootingInfo]
0xE005CDA9: [FA_CreateColor]
0xE005CDED: [FA_CreateGradColor]
0xE005CDCB: [FA_CreateMixColor]
0xE005CE3F: [FA_CreateRGBWPanelColor]
0xE00598C9: [FA_CreateTestImageEx]
0xE0059763: [FA_CreateTestImage]
0xE009355B: [FA_CreateTimeLapse]
0xE0093B0F: [FA_DebugPrint]
0xE0091651: [FA_DebugShdData]
0xE009199F: [FA_DefectsTestImage]
0xE005CE87: [FA_DeleteColor]
0xE0092FE5: [FA_DeleteFile]
0xE00910A3: [FA_DeleteProperty]
0xE0059C6F: [FA_DeleteTestImageEx]
0xE005983B: [FA_DeleteTestImage]
0xE00919E3: [FA_DetectDefTestImage]
0xE0091A3B: [FA_DetectDefTestMarge]
0xE0091FBB: [FA_DisableAccumGain]
0xE005AF5F: [FA_DisableElectronicShutterCorrection]
0xE005B593: [FA_DisableEvfFrameRateLower]
0xE005B033: [FA_DisableFixedPo]
0xE0091FA1: [FA_DisableFnoCorrect]
0xE0091F79: [FA_DisableLinearOffset]
0xE005B053: [FA_DisableLinerEShutCurve]
0xE0091FCD: [FA_DisableLtkids]
0xE005CD63: [FA_DisplayLayerOff]
0xE0091FB5: [FA_EnableAccumGain]
0xE00935B9: [FA_EnableColorBar]
0xE005B58F: [FA_EnableEvfFrameRateLower]
0xE005B023: [FA_EnableFixedPo]
0xE0091F8D: [FA_EnableFnoCorrect]
0xE0091F65: [FA_EnableLinearOffset]
0xE005B043: [FA_EnableLinerEShutCurve]
0xE0091FC1: [FA_EnableLtkids]
0xE005D3D3: [FA_EndColor]
0xE05BC849: [FA_EndViewFinderData]
0xE00933CD: [FA_FM_GetCardExist]
0xE00933FF: [FA_FM_GetCardWriteProtect]
0xE00934CB: [FA_FM_GetNumOfMovieObject]
0xE05BC999: [FA_FinishRemoteRelease]
0xE0093057: [FA_FormatDrive]
0xE005A3EF: [FA_GetAEIntegBuf]
0xE065FA23: [FA_GetAdapterProperty]
0xE08F793F: [FA_GetBLEFirmVerInICU]
0xE08F78FD: [FA_GetBLEFirmVer]
0xE005A3D7: [FA_GetBlockIntegBuf]
0xE007A0E7: [FA_GetCalendar]
0xE08F6FD1: [FA_GetCheckFlagBoardInf]
0xE08F7001: [FA_GetCheckModelNoInf]
0xE08F6FE9: [FA_GetCheckProgramVersionBoardInf]
0xE005A319: [FA_GetCmosGainAddr]
0xE005E52F: [FA_GetCorrectLowBattValue]
0xE005A377: [FA_GetCrawBuf]
0xE0622FC9: [FA_GetDLDriveMaxADValue]
0xE0622FCD: [FA_GetDLDriveMinADValue]
0xE062303B: [FA_GetDLDriveSettingCycleCount]
0xE0623049: [FA_GetDLDriveSettingCycleIntervalTime]
0xE062300B: [FA_GetDLDriveSettingDeltaFrequency]
0xE0622FF5: [FA_GetDLDriveSettingEndFrequency]
0xE0622FDF: [FA_GetDLDriveSettingStartFrequency]
0xE0623023: [FA_GetDLDriveSettingSweepTime]
0xE005A38F: [FA_GetDPRawBuf]
0xE005E44B: [FA_GetDafImageABAreaData]
0xE005B277: [FA_GetDarkLevel]
0xE005B597: [FA_GetDecryptPcsetFlavorLuckyTable]
0xE009191B: [FA_GetDetectDefCount]
0xE009192F: [FA_GetDetectDefSize]
0xE005A349: [FA_GetDfeGainAddr]
0xE0092F13: [FA_GetFileData]
0xE0092E8F: [FA_GetFileSize]
0xE007A1A7: [FA_GetFixDataCheckSum]
0xE00915B7: [FA_GetFreeSizeOfMemory]
0xE007A1A3: [FA_GetIcuCheckSum]
0xE005E35F: [FA_GetKeySwInfoData]
0xE005E4BB: [FA_GetLensAdpID]
0xE005E4B5: [FA_GetLensInfoData]
0xE005E47F: [FA_GetLensUnsharpMaskCommCheckSum]
0xE005B27F: [FA_GetLvDarkLevel]
0xE005E7D5: [FA_GetMacAddress]
0xE0091F55: [FA_GetObInteg]
0xE005AF15: [FA_GetPITimeData]
0xE005E44F: [FA_GetPredictionData]
0xE0090D77: [FA_GetProperty32]
0xE0090AC1: [FA_GetPropertyAddress]
0xE0090A75: [FA_GetPropertyDataSize]
0xE0090A91: [FA_GetProperty]
0xE0093553: [FA_GetRecCount]
0xE005B581: [FA_GetRefCxCy]
0xE05BC8BD: [FA_GetRemoteReleasePlusImage]
0xE0092447: [FA_GetReverseAdjustSum]
0xE0091AA7: [FA_GetSensDefect]
0xE009161F: [FA_GetTotalSizeOfMemory]
0xE00913C9: [FA_GetTuneDataPropertyList]
0xE05BC85F: [FA_GetViewFinderData]
0xE005E819: [FA_GetWlanModuleNum]
0xE005A3A7: [FA_GetWorkBuf]
0xE005CFA1: [FA_ImgMuteOff]
0xE005CF85: [FA_ImgMuteOn]
0xE005E34D: [FA_InactivateModule]
0xE01C9495: [FA_InitAudioVolumeReg]
0xE005E31F: [FA_IsActivated]
0xE005E343: [FA_IsHotPlugDrvDisableMode]
0xE005E325: [FA_IsMechaDrvDisableMode]
0xE005E32F: [FA_IsStrobeDrvDisableMode]
0xE005E339: [FA_IsTPDrvDisableMode]
0xE005E6FB: [FA_JoinNetwork]
0xE005E725: [FA_LeaveNetwork]
0xE005D18D: [FA_LightMeasureOnOff]
0xE005D519: [FA_LightMeasure]
0xE009101D: [FA_LoadProperty]
0xE009344B: [FA_MVP_ChangePlayCard]
0xE0093431: [FA_MVP_ChangePlayMode]
0xE00933B9: [FA_MVP_GetMovieSize]
0xE00933A1: [FA_MVP_GetPlayTime]
0xE00934AD: [FA_MVP_PlayStart]
0xE005AF63: [FA_MechaShutterClose]
0xE005AF89: [FA_MechaShutterOpen]
0xE0092E49: [FA_MovieEnd]
0xE0092DCB: [FA_MovieStart]
0xE05BCF5B: [FA_NeoFinishRemoteRelease]
0xE05BD087: [FA_NeoRemoteReleaseSw1]
0xE05BCF9D: [FA_NeoRemoteReleaseSw2]
0xE05BD0B9: [FA_NeoRemoteRelease]
0xE005CEEB: [FA_OSDMuteOff]
0xE005CE9F: [FA_OSDMuteOn]
0xE0091B13: [FA_ObIntegTestImage]
0xE05BC825: [FA_PCLVEnd]
0xE05BC837: [FA_PCLVStart]
0xE005E527: [FA_PrepareLowBattValue]
0xE005D1F3: [FA_ReadDispDebugFile]
0xE08F701D: [FA_ReadEepromData]
0xE08F7033: [FA_ReadEepromMultiData]
0xE005E49D: [FA_ReadLensEEPROM]
0xE005D4DB: [FA_ReceiveDispData]
0xE0090E9F: [FA_RegistSavePropertyList]
0xE0059F11: [FA_RegisterPostNextCBR]
0xE0059D4B: [FA_Release]
0xE05BCA65: [FA_RemoteRelease]
0xE005CF69: [FA_ReplaceMuteOff]
0xE005CF4D: [FA_ReplaceMuteOn]
0xE005A48D: [FA_RequestIntegResult]
0xE0079D65: [FA_ResetCalendar]
0xE005B58B: [FA_RestartEvfDevFactorySendJobToEpp]
0xE005E35B: [FA_ResumeSubCPUUSBCharge]
0xE00923ED: [FA_ReverseAdjust]
0xE0090E2B: [FA_SaveAllProperty]
0xE0090F75: [FA_SavePropertyList]
0xE0090DAF: [FA_SaveProperty]
0xE0090A2B: [FA_SeBitProperty32]
0xE009359B: [FA_SelectCard]
0xE0093A63: [FA_SelectInnerMIC]
0xE005D477: [FA_SendDispData]
0xE005E499: [FA_SendLensCommand]
0xE005E7AB: [FA_SendTestPacket]
0xE005B0CB: [FA_SetAccumulateTimeForSR12]
0xE005B0D7: [FA_SetAccumulateTimeForSR14]
0xE005B0E3: [FA_SetAccumulateTimeForSR15]
0xE005B0EF: [FA_SetAccumulateTimeForSR]
0xE065FAF9: [FA_SetAdapterProperty]
0xE0093A83: [FA_SetAudioFilterMicTest]
0xE01C9499: [FA_SetAudioVolumeReg]
0xE0091905: [FA_SetBayerComponent]
0xE005D401: [FA_SetBrightness]
0xE0091895: [FA_SetCRawBitNum]
0xE0079DAD: [FA_SetCalendar]
0xE00924CD: [FA_SetColor]
0xE005B259: [FA_SetContinuasCaptureForFixed]
0xE062303F: [FA_SetDLDriveSettingCycleCount]
0xE062304D: [FA_SetDLDriveSettingCycleIntervalTime]
0xE0623015: [FA_SetDLDriveSettingDeltaFrequency]
0xE0622FFF: [FA_SetDLDriveSettingEndFrequency]
0xE0622FD5: [FA_SetDLDriveSettingNumPattern]
0xE0622FE9: [FA_SetDLDriveSettingStartFrequency]
0xE062302D: [FA_SetDLDriveSettingSweepTime]
0xE00918AB: [FA_SetDarkLevelValue]
0xE005B2A9: [FA_SetDarkLevelforCaptain]
0xE007A291: [FA_SetDefaultNetworkSetting]
0xE00914AB: [FA_SetDefaultSetting]
0xE005B283: [FA_SetDetectAreaforCaptain]
0xE005B293: [FA_SetDetectThresholdforCaptain]
0xE0059F6B: [FA_SetFactoryLens]
0xE005B00B: [FA_SetFixedPo]
0xE005E347: [FA_SetHotPlugDrvDisableMode]
0xE005E453: [FA_SetIBPAFWinPos]
0xE005E48D: [FA_SetIBPCameraAFFrameSetting]
0xE005E487: [FA_SetIBPCameraAFSetting]
0xE005E483: [FA_SetIBPCameraDefaultMenu]
0xE005E493: [FA_SetIBPCameraExpSimSetting]
0xE005E463: [FA_SetIBPDataSetting]
0xE005E473: [FA_SetIBPDriveMode]
0xE005B29B: [FA_SetIdGradeforCaptain]
0xE005E479: [FA_SetLensCommProtcol]
0xE005B26B: [FA_SetLvCaptureStartFrame]
0xE005B22D: [FA_SetLvControlAEParam]
0xE005E329: [FA_SetMechaDrvDisableMode]
0xE08F7505: [FA_SetNeoLvProjectionMode]
0xE007A261: [FA_SetNetworkServerRegion]
0xE0092759: [FA_SetNormalizedRGB]
0xE00918EB: [FA_SetObIntegMode]
0xE00918C1: [FA_SetObWindow]
0xE005E445: [FA_SetPhotoOpeMechalessMode]
0xE00909CD: [FA_SetProperty32]
0xE009093D: [FA_SetProperty]
0xE005D1CF: [FA_SetReadDispDebugFileParam]
0xE0093549: [FA_SetRecInit]
0xE0093557: [FA_SetRecMode]
0xE005B063: [FA_SetReleaseModeForSR]
0xE0090E79: [FA_SetSavePropertyListNum]
0xE0092459: [FA_SetSsWbCoef]
0xE005E333: [FA_SetStrobeDrvDisableMode]
0xE005E33D: [FA_SetTPDrvDisableMode]
0xE005B0FB: [FA_SetVramOutput]
0xE005E749: [FA_StartAddressing]
0xE005D385: [FA_StartCenter]
0xE005D2B9: [FA_StartColor]
0xE0622F7B: [FA_StartDLDrive]
0xE005AEF5: [FA_StartLiveView]
0xE005D2FD: [FA_StartMix]
0xE005B105: [FA_StartNeoLvTestExposureImage]
0xE005D341: [FA_StartRGBW]
0xE0093593: [FA_StartRecord]
0xE0622FC5: [FA_StopDLDrive]
0xE005B587: [FA_StopEvfDevFactorySendJobToEpp]
0xE005A4CD: [FA_StopIntegResult]
0xE005AF05: [FA_StopLiveView]
0xE005B1A1: [FA_StopNeoLvTestExposureImage]
0xE005D43F: [FA_StopOrbit]
0xE0093597: [FA_StopRecord]
0xE0091943: [FA_SubtractTestImage]
0xE005E357: [FA_SuspendSubCPUUSBCharge]
0xE00910CD: [FA_SyncProperty]
0xE01658AD: [FA_TP_BackLightOff]
0xE016585D: [FA_TP_Complete]
0xE0165829: [FA_TP_Prepare]
0xE0165A63: [FA_TP_ReceiveData]
0xE016587F: [FA_TP_ResetTP]
0xE0165915: [FA_TP_SendData]
0xE01658FD: [FA_TP_SetWaitIntTime]
0xE01658D5: [FA_TP_TurnOff]
0xE005CD9B: [FA_TurnOffDisplay]
0xE005CD8D: [FA_TurnOnDisplay]
0xE0059F1B: [FA_UnregisterPostNextCBR]
0xE009249D: [FA_UseAdjustSsDevelopParam]
0xE00926C7: [FA_UseDefaultSsDevelopParam]
0xE0090F61: [FA_WaitSavePropertyList]
0xE005E6B3: [FA_WlanInitialize]
0xE005E6D7: [FA_WlanTerminate]
0xE08F7023: [FA_WriteEepromData]
0xE08F703F: [FA_WriteEepromMultiData]
0xE005E4A5: [FA_WriteLensEEPROM]
0xE005AB13: [FA_WriteMem1File2]
0xE005AB01: [FA_WriteMem1File]
0xE005AB25: [FA_WriteYuvFile]
0xE00927E5: [FA_YuvSsDevelopTestImage]
0xE005B2AF: [FA_colorConvertColor2CxCyForAdjustment]
0xE005B2BF: [FA_colorConvertCxCy2ColorForAdjustment]
0xE005B2B7: [FA_colorGetMatrixForAdjustment]
0xE005E4C7: [FactorySW1]
0xE005E4D5: [FactorySW2]
0xE0049611: [FireErr]
0xE005E311: [FreeFactoryProgramMemoryArea]
0xE005E2FD: [FreeFactoryWorkMemoryArea]
0xE0050F31: [FreeMemory]
0xE05F3771: [FromCustomWriteTime]
0xE05F33AD: [FromEraseTime]
0xE05F3733: [FromLensWriteTime]
0xE05F36F5: [FromRasenWriteTime]
0xE05F367F: [FromRingWriteTime]
0xE05F33DF: [FromSectorWriteTime]
0xE0431251: [GUILiveViewTSM]
0xE005E40B: [GetADValue]
0xE005E3B3: [GetBatteryVoltage]
0xE05C11FD: [GetCCDTemperature]
0xE05F326F: [GetCamSetProp]
0xE0650F11: [GetCameraFlg]
0xE00493E1: [GetCameraInformationData]
0xE005E2B9: [GetCurrentMaximumLogSize]
0xE03AFA3D: [GetDOSState]
0xE05F3381: [GetDebugDataFromFROM]
0xE005E315: [GetFaexeWorkAddress]
0xE005E2AD: [GetFirmwareVersion]
0xE05F392B: [GetGripFirList]
0xE03DD759: [GetGyroDataMultiPitch]
0xE03DD79D: [GetGyroDataMultiRoll]
0xE03DD77B: [GetGyroDataMultiYaw]
0xE03DD977: [GetGyroDataPitch]
0xE03DD99F: [GetGyroDataRoll]
0xE03DD98B: [GetGyroDataYaw]
0xE03DD7BF: [GetGyroHPFINMultiPitch]
0xE03DD803: [GetGyroHPFINMultiRoll]
0xE03DD7E1: [GetGyroHPFINMultiYaw]
0xE03DDD55: [GetGyroHPFINPitch]
0xE03DDD7D: [GetGyroHPFINRoll]
0xE03DDD69: [GetGyroHPFINYaw]
0xE03DE019: [GetISTripodMode]
0xE004F38B: [GetLensExist]
0xE005E2A9: [GetLogData]
0xE05F3907: [GetNumOfGripFir]
0xE005E419: [GetPORTValue]
0xE004F3AD: [GetPostureState]
0xE0050EFB: [GetRand]
0xE005E2B3: [GetSFInfoData]
0xE06795F1: [GetSRShutterType]
0xE08F7791: [GetShakeTripod]
0xE004F3CB: [GetStroboPopUpState]
0xE005E427: [GetSubPORTValue]
0xE0051029: [GetSystemTime]
0xE08F778F: [GetTRIPODModeFlagbyIS]
0xE03B6DFB: [GetTimeOfSystem]
0xE0092B47: [GetTransMemory]
0xE0092B47: [GetTransparentMemoryPosition]
0xE0092B57: [GetTransparentMemorySize]
0xE05D8511: [GetValVbatt]
0xE05A5BBF: [GiveSemaphore]
0xE01D30FB: [GraphFocusPos_DispFocusInfo]
0xE0796699: [GuiDebugAE]
0xE005680D: [GuiDebugInfo]
0xE04314F7: [GuiDialItemInfo]
0xE0268A13: [GvdnMemory]
0xE039B44B: [INDEV_Test_CutMovie]
0xE0183527: [IOPSenarios]
0xE06BBDC9: [ImgSeq_LvDumpFullImg]
0xE06BBDBF: [ImgSeq_LvSetFullImg]
0xE05D7A7B: [InActivateDL]
0xE03AFAA9: [InActivateDOS]
0xE05AB0B7: [InActivateHotPlug]
0xE05F4CA1: [InActivateRTC]
0xE039B58F: [Indev_Test_CFilter]
0xE039B5F1: [Indev_Test_Resize]
0xE039B6CD: [Indev_Test_Trimming]
0xE05C11EB: [InhTempStatus]
0xE0056831: [InitGuiView]
0xE05AB1BD: [InitialOperateHDMI]
0xE005E25F: [InitializeAdjustmentSystem]
0xE06979CB: [InitializeLED]
0xE04F8015: [InitializePTPFrameworkController]
0xE005E26B: [InitializeTestRec]
0xE005E263: [IsAdjustmentSystem]
0xE005E385: [IsDUIDFixFlag]
0xE005E43B: [IsEVFDriveMode]
0xE005E437: [IsEVFDrive]
0xE005E273: [IsFactoryMenu]
0xE005E26F: [IsFactoryMode]
0xE005E25B: [IsNTSC]
0xE039CE93: [IsTransCodeFinish]
0xE0698243: [LEDDrv.Create]
0xE0697D3B: [LEDDrv_SetLEDBlinkCount]
0xE0697BCB: [LEDDrv_SetLED]
0xE0063E21: [LensCorrectDebug]
0xE0056871: [LimitLangJapan]
0xE0056843: [LimitLangOther]
0xE005E3E1: [LoadBatteryAdjData]
0xE005E4F9: [LoadBatteryID]
0xE005E50B: [LoadBatteryKey]
0xE03B03B9: [LoadDOSParam]
0xE005E379: [LoadDUIDCheckSum]
0xE005E36D: [LoadDUID]
0xE005E389: [LoadFactoryAdjData]
0xE005E39D: [LoadFactoryAdjFlag]
0xE05F4F7B: [LoadScript]
0xE06D329D: [LvDisableDebugFnoGain]
0xE06D3211: [LvEnableDebugFnoGain]
0xE06E6B59: [MRRSC_SHOW_MEM]
0xE06E774F: [MRRSC_SHOW_MEM_DISABLE]
0xE06E774F: [MRRSC_SHOW_MEM_ENABLE]
0xE005E253: [Mecha.Create]
0xE05F3881: [MemLVOn]
0xE00EACB3: [MixFailCount]
0xE00830B7: [MonSelCamifFunctionPlus]
0xE0083075: [MonSelCamifFunction]
0xE00831F7: [MonSelCdomainFunction]
0xE008320D: [MonSelCdomainOckickFunction]
0xE00831A5: [MonSelClkgenFunction]
0xE0083155: [MonSelPiassFunctionPlus]
0xE0083113: [MonSelPiassFunction]
0xE008303F: [MonSelToCamif]
0xE00831C1: [MonSelToCdomain]
0xE008316F: [MonSelToClkgen]
0xE00830DD: [MonSelToPiass]
0xE005E257: [MoveFocusDistance]
0xE005E253: [MoveLensToFirstPoint]
0xE005E253: [MoveLensToTerminatePoint]
0xE00D0EFB: [NWFA_GetMacAddress]
0xE00D15D7: [NWFA_GetWlanModuleNum]
0xE00D1503: [NWFA_JoinNetwork]
0xE00D0DB3: [NWFA_LeaveNetwork]
0xE00D159F: [NWFA_SendTestPacket]
0xE00D1535: [NWFA_StartAddressing]
0xE00D0F97: [NWFA_StartPtpIP]
0xE00D142D: [NWFA_StopPtpIP]
0xE00D0CD9: [NWFA_WlanInitialize]
0xE00D0D1F: [NWFA_WlanTerminate]
0xE0044EE1: [NewTaskShell]
0xE00826BD: [NwLimeInit]
0xE00826A7: [NwLimeOn]
0xE0050F99: [OpenFileCREAT]
0xE0050F93: [OpenFileRDWR]
0xE0050F87: [OpenFileRD]
0xE0050F8D: [OpenFileWR]
0xE005E253: [OpenMShutter]
0xE04F7F3D: [OpenSession]
0xE068C615: [PTPRspnd.ShutDownPTPFrameworkClient]
0xE068C5E9: [PTPRspnd.StartUpPTPFrameworkClient]
0xE0050F4D: [Peek16]
0xE0050F49: [Peek32]
0xE0051023: [Peek8]
0xE0050F41: [Poke16]
0xE0050F3D: [Poke32]
0xE0050F45: [Poke8]
0xE0678CB9: [PowerOffCaptureDevice]
0xE0678C9B: [PowerOnCaptureDevice]
0xE0788D75: [PrepareDisableFirmware]
0xE0788D7D: [PrepareEnableFirmware]
0xE005E3AF: [PrintAdjKabotanInfo]
0xE03B0335: [PrintDOSParam]
0xE05AA38D: [PrintIDCnt]
0xE00A413F: [PrintSRClk]
0xE0050F53: [Printf]
0xE005E253: [PutOutNdFilter]
0xE005E253: [QuietImager]
0xE03DDFE9: [RS_Eis_onoff]
0xE02CD2ED: [RTC_CheckCharge]
0xE02CE49D: [RTC_Permit]
0xE02CE4A1: [RTC_Prohibit]
0xE02CD2DD: [RTC_RegRead]
0xE02CD2E3: [RTC_RegWrite]
0xE03AED15: [ReadALS]
0xE03B00FF: [ReadDOSReg]
0xE05F3359: [ReadDebugDataFromFROM]
0xE03AEC4F: [ReadPS]
0xE008548F: [ReadParam_IsExistString]
0xE008537D: [ReadParam_Num]
0xE00853E7: [ReadParam_String]
0xE004F259: [RegisterAutoPowerOffNotify]
0xE004F1C1: [RegisterEmPropMultiCastForScript]
0xE0059F23: [Release]
0xE0050FA1: [RemoveFile]
0xE0092B63: [RemoveTransMemory]
0xE0092B63: [RemoveTransparentMemory]
0xE004F32F: [ReqChgAfDistance]
0xE004F28B: [ReqChgAudioVolumeBeep]
0xE004F37D: [ReqChgAutoPowerOffTime]
0xE004F33D: [ReqChgLvAFSystem]
0xE004F27D: [ReqChgMoviePlayVolume]
0xE004A5ED: [ResetLensData2]
0xE06795F7: [ResetSRShutterType]
0xE005E403: [RomCheckSum]
0xE05F3A23: [SDWriteProtect]
0xE06D820B: [SaveAllRomImageToFile]
0xE06D81F7: [SaveAllTuneToFile]
0xE005E3CF: [SaveBatSenseOffsetAdjustmentTable]
0xE005E3D9: [SaveBatteryAdjData]
0xE005E4F1: [SaveBatteryID]
0xE005E4FF: [SaveBatteryKey]
0xE06D82AB: [SaveBootableToFile]
0xE06D83C3: [SaveCamifToFile]
0xE06D8233: [SaveCustomToFile]
0xE03B039F: [SaveDOSParam]
0xE005E373: [SaveDUIDCheckSum]
0xE005E365: [SaveDUID]
0xE05F3319: [SaveDebug1ToFileRAM]
0xE06D825B: [SaveDebug1ToFileROM]
0xE06D8283: [SaveDebug2ToFileROM]
0xE00493C7: [SaveErrHistory]
0xE06D8413: [SaveErrorToFile]
0xE005E391: [SaveFactoryAdjData]
0xE005E3A3: [SaveFactoryAdjFlag]
0xE06D8F75: [SaveFixToFileForSlave]
0xE06D8105: [SaveFixToFile]
0xE06D82D3: [SaveGUIToFile]
0xE05F38A9: [SaveGkLogToFile]
0xE06D82FB: [SaveLens2ToFile]
0xE06D8323: [SaveLens3ToFile]
0xE06D834B: [SaveLens4ToFile]
0xE06D8373: [SaveLens5ToFile]
0xE06D8109: [SaveLensToFile]
0xE06D839B: [SavePPPToFile]
0xE06D80B5: [SaveRasenToFile]
0xE06D80DD: [SaveRingToFile]
0xE06D83EB: [SaveServiceToFile]
0xE06D81F1: [SaveTune2ToFileForSlave]
0xE06D8159: [SaveTune2ToFile]
0xE06D8187: [SaveTune4ToFile]
0xE06D81B9: [SaveTuneMapToFile]
0xE06D81EB: [SaveTuneToFileForSlave]
0xE06D8131: [SaveTuneToFile]
0xE03315C1: [SaveVRAM]
0xE05F3153: [ScriptAutoRun]
0xE0050FF7: [SeekFileEnd]
0xE04A03FD: [SetAccessLedMode]
0xE0679565: [SetAccumulateMsecTimeForSR14]
0xE0650EC1: [SetCameraFlgWithWrite]
0xE0650E35: [SetCameraFlg]
0xE0069D0B: [SetClkGearFlgPU0]
0xE00444FD: [SetClkGearFlgPU1]
0xE03AFFA9: [SetDOSIled]
0xE03AFF0B: [SetDOSMode]
0xE03B00E7: [SetDOSPers]
0xE03AFF03: [SetDOSPsOffSet]
0xE03AFE2B: [SetDOSVthH]
0xE03AFD55: [SetDOSVthL]
0xE005E37D: [SetDUIDFixFlag]
0xE0063E29: [SetDloTestMode]
0xE0331647: [SetDrawWait]
0xE0050EEB: [SetEventFlag]
0xE005E3E7: [SetFactoryMasterFlag]
0xE005E3EF: [SetFactoryMasterROMProtection]
0xE005E277: [SetFactoryMenu]
0xE0788D85: [SetFactoryModeFlag]
0xE005E285: [SetFactoryMode]
0xE005E4C1: [SetFactorySW]
0xE005681F: [SetGuiSpecialMode]
0xE03DDD0D: [SetGyroHPFINOffsetPitch]
0xE03DDD3D: [SetGyroHPFINOffsetRoll]
0xE03DDD25: [SetGyroHPFINOffsetYaw]
0xE005E3B7: [SetInputVoltage]
0xE005E4EB: [SetOLCLightingFunc]
0xE005E411: [SetPORTValue]
0xE0063E19: [SetPrintAngelParam]
0xE0063E31: [SetPrintApiParam]
0xE00A412D: [SetSRClk]
0xE06795E7: [SetSRShutterType]
0xE0063D95: [SetSfrDevelopParam]
0xE0650D17: [SetSpOpt]
0xE0650F5B: [SetSpecialOptionID]
0xE005E41F: [SetSubPORTValue]
0xE05F30E5: [SetTuningFlag]
0xE05F6BF1: [SetVariangleStateCBR]
0xE00EAB09: [SetYccRgb]
0xE01087FB: [ShowApInfo]
0xE0650DBD: [ShowCameraFlg]
0xE01086B5: [ShowDeviceInfo]
0xE05F3A17: [ShowMainFirmVersion]
0xE06D8AB1: [ShowROM1ModelAndVer]
0xE06D8A8F: [ShowROM1Version]
0xE0650CF1: [ShowSpOpt]
0xE0092B2F: [ShowTransparentMemory]
0xE020B009: [ShowWinsysMemory]
0xE058F77B: [SleepTask]
0xE05C11B7: [StartAllTempMeasurement]
0xE005E43F: [StartEVFDriveWithMode]
0xE005E42D: [StartEVFDrive]
0xE02689A9: [StartFlatDisplay]
0xE042104D: [StartGraphics]
0xE03DDD91: [StartGyroAdjust]
0xE03DDE93: [StartGyroRec]
0xE005E299: [StartLogOut]
0xE05A6665: [StartRedirectUART]
0xE005E4E3: [StartTestRecLog]
0xE005E433: [StopEVFDrive]
0xE005E2A5: [StopLogOut]
0xE05A6401: [StopRedirectUART]
0xE005E4E7: [StopTestRecLog]
0xE013BFED: [SvdsDate]
0xE013BF49: [SvdsSleep]
0xE005E253: [System.Create]
0xE05E423F: [TCMTest]
0xE019D003: [TCTest]
0xE01F59C3: [TEST_ACodecDec]
0xE01F5B49: [TEST_ACodecEnc]
0xE01F5593: [TEST_ACodecTStart]
0xE01F5339: [TEST_ACodecTStop]
0xE01C9479: [TEST_ALV_GetOutputVol]
0xE01C7BA5: [TEST_ALV_RegistCBR]
0xE01C7CE5: [TEST_ALV_SetAttenuator]
0xE01C7D6F: [TEST_ALV_SetInputMode]
0xE01C7D3B: [TEST_ALV_SetInputVol]
0xE01C7C05: [TEST_ALV_SetOutputVol]
0xE01C7D0F: [TEST_ALV_SetWindCut]
0xE01C7DDD: [TEST_ALV_Start]
0xE01C7D9B: [TEST_ALV_Stop]
0xE01C7B51: [TEST_ALV_UnRegistCBR]
0xE01C89F7: [TEST_AUDGetTime]
0xE01C8A5B: [TEST_AudioFile]
0xE01C94D7: [TEST_AudioResetSigSel]
0xE01C8A33: [TEST_AudioTime]
0xE01C7EA1: [TEST_Audio_AddPlayNextBuffer]
0xE01C7F9D: [TEST_Audio_AddPlayStartBuffer]
0xE01C867B: [TEST_Audio_AudioEnd]
0xE01C75B5: [TEST_Audio_DebugAproc]
0xE01C75C7: [TEST_Audio_DebugWriteEnd]
0xE01C75D3: [TEST_Audio_DebugWriteStart]
0xE01C88C5: [TEST_Audio_GetFrame]
0xE01C88A1: [TEST_Audio_GetSize]
0xE01C7E1F: [TEST_Audio_HDMIConnect]
0xE01C7E49: [TEST_Audio_HPConnect]
0xE01C841D: [TEST_Audio_HdmiMute]
0xE01C84FD: [TEST_Audio_LPCMode]
0xE01C84B5: [TEST_Audio_LPC]
0xE01C755D: [TEST_Audio_MakeFileAproc]
0xE01C7E75: [TEST_Audio_MicConnect]
0xE01C83D5: [TEST_Audio_Mute]
0xE01C8489: [TEST_Audio_PlayParam]
0xE01C8131: [TEST_Audio_ReadyPlayData]
0xE01C8929: [TEST_Audio_RecDMAStop]
0xE01C8637: [TEST_Audio_RecNextBuffer]
0xE01C890B: [TEST_Audio_RecPause]
0xE01C88E9: [TEST_Audio_RecResume]
0xE01C84FF: [TEST_Audio_SetAtt]
0xE01C8863: [TEST_Audio_SetAudioInit]
0xE01C83F9: [TEST_Audio_SetHdmiDelay]
0xE01C865B: [TEST_Audio_SetInStart]
0xE01C8611: [TEST_Audio_SetInVolume]
0xE01C86AD: [TEST_Audio_SetMovieStart]
0xE01C921B: [TEST_Audio_SetMovieStop]
0xE01C80CD: [TEST_Audio_SetOutStart]
0xE01C8441: [TEST_Audio_SetOutVolume]
0xE01C8465: [TEST_Audio_SetOut]
0xE01C82EB: [TEST_Audio_SetPlayParam]
0xE01C874D: [TEST_Audio_SetRecParam]
0xE01C85ED: [TEST_Audio_SetWindCut]
0xE01C75A3: [TEST_Audio_WriteAproc]
0xE01C765F: [TEST_ExtractAacBinFile]
0xE01C7291: [TEST_TransCancel]
0xE01C74F7: [TEST_TransStart]
0xE05A5B45: [TakeSemaphore]
0xE0652AB9: [TempStatusDebugMode]
0xE005E267: [TerminateAdjustmentSystem]
0xE04F808F: [TerminatePTPFrameworkController]
0xE005E28D: [TerminateTestRec]
0xE01C9449: [TestAudioSignalPlay]
0xE01C945B: [TestAudioSignalRec]
0xE01C94C3: [TestGetAudioMic]
0xE01C94CD: [TestGetSignalParam]
0xE03DD825: [TestGyroAdjust]
0xE01C94A3: [TestSetAudioHPMon]
0xE01C94B7: [TestSetAudioHeadPhone]
0xE01C94C7: [TestSetAudioMic]
0xE01C894D: [Test_AprocDis]
0xE01C896D: [Test_AprocEna]
0xE01C89B1: [Test_AudInit]
0xE0133E13: [Test_ChgBLBrightness]
0xE017EF35: [Test_ChgEvfBrightness]
0xE017EFBB: [Test_Evf_CurrentRegMap]
0xE017F6EB: [Test_Evf_GetTempNullCount]
0xE017EFF9: [Test_Evf_IndividualAdj]
0xE017EFA7: [Test_Evf_SetBrightness]
0xE017F6DB: [Test_Evf_TempCorrLogLevel]
0xE017F10B: [Test_Evf_TempCorrParam]
0xE017F0C7: [Test_Evf_TempCorrResult]
0xE017EF7D: [Test_ReceiveDataFromEVF]
0xE01FC9A3: [Test_SE_ChangeBeepVolume]
0xE017EF45: [Test_SendDataToEvf]
0xE0133E33: [Test_SendDataToTft]
0xE013406D: [Test_SetTFTTone]
0xE0133E6B: [Test_VariangleNormal]
0xE0133EAB: [Test_VariangleOpen]
0xE0133E8B: [Test_VariangleSelf]
0xE018361B: [UHS2Test]
0xE0183D57: [UHSIICompTest]
0xE05F4EC7: [UnLoadScript]
0xE0405DA1: [UndispRealFrame]
0xE05F39EB: [UpdateGripFir]
0xE04A0013: [UtilSTG_SetScriptMode]
0xE06D8A2F: [VerifyCamif]
0xE06D8A0D: [VerifyFixData]
0xE06D8A3F: [VerifyGUIResource]
0xE06D8A5F: [VerifyLensData2]
0xE06D8A4F: [VerifyLensData]
0xE06D8A6F: [VerifyRasenData]
0xE06D8A7F: [VerifyRingData]
0xE06D89C5: [VerifyTuneData2]
0xE06D89ED: [VerifyTuneData4]
0xE06D89FD: [VerifyTuneDataMap]
0xE06D885F: [VerifyTuneData]
0xE00EA5F5: [VramRead]
0xE012B0F9: [VramStateNum]
0xE012B14D: [VramState]
0xE005E3F7: [WRITEADJTABLETOFROM]
0xE005E3F7: [WRITEADJUSTMENTDATATOFROM]
0xE005E3F7: [WRITEBOARDADJDATATOFROM]
0xE0050EDF: [WaitForAllEventFlag]
0xE0050ED3: [WaitForAnyEventFlag]
0xE0268899: [WinsysTSM]
0xE0050FA9: [WriteFileString]
0xE0046E75: [WriteSpeedMeasureOn]
0xE0254A67: [XCMStatus]
0xE05DF3CF: [accrcBttyInfo]
0xE05DF54D: [accrcCancel]
0xE05DF5DF: [accrcDmyCCCB]
0xE05DEFA9: [accrcFirmVer]
0xE05DF3F7: [accrcFirmup]
0xE05DF56D: [accrcSetPhase]
0xE05C1175: [actTemp]
0x02242535: [aeds_setaealo]
0x02242551: [aewb_inhibitmicrostep]
0xE01C9867: [af.close]
0xE01C988B: [af.closecancel]
0xE01C9829: [af.open]
0xE06522FF: [algs_dump]
0xE06DC2F7: [appendH]
0xE06DC30D: [appendP]
0xE038A4B9: [arima_setdebugmode]
0xE038A4EF: [arima_setdebugvalue]
0xE038A4D3: [arima_setlogint]
0xE00641BD: [arimadrysh]
0xE01C98A9: [arimamoni]
0xE05DF649: [bleFallTest]
0xE05DDF25: [bleactivate]
0xE05DEDC9: [blearceventres]
0xE05DFAF5: [bleatthandle]
0xE05DE785: [bleautooff]
0xE05DE077: [blebtdualclean]
0xE05DE0F3: [blebtdualinit]
0xE05DE0D7: [blebtdualterm]
0xE05DDEBD: [blebuilt]
0xE05DE729: [blecampoweroff]
0xE05DE95D: [blecampoweroffenable]
0xE05DE86D: [bleclearpair]
0xE05DE811: [blecomcheck]
0xE05DE1AF: [bleconnect]
0xE05DE5D5: [bleconnectcancel]
0xE05DE621: [bledispbdaddr]
0xE05DE099: [bleen]
0xE05E1031: [blefa_chkassembly]
0xE05E10A9: [blefa_endfactory]
0xE05E1019: [blefa_firmup]
0xE05E1079: [blefa_getaddr]
0xE05E1091: [blefa_getmodulenum]
0xE05E1001: [blefa_getver]
0xE05E0FE9: [blefa_getvericu]
0xE05E10C1: [blefa_startfactory]
0xE05E1061: [blefa_startscan]
0xE05E1049: [blefa_stopscan]
0xE05DFA93: [blefuncinpoweroff]
0xE05DE157: [blegetbdaddr]
0xE05DE65F: [blegetmodulenum]
0xE05DE8F3: [blegetnvram]
0xE05DEEA3: [blegpsSpiGpsInfo]
0xE05DEF05: [blegpsStateChange]
0xE05DEE57: [blegps]
0xE05DE5F9: [blehofromcam]
0xE05DE055: [bleillegalflg]
0xE05DFAC3: [bleinfo]
0xE05DDEEB: [bleinit]
0xE05DED8B: [blepairconfirmres]
0xE05DED45: [blepairing]
0xE05DFA63: [blepowerstate]
0xE05DFAF7: [blerefresh]
0xE05DE7CB: [blereset]
0xE05DE69D: [bleresstartho]
0xE05DE667: [blesethocbr]
0xE05DE17F: [blesleep]
0xE05DE83F: [blespicheck]
0xE05DF5E5: [blesrcShootResult]
0xE05DE01F: [blestateadv]
0xE05DDFED: [blestateidle]
0xE05DDF95: [bleterm]
0xE05DE953: [blewaittime]
0xE05E09A9: [btc_changerfmode]
0xE05E0A43: [btc_startrxtest]
0xE05E0A95: [btc_starttxfrqtest]
0xE05E09CF: [btc_starttxtest]
0xE05E0A71: [btc_stoprxtest]
0xE05E0E61: [btc_stoptxfrqtest]
0xE05E0A1F: [btc_stoptxtest]
0xE062BD29: [captain_detect]
0xE062C15F: [captain_detect_akbad]
0xE062C355: [captain_merge]
0xE062C7DD: [captain_setDarkLevel]
0xE062C7A9: [captain_setDetArea]
0xE062C7BB: [captain_setDetTh]
0xE062C7C9: [captain_setIdGrade]
0xE062C4A5: [captain_zero]
0xE066806B: [cc_cmd_change_moviesize]
0xE066809F: [cc_cmd_change_shotmode]
0xE06680BB: [cc_cmd_change_strobo_firing]
0xE0668141: [cc_cmd_input_anyevent]
0xE0668065: [cc_cmd_keychkmode]
0xE066813D: [cc_cmd_movie_mode]
0xE0668183: [cc_cmd_moviebtn_on]
0xE066833B: [cc_cmd_playbtn_on]
0xE066800F: [cc_cmd_print_uilock]
0xE0668147: [cc_cmd_reboot_start]
0xE066815D: [cc_cmd_reboot_start_mainsw_off]
0xE06680D9: [cc_cmd_regist_btn_hook]
0xE0667F9B: [cc_cmd_send_cmdctrl]
0xE0668139: [cc_cmd_set_movie_mode]
0xE0668015: [cc_cmd_settuningmode]
0xE066800D: [cc_cmd_show_stepzoom_pos]
0xE0668551: [cc_cmd_shutdown_start]
0xE0667FED: [cc_cmd_start_cmdctrl]
0xE06680B9: [cc_cmd_start_zoom_with_pos]
0xE06680B7: [cc_cmd_start_zoom_with_pos_digi]
0xE06681C3: [cc_cmd_sw1sw2on_continuous]
0xE066827D: [cc_cmd_sw1sw2on_single]
0xE06680D5: [cc_cmd_unregist_btn_hook]
0xE0182A7F: [cfastSataCtrl]
0xE0182B03: [cfastSataPowerMode]
0xE0182ADD: [cfastSataTransMode]
0xE01828EF: [cfastSatagen]
0xE01828A3: [cfastactpm]
0xE01828C9: [cfastplevel]
0xE0182939: [cfastsanitize]
0xE0182909: [cfastsata]
0xE018287D: [cfastslumber]
0xE05E0F83: [changerfmode]
0xE06988B7: [checksum]
0xE06988BF: [checksumarea]
0xE0196113: [chgedid]
0xE0698EC3: [chgmon]
0xE0190D4B: [chkAlloc]
0xE0063EE1: [col_CyclicNrDebugMode]
0xE0063E4F: [col_clearlog]
0xE0063ED5: [col_lvwbdump]
0xE0063EC9: [col_wbdump]
0xE0063E39: [colorprint]
0xE044823F: [comEMITestRamDataOff]
0xE0448197: [comEMITestRamDataOn]
0xE0448281: [comRTCDebug]
0xE06987CD: [d]
0xE035BD51: [daf_dumpab]
0xE038914D: [daf_dumpabshdk]
0xE035BCFB: [daf_dumpcor]
0xE038A49F: [daf_dumpcorout]
0xE03892DF: [daf_dumpdafraw]
0xE0389115: [daf_getsensorinfo]
0xE03890FB: [daf_ibpoff]
0xE03890E1: [daf_ibpon]
0xE038D06F: [daf_meminfo]
0xE0389DE1: [daf_postevent]
0xE038A485: [daf_predmodeenable]
0xE0389CEF: [daf_setabexpcorrectgainmode]
0xE038A4AD: [daf_setafset]
0xE038924B: [daf_setdafraw]
0xE0388FC9: [daf_setdafwinpos]
0xE0389013: [daf_setdafwinpossub]
0xE0388F97: [daf_setdebugmode]
0xE0388FAF: [daf_setlogint]
0xE03899FD: [daf_setposition]
0xE0389059: [daf_setpredictmode]
0xE03890B5: [daf_setwbmode]
0xE03899E3: [daf_testadjbaseparam]
0xE03899AB: [daf_testdafabout]
0xE0389939: [daf_testdafmemout]
0xE038975B: [daf_testdafpass]
0xE038970F: [daf_testfocuswinmag]
0xE038A353: [daf_warpabortdafigaro]
0xE038A303: [daf_warpactivatedafigaro]
0xE038A377: [daf_warpenddafigaro]
0xE038A2BB: [daf_warpinitdafigaro]
0xE038A3C9: [daf_warpoutabsig]
0xE038A3BF: [daf_warpoutclk]
0xE038A3AB: [daf_warpoutcmdprm]
0xE038A435: [daf_warpoutdafigaromem]
0xE038A397: [daf_warpoutedafigaro]
0xE038A3A1: [daf_warpoutedmacdaf]
0xE038A3B5: [daf_warpoutintreg]
0xE038A323: [daf_warpstartdafigaro]
0xE030F309: [dafdebug]
0xE030F8D5: [dafdebugoption]
0xE030F9C1: [dafdefocusdrive]
0xE030F905: [dafdisableafg]
0xE030F939: [dafenableafg]
0xE035B2FD: [dafg_init]
0xE030F983: [daflvd]
0xE035B0F9: [dafmonpoint]
0xE030F96D: [dafparam]
0xE0088AC5: [dev_AutoTest]
0xE0087517: [dev_CfilterAll]
0xE008753D: [dev_Cfilter]
0xE013BD17: [dev_InitLogFile]
0xE00878F7: [dev_Pcheck]
0xE00875E9: [dev_aspecttype]
0xE00881DD: [dev_check]
0xE0088773: [dev_contcheck]
0xE0088867: [dev_cropcheck]
0xE00889D9: [dev_cropcontcheck]
0xE00D5DFF: [dev_ddd]
0xE008A36B: [dev_def]
0xE0087565: [dev_developAll]
0xE0087645: [dev_disttest]
0xE0088ABB: [dev_drvin]
0xE0088AC1: [dev_hdrplayoff]
0xE0088ABD: [dev_hdrplayon]
0xE0087639: [dev_in]
0xE00D58EF: [dev_mem1develop]
0xE00875C3: [dev_monall]
0xE00875BB: [dev_mondisp]
0xE00875B7: [dev_monoff]
0xE00875B3: [dev_monon]
0xE008A371: [dev_off]
0xE0087633: [dev_out]
0xE0087653: [dev_outdecodeImg]
0xE008763F: [dev_outohyear]
0xE00D5F6F: [dev_pan]
0xE00875C9: [dev_picttype]
0xE00D55A9: [dev_qtest]
0xE008A365: [dev_reg]
0xE00874E9: [dev_resizeAll]
0xE00872ED: [dev_settrimmingRotatAng]
0xE0088AB1: [dev_test]
0xE0087333: [dev_trimmingAll]
0xE00874B1: [dev_trimmingRotatAll]
0xE0087391: [dev_trimming]
0xE03DFBF3: [dev_tsm_disable]
0xE03DFC11: [dev_tsm_e]
0xE03DFBC1: [dev_tsm_enable]
0xE03DFBFB: [dev_tsm_s]
0xE00D62CD: [dev_yuvdevelop]
0xE008759F: [devbindtest]
0xE007FD2F: [devpath_setColorApithrough]
0xE007FE11: [devpath_setReplaceImg]
0xE007FD11: [devpath_setthrough]
0xE007FD37: [devpath_setunittestmode]
0xE06987D5: [dfrom]
0xE05D6097: [dl_CancelDL]
0xE05D7CD5: [dl_ChangeRegister]
0xE05D7AF3: [dl_ExecJustNow]
0xE05D7D19: [dl_FactoryCheck]
0xE05D795B: [dl_GetCycleCount]
0xE05D799F: [dl_GetCycleIntervalTime]
0xE05D78AD: [dl_GetDeltaFreq]
0xE05D7855: [dl_GetEndFreq]
0xE05D7CF1: [dl_GetMaxValue]
0xE05D7D05: [dl_GetMinValue]
0xE05D77B7: [dl_GetNumPattern]
0xE05D7A63: [dl_GetPeakFreq]
0xE05D77FD: [dl_GetStartFreq]
0xE05D7907: [dl_GetSweepTime]
0xE05D703B: [dl_PrepareDL]
0xE05D60E1: [dl_ReqStartDL]
0xE05D7973: [dl_SetCycleCount]
0xE05D79B7: [dl_SetCycleIntervalTime]
0xE05D78D1: [dl_SetDeltaFreq]
0xE05D7879: [dl_SetEndFreq]
0xE05D77CB: [dl_SetNumPattern]
0xE05D7A3B: [dl_SetPeakFreq]
0xE05D7821: [dl_SetStartFreq]
0xE05D792B: [dl_SetSweepTime]
0xE05D7D25: [dl_StartDL]
0xE05D7231: [dl_TerminateDL]
0xE05D778F: [dl_TestFactoryDL]
0xE05A6017: [dmescalation]
0xE05A6765: [dmhistory]
0xE05A67E5: [dmprint]
0xE05A612F: [dmstart]
0xE05A6157: [dmstop]
0xE05A67B5: [dmstore]
0xE055A341: [dope_guilock_Show]
0xE036B373: [dope_occ_Show]
0xE008322F: [drvtimer.info]
0xE0668A0D: [drysh]
0xE00A41BF: [dumpSRClk]
0xE05A6919: [dump]
0xE05F30B9: [dumpall]
0xE05F30D9: [dumpentire]
0xE05A68F9: [dumpf]
0xE05F30C1: [dumpfall]
0xE05A63D7: [dumpfrom]
0xE0195F8B: [edid]
0xE06AB9BB: [edstart]
0xE06AAE37: [edstop]
0xE0065753: [eep_boot_change_ring]
0xE00656F3: [eep_boot_change_service]
0xE00657B3: [eep_boot_check]
0xE0065E07: [eep_erase]
0xE006626F: [eep_force_read]
0xE006639F: [eep_force_sync]
0xE00656B1: [eep_forcefrom_ring]
0xE0065675: [eep_forcefrom_service]
0xE0065EC1: [eep_read]
0xE006563F: [eep_show_service]
0xE0065627: [eep_sync]
0xE0066241: [eep_write]
0xE0065CDF: [eep_write_single]
0xE03DD2DF: [eis_auto_offset]
0xE03DD2B5: [eis_balancetime]
0xE03DD26B: [eis_gain_r]
0xE03DD275: [eis_gain_rs]
0xE03DD257: [eis_gain_x]
0xE03DD261: [eis_gain_y]
0xE05B6F73: [eis_get_offset]
0xE05B7029: [eis_getset_offset]
0xE03DD217: [eis_off]
0xE03DD27F: [eis_offset]
0xE03DD1E1: [eis_on]
0xE05B6F0D: [eis_set_offset1]
0xE05B6F27: [eis_set_offset2]
0xE05B6F41: [eis_set_offset3]
0xE03DD24D: [eis_timing]
0xE03DD289: [eis_x]
0xE03DD29F: [eis_y]
0xE03DD357: [eisinterface]
0xE03DD30B: [eislog]
0xE03DD325: [eislogmode]
0xE03DD1C1: [eisrecflag]
0xE03DD33F: [eistest]
0xE03DD3A9: [eisvectorgain]
0xE03DD36F: [eisvectormode]
0xE058EEED: [epp_disable]
0xE007DF07: [epp_dump_compositeHdr]
0xE007E80D: [epp_dump_compositeRaw]
0xE00C3A61: [epp_dump_vram]
0xE00C1F75: [epp_dump_vram_old]
0xE007D531: [epp_dump_vramsub]
0xE058EF0F: [epp_e]
0xE058EEC1: [epp_enable]
0xE058EF27: [epp_regist_cpusage]
0xE058EEF9: [epp_s]
0xE007D537: [epp_test_jpegenc_vramsub]
0xE06D6F37: [fcacheClear]
0xE06D6F0F: [fcacheDump]
0xE0056E21: [fcsChangeEOICheckFlag]
0xE0698A2D: [filewrite]
0xE06988C5: [flasherase]
0xE0698965: [flashwrite]
0xE069EE9F: [fmAllFileRemove]
0xE0699555: [fmChangeCardExtentionSameSave]
0xE0699567: [fmChangeCurrentMedia]
0xE06995EF: [fmContainerIbus]
0xE069957B: [fmPropertyPrint]
0xE069EE3F: [fmShotRecordAvailable]
0x02273BCF: [fmdefmapnotify]
0xE0232021: [fmdefocus]
0xE0699693: [fmdump]
0xE0232089: [fmface]
0xE0232071: [fmfacenum]
0xE023203B: [fmgeneral]
0xE023209F: [fmheader]
0x02273C13: [fmidCompo]
0x02273C2F: [fmidOneShotYuvDump]
0x02273C25: [fmidSetFactoryMode]
0x0227430F: [fmidTestOneShotProc]
0xE023207D: [fmobject]
0xE023202F: [fmrecog]
0xE02320AB: [fmresultdump]
0xE0232049: [fmsimple]
0xE0232057: [fmsurfing]
0xE0232065: [fmtrust]
0x02273BA1: [fmutil]
0xE02320B7: [fmvalidarea]
0xE0232143: [fmyuvdump]
0x02273BF1: [fmyuvnotify]
0xE0231EC3: [ftafareamode]
0xE0231E8D: [ftcancelmaintarget]
0xE0231F3D: [ftchangelostalg]
0xE0231FE5: [ftcompo]
0xE0231FDB: [ftcompoparam]
0xE0231FB5: [ftdisptrackframe]
0xE0231E49: [ftdummydetect]
0xE0231E6B: [ftdummytrack]
0xE0231F97: [fteyeaf]
0xE0231F03: [ftframeselect]
0xE0231ECD: [ftignorebvthresh]
0xE0231EF5: [ftmotionmethod]
0xE0231F47: [ftsetmaintargetsal]
0xE0231E9F: [ftsetmaintargettrack]
0xE0231F21: [ftshiftface]
0xE0231EB1: [ftsurfinfo]
0xE0231F33: [fttoggleface]
0xE0232003: [ftutil]
0xE0698845: [gang]
0xE006240F: [gis_AllocateMemory]
0xE0062345: [gis_CopyMM1ToMEM1]
0xE0062809: [gis_SetMM1]
0xE0331599: [gkdump]
0xE02743B3: [gmtwaku_af_center]
0xE0274DEB: [gmtwaku_all]
0xE0274263: [gmtwaku_avail]
0xE0274AC5: [gmtwaku_center]
0xE0275D6D: [gmtwaku_check]
0xE027584D: [gmtwaku_conti]
0xE0274841: [gmtwaku_conv_cmos]
0xE0275CB7: [gmtwaku_dbg_frame]
0xE027596D: [gmtwaku_dispsize]
0xE0275E5B: [gmtwaku_facedata]
0xE0275D39: [gmtwaku_focus]
0xE0275E49: [gmtwaku_force_updateavail]
0xE0275D5B: [gmtwaku_ignore_eis_shift]
0xE02742AD: [gmtwaku_imag]
0xE02745C3: [gmtwaku_mem1]
0xE027591F: [gmtwaku_set_afsystem]
0xE0275C97: [gmtwaku_set_lenssw]
0xE0275885: [gmtwaku_set_magnify_location]
0xE0275959: [gmtwaku_set_mainframemagnify]
0xE0275E2F: [gmtwaku_setlvinfo]
0xE0275993: [gmtwaku_show_winmode]
0xE0274233: [gmtwaku_status]
0xE0275C61: [gmtwaku_test_dmprint]
0xE0274D91: [gmtwaku_touch]
0xE0698ADD: [gpioread]
0xE0698AD3: [gpiowrite]
0xE05A68C7: [grep]
0xE07070E3: [gus]
0xE0698EBF: [harbint]
0xE01BF963: [hdmiddc]
0xE01BF8DF: [hdmiphy]
0xE0196AFB: [hdmitc]
0xE0060985: [hdr_AllocateMemory]
0xE00608E9: [hdr_CopyMM1ToMEM1]
0xE0060A53: [hdr_SetMM1]
0xE06511C5: [head_logon.end]
0xE065119D: [head_logon.l]
0xE06511B1: [head_logon.s]
0xE007AF0F: [hist_card]
0xE007AF25: [hist_unit_test]
0xE03C9CAD: [i2c_read_proc]
0xE03C9B45: [i2c_write_proc]
0xE0698791: [i]
0xE01CB23D: [ibpmodeon]
0xE01CB273: [ibpon]
0xE06E43AD: [icodec_out_decbuf]
0xE06E437F: [icodec_through]
0xE0420E4D: [imagevram]
0xE0678CED: [imgctrl_DisableFixedCmosPattern]
0xE0678CD7: [imgctrl_EnableFixedCmosPattern]
0xE0679589: [imgctrl_ReseetAdjDarkCapture]
0xE067957F: [imgctrl_SetAdjDarkCapture]
0xE0678D03: [imgctrl_SetFixedCmosPattern]
0xE06BBDEB: [imgseq_propread]
0xE06BBE3B: [imgseq_propwrite]
0xE05C11A7: [inActTemp]
0xE05F38A7: [initPod]
0xE0707121: [kill]
0xE0697F51: [led.debug.noprint]
0xE0697EC3: [led.debug]
0xE0697D3B: [led.set.blinkcount]
0xE0697EB5: [led.set.callback.ae]
0xE0697E93: [led.set.callback]
0xE0697DAB: [led.set.directly]
0xE0697CE7: [led.set.sync]
0xE0697BCB: [led.set]
0xE01CA33D: [lensafdata]
0xE01C9D75: [lensapitest]
0xE01CB231: [lensdeli.test]
0xE01CA941: [lensdrivefocus]
0xE01CA333: [lensdynamic]
0xE01CA3DD: [lensemdnoise]
0xE01CA4E5: [lensemdnoisenew]
0xE01CA353: [lensfactorydata]
0xE01CA347: [lensfactoryinfo]
0xE01CA641: [lensfocusnoise]
0xE01CA64F: [lensfocusnoiseex]
0xE01CA969: [lensfocusoverlapnoise]
0xE01CA329: [lensfscubugfix]
0xE01CA385: [lenshaltdisable]
0xE01CA30F: [lensheattest]
0xE01CAAD5: [lensisnoise]
0xE01CABE9: [lensmoni]
0xE01CBDC9: [lensoispos]
0xE01C9959: [lenspower]
0xE01CA2F5: [lenssearch]
0xE01CA5C9: [lenssearchnoise]
0xE01CBDFD: [lenssetisparam]
0xE01CB12D: [lenstest.api]
0xE01CB15B: [lenstest.burst]
0xE01CAB95: [lensusmnoise]
0xE01CA36D: [lensusmnoisemode]
0xE01CAB5D: [lensusmnoiseold]
0xE01CA3B1: [lensvdd2Reset]
0xE05A6793: [logstat]
0xE04EAFF7: [lv_90fps_off]
0xE04EAFB9: [lv_90fps_on]
0xE02E6C8F: [lv_addkizdet2]
0xE02E6A5D: [lv_addkizdet]
0xE0261BAD: [lv_af_area]
0xE026634F: [lv_af_disable]
0xE0266345: [lv_af_enable]
0xE026482F: [lv_af_log]
0xE0379411: [lv_af_raw]
0xE026480D: [lv_af_test]
0xE0261A25: [lv_avail]
0xE0261A95: [lv_availall]
0xE00DCC87: [lv_capraw_dump]
0xE025269B: [lv_capture_iso]
0xE05B4415: [lv_capturecontinuousframe_fa]
0xE05B433F: [lv_capturetestimage]
0xE026004F: [lv_changemoviemode]
0xE028A901: [lv_conaf_start]
0xE028A913: [lv_conaf_stop]
0xE00DCCB3: [lv_counterraw_dump]
0xE00DCC0D: [lv_dafraw_dump]
0xE0266357: [lv_dbg_pocom]
0xE04EB12F: [lv_dbg_timemeasure]
0xE0252845: [lv_debug_acc]
0xE00DD061: [lv_debug_mon]
0xE0344983: [lv_defmap_dump]
0xE0303E35: [lv_defmark_disable]
0xE0303E3D: [lv_defmark_enable]
0xE028AA3F: [lv_disable_disp]
0xE04EB135: [lv_dispAvailableArea]
0xE007AF1D: [lv_disp_alohist]
0xE04EB0EB: [lv_dispafframe]
0xE04EB10F: [lv_dispframerate]
0xE0261B91: [lv_disppri]
0xE026747D: [lv_distort_disable]
0xE02673F1: [lv_distort_dumpinfo]
0xE02674AB: [lv_distort_print]
0xE0267473: [lv_distort_strong]
0xE053FF3F: [lv_dts_printrandominfo]
0xE053FF39: [lv_dts_subdatastoreaddrdump]
0xE053FF3D: [lv_dts_transferdatastore]
0xE053FF3B: [lv_dts_transferrandomdata]
0xE00DD229: [lv_dummy_badframe]
0xE0261671: [lv_dzoom_debug]
0xE028AA35: [lv_enable_disp]
0xE02BA0C9: [lv_enable_lipsync]
0xE0252691: [lv_enable_sync]
0xE04EC9B3: [lv_execafmechaless]
0xE04EC9A5: [lv_execmechaless]
0xE0309AA3: [lv_factory_changemode]
0xE0309A57: [lv_factory_resume]
0xE0309A8F: [lv_factory_setinfo]
0xE0309935: [lv_factory_start]
0xE03099E1: [lv_factory_stop]
0xE0309A1F: [lv_factory_suspend]
0xE026167F: [lv_flicker_on]
0xE04EB07D: [lv_force_suspend]
0xE0303DFD: [lv_get_defm_data]
0xE05B429F: [lv_getframeNo]
0xE04EB067: [lv_gmtfact_off]
0xE04EB051: [lv_gmtfact_on]
0xE04EBE9F: [lv_hd120_recfrkeep]
0xE00DCD09: [lv_hdr_dump]
0xE00DD21B: [lv_ignore_badframe]
0xE04EB0B3: [lv_manip]
0xE00DD171: [lv_measure_usage]
0xE04EBEBF: [lv_mechalessmode]
0xE026168F: [lv_msht_aspect_test]
0xE04EB0E1: [lv_mvhdr_on]
0xE00DCB85: [lv_new_folder]
0xE026617F: [lv_old_start]
0xE02662BB: [lv_old_stop]
0xE00DCF47: [lv_pclvyuv_dump]
0xE033F249: [lv_pps_print_debug]
0xE00DD23F: [lv_print_badframe]
0xE02BA0D3: [lv_print_lipsync_log]
0xE04EB047: [lv_print_mode]
0xE00DD1EB: [lv_put_usage]
0xE00DCB65: [lv_raw_100dumpStart]
0xE00DCB75: [lv_raw_100dump]
0xE00DCA53: [lv_raw_dump2]
0xE00DCA89: [lv_raw_dump3]
0xE00DCA23: [lv_raw_dump]
0xE00DCBDF: [lv_raw_flicker_dump]
0xE0422D1B: [lv_real_object]
0xE00BF4E1: [lv_remote_param]
0xE0379425: [lv_rshd_raw]
0xE00DD013: [lv_save_hdmivram]
0xE00DC971: [lv_save_raw]
0xE00DCFF9: [lv_save_sndpas]
0xE00DD0A3: [lv_sequence_checker]
0xE0422D03: [lv_set_af_frame_size]
0xE02619E9: [lv_set_atemp_new]
0xE00DD211: [lv_set_diorama_rate]
0xE04EBE5D: [lv_set_eis_mode]
0xE04EBD41: [lv_set_fixed_movie]
0xE0379507: [lv_set_mm]
0xE04EBDF3: [lv_set_movie_resol]
0xE04EB02F: [lv_set_multi_aspect]
0xE0379439: [lv_set_raw]
0xE0379503: [lv_set_raw_wp]
0xE05B436D: [lv_setcapturetestimagebuffer]
0xE05B43BB: [lv_setcontinuascaptureforfamode]
0xE05B42E1: [lv_setcontinuascaptureforfixed]
0xE00DC98B: [lv_setcounter_raw]
0xE05B4245: [lv_setfaaccum]
0xE05B4237: [lv_setfactoryflag]
0xE05B4241: [lv_setfactorylegacyflag]
0xE05B41D3: [lv_setfactorylens]
0xE05B426B: [lv_setfadaf]
0xE05B4295: [lv_setfamodeflag]
0xE05B4283: [lv_setimagemagnifyforfactory]
0xE05B4209: [lv_setlvcapturestartframe]
0xE05B422B: [lv_setlvcapturewaitframe]
0xE0265E5D: [lv_start]
0xE0266223: [lv_stop]
0xE00DCC39: [lv_ta10raw_dump]
0xE0422D0B: [lv_track_compo_track_gui]
0xE00DD02D: [lv_veckydebugyuv_dump]
0xE04EB09F: [lv_visibleframe_log]
0xE028AA49: [lv_vram_delay]
0xE00DCD05: [lv_vram_dump]
0x02247947: [lvae_2kando]
0x022486D1: [lvae_ChangeAvType]
0x02249B6F: [lvae_ClearAdjustSenzu]
0x02248683: [lvae_ClearGPParam]
0x022486C7: [lvae_ClearRealCurrentAv]
0x0224B7E7: [lvae_ColorLogTest]
0x0224B91D: [lvae_DafLight_End]
0x0224B8C9: [lvae_DafLight_Ready]
0x0224B92F: [lvae_DafLight_SetIso]
0x0224B949: [lvae_DafLight_Show]
0x0224B8E9: [lvae_DafLight_StartInd]
0x0224B8FD: [lvae_DafLight_StartOvl]
0x0224B911: [lvae_DafLight_StopOvl]
0x02247895: [lvae_GetExposure]
0x02249BA1: [lvae_GetInfoForAdjustSenzu]
0x02247887: [lvae_IntegResult]
0x02247867: [lvae_LensEmd]
0x0224AD77: [lvae_MBvSimDataSet]
0x0224B081: [lvae_MBvSim]
0x02249B37: [lvae_SetAdjustSenzu]
0x02248663: [lvae_SetGPParam]
0x0224AB79: [lvae_SetKeepRange]
0x022486BB: [lvae_SetRealCurrentAv]
0x0224B23D: [lvae_SetVignettingOff]
0x0224869D: [lvae_ShowDiagramKind]
0x0224AC39: [lvae_TBvSimDataSet]
0x0224AB8B: [lvae_TBvSim]
0x0224A08B: [lvae_accumh]
0x0224A507: [lvae_accumhssm]
0x02248E09: [lvae_afledoff]
0x02248DFF: [lvae_afledon]
0x0224B80D: [lvae_checkdiagram]
0x0224AABD: [lvae_checkiso]
0x02248E13: [lvae_checksenzu]
0x02248E57: [lvae_checksenzup]
0x0224934B: [lvae_chkexpcomp]
0x022487F7: [lvae_clearcontrolaeparam]
0x02249FEB: [lvae_debug]
0x02249F51: [lvae_dumpvig]
0x02249BE9: [lvae_dumpy]
0x02247911: [lvae_frtrdebugmode]
0x02247929: [lvae_furicore]
0x02248697: [lvae_getEFYforTable]
0x02248C7B: [lvae_getslensdata]
0x0224B7B5: [lvae_guicompomode]
0x0224B295: [lvae_guidebugmode]
0x0224785B: [lvae_lensinfo]
0x02247955: [lvae_printfixdata]
0x02247951: [lvae_printgero]
0x02249BD5: [lvae_savey]
0x02248CD7: [lvae_setaccumgain]
0x02248D75: [lvae_setaealo]
0x02248D91: [lvae_setaemeteringmode]
0x0224B7CD: [lvae_setaflimitav]
0x0224882D: [lvae_setcontrolaccumh]
0x02248735: [lvae_setcontrolaeparamAF]
0x02248785: [lvae_setcontrolaeparamEFandFlicker]
0x022486FD: [lvae_setcontrolaeparam]
0x022487B9: [lvae_setcontrolaeparamaftv]
0x0224864B: [lvae_setcontrolbv]
0x02247827: [lvae_setdebugmode2]
0x022477F3: [lvae_setdebugmode]
0x022477D5: [lvae_setdebugport]
0x02248CF3: [lvae_setdispgain]
0x02249BC5: [lvae_setdumpy]
0x02248D1D: [lvae_setemdpoweroffmode]
0x02248D59: [lvae_setemdsafeshiftmode]
0x02249923: [lvae_setexpcomp]
0x02248CAD: [lvae_setfixaccumgain]
0x022488DF: [lvae_setflickermode]
0x02248DE5: [lvae_setinitialbv]
0x0224888B: [lvae_setinterpolatecontrol]
0x022488A7: [lvae_setmanualcontrol]
0x022478FB: [lvae_setmaxtv]
0x022488C3: [lvae_setmoviemanualcontrol]
0x0224BA71: [lvae_setsendDecbv]
0x0224BA8B: [lvae_setsendbv]
0x02249AF1: [lvae_setsenzudump]
0x022498E9: [lvae_settargetbv]
0x022492AF: [lvae_settimelapsemode]
0x0224B259: [lvae_settuneingmode]
0x02249FFB: [lvae_simmetering]
0x022499B3: [lvae_startsenzudump_af]
0xE02B014D: [lvafae_log]
0xE02B013F: [lvafae_setaftv]
0xE0310FEB: [lvdbg_printmember_aecolor]
0xE03112DB: [lvdbg_printmember_af]
0xE03115D9: [lvdbg_printmember_debugtruck]
0xE0310A4D: [lvdbg_printmember_normal]
0xE03118F7: [lvdbg_setmode2]
0xE007FE75: [lvdev_subchip_dump]
0xE026A343: [lvdnavi_testlvmem]
0xE026A4AB: [lvdnavi_testservomem]
0xE092634D: [lvdrv_santa_chgain_ignore_dafprm]
0xE0926871: [lvdrv_santa_choff_ignore_dafprm]
0xE0926961: [lvdrv_santa_defr_ignore_dafprm]
0xE0378E25: [lvdrv_santa_fact_mode]
0xE0926675: [lvdrv_santa_hivshd_ignore_dafprm]
0xE092617D: [lvdrv_santa_kids_ignore_dafprm]
0xE09264A1: [lvdrv_santa_mkb_ignore_dafprm]
0xE0926245: [lvdrv_santa_orbben_ignore_dafprm]
0xE0926595: [lvdrv_santa_win28_ignore_dafprm]
0xE0924DD9: [lvdrv_sap_chgain_bypass]
0xE0924D05: [lvdrv_sap_choff_bypass]
0xE0925EC9: [lvdrv_sap_defoe_bypass]
0xE0924F81: [lvdrv_sap_degeen28_1_bypass]
0xE0925959: [lvdrv_sap_degeen32_bypass]
0xE0925101: [lvdrv_sap_hivshd_bypass]
0xE0924C31: [lvdrv_sap_kids_bypass]
0xE0925C21: [lvdrv_sap_rshd_bypass]
0xE0924EAD: [lvdrv_sap_yossie_bypass]
0xE02670BF: [lvezoom_disp]
0xE0267083: [lvezoom_log]
0xE0266FDD: [lvezoom_posi]
0xE02670AB: [lvezoom_setting]
0xE0266FF3: [lvezoom_start]
0xE0267047: [lvezoom_stop]
0xE03097F3: [lvfact_lv_old_start]
0xE0309887: [lvfact_lv_old_stop]
0xE030978D: [lvfact_lv_start]
0xE030985D: [lvfact_lv_stop]
0xE03098FF: [lvfact_setmode]
0xE0309755: [lvfact_state]
0xE01C995D: [lvmirrorup]
0xE0083A2B: [mecha.activate1st]
0xE0083A21: [mecha.activate2nd]
0xE0083A35: [mecha.activate]
0xE0083943: [mecha.bulb]
0xE00839E9: [mecha.check]
0xE0083471: [mecha.debug.port]
0xE008347F: [mecha.debug]
0xE0083353: [mecha.fa.getShInfo]
0xE00832F5: [mecha.fa.omrel]
0xE00833FF: [mecha.fa.rel]
0xE008395B: [mecha.gotofd]
0xE0083973: [mecha.gotolv]
0xE0083A0D: [mecha.hist]
0xE0083A17: [mecha.inactivate]
0xE008323D: [mecha.init.learn.param]
0xE00839D5: [mecha.lvopen]
0xE008345F: [mecha.mirror.count.set]
0xE0083579: [mecha.mirror.down]
0xE00835E9: [mecha.mirror.recover]
0xE0083527: [mecha.mirror.release]
0xE00835B1: [mecha.mirror.up]
0xE008398B: [mecha.recover]
0xE00838D9: [mecha.release.ex]
0xE00838CF: [mecha.release.exend]
0xE0083905: [mecha.release.ready]
0xE0083919: [mecha.release]
0xE00839F3: [mecha.reset]
0xE00839DF: [mecha.rushEnd]
0xE0083835: [mecha.shutter.charge]
0xE0083865: [mecha.shutter.chargeset.chk]
0xE008384D: [mecha.shutter.chargeset]
0xE008389F: [mecha.shutter.close]
0xE00832D3: [mecha.shutter.correct.off]
0xE00832C7: [mecha.shutter.correct.on]
0xE0083463: [mecha.shutter.count.set]
0xE00834DB: [mecha.shutter.learnparam]
0xE00838B7: [mecha.shutter.open]
0xE008392B: [mecha.shutter.recover]
0xE0083805: [mecha.shutter.return]
0xE0083887: [mecha.shutter.run1]
0xE008386F: [mecha.shutter.run2]
0xE008381D: [mecha.shutter.set]
0xE0083A09: [mecha.test]
0xE00839B5: [mecha.timerinfo]
0xE069877D: [memMap]
0xE06987DD: [memShow]
0xE0652789: [memcmp]
0xE03E1C25: [memcpy]
0xE052C799: [memdump]
0xE0798BB5: [memset]
0xE039FDDD: [mnav_alloc]
0xE03A0149: [mnav_alloca]
0xE039FE11: [mnav_free]
0xE03A0191: [mnav_free_adr]
0xE03A015F: [mnav_freea]
0xE039FD9B: [mnav_sem]
0xE05E4DED: [mnav_shoot]
0xE039FCB7: [mnav_status]
0xE05F32F5: [mount]
0xE06DCF0D: [mrapc]
0xE06DE0CF: [mrbreakoffset]
0xE06DC9EB: [mrcancel]
0xE06DC9B7: [mrcnlg]
0xE06DD9ED: [mrdctl]
0xE06DDAE9: [mrencth]
0xE06DDC27: [mrenctl]
0xE06DC7C7: [mrgklog]
0xE06DC9A5: [mrhdmi]
0xE06DC7DF: [mrmbilog]
0xE06DE0E1: [mrmem]
0xE06DD965: [mrpma]
0xE06DE0A7: [mrrectl]
0xE06DCF3B: [mrsetpma]
0xE06DDF15: [mrstoptl]
0xE06DE6B7: [mrtcfwrite]
0xE06DE889: [mrtstart]
0xE06DE7F3: [mrtstop]
0xE06DC0D7: [mvrAppendCheckSetRecLimit]
0xE06DC35F: [mvrDump]
0xE06DC22D: [mvrSetRecLimit]
0xE06DC13B: [mvrTestGero]
0xE06DC2C5: [normal]
0xE06987A5: [objInfo]
0xE05A68A7: [olddump]
0xE05F30C9: [olddumpall]
0xE05A6887: [olddumpf]
0xE05F30D1: [olddumpfall]
0xE05A6855: [oldgrep]
0xE05AA11B: [on]
0xE073BE05: [oplg.all]
0xE073C2D9: [oplg.assert]
0xE073B62D: [oplg.entermenu]
0xE073B5CD: [oplg.excommand]
0xE073C219: [oplg.level]
0xE073C269: [oplg.mode]
0xE073C7E1: [oplg.play.sd.newest]
0xE073C811: [oplg.play.sd]
0xE073C20D: [oplg.reg]
0xE073C345: [oplg.send.fin]
0xE073C49D: [oplg.send.init]
0xE073C40F: [oplg.send.usb]
0xE073C321: [oplg.start]
0xE073C2DB: [oplg.state]
0xE073BDE3: [oplg.test]
0xE073C353: [oplg]
0xE01CB2B5: [overwritelensfunc]
0xE01CB2CB: [overwritelensfuncextern]
0xE03CAB35: [pa_GetDbgAssist1State]
0xE03CAB3B: [pa_SetDbgAssist1ONOFF]
0xE03CAC19: [pa_dbg]
0xE03CAB81: [pa_gero_reset]
0xE03CABCD: [pa_gero_set]
0xE03CAC7F: [pa_moni_on]
0xE03CAC8B: [pa_status]
0xE03CAC43: [pa_tsm_on]
0xE008266F: [pcomnetmem]
0xE05FD345: [po.batt_cal]
0xE05FD15D: [po.call]
0xE05FD0C5: [po.debug]
0xE05FD249: [po.drivemode]
0xE05FD6A5: [po.fel]
0xE05FCFB1: [po.flick.now]
0xE05FCFA1: [po.highSpeedImageReviewOn]
0xE05FCF75: [po.ibpmode]
0xE05FD7CB: [po.ignore]
0xE05FD1FF: [po.ignore_check]
0xE05FD68B: [po.maskReleaseBlock]
0xE05FD0B5: [po.measure]
0xE05FD1EF: [po.mecha.recover]
0xE05FD203: [po.mirrorUpSetting]
0xE05FD21B: [po.optimizationTimeLag]
0xE05FCF65: [po.posture]
0xE05FD653: [po.printReleaseBlock]
0xE05FD35D: [po.relcount.clear]
0xE05FD333: [po.relcount.print]
0xE05FD357: [po.relcount.set]
0xE05FD7C7: [po.respect]
0xE05FD1FB: [po.respect_check]
0xE05FD0D5: [po.set]
0xE05FCFC3: [po.set_cu_buffer]
0xE05FD1D7: [po.shutter.close]
0xE05FD1E3: [po.shutter.open]
0xE05FD305: [po.sw2on]
0xE05FD073: [po.test.init]
0xE05FD01D: [po.test.start]
0xE05FCFE9: [po.test.stop]
0xE05FD6D1: [po_fa_resetaeparam]
0xE05FD6DB: [po_fa_setaeparam]
0xE004949F: [printerr]
0xE0592AA1: [prop_deletepropertyfromfile]
0xE0592431: [prop_getproperty]
0xE0592BC1: [prop_getpropertylist]
0xE05936FF: [prop_prohibitfromaccess]
0xE05924A3: [prop_readpropertytofile]
0xE05962FD: [prop_saveproperty]
0xE05962DD: [prop_savepropertydual]
0xE0596345: [prop_savepropertymultipartly]
0xE0596321: [prop_savepropertypartly]
0xE059304D: [prop_savewritemultipartly]
0xE0592FBB: [prop_setidwritemultipartly]
0xE0592F73: [prop_setnumwritemultipartly]
0xE05963F3: [prop_testFactory]
0xE05930A3: [prop_testmultipartly1]
0xE0592F1B: [prop_writemultipartly]
0xE0592915: [prop_writepropertyfromfile]
0xE065FA15: [ptptest]
0xE0196413: [readedid]
0xE01CB2FB: [readid]
0xE06AD8E1: [rectsm]
0xE06AD8FD: [rectsmtime]
0xE03DE3A9: [redevCreate]
0xE05FD267: [releaseType]
0xE05FD2C3: [rep_sw2on]
0xE0420E93: [repvram]
0xE004947D: [reqBatt]
0xE0049493: [reqError]
0xE0049487: [reqStrobo]
0xE01960A3: [saveedid]
0xE052C7FD: [scls]
0xE05AD4A5: [scsFactoryLens]
0xE00A41EF: [selfRefresh]
0xE05F37BD: [send_mpu]
0xE06DE8DF: [setStartTime]
0xE06DE8BB: [setTimeMode]
0xE00701A1: [set_Ta10CorrectType]
0xE00E72C5: [set_multishot_debugmode]
0xE0063D69: [set_multishot_obwb]
0xE0196017: [setedid]
0xE00830D1: [shirahama.taskinfo]
0xE0054879: [sht_ChangeAv]
0xE0054971: [sht_ChangeIso]
0xE00548EB: [sht_ChangeTv]
0xE0054ED3: [sht_ChgPropVal]
0xE0054841: [sht_DisableManualSilent]
0xE0054869: [sht_DisableNrJudgement]
0xE0054855: [sht_EnableManualSilent]
0xE0054875: [sht_EnableNrJudgement]
0xE00D5A71: [sht_EngineCheck]
0xE0054E09: [sht_GetPropVal]
0xE00546FD: [sht_SaveMmrFileNoOverWrite]
0xE0054793: [sht_SaveMmrFile]
0xE00701A1: [sht_SetTa10CorrectType]
0xE00545D9: [sht_SubChipCheck]
0xE00700DB: [sht_Ta10Check]
0xE06C574F: [sht_bypass_chgain]
0xE06C575B: [sht_bypass_choff]
0xE06C5749: [sht_bypass_degeen28]
0xE06C5703: [sht_bypass_degeen32]
0xE06C5743: [sht_bypass_hivshd]
0xE06C5763: [sht_bypass_kids]
0xE06C56B3: [sht_bypass_off]
0xE06C5755: [sht_bypass_yossie]
0xE06A8583: [sht_dbgcappath_direct]
0xE06A857B: [sht_dbgcappath_end]
0xE005467D: [sht_dmprint]
0xE0054683: [sht_dmstore]
0xE0055F1F: [sht_fixflag]
0xE0055965: [sht_fixregread]
0xE0055BB7: [sht_fixregsave]
0xE00554AF: [sht_fixregwrite]
0xE0054DDD: [sht_out_dark]
0xE0054D9B: [sht_out_face]
0xE0054DF3: [sht_out_vram]
0xE0055CDD: [sht_propread]
0xE0055BE7: [sht_propshow]
0xE0055C3B: [sht_propwriteSC]
0xE0055C7B: [sht_propwrite]
0xE0055BA7: [sht_regread]
0xE0055675: [sht_regwrite]
0xE0054DB1: [sht_servo_vram_off]
0xE0054DC7: [sht_servo_vram_on]
0xE0054689: [sht_showid]
0xE0055A91: [sht_tuneregread]
0xE0055EED: [sht_tuneregsave]
0xE005559B: [sht_tuneregwrite]
0xE067C155: [sio_FA_ReceiveDataFromEEPROM]
0xE067C13D: [sio_FA_SendDataToEEPROM16]
0xE067C149: [sio_FA_SendDataToEEPROM8]
0xE067C131: [sio_FA_SendDataToEEPROM]
0xE067AEA1: [sio_logon2]
0xE067AD15: [sio_logon2_wp]
0xE0531093: [smemFactory2]
0xE0531041: [smemFactory]
0xE0530F63: [smemImage]
0xE052C78F: [smemSetCraw]
0xE019075B: [smemShowCBx]
0xE01907F1: [smemShowFix]
0xE01906FD: [smemShowObj]
0xE0190D3F: [smemShowStat]
0xE052C88F: [smemStgAlloc]
0xE052C729: [smemTerm]
0xE05A5A35: [sprintf]
0xE05E1C45: [sscanf]
0xE052C76F: [sstgShowDcf]
0xE01CBDA9: [startcircledrive]
0xE05E08E3: [startrxtest]
0xE05E0987: [starttxfrqtest]
0xE05E0853: [starttxtest]
0xE01CBDB9: [stopcircledrive]
0xE05E0ED9: [stoprxtest]
0xE05E0E85: [stoptxfrqtest]
0xE05E0F2F: [stoptxtest]
0xE05A59CD: [strcmp]
0xE05A581F: [strcpy]
0xE05A580B: [strlen]
0xE06987B9: [sysConfig]
0xE0698791: [taskShow]
0xE05E3BE5: [tcmdisptest]
0xE05E3A3B: [tcmpre]
0xE06795B9: [tg_FA_ClearGainSetting]
0xE06794CB: [tg_FA_DisableAdjustForSR]
0xE06794A9: [tg_FA_DisableDefmark]
0xE0679419: [tg_FA_DisableFixedPo]
0xE067944D: [tg_FA_DisableLinerEShutCurve]
0xE06794B1: [tg_FA_EnableAdjustForSR]
0xE067949F: [tg_FA_EnableDefmark]
0xE06793FF: [tg_FA_EnableFixedPo]
0xE0679433: [tg_FA_EnableLinerEShutCurve]
0xE0679541: [tg_FA_SetAccumulateTimeForSR12]
0xE067954D: [tg_FA_SetAccumulateTimeForSR14]
0xE0679559: [tg_FA_SetAccumulateTimeForSR15]
0xE06793F1: [tg_FA_SetFixedPo]
0xE0679591: [tg_FA_SetGainSetting]
0xE0083247: [timer.getcount]
0xE008325B: [timer.setcount]
0xE05F3307: [umount]
0xE05F37AF: [update]
0xE0623FED: [usm_changefreq]
0xE0623F5D: [usm_init]
0xE0623FAD: [usm_start]
0xE0624085: [usm_stop]
0xE05F3835: [usvMaker]
0xE00894A9: [vfx_CFDevAll]
0xE00893DF: [vfx_CFilterDev]
0xE00893BF: [vfx_ResizeAll]
0xE008931D: [vfx_Resize]
0xE00892BD: [vfx_TrimmingAll]
0xE00892DD: [vfx_TrimmingBase]
0xE0089303: [vfx_TrimmingEasy]
0xE0089195: [vfx_Trimming]
0xE007C695: [vramdump]
0xE06DC2DD: [vsmode]
0xE0069D3F: [waitForInt]
0xE0081ED5: [wlanHeatStart]
0xE0081DEB: [wlanLachesisTest]
0xE0082565: [wlanSetMacAdderess]
0xE0081CC9: [wlanchk]
0xE0082697: [wlandebug]
0xE0082C39: [wlandown]
0xE0081DE1: [wlanhwreset]
0xE0082727: [wlanipset]
0xE0082BC7: [wlanjoin]
0xE0081DBB: [wlanledblink]
0xE0081DAB: [wlanledoff]
0xE0081D9B: [wlanledon]
0xE0082679: [wlanpingsend]
0xE0081D05: [wlanpoweroff]
0xE0081CF3: [wlanpoweron]
0xE0081D17: [wlanscan]
0xE0082433: [wlanuAPTest]
0xE0082C87: [wlanup]
0xE00826C9: [wprd]
0xE007C5A9: [yuvdump]


Code to dump the stubs:


msleep(30000);

typedef struct {
  void* pStaticArg;
  void* pFunction;
} EventProc;

typedef struct {
  struct EventProcList* pNext;
  EventProc* pProc;
  char pName[64];
} EventProcList;

typedef struct {
  char* pName;
  int numElements;
  uint32_t semaphore;
  uint32_t numLists;
  uint32_t unknown_16;
  uint32_t unknown_20;
  struct EventProcList* pList;
} Service;

Service* pService = 0xc80080;
void* pExportProxy = 0xe0595d35;

uart_printf("Service Name: %s\n", pService->pName);
uart_printf("number of lists: %d\n", pService->numLists);

int traversedElems = 0;

for (int i = 0; i < pService->numLists; ++i) {
  EventProcList* pCurListItem = (&pService->pList)[i];

  while (pCurListItem) {
    void* pFunction = NULL;

    if (pCurListItem->pProc->pFunction != pExportProxy) // Got function registred via ExportToEventProcedure?
      pFunction = pCurListItem->pProc->pFunction;
    else
      pFunction = pCurListItem->pProc->pStaticArg;

    uart_printf("0x%08X: [%s]\n", pFunction, pCurListItem->pName);
    pCurListItem = pCurListItem->pNext;

    ++traversedElems;
  }
}

uart_printf("Expected functions: %d\n", pService->numElements);
uart_printf("Items traversed: %d\n", traversedElems);


Update: all stubs do have correct addresses now.
Title: Re: Canon EOS R / RP
Post by: ArcziPL on February 25, 2021, 08:18:11 PM
Quote from: coon on February 24, 2021, 10:17:53 PM
I have analyzed how the ExecuteEventProcedure function calls functions by name and I have found the location where names and function pointers are stored. Thus I was able to dump
Isnt't this an amazing breakthrough in scope of whole ML (and maybe all cams)? For me it sounds like (but I'm a noob here)! Congratulations!
Title: Re: Canon EOS R / RP
Post by: coon on February 25, 2021, 09:41:23 PM
nah, not a huge breakthrough but it makes decompiled code a little bit more readable on some places
Title: Re: Canon EOS R / RP
Post by: c_joerg on March 12, 2021, 08:10:48 PM
Any idea what the functions do:
dev_cropcheck
dev_cropcontcheck

I was hoping to find features like disable_crop ...
Title: Re: Canon EOS R / RP
Post by: kitor on March 13, 2021, 10:42:07 AM
Dump rom, open in ghidra, take a peek :)

We had a property bricked camera recently on Discord (fixed by rewriting part of ROM from copy), and IIRC that was due to one of dev_ functions, so I don't think anyone will yolo-check  ;)
Title: Re: Canon EOS R / RP
Post by: kitor on March 14, 2021, 10:45:42 PM
This was a crazy weekend. After two days of work, and a ton of help from @names_are_hard, I managed to get CONFIG_HELLO_WORLD running on R.180:

(https://kitor.pl/eos_r/img/config_hello_world.jpg)

Code so far is in my repo: https://github.com/kitor/magiclantern_simplified/tree/eosr_hello_world, not merged yet as names_are_hard has some stuff to push.
Title: Re: Canon EOS R / RP
Post by: Danne on March 15, 2021, 07:22:01 AM
Nice work  8)!
Title: Re: Canon EOS R / RP
Post by: coon on March 20, 2021, 10:23:48 AM
Turtius found out how networking works on 200D a few days ago. I can confirm that his findings do also work for RP. I can successfully join a WiFi network, open a TCP/IP connection and send data. Based on the work for 200D I did some further investigations about the structures used for networking. Here is some example code on how to connect to wifi:


call("NwLimeOn");
call("wlanchk");

WlanSettings_t wlanSettings;
memset(&wlanSettings, 0, sizeof(wlanSettings));

wlanSettings.mode = INFRA; // ADHOC_WIFI, INFRA, ADHOC_G
wlanSettings.unknown_8 = 0; // set to 0 on INFRA, 1 on ADHOC_WIFI, and 2 on ADHOC_G
wlanSettings.unknown_40 = 6; // set to 6 when using WPA2PSK or BOTH
strcpy(wlanSettings.pSSID, "<SSID name>");
wlanSettings.channel = <WiFI channel>;
wlanSettings.authMode = <Auth Mode>; // OPEN, SHARED, WPA2PSK, BOTH
wlanSettings.cipherMode = <Cipher Mode>; // NONE, WEP, AES
strcpy(wlanSettings.pKey, "<password>");
wlanconnect(&wlanSettings);

call("wlanipset", "<IP to set>"); // For example: "192.168.1.100"


This connects to a Wifi in infrastructure mode. I don't know how to use DHCP yet so one has to set an IP by themselves for now.


And here are the structures (not fully reversed yet):


0xe040d5b5: int wlanconnect(WlanSettings_t* pWlanSettings)



typedef enum WlanSettingsMode_t {
  ADHOC_WIFI=1,
  INFRA=2,
  ADHOC_G=3
} WlanSettingsMode_t;



typedef enum WlanSettingsAuthMode_t {
  OPEN=0
  SHARED=1,
  WPA2PSK=5,
  BOTH=6,
} WlanSettingsAuthMode_t;



typedef enum WlanSettingsCipherMode_t {
  NONE=0,
  WEP=1,
  AES=4
} WlanSettingsCipherMode_t;



struct WlanSettings_t {
  int unknown_0;
  enum WlanSettingsMode_t mode;
  int unknown_8;
  char pSSID[36];
  int channel;
  enum WlanSettingsAuthMode_t authMode;
  enum WlanSettingsCipherMode_t cipherMode;
  int unknown_3C;
  int unknown_40;
  char pKey[63];
  byte pUnknown_83[121];
};


My next goal is implementing some simple server where you can update autoexec.bin via Wifi. Thus massive swapping of SD card is not needed anymore in future hopefully.
Title: Re: Canon EOS R / RP
Post by: kitor on March 30, 2021, 06:25:21 PM


8)

Team work with @names_are_hard (200D)

This is "only" menus so don't get overexcited.

I have some big discoveries on how Digic 7 and 8 render image to screen, need to make a summary and create a separate thread for that. Hopefully will be posted later this week.
Title: Re: Canon EOS R / RP
Post by: sast on April 04, 2021, 12:09:31 PM
Wow, I can't wait for Magic Lantern to run on the EOS R. Thanks in advance. :)
Title: Re: Canon EOS R / RP
Post by: coon on April 18, 2021, 05:00:41 PM
I have found a JSON library Canon calls JSONPG or cJson and here are the stubs to all of its functions for EOS RP 1.6.0:


0xe0185d14: cJsonArrayList_Create
0xe0185f24: cJsonArrayList_DisplaceBack
0xe01862e8: cJsonArrayList_DisplaceForward
0xe0185e06: cJsonArrayList_ExtendBufferIfNecessary
0xe0185c28: cJsonArrayList_Finalize
0xe0185c60: cJsonArrayList_Free
0xe0185dae: cJsonArrayList_Get
0xe0185d7e: cJsonArrayList_GetCount
0xe0185c9c: cJsonArrayList_Initialize
0xe018638a: cJsonArrayList_Remove
0xe0186260: cJsonArrayList_Replace
0xe018bb4c: cJsonBufferInput_Create
0xe018bc8e: cJsonBufferInput_Finalize
0xe018bbca: cJsonBufferInput_Free
0xe018badc: cJsonBufferInput_Initialize
0xe018bc06: cJsonBufferInput_Read
0xe018657e: cJsonBufferOutput_Create
0xe01865ea: cJsonBufferOutput_ExtendBufferIfNecessary
0xe018648c: cJsonBufferOutput_Finalize
0xe01864c4: cJsonBufferOutput_Free
0xe0186500: cJsonBufferOutput_Initialize
0xe0186672: cJsonBufferOutput_Write
0xe018c010: cJsonCharProviderUtf8_Create
0xe018bebc: cJsonCharProviderUtf8_Finalize
0xe018bef8: cJsonCharProviderUtf8_Free
0xe018c1d0: cJsonCharProviderUtf8_Get
0xe018c22c: cJsonCharProviderUtf8_GetPosition
0xe018bf34: cJsonCharProviderUtf8_Initialize
0xe018c148: cJsonCharProviderUtf8_Peek
0xe018c0ba: cJsonCharProviderUtf8_ReadIfBufferEmpty
0xe0116254: cJsonDocument_CreateNodeFromTokenType
0xe0117778: cJsonDocument_FreeBuffer
0xe0116e0a: cJsonDocument_GenerateArray
0xe0117154: cJsonDocument_GenerateObject
0xe01172cc: cJsonDocument_GenerateRoot
0xe0117452: cJsonDocument_GenerateToBuffer
0xe0117626: cJsonDocument_GenerateToStream
0xe0116310: cJsonDocument_ParseArray
0xe01169ca: cJsonDocument_ParseFromBuffer
0xe0116af6: cJsonDocument_ParseFromStream
0xe01164a2: cJsonDocument_ParseObject
0xe0116806: cJsonDocument_ParseRoot
0xe0116f7e: cJsonDocument_WriteFieldByNodeType
0xe0116d1a: cJsonDocument_WriteValueByNodeType
0xe0496b78: cJsonGenerator_BackupState
0xe0494b48: cJsonGenerator_BuildString
0xe0494c0a: cJsonGenerator_Close
0xe0495144: cJsonGenerator_Create
0xe049531c: cJsonGenerator_CreateForStream
0xe0494c74: cJsonGenerator_Finalize
0xe0496ad0: cJsonGenerator_Flush
0xe0494cfc: cJsonGenerator_Free
0xe0496a52: cJsonGenerator_GetBuffer
0xe04969d4: cJsonGenerator_GetBufferLength
0xe0494e5a: cJsonGenerator_Initialize
0xe0494de2: cJsonGenerator_InitializeForBuffer
0xe0495234: cJsonGenerator_InitializeForStream
0xe0494d5e: cJsonGenerator_InitializeTextWriter
0xe049566a: cJsonGenerator_PrepareWrite
0xe049545e: cJsonGenerator_RestoreState
0xe0496964: cJsonGenerator_VerifyCompleted
0xe0495f78: cJsonGenerator_VerifyField
0xe04955ac: cJsonGenerator_VerifyToken
0xe0495850: cJsonGenerator_WriteBeginArray
0xe0496200: cJsonGenerator_WriteBeginArrayField
0xe049593a: cJsonGenerator_WriteBeginObject
0xe049630a: cJsonGenerator_WriteBeginObjectField
0xe049668a: cJsonGenerator_WriteBoolField
0xe0495d0e: cJsonGenerator_WriteBoolValue
0xe04958c4: cJsonGenerator_WriteEndArray
0xe0495a1c: cJsonGenerator_WriteEndObject
0xe049609e: cJsonGenerator_WriteFieldTemplate
0xe04964be: cJsonGenerator_WriteIntegerField
0xe0495b6e: cJsonGenerator_WriteIntegerValue
0xe049678e: cJsonGenerator_WriteNullField
0xe0495e80: cJsonGenerator_WriteRawValue
0xe049684e: cJsonGenerator_WriteRawValueField
0xe04965a4: cJsonGenerator_WriteRealField
0xe0495c3e: cJsonGenerator_WriteRealValue
0xe04963c8: cJsonGenerator_WriteStringField
0xe0495a8e: cJsonGenerator_WriteStringValue
0xe04956e8: cJsonGenerator_WriteValueTemplate
0xe0186f94: cJsonHashTable_AddToBucket
0xe0186a74: cJsonHashTable_Clear
0xe0186be0: cJsonHashTable_Create
0xe01869a6: cJsonHashTable_CreateItem
0xe0186abe: cJsonHashTable_Finalize
0xe0186c4a: cJsonHashTable_FindItem
0xe0186b02: cJsonHashTable_Free
0xe0186968: cJsonHashTable_FreeItem
0xe018720e: cJsonHashTable_GetIterator
0xe018692c: cJsonHashTable_Hash
0xe0186b40: cJsonHashTable_Initialize
0xe0187038: cJsonHashTable_Rehash
0xe01873ca: cJsonHashTable_Remove
0xe01872c8: cJsonHashTable_RemoveFromBucket
0xe01870f2: cJsonHashTable_Set
0xe01b6894: cJsonLexer_AppendCharToToken
0xe01b869a: cJsonLexer_ClearBuffer
0xe01b854a: cJsonLexer_Create
0xe01b7bec: cJsonLexer_DecodeUnicode
0xe01b67dc: cJsonLexer_Finalize
0xe01b6820: cJsonLexer_Free
0xe01b6fae: cJsonLexer_GetChar
0xe01b6938: cJsonLexer_GetCharIfTokenContinue
0xe01b685c: cJsonLexer_GetTokenString
0xe01b8364: cJsonLexer_Initialize
0xe01b86d2: cJsonLexer_IsValueStart
0xe01b862c: cJsonLexer_Next
0xe01b830a: cJsonLexer_OnError
0xe01b6ab4: cJsonLexer_OnKeyword
0xe01b8182: cJsonLexer_OnNeutral
0xe01b6e52: cJsonLexer_OnNumExp
0xe01b70ac: cJsonLexer_OnNumExpSign
0xe01b733c: cJsonLexer_OnNumExpStart
0xe01b748a: cJsonLexer_OnNumFrac
0xe01b761a: cJsonLexer_OnNumFracStart
0xe01b7752: cJsonLexer_OnNumInt
0xe01b7908: cJsonLexer_OnNumIntZero
0xe01b7a96: cJsonLexer_OnNumSign
0xe01b7fdc: cJsonLexer_OnStr
0xe01b7dfa: cJsonLexer_OnStrEscape
0xe01b7c9e: cJsonLexer_OnStrEscapeUnicode
0xe0145b0c: cJsonNode_AddToArray
0xe0144ae0: cJsonNode_ClearArray
0xe0144ae0: cJsonNode_ClearArray
0xe0144a38: cJsonNode_ClearObject
0xe0146480: cJsonNode_Clone
0xe0145fe6: cJsonNode_ContainsKeyInObject
0xe0144d44: cJsonNode_CreateObject
0xe0145e7c: cJsonNode_DetachFromArray
0xe01462b0: cJsonNode_DetachFromObject
0xe0146632: cJsonNode_Finalize
0xe0144b8c: cJsonNode_Free
0xe01459b2: cJsonNode_GetArrayCount
0xe014586c: cJsonNode_GetBigNumber
0xe0145ad0: cJsonNode_GetFromArray
0xe0145fae: cJsonNode_GetFromObject
0xe014575c: cJsonNode_GetInteger
0xe0145674: cJsonNode_GetNodeType
0xe0146356: cJsonNode_GetObjectIterator
0xe01457e4: cJsonNode_GetReal
0xe01456da: cJsonNode_GetString
0xe0144bec: cJsonNode_InitializeArray
0xe014527e: cJsonNode_InitializeBigNumber
0xe01466a6: cJsonNode_InitializeInteger
0xe01454ea: cJsonNode_InitializeKeyword
0xe0144cda: cJsonNode_InitializeObject
0xe01466d8: cJsonNode_InitializeReal
0xe0144ff2: cJsonNode_InitializeString
0xe0145bd2: cJsonNode_InsertToArray
0xe0145da0: cJsonNode_RemoveFromArray
0xe01461c4: cJsonNode_RemoveFromObject
0xe014608a: cJsonNode_SetToObject
0xe01463e0: cJsonNode_ShallowCopy
0xe014b432: cJsonObjectIterator_GetKey
0xe014b486: cJsonObjectIterator_GetMutableValue
0xe014b4b8: cJsonObjectIterator_GetValue
0xe014b3c0: cJsonObjectIterator_Next
0xe01b8864: cJsonParserStateStack_CopyContent
0xe01b89d6: cJsonParserStateStack_Create
0xe01b88ce: cJsonParserStateStack_Finalize
0xe01b8908: cJsonParserStateStack_Free
0xe01b8944: cJsonParserStateStack_Initialize
0xe01b8ad2: cJsonParserStateStack_IsEmpty
0xe01b8b08: cJsonParserStateStack_Pop
0xe01b8a6a: cJsonParserStateStack_Push
0xe014b5b8: cJsonParser_Close
0xe014b856: cJsonParser_CreateFromBuffer
0xe014bc2c: cJsonParser_CreateFromStream
0xe014bd48: cJsonParser_DecodeNumber
0xe014b626: cJsonParser_Finalize
0xe014b69a: cJsonParser_Free
0xe014c9bc: cJsonParser_GetEncoding
0xe014c5c2: cJsonParser_GetFieldName
0xe014c6fe: cJsonParser_GetInteger
0xe014ca1a: cJsonParser_GetPosition
0xe014c80a: cJsonParser_GetRawValue
0xe014c784: cJsonParser_GetReal
0xe014c660: cJsonParser_GetString
0xe014c4d8: cJsonParser_GetTokenType
0xe014b7ba: cJsonParser_Initialize
0xe014c0fa: cJsonParser_InitializeCharProvider
0xe014b6fa: cJsonParser_InitializeFromBuffer
0xe014bb4c: cJsonParser_InitializeFromStream
0xe014c1e2: cJsonParser_InitializeLexer
0xe014c53e: cJsonParser_IsBigNumber
0xe014be18: cJsonParser_PreRead
0xe014c2c2: cJsonParser_Read
0xe014bee4: cJsonParser_ResolveEncoding
0xe01b2d0c: cJsonString_AppendChar
0xe01b2ebc: cJsonString_AppendString
0xe01b2de0: cJsonString_AppendStringN
0xe01b2f4a: cJsonString_Clear
0xe01b28aa: cJsonString_Create
0xe01b2fb6: cJsonString_Equals
0xe01b29d4: cJsonString_ExtendBufferIfNecessary
0xe01b2790: cJsonString_Finalize
0xe01b27ca: cJsonString_Free
0xe01b2934: cJsonString_Get
0xe01b2828: cJsonString_Initialize
0xe01b2984: cJsonString_Length
0xe01b2a9a: cJsonString_Set
0xe0187622: cJsonSyntaxVerifier_Create
0xe0187510: cJsonSyntaxVerifier_Finalize
0xe018754a: cJsonSyntaxVerifier_Free
0xe0187588: cJsonSyntaxVerifier_Initialize
0xe01876b8: cJsonSyntaxVerifier_TransitState
0xe018777c: cJsonSyntaxVerifier_Verify
0xe01879fa: cJsonSyntaxVerifier_VerifyEof
0xe0187ac2: cJsonTextWriterUtf8_Create
0xe0187c08: cJsonTextWriterUtf8_Finalize
0xe0187b2c: cJsonTextWriterUtf8_Free
0xe0187a78: cJsonTextWriterUtf8_Initialize
0xe0187b68: cJsonTextWriterUtf8_WriteString
0xe0188d8a: cJsonUtil_DiscriminateEncoding
0xe0188406: cJsonUtil_DoubleToString
0xe0187ff4: cJsonUtil_EscapeAndAppendString
0xe0188788: cJsonUtil_GetForVerify
0xe018814a: cJsonUtil_IntToString
0xe0188728: cJsonUtil_IsInteger
0xe01889ec: cJsonUtil_IsNumberString
0xe0188c2e: cJsonUtil_IsStartWithBom
0xe0188a62: cJsonUtil_IsString
0xe0188890: cJsonUtil_PeekForVerify
0xe0188658: cJsonUtil_StringToDouble
0xe018852a: cJsonUtil_StringToInt
0xe0187e28: cJsonUtil_UnicodeEscape
0xe0188ad2: cJsonUtil_Utf16CharToUtf8


Not all of these functions are needed to use the library. Most of them are used by internal mechanisms. I'll open another thread in the Reverse Engineering (https://www.magiclantern.fm/forum/index.php?board=6.0) section with more info on how to use the library.
Title: Re: Canon EOS R / RP
Post by: coon on May 24, 2021, 12:49:43 PM
As already mentioned here https://www.magiclantern.fm/forum/index.php?topic=25662.msg235562#msg235562 I have found a way to close and open the shutter manually on RP.
To do so, FA_MechaShutterClose and FA_MechaShutterClose can be called.

On the EOS R the shutter will close when the camera is turned off do reduce the risk of getting dust onto the sensor. Unfortunately this feature is not available on RP. By using this functions it should be possible to also enable that on RP.
Title: Re: Canon EOS R / RP
Post by: kitor on May 24, 2021, 12:56:06 PM
R doesn't close shutter on lens detached so it may be a nice feature to implement too.
Title: Re: Canon EOS R / RP
Post by: kitor on May 29, 2021, 08:05:06 PM
(https://kitor.pl/eos_r/img/eos_r_ram.png)

Funny stuff - when your camera has 2GB of ram, and you have a problem to find just about 3MB for yourself.

Our current progress uses a lot of ram considering "regular" Digic 4/5 cameras:

- ~500kb already used by Zebra for double buffering
- ~500kb for indexed RGB buffer that emulates old style of drawing (so we don't need to rewrite a lot of GUI code)
- ~500kb for bitmap font (gone from D6+ ROMs, at the moment I loaded one extracted from my 50D)
- ~2MB for RGBA layer (see thread on Compositor (https://www.magiclantern.fm/forum/index.php?topic=26024))

This is already more than regular memory available on R ???

While 3rd and 4th are optional:
- Bitmap font was already mostly replaced, and we will either prepare a much smaller BMP font that we can distribute, or get rid of it at all
- Own compositor layer can be avoided - at the moment it has no big benefits over drawing directly to GUI layer like 200D, M

it is still less than 3MB of memory available  >:(

For the last two days with names_are_hard I was looking at memory management functions. In general there are two main allocators (malloc/free and AllocateMemory/FreeMemory) that can be "freely" used.

What I noticed is that 2nd one (AllocateMemory/FreeMemory) just wraps calls to more general functions that take memory pool address as first param. Those functions are also used by some other components. It turns out that Canon has nice "class" for managing memory area - called... you guessed it, MemoryManager.

There's just a single function to initialize - takes just start memory address and memory length. After using it over arbitrary block of memory (of course assuming it is not used by anyone else) one can just call any of those general functions (e.g. void* ptr = AllocateMemory_impl(pMemMgr, size) or FreeMemory_impl(pMemMgr, ptr).

As I found potentially unused 4MB memory block, I was able to just initialize MemoryManager and substitute functions stubs with ones that wrap into that block. Code is fairly clean and simple and you can  see it in this commit in my repo (https://github.com/kitor/magiclantern_simplified/commit/cfd514bf42f1ff58cd03eb557e2452bbeb208786).

While my code just replaces usage of usual Canon pool, it can be integrated as additional space into our memory management system. I just replaced it as this way I was able to keep my changes in platform dir for now, and this way code is forced to use it - so I'll probably see some crashes is something else uses the mentioned memory area. Hopefully it won't happen ;)
Title: Re: Canon EOS R / RP
Post by: kitor on June 03, 2021, 04:04:19 PM
Moar stuff!  8)

Turns out that there were a lot of property changes on Digic 8 generation (unconfirmed on DSLR, but applicable at least for R* and M50).

(https://kitor.pl/eos_r/img/eos_r_shutter2.png) (https://kitor.pl/eos_r/img/eos_r_lens_info.png)

I started today's journey with fixing shutter counter. Guess what, new property is used...

At least this one was easy. Although I didn't find "total count" (the one that includes LV), but this was expected as R is LV all the time. Requires verification on D8 DSLR.
I also found another counter - which includes shots made in silent (electronic) shutter mode. I decided to add it to the menus as a new, currently R only feature  8)

Fixing Lens info was a more complex task. Turns out that multiple properties were replaced with two, called nicely LENS_STATIC_DATA and LENS_DYNAMIC_DATA

I had to work out new structures and make a new handlers for those. As you can see, they work. Confirmed on RF and EF lenses (latter both on Canon and Tamron lenses).
Changes for now are on in my repo on kitor_dev branch (https://github.com/kitor/magiclantern_simplified/tree/kitor_dev)
Title: Re: Canon EOS R / RP
Post by: coon on June 14, 2021, 10:36:09 AM
I have catched up with R / M50 / 200D progress and finally got Magic Lantern menus running on RP:

(https://i.ibb.co/rxJqN0m/ml-menus-eosrp.jpg)

Running ML was not easily possible for a while since from RP on Canon decided to use a different way to render graphics then on previous models like R. This new method is also used on R6, R5 etc.
However, due to kitors research on the compositor (https://www.magiclantern.fm/forum/index.php?topic=26024.0) this is not an issue anymore.

Navigating through the menu is possible but no feature works currently. Camera tends to crash when running menu entries and behaves in a undefined manner so this is nothing what can be released to the public for now. Next step is getting menus stable and enable features :).
Title: Re: Canon EOS R / RP
Post by: Corallaro on June 14, 2021, 01:18:23 PM
Wow that's great!!!! :)

My RP is very excited! !
Title: Re: Canon EOS R / RP
Post by: coon on June 16, 2021, 06:03:04 PM
And here is the first Magic Lantern feature for RP: Close shutter when turning the camera off. For some reason this is only available on R, R6 and R5 but not for RP... At least until today :).

Title: Re: Canon EOS R / RP
Post by: Walter Schulz on June 16, 2021, 06:22:16 PM
Build available?
Title: Re: Canon EOS R / RP
Post by: kitor on June 16, 2021, 07:03:49 PM
Yup, on @coon's SD card ;)

This requires a proper integration with ML codebase first. Right now it is just yolo-attached to ML shutdown code  :)

====

On the other hand - I spent almost whole week trying to implement intervalometer. Not only factory functions looks to be implemented differently on this generation (we used some of those to make shoots), but after roughly understanding how they work I hit a wall - they have a bug. If photo is not taken (e.g. AF fails) camera ends up in a state where next photo will crash it [1].
I'm looking for other methods of making shoots from code.

Inb4 "bbbbbut R has intervalometer built in!". No, it doesn't! It has movie timelapse mode only, something completely different but often mistaken by people who never had R in their hands.

[1] Technical TL;DR: Post-shoot callback is set up which releases a semaphore, that is already removed on failure. Kernel fails on null pointer...
I tried cleaning all memory locations that hold CBR address, but no luck - it is still executed. After a week I needed a break.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on June 16, 2021, 07:29:29 PM
"Use Autofocus" on any recent ML build will break intervalometer, audio remote shot and focus trap (motion detection): https://foss.heptapod.net/magic-lantern/magic-lantern/-/issues/2923
Title: Re: Canon EOS R / RP
Post by: kitor on June 16, 2021, 07:58:52 PM
Quote7D's reaction: Shoot like crazy, burst mode (7D.206 running dfort's build)
Confirmed by user critix running 500D (latest nightly).

Quote650D behaves different. Screen will be frozen Canon's "Q"-view. Pics will be taken by full press, but no reaction on half-shutter, set, info, menu buttons.

Both are possible outcomes on R, depending on function used. 3rd, more common one is just hard crash due to kernel assertion on mentioned null pointer.
Thanks for pointing this out. So it is not R being crazy, but we just need a better method to make DryOS do photos.
Title: Re: Canon EOS R / RP
Post by: Corallaro on June 19, 2021, 12:24:03 AM
Quote from: coon on June 16, 2021, 06:03:04 PM
And here is the first Magic Lantern feature for RP: Close shutter when turning the camera off. For some reason this is only available on R, R6 and R5 but not for RP... At least until today :).

A this point the second feature can be silent shutter in all modes......... ;)
Title: Re: Canon EOS R / RP
Post by: Sapporo on June 19, 2021, 04:05:25 PM
Two different firmware 1.8.0.
https://gdlp01.c-wss.com/gds/8/0400006288/01/eosr-v180-win.zip
https://gdlp01.c-wss.com/gds/8/0400006288/02/eosr-v180-win.zip
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on June 19, 2021, 04:11:14 PM
CRC32:
178F25F7
EDD1561F

Dammit, Canon! Why?
Title: Re: Canon EOS R / RP
Post by: ArcziPL on June 20, 2021, 12:15:48 AM
Nice, hehe. Just FYI: first one comes from canon-europe.com (http://canon-europe.com), the second one from asia.canon (http://asia.canon).
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on June 20, 2021, 12:59:48 AM
Any insights about the differences?
Title: Re: Canon EOS R / RP
Post by: names_are_hard on June 20, 2021, 02:14:00 AM
The FIR files aren't really meaningful to compare, they're mostly an encrypted blob so they appear entirely different apart from the short header (which has some small differences).  The files are different sizes, so there's probably some real changes.  Needs dumps to compare sensibly.

I don't think this is the first time this has happened, seem to recall it in source somewhere.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on June 20, 2021, 03:20:25 AM
I remember 70D where cams got delivered (first firmware) with 4 different firmware versions but same version string. Unaware of actual firmware files in the wild showing differences.
Title: Re: Canon EOS R / RP
Post by: kitor on June 20, 2021, 02:27:05 PM
Ouch  :o

If I don't forget about it, I'll try flashing and dumping both next week.
Title: Re: Canon EOS R / RP
Post by: sast on August 05, 2021, 07:36:43 AM
Is there any progress yet?
Title: Re: Canon EOS R / RP
Post by: kitor on August 05, 2021, 08:46:24 AM
All recent discussions were a huge milestones, some even for CHDK project and not only Magic Lantern.

But like (https://www.magiclantern.fm/forum/index.php?topic=22770.msg216706#msg216706) we (https://www.magiclantern.fm/forum/index.php?topic=22770.msg216715#msg216715) told you (https://www.magiclantern.fm/forum/index.php?topic=22770.msg218757#msg218757) already a few times, no posts = no progress.

Quote from: sast on May 18, 2019, 08:52:46 PMI don't now how to do all the things on the EOS R without ML (f. e. Intervalometer, Motion detection, the modules).

If you count on getting any of those features in near future, stop right now. Assume they won't happen unless they are announced.

In fact I already wrote about intervalometer just a few posts above (https://www.magiclantern.fm/forum/index.php?topic=22770.msg235774#msg235774) - and since then I spent too much time to understand how shooting works, without any success.
Title: Re: Canon EOS R / RP
Post by: sast on August 08, 2021, 12:13:59 PM
ok, Thanks for answering
Title: Re: Canon EOS R / RP
Post by: IDA_ML on August 08, 2021, 03:59:59 PM
"I don't now how to do all the things on the EOS R without ML (f. e. Intervalometer, Motion detection, the modules). "

Just sell the EOS-R and get yourself the 5DMkIII for the money.  You won't regret !!!
Title: Re: Canon EOS R / RP
Post by: nikfreak on August 09, 2021, 12:37:15 PM
Quote from: Walter Schulz on June 20, 2021, 03:20:25 AM
I remember 70D where cams got delivered (first firmware) with 4 different firmware versions but same version string. Unaware of actual firmware files in the wild showing differences.

true pain in my a$$  ;D
Title: Re: Canon EOS R / RP
Post by: c_joerg on August 09, 2021, 01:37:08 PM
Quote from: IDA_ML on August 08, 2021, 03:59:59 PM
"I don't now how to do all the things on the EOS R without ML (f. e. Intervalometer, Motion detection, the modules). "

At least simple things like Intervalometer, would work with Canon Basic.
https://chdk.setepontos.com/index.php?topic=13522.0

(https://live.staticflickr.com/7829/46750428704_4f3a71e117_c.jpg) (https://flic.kr/p/2eebaGd)


Title: Re: Canon EOS R / RP
Post by: kitor on August 10, 2021, 08:45:59 AM
QuoteAt least simple things like Intervalometer, would work with Canon Basic.

We have "factory" evprocs that ML calls for this reason. They work, unless they didn't and leave camera in weird state.

They have a bug in sw1/sw2 handling - callbacks are installed for that and if eg focusing fails, callback is not removed. It fires on next (even real) shot attempt, with null pointer (iirc on recursive lock) - crashing the camera.
If it even won't crash (if I reset CBRs myself after failed attempt), it leaves camera in a state where it thinks photo is developing but it is not.

If there's another possibility on EOS firmwares, I'll be happy to take it as like I mentioned on previous page I spent too much time on those functions that we used previously :)
Title: Re: Canon EOS R / RP
Post by: sast on November 27, 2021, 12:26:56 PM
Ist hier noch etwas in der Entwicklung?
Title: Re: Canon EOS R / RP
Post by: sast on November 27, 2021, 12:27:09 PM
Is there anything else in development here?
Title: Re: Canon EOS R / RP
Post by: Dmytro_ua on November 27, 2021, 02:55:23 PM
Quote from: sast on November 27, 2021, 12:27:09 PM
Is there anything else in development here?

No news here = no news in development.
How hard to understand this?  :o
Title: Re: Canon EOS R / RP
Post by: coon on November 27, 2021, 07:58:03 PM
Only boring internal stuff, but nothing usable for the end user. Research and development is still on going.
Title: Re: Canon EOS R / RP
Post by: stan101 on November 30, 2021, 02:06:40 PM
Quote from: Dmytro_ua on November 27, 2021, 02:55:23 PM
No news here = no news in development.
How hard to understand this?  :o
It's hard enough that it couldn't be understood in two languages, apparently.
Title: Re: Canon EOS R / RP
Post by: vincesd on December 02, 2021, 06:52:43 AM
Quote from: coon on November 27, 2021, 07:58:03 PM
Only boring internal stuff, but nothing usable for the end user. Research and development is still on going.
is it possible for an early release? the shutter curtain close mod that you showed already has value for end user.
Title: Re: Canon EOS R / RP
Post by: kitor on January 03, 2022, 06:48:57 PM
Some fun tests.

Benchmarks with the cheapest UHS-II card I was able to get (Lexar LSD64GCB1667)

(https://kitor.pl/eos_r/img/r_bench2.jpg) (https://kitor.pl/eos_r/img/r_bench1.jpg)

In desktop UHS-II reader:
(https://kitor.pl/eos_r/img/r_bench3.png)




What about overexposure warning in LV?

Yes, ML has this feature on older cameras. But DIGIC registers doesn't work the same way as before.
I was able to alter threshold and highlight style by poking registers, but I'm not able to activate the function (yet?). For now it works like warning you can enable in Play mode.

(https://kitor.pl/eos_r/img/r_overexpo1.jpg)
(https://kitor.pl/eos_r/img/r_overexpo2.jpg)
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on January 03, 2022, 08:23:56 PM
Faster card here:
(https://cdn.discordapp.com/attachments/802198165389705232/927613190974619738/Bench_V90.png)
(https://cdn.discordapp.com/attachments/802198165389705232/927623158738067486/bench9.png)
Title: Re: Canon EOS R / RP
Post by: kitor on January 05, 2022, 11:05:49 PM
Quote from: Sapporo on June 19, 2021, 04:05:25 PM
Two different firmware 1.8.0.
https://gdlp01.c-wss.com/gds/8/0400006288/01/eosr-v180-win.zip
https://gdlp01.c-wss.com/gds/8/0400006288/02/eosr-v180-win.zip

Confusion confirmed. There are at least two versions of R 1.8.0 firmware ???

One that all development is based on:
K424 ICU Firmware Version 1.8.0 ( 7.3.9 )
ICU Release DateTime Jul 27 2020 18:48:59


First file has modification date of 21.10.2020. It holds the same firmware as above, as 1.8.0 was publicly released on 19.11.2020.

One that we just found about (this one matches modification date of 2nd file):
K424 ICU Firmware Version 1.8.0 ( 7.4.0 )
ICU Release DateTime Feb 4 2021 17:01:29


They differ enough (everything is slightly shifted, differently aligned) that it will not work on newer version.

You can verify which one you have with Canon Basic script, mentioned on previous pages:

private sub Initialize()
    CamInfo_Debug(1)
end sub


It contains some info, including:

<FirmwareVer>
    <Internal>0.7.3.9</Internal>
    <Major>1.8.0</Major>
</FirmwareVer>
Title: Re: Canon EOS R / RP
Post by: c_joerg on January 06, 2022, 05:50:33 AM
Quote from: kitor on January 05, 2022, 11:05:49 PM
You can verify which one you have with Canon Basic script, mentioned on previous pages:

It contains some info, including:

<FirmwareVer>
    <Internal>0.7.3.9</Internal>
    <Major>1.8.0</Major>
</FirmwareVer>



I have a new EOS R, one month old that shows


<FirmwareVer>
    <Internal>0.7.4.0</Internal>
    <Major>1.8.0</Major>
</FirmwareVer>


Title: Re: Canon EOS R / RP
Post by: coon on January 08, 2022, 11:51:37 PM
Currently we are doing some research on PTP. There is a tool called ptpcam` in https://github.com/coon42/magiclantern_simplified/tree/ptpcam_add_more_canon_codes/contrib/ptpcam which allows reading some camera info via PTP. Every camera exposes all PTP commands it supports which can be queried via PTP. I've added alot of missing PTP command ids to ptpcam and got the following list of command IDs by executing:

./ptpcam --list-operations


  0x1001: GetDeviceInfo
  0x1002: OpenSession
  0x1003: CloseSession
  0x1004: GetStorageIDs
  0x1005: GetStorageInfo
  0x1006: GetNumObjects
  0x1007: GetObjectHandles
  0x1008: GetObjectInfo
  0x1009: GetObject
  0x100a: GetThumb
  0x100b: DeleteObject
  0x100c: SendObjectInfo
  0x100d: SendObject
  0x100f: FormatStore
  0x1014: GetDevicePropDesc
  0x1016: SetDevicePropValue
  0x101b: GetPartialObject
  0x902f: UNKNOWN
  0x9033: UNKNOWN
  0x9050: PTP_OC_CANON_InitiateEventProc0
  0x9051: PTP_OC_CANON_TerminateEventProc_051
  0x905c: PTP_OC_CANON_InitiateEventProc1
  0x905d: PTP_OC_CANON_TerminateEventProc_05D
  0x9060: PTP_OC_CANON_IsNeoKabotanProcMode
  0x9068: PTP_OC_CANON_GetWebServiceSpec
  0x9069: PTP_OC_CANON_GetWebServiceData
  0x906a: PTP_OC_CANON_SetWebServiceData
  0x906b: PTP_OC_CANON_DeleteWebServiceData
  0x906c: PTP_OC_CANON_GetRootCertificateSpec
  0x906d: PTP_OC_CANON_GetRootCertificateData
  0x906e: PTP_OC_CANON_SetRootCertificateData
  0x906f: PTP_OC_CANON_DeleteRootCertificateData
  0x9077: PTP_OC_CANON_GetTranscodeApproxSize
  0x9078: PTP_OC_CANON_RequestTranscodeStart
  0x9079: PTP_OC_CANON_RequestTranscodeCancel
  0x9101: PTP_OC_CANON_GetStorageIDS
  0x9102: PTP_OC_CANON_GetStorageInfo
  0x9103: PTP_OC_CANON_GetObjectInfo
  0x9104: PTP_OC_CANON_GetObject
  0x9105: PTP_OC_CANON_DeleteObject
  0x9106: PTP_OC_CANON_FormatStore
  0x9107: PTP_OC_CANON_GetPartialObject
  0x9108: PTP_OC_CANON_GetDeviceInfoEX
  0x9109: PTP_OC_CANON_GetObjectInfoEX
  0x910a: PTP_OC_CANON_GetThumbEX
  0x910c: PTP_OC_CANON_SetObjectAttributes
  0x910f: PTP_OC_CANON_Remote_Release
  0x9110: PTP_OC_CANON_SetDevicePropvalueEX
  0x9114: PTP_OC_CANON_SetRemoteMode
  0x9115: PTP_OC_CANON_SetEventMode
  0x9116: PTP_OC_CANON_GetEvent
  0x9117: PTP_OC_CANON_TransferComplete
  0x9118: PTP_OC_CANON_CancelTransfer
  0x911a: PTP_OC_CANON_PCHDDCapacity
  0x911b: PTP_OC_CANON_SetUILock
  0x911c: PTP_OC_CANON_ResetUILock
  0x911d: PTP_OC_CANON_KeepDeviceON
  0x911e: PTP_OC_CANON_SetNullPacketMode
  0x911f: PTP_OC_CANON_UpdateFirmware
  0x9122: PTP_OC_CANON_SetWFTPROFILE
  0x9123: PTP_OC_CANON_GetWFTPROFILE
  0x9124: PTP_OC_CANON_SetPROFILETOWFT
  0x9127: PTP_OC_CANON_RequestDevicePropvalue
  0x9128: PTP_OC_CANON_RemoteReleaseON
  0x9129: PTP_OC_CANON_RemoteReleaseOFF
  0x912b: PTP_OC_CANON_ChangePhotoStudioMode
  0x912c: PTP_OC_CANON_GetPartialObjectEX
  0x912d: PTP_OC_CANON_ReSizeImageData
  0x912e: PTP_OC_CANON_GetReSizeData
  0x912f: PTP_OC_CANON_ReleaseReSizeData
  0x9130: PTP_OC_CANON_ResetMirrorLockupState
  0x9131: PTP_OC_CANON_PopupBuiltinFlash
  0x9132: PTP_OC_CANON_EndGetPartialObjectEX
  0x9133: PTP_OC_CANON_MovieSelectSWOn
  0x9134: PTP_OC_CANON_MovieSelectSWOff
  0x9135: PTP_OC_CANON_GetCtgInfo
  0x9136: PTP_OC_CANON_GetLensAdjust
  0x9137: PTP_OC_CANON_SetLensAdjust
  0x9138: PTP_OC_CANON_GetMusicInfo
  0x9139: PTP_OC_CANON_CreateHandle
  0x913a: PTP_OC_CANON_SendPartialObjectEx
  0x913b: PTP_OC_CANON_EndSendPartialObjectEx
  0x913c: PTP_OC_CANON_SetCtgInfo
  0x913d: PTP_OC_CANON_SetRequestOlcInfoGroup
  0x913e: PTP_OC_CANON_SetRequestRollingPitching
  0x913f: PTP_OC_CANON_GetCameraSupport
  0x9140: PTP_OC_CANON_SetRating
  0x9141: PTP_OC_CANON_RequestDevelopStart
  0x9143: PTP_OC_CANON_RequestDevelopEnd
  0x9144: PTP_OC_CANON_GetGpsLoggingData
  0x9145: PTP_OC_CANON_GetGpsLogCurrentHandle
  0x9146: PTP_OC_CANON_SetImageRecoveryData
  0x9147: PTP_OC_CANON_GetImageRecoveryList
  0x9148: PTP_OC_CANON_FormatRecoveryData
  0x9149: PTP_OC_CANON_GetPresetLensAdjustParam
  0x914a: PTP_OC_CANON_GetRawDispImage
  0x914b: PTP_OC_CANON_SaveImageRecoveryData
  0x914c: PTP_OC_CANON_BLERequest
  0x914d: PTP_OC_CANON_DrivePowerZoom
  0x914e: PTP_OC_CANON_SendTimeSyncMessage
  0x914f: PTP_OC_CANON_GetIptcData
  0x9150: PTP_OC_CANON_SetIptcData
  0x9153: PTP_OC_CANON_GetViewfinderData
  0x9154: PTP_OC_CANON_DoAF
  0x9155: PTP_OC_CANON_DriveLens
  0x9157: PTP_OC_CANON_ClickWB
  0x9158: PTP_OC_CANON_Zoom
  0x9159: PTP_OC_CANON_ZoomPosition
  0x915a: PTP_OC_CANON_SetLiveAFFrame
  0x915b: PTP_OC_CANON_TouchAfPosition
  0x915c: PTP_OC_CANON_SetLvPcFlavoreditMode
  0x915d: PTP_OC_CANON_SetLvPcFlavoreditParam
  0x9160: PTP_OC_CANON_AFCancel
  0x916b: PTP_OC_CANON_SetImageRecoveryDataEx
  0x916c: PTP_OC_CANON_GetImageRecoveryListEx
  0x916d: PTP_OC_CANON_CompleteAutoSendImages
  0x916e: PTP_OC_CANON_NotifyAutoTransferStatus
  0x916f: PTP_OC_CANON_GetReducedObject
  0x9170: PTP_OC_CANON_GetObjectInfo64
  0x9171: PTP_OC_CANON_GetObject64
  0x9172: PTP_OC_CANON_GetPartialObject64
  0x9173: PTP_OC_CANON_GetObjectInfoEx64
  0x9174: PTP_OC_CANON_GetPartialObjectEx64
  0x9177: PTP_OC_CANON_NotifySaveComplete
  0x9178: PTP_OC_CANON_GetTranscodedBlock
  0x9179: PTP_OC_CANON_TransferCompleteTranscodedBlock
  0x9180: UNKNOWN
  0x9181: UNKNOWN
  0x9182: PTP_OC_CANON_NotifyEstimateNumberofImport
  0x9183: PTP_OC_CANON_NotifyNumberofImported
  0x9184: PTP_OC_CANON_NotifySizeOfPartialDataTransfer
  0x9185: PTP_OC_CANON_NotifyFinish
  0x91ae: UNKNOWN
  0x91af: UNKNOWN
  0x91b9: PTP_OC_CANON_SetFELock
  0x91d3: UNKNOWN
  0x91d4: PTP_OC_CANON_SendCertData
  0x91d5: UNKNOWN
  0x91d7: PTP_OC_CANON_DistinctionRTC
  0x91d8: PTP_OC_CANON_NotifyGpsTimeSyncStatus
  0x91d9: UNKNOWN
  0x91da: UNKNOWN
  0x91db: UNKNOWN
  0x91dc: UNKNOWN
  0x91dd: UNKNOWN
  0x91de: UNKNOWN
  0x91df: PTP_OC_CANON_GetAdapterFirmData
  0x91e1: UNKNOWN
  0x91e2: UNKNOWN
  0x91e3: PTP_OC_CANON_ceresSEndScanningResult
  0x91e4: PTP_OC_CANON_ceresSEndHostInfo
  0x91e6: PTP_OC_CANON_NotifyAdapterStatus
  0x91e7: UNKNOWN
  0x91e8: PTP_OC_CANON_ceresNotifyNetworkError
  0x91e9: PTP_OC_CANON_AdapterTransferProgress
  0x91ea: PTP_OC_CANON_ceresRequestAdapterProperty
  0x91eb: UNKNOWN
  0x91ec: PTP_OC_CANON_ceresSEndWpsPinCode
  0x91ed: PTP_OC_CANON_ceresSEndWizardInfo
  0x91ee: UNKNOWN
  0x91ef: PTP_OC_CANON_ceresSEndBtSearchResult
  0x91f0: PTP_OC_CANON_TransferComplete2
  0x91f1: PTP_OC_CANON_CancelTransfer2
  0x91f2: PTP_OC_CANON_ceresGetUpdateFileData
  0x91f3: PTP_OC_CANON_NotifyUpdateProgress
  0x91f4: UNKNOWN
  0x91f5: PTP_OC_CANON_ceresSEndFactoryProperty
  0x91f6: UNKNOWN
  0x91f8: PTP_OC_CANON_ceresSEndBtPairingResult
  0x91f9: PTP_OC_CANON_ceresNotifyBtStatus
  0x91fb: UNKNOWN
  0x91fc: PTP_OC_CANON_SendTimeSyncInfo
  0x91fd: PTP_OC_CANON_SetAdapterBatteryReport
  0x91fe: PTP_OC_CANON_fapiMessageTX
  0x91ff: PTP_OC_CANON_fapiMessageRX


We may also execute this on other cameras while being connected via USB for getting an overview what is possible with PTP for each model.
Title: Re: Canon EOS R / RP
Post by: coon on January 22, 2022, 03:38:11 PM
RP can run Doom btw:



In this hack ML is loaded into 4K clean HDMI buffer 0 and Doom into 4k clean HDMI buffer 1, as Doom needs a plenty amount of code and work ram size. Both buffers offer 4MB of memory each. Thus one shouldn't enable 4K clean HDMI while playing Doom or Canon firmware will overwrite ML and Doom code and camera will crash horribly. I may port this into a generic ML module later, so it can be run on any camera.
Title: Re: Canon EOS R / RP
Post by: vvzvlad on February 06, 2022, 08:10:20 PM
Good afternoon, I have an RP camera, and I really suffer from the fact that with my favorite lens, the cropped frame is forced to turn on.
I would like to fix the firmware and make this feature not work. A very simple fix, no menus, no testing on many lenses, no syncing to the main ML code base. I think it would be on the level of the fix above, where the shutter closes when the camera is turned off, simple enough. I have decades of experience developing for microcontrollers, and some experience reverse-engineering firmware. I really want to try this, and if I succeed, I'll post the result.

However, I have a distinct lack of understanding of reverse engineering the firmware for EOS/ML.

1)How do I get the firmware from my camera? Can I take the file from the website, modify it and flash it as usual, or are there mechanisms out there that don't allow me to flash the modified file?
2)If I can't do that, do I have to download the firmware from the camera itself? I've seen it done by people in this thread, but it was sketchy and I never figured out exactly how to do it. Can it be done by downloading the code to the card or does it require access to the insides of the camera?
3)What are the risks in reading and writing firmware? Can I brick the camera in a way that requires something non-trivial steps to repair?
4)Should I fix the firmware code directly or can I write a small program which will run at startup and patch the camera's memory, to reduce the risk of the camera turning into a brick?
5)What is the best way to disassemble the firmware? Programs, tools?

Please feel free to RTFM and poke me in the documentation. I need directions, not a teacher's help at every step.
Title: Re: Canon EOS R / RP
Post by: kitor on February 20, 2022, 05:01:53 PM
Quote from: kitor on January 03, 2022, 06:48:57 PM
What about overexposure warning in LV?

Yes, ML has this feature on older cameras. But DIGIC registers doesn't work the same way as before.
I was able to alter threshold and highlight style by poking registers, but I'm not able to activate the function (yet?). For now it works like warning you can enable in Play mode.

Not valid anymore. I spent some time and found out that now this is a set of three registers, not a single one.

And both overexposure and underexposure warning can be enabled independently at the same time with different visual settings.

And while running in Clean HDMI mode, one can configure HDMI and LCD to display different things, with independent thresholds and styles :)

Complete registers documentation is on wiki. (https://wiki.magiclantern.fm/digic8:registers#lv_peaking_highlights_zebra)
This should apply to all Digic 8 models (+/- clean hdmi limitations), I need to explore code on Digic 6 and 7.

[e] Digic 6 and 7 use different register addresses and a bit different values, but capabilities are generally the same. I added those in Digic 6 section of Wiki.

PoC will follow soon.

(https://kitor.pl/eos_r/img/r_zebra_th.jpg) (https://kitor.pl/eos_r/img/r_zebra.jpg)
Title: Re: Canon EOS R / RP
Post by: paradox87 on February 23, 2022, 08:02:27 PM
hi guys,
great to see that there's development on this build.

one question: how likely is it to have a canon R build at some point in the near future, shooting 14bit raw video in 4K, while keeping the AF methods available (eye tracking in particular).
I'm thinking whether to get a 5d mk III and enjoy ML, or wait for an R release.

Thanks.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 23, 2022, 09:04:34 PM
Quote from: paradox87 on February 23, 2022, 08:02:27 PM
one question: how likely is it to have a canon R build at some point in the near future, shooting 14bit raw video in 4K, while keeping the AF methods available (eye tracking in particular).

Not at all likely to come true this year.
Title: Re: Canon EOS R / RP
Post by: zLOST on February 24, 2022, 10:29:09 AM
Hi,
and what about stripped-down ML with only LUA scripting and https://www.magiclantern.fm/forum/index.php?topic=18083 ? ;)
That'd make my day/week/month/everything

cheers
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 24, 2022, 11:03:37 AM
LUA? Don't hold your breath.
Title: Re: Canon EOS R / RP
Post by: zLOST on February 24, 2022, 12:46:50 PM
Quote from: Walter Schulz on February 24, 2022, 11:03:37 AM
LUA? Don't hold your breath.

well, the fact is, that i've been using ML for nothing but this script on 6D + 650D and it's a pitty, that i can't do the same on R. but i haven't contributed to ML at all, nor do i have any skills to do that, so all i can do now is just silently wait ;)
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 24, 2022, 12:52:07 PM
If there is no ML for your cam now act like there will be no ML for your cam ever.
Title: Re: Canon EOS R / RP
Post by: kitor on February 24, 2022, 12:56:30 PM
There's no such thing as "only lua scripting" anyway.
Lua can only expose what is already supported by the build. If you strip something from build, you strip the lua ability to use that.

Not to mention that Lua is probably completely broken on Digic 6+, and will be not trivial to fix.

Existing code crashes camera with seemingly random reasons. We don't release anything for your own safety. Do not request any builds as those requests will be ignored.

Quote from: Walter Schulz on February 23, 2022, 09:04:34 PM
Not at all likely to come true this year.

I see post was deleted? (or not approved by mod). Anyway,  there will be no RAW recording support, unless announced otherwise. Hardware is different.
Title: Re: Canon EOS R / RP
Post by: kitor on March 07, 2022, 09:11:28 AM
Quote from: vvzvlad on February 06, 2022, 08:10:20 PM
However, I have a distinct lack of understanding of reverse engineering the firmware for EOS/ML.

Hi,
looks that I missed that post - since newcomers are moderated and may show up with delay.

Quote
1)How do I get the firmware from my camera? Can I take the file from the website, modify it and flash it as usual, or are there mechanisms out there that don't allow me to flash the modified file?
Easiest way to grab the firmware is via Canon Basic script - see General Development section, pinned topic.
We don't modify / flash original firmware - so I can't answer that question. Magic Lantern is altering DryOS bootloader in RAM, and then just runs as regular task(s) in DryOS.

Quote
2)If I can't do that, do I have to download the firmware from the camera itself?
I've seen it done by people in this thread, but it was sketchy and I never figured out exactly how to do it.
Can it be done by downloading the code to the card or does it require access to the insides of the camera?
Yes, because we do not redistribute firmware dumps. Those contain copyrighted Canon code.
You can access UART (Reverse engineering section, pinned topic) and do some things directly from bootloader, but that is not needed.

Quote
3)What are the risks in reading and writing firmware? Can I brick the camera in a way that requires something non-trivial steps to repair?
Reading - no risks. Writing - again, can't answer. Main firmware runs from 25xx flash on board so it is theoretically possible to desolder those and program externally.
If you break MPU firmware (hardware "hypervisor", controls buttons, some peripherlials comm and most important - power to main CPU (ICU)) it will get tricky, as this one stores firmware in internal flash - and @coon probably found Jtag there just last week. We don't touch MPU code though.

Quote
4)Should I fix the firmware code directly or can I write a small program which will run at startup and patch the camera's memory, to reduce the risk of the camera turning into a brick?
See 1a - we do exactly that. Patch in RAM (what we can) and just run our own tasks that alter camera state where possible.
On older models it was possible to use so called Cache hacks to patch ROM code on runtime - but this feature is missing from new generation CPUs.
In theory you can use MMU to remap whole pages of ROM with patched code - however we don't do that (yet). CHDK uses that functionality, just so far we didn't have to patch ROM directly (again - yet), thus it wasn't investigated.

Quote
5)What is the best way to disassemble the firmware? Programs, tools?
The best tool is the tool you know to use. Nowadays we mostly use Ghidra,
Title: Re: Canon EOS R / RP
Post by: s0v3r1gn on March 10, 2022, 01:11:54 AM
I just got a Canon RP and I have some experience with Ghidra and reverse engineering some though nothing this complex.

I'd be interested in helping the project out if anyone on the development team could help to bring me up to speed.
Title: Re: Canon EOS R / RP
Post by: kitor on March 10, 2022, 08:59:59 AM
You probably want to join our development Discord then. We are looking for an opportunity to make some wiki pages on that, since all documentation on forum is very outdated.
Title: Re: Canon EOS R / RP
Post by: iggy2 on June 18, 2022, 04:03:19 PM
Hi, Have you any news with develop?
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on June 18, 2022, 04:41:24 PM
If you are asking for a release being intended to be used by camera owners for testing purposes: Ask again every 6-9 months.

Dev talk can be watched on ML's discord channel. Invite linked above.
Title: Re: Canon EOS R / RP
Post by: Tjabo on January 19, 2023, 07:19:54 PM
Strange, but I keep hanging onto my EOS R, and it really does a nice job.  I can't help but think how amazing it could be with the ML power like my old 5Diii had!  Has there been any progress since the last post?
Title: Re: Canon EOS R / RP
Post by: kitor on January 19, 2023, 11:09:45 PM
No posts = no progress.
Title: Re: Canon EOS R / RP
Post by: kitor on June 09, 2023, 12:03:40 AM

  mzrm eglGetDisplay 0
  mzrm eglInitialize 1 2720200 2720204
  mzrm eglGetError
cmd status      EGL_SUCCESS
EGL Version     1.3 // via eglInitialize()
EGL_VENDOR      TAKUMI Corporation
EGL_VERSION     1.3 TAKUMI Corporation
EGL_EXTENSIONS  NONE
EGL_CLIENT_APIS OpenGL_ES OpenVG


Fun fact: Zico core can do OpenGL ES and EGL 1.3. There's no implementation ICU side, but at least EGL is implemented on Zico. After some digging I was able to initialize EGL and query capability strings.
Not sure if that will go anywhere (OpenGL seems missing in Zico firmware even though hardware is capable of that), I never worked with OpenGL before so I don't know if EGL is enough to do anything interesting.
There's OpenVG support too.

This was a good excuse to dig into ICU-Zico communication.
Title: Re: Canon EOS R / RP
Post by: kitor on July 10, 2023, 01:49:39 PM
EOS RP also have two different versions of 1.6.0 firmware in the wild - 3.9.5 and 3.9.6. (like case of R.180)

The one we work on is 3.9.5, build date is 2020-08-20 15:54:54 and is available at https://gdlp01.c-wss.com/gds/2/0400006292/01/eosrp-v160-win.zip
I was unable to track update file for 3.9.6 anywhere. It has build date of 2021.02.01 11:46:45.

Good news is that (just like R) it is enough to grab 1.6.0 3.9.5 file from the URL above and install it - no card swap tricks needed.
Title: Re: Canon EOS R / RP
Post by: kitor on February 11, 2024, 05:56:01 PM
(X-post from 200D shoots raw video (https://www.magiclantern.fm/forum/index.php?topic=27107.new#new))

Quote from: kitor on February 11, 2024, 05:50:20 PM
(https://kitor.pl/eos/r_raw/eos_r_raw.jpg)

Yes, that's EOS R. Yes, it is Digic 8. Yes, we said it don't count on it as EDMAC is completely different.
Yet here we are  8)

Caveat: it only adds a page into a list of digic 8 instabilities with ML, records roughly 30-60 frames before stops... something related to memory management that I didn't solve yet.
No builds will follow as D8 requires a ton of work before being usable in any way.

But: AF works while recording  :) When 4k is selected in Canon menus, raw buffer is 4K too (unfortunately cropped, as expected).

My PoC on top of @names_are_hard PoC is on my branch: https://github.com/kitor/magiclantern_simplified/commits/raw_draft/
This is shameless "fake it till you make it", thus needs to be redone from scratch after fixing stuff.


There's also a significant progress in understanding D8 EDMAC. Not enough to setup random transfers, but it was more than good enough to get mlv_lite working :)
I'll wait for Names for his EDMAC documentation and update it by my current D8 knowledge.
Title: Re: Canon EOS R / RP
Post by: kitor on February 17, 2024, 10:25:57 PM


Turns out I just forgot I have two nearly identical cards: Lexar 64GB x1000 and x1666. And I used the slower one.
With x1666 (~100MB/s write) I get continuous 1080p30 14 bit RAW.
Title: Re: Canon EOS R / RP
Post by: c_joerg on February 18, 2024, 09:20:25 AM
Cool . Does the temperature rise significantly? Can you measure the temperature in the camera?
Title: Re: Canon EOS R / RP
Post by: kitor on February 18, 2024, 02:10:54 PM
Not tested, tbh 64 gig card I have is good for what, like 5 minutes of recording?
And there's no temperature reading integrated with code right now, I had some PoC stashed (works differently than old models)
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 18, 2024, 02:19:47 PM
Old method applies: Take a vid, take a pic and check EXIF.
Or ask MPU via UART.

Not a big deal. Can do this.
Title: Re: Canon EOS R / RP
Post by: c_joerg on February 18, 2024, 04:59:10 PM
I don't know how it is with the EOS R, but my M3 with CHDK gives me 3 temperatures (optical / housing, sensor, battery). Unfortunately, the EXIF ​​does not show the sensor temperature, but only the significantly smaller optical / housing temperature.
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 18, 2024, 05:11:30 PM
Only one way to find out: Testing.
See https://www.magiclantern.fm/forum/index.php?topic=9673.0

I don't think all cams do the same. 7D's readout is matching EXIF, 650D's is not.
Title: Re: Canon EOS R / RP
Post by: kitor on February 18, 2024, 09:11:42 PM
I found the code, R has 5 sensors: SH, MAIN, A, WM, BACK.
I did a test, started with 27, 32, 31, 29, 26 C. Recorded half of 64G card in 1080p30 (that was 3 minutes). Temps after recording: 29, 35, 33, 29, 27.
Title: Re: Canon EOS R / RP
Post by: Danne on February 18, 2024, 09:23:50 PM
I so regret selling my eos  rp now.
Title: Re: Canon EOS R / RP
Post by: c_joerg on February 19, 2024, 07:27:11 AM
Quote from: kitor on February 18, 2024, 09:11:42 PM
I found the code, R has 5 sensors: SH, MAIN, A, WM, BACK.
I did a test, started with 27, 32, 31, 29, 26 C. Recorded half of 64G card in 1080p30 (that was 3 minutes). Temps after recording: 29, 35, 33, 29, 27.

It looks like that MAIN is Sensor.
On my M3 I have seen max Sensor Temp from 68 degree.


Title: Re: Canon EOS R / RP
Post by: kitor on February 19, 2024, 08:42:28 AM
Linked attachment requires logging in.

Quote from: Danne on February 18, 2024, 09:23:50 PM
I so regret selling my eos  rp now.

I kinda expect RP to be the same +/- sensor.
Can't test as I'm still hunting for a donor RP and 250D motherboards - RP was sent my way by one of our community members; 250D i found myself - both exhibit the same issue with power circuit. I tried reviving those, with a great help from @vth (from photo-parts.com.ua) but it seems I got unlucky and got too many dead PMICs (which are unavailable except sourcing them from Canon boards). Funny is that IIRC @coon has two dead RP boards that exhibit similar issue - only MPU wakes up and complains about PMICs i2c responses.

Anyway, I'm going to check another D8 cam soon. The most ridiculous one :)
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 19, 2024, 09:08:41 AM
Quote from: kitor on February 19, 2024, 08:42:28 AM
Anyway, I'm going to check another D8 cam soon. The most ridiculous one :)

Really? The hand axe?
Title: Re: Canon EOS R / RP
Post by: kitor on February 19, 2024, 09:12:07 AM
Ok, forgot about that one  8) Nah, SX740 - it will be fun to see if this point-and-shoot can do 1080p30. D8, gig of RAM, only UHS1 though. Seems enough.
Title: Re: Canon EOS R / RP
Post by: kytai90 on February 19, 2024, 01:46:01 PM
So, M6 mark 2 now got a chance for ML raw video , right?
Title: Re: Canon EOS R / RP
Post by: Walter Schulz on February 19, 2024, 01:52:36 PM
Don't hold your breath!
Title: Re: Canon EOS R / RP
Post by: kitor on February 26, 2024, 11:09:55 AM
Some fun tests with fast card (Adata 64GB 290MB/s).
Benchmarks top in-cam at 220MB/s write. That's enough for continuous 1080p60 and borderline for 3k@24p (literally, requires card warmup to not stop immediately).

This also means 4k 16 bit uncompressed is impossible at usable FPS. Maybe 10 bit lossless, but at this moment we don't know how to do 10 bit or how to do lossless.
Title: Re: Canon EOS R / RP
Post by: LittleTitu on March 11, 2024, 03:18:03 PM
Hey Kitor!
Nice progress you made with the Digic 8. I didn't really expect that.

Do you know how Canon limits the focus on RP at 4K? Wondering if it's a Hardware or Software limitation.

With the fast card you have, recording at 3k@24, do you see any temp bump, beyond the one you posted before?
Title: Re: Canon EOS R / RP
Post by: kitor on March 14, 2024, 11:59:15 AM
QuoteDo you know how Canon limits the focus on RP at 4K? Wondering if it's a Hardware or Software limitation.
No idea, I don't have a working RP, nor I investigated focus stuff.

QuoteWith the fast card you have, recording at 3k@24, do you see any temp bump, beyond the one you posted before?

Those were like 3 minutes bursts, I didn't see any high temp rise. Hard to test with so small card for the job though :)