Hi,
Just to let you know, Nikon hackers are discussing about the TX19A chip here:
http://nikonhacker.com/viewtopic.php?f=2&t=214
http://nikonhacker.com/viewtopic.php?f=2&t=167
this chip is also in our camera body.
ML Wiki page is here:
http://magiclantern.wikia.com/wiki/Tx19a
IDA Pro edition (with MIPS support) is required for TX19A. Starter edition does not support MIPS
could we add AF micro-adjustment on xxxD bodies if we understand TX19A code ?
Indy
Faking a lens would be even better.
Provided we can patch tx19 code, we can do pretty much whatever we desire
Is IDA PRO coming soon on A1ex's machine?
Good question, I have lost track of the IDA status to be honest
Better yet, full I/O control.
on the paper, "yes we can" patch TX19A, because:
- TX19A is updated : http://magiclantern.wikia.com/wiki/Update_records#SRecord_files
- we can create .FIR files
but it is very risky : bricking probability is very high
Indy
Quote from: Indy on November 02, 2012, 06:54:52 PM
on the paper, "yes we can" patch TX19A, because:
- TX19A is updated : http://magiclantern.wikia.com/wiki/Update_records#SRecord_files
- we can create .FIR files
but it is very risky : bricking probability is very high
Indy
What do you think, could you theoretically upgrade the firmware from one camera to another?
I see little to no point in that, most cameras have different sensor / AF pixels arrangement
Maybe overclock SD mhz somehow? But if you kill TX19 then camera is dead to the world, no IO will happen.
Quote from: ilguercio on November 02, 2012, 07:27:49 PM
What do you think, could you theoretically upgrade the firmware from one camera to another?
there is no camera difference, one update is applicable to all camera of the same model.
we can patch one TX19A record in an update, repackage the update file, update the camera, thus pushing our TX19A patch.
this is theory, in practice we'll have to understand TX19A code, which is not easy.
I think he meant camera as in model ;)
That would infringe on Canon's copyright => no ;)
Not that much in the firmware to risk flashing that first camera and have it not work. Maybe between same models like 1100D and 600D... but then the screens are different and you'd lose that. Better off altering I/O and making fake lenses... would put that whole dandelion chip making industry out. I bet canon has it like openwrt where you compile the modules from the source tree needed for each camera. We'd have to make custom firmware to cross flash and we don't have the source and plus the copyright issues on top.
Quote from: a1ex on November 02, 2012, 09:47:23 PM
That would infringe on Canon's copyright => no ;)
Yeah, i know, it meant feasible in a potential way, law aside.
alex and i have talked about buying the pro version for tx19a.
tx19a is interesting, but far beyond ML scope.
also patching is too risky imho and i am not sure what the advantages will be.
so we decided to not buy a pro version but use the money to buy starter editions for some devs.
Quote from: g3gg0 on November 02, 2012, 10:32:34 PM
alex and i have talked about buying the pro version for tx19a.
tx19a is interesting, but far beyond ML scope.
also patching is too risky imho and i am not sure what the advantages will be.
so we decided to not buy a pro version but use the money to buy starter editions for some devs.
:(
Quote from: a1ex on November 02, 2012, 09:47:23 PM
That would infringe on Canon's copyright => no ;)
if we distribute an binary patch against a canon update, we do not ourself distribute Canon code...
Well, since this is a common chip to be investigated what if you team up with them? Both of you have the interest in acquiring informations.
;)
http://www.toshiba.com/taec/components2/Datasheet_Sync/134/26203.pdf
Quoteif we distribute an binary patch against a canon update, we do not ourself distribute Canon code...
I'm not that sure - the end result would be a modified version (derivative work) of Canon code, and some users might be tempted to post it online.
Have you tried contacting them? I know that hardware is different on a Nikon but since the chip is the same there is a big piece of work that can be done together, probably?
the TX19A chip is still alive on my 5d, could be used for testing if someone wanted (i can send the 5d to you). though, the firmware doesn't boot so you can't test much.
QuoteHave you tried contacting them? I know that hardware is different on a Nikon but since the chip is the same there is a big piece of work that can be done together, probably?
Guys, we have TX19A fully simulated in Emulator. I would not buy IDA for TX19A - it is very expensive and has bugs. Also a problem to generate correct code for TX19A. But you can try our TX19A disassembler, just download NikonEmulator 2.50 and look in startDtx.bat and use something like
QuotestartDtx.bat -wstructure -wparameters -wmemory -wshift -wli -wquestion -wdmov -wbz -wret -waddress -whexcode -x firmware.dtx.txt -o firmare.asm firmware.bin
For syntax of firmware.dtx.txt you can execute "startDtx.bat -m?" or "startDtx.bat -w?" or look inside our a640m010100.dtx.txt.
Cheers,
coderat
Anybody gave a look at their forum?
Just take a look at TX19 firmware of 550D , lots of buttons found in RAM :
RAM:FFFFCC3C LockSW: .byte 1 # DATA XREF: ROM:000213BCo
RAM:FFFFCC3C # 0 - Lock(Off)
RAM:FFFFCC3D CardCover: .byte 1 # DATA XREF: sub_4BB14+B2r
RAM:FFFFCC3D # 0 - open
RAM:FFFFCC3E BatCover: .byte 1 # DATA XREF: sub_4BB14+E4r
RAM:FFFFCC3E # 0 - Open
RAM:FFFFCC40 SDDetectSw: .byte 0 # DATA XREF: sub_4BB14+116r
RAM:FFFFCC43 Sw1: .byte 1 # DATA XREF: sub_4BB14+148r
RAM:FFFFCC43 # 0 - on
RAM:FFFFCC44 Sw2: .byte 1 # DATA XREF: sub_4BB14+17Ar
RAM:FFFFCC44 # sub_6FED0+52r ...
RAM:FFFFCC45 AELockButton: .byte 1 # DATA XREF: sub_4BB14+1ACr
RAM:FFFFCC45 # 0 - on
RAM:FFFFCC48 SpdnButton: .byte 1 # DATA XREF: sub_4BB14+1DEr
RAM:FFFFCC48 # 0 - on
RAM:FFFFCC49 StroboPopUpButton:.byte 1 # DATA XREF: sub_4BB14+210r
RAM:FFFFCC49 # sub_6FED0+66r ...
RAM:FFFFCC4A StroboPopEndSw: .byte 0 # DATA XREF: sub_4BB14+242r
RAM:FFFFCC4E AFFrameSelectButton:.byte 1 # DATA XREF: sub_4BB14+274r
RAM:FFFFCC54 ISOButton: .byte 1 # DATA XREF: sub_4BB14+2A6r
RAM:FFFFCC57 Av_Button: .byte 1 # DATA XREF: sub_4BB14+2D8r
RAM:FFFFCC59 SetButton: .byte 1 # DATA XREF: sub_4BB14+30Ar
RAM:FFFFCC5A MenuButton: .byte 1 # DATA XREF: sub_4BB14+33Cr
RAM:FFFFCC5B PlayButton: .byte 1 # DATA XREF: sub_4BB14+36Er
RAM:FFFFCC5C DisplayButton: .byte 1 # DATA XREF: sub_4BB14+3D4r
RAM:FFFFCC5D EraseButton: .byte 1 # DATA XREF: sub_4BB14+3A0r
RAM:FFFFCC61 EasyDirect_QuickSetting:.byte 1 # DATA XREF: sub_4BB14+408r
RAM:FFFFCC63 CrossUp: .byte 1 # DATA XREF: sub_4BB14+470r
RAM:FFFFCC64 CrossDown: .byte 1 # DATA XREF: sub_4BB14+4A4r
RAM:FFFFCC65 CrossRight: .byte 1 # DATA XREF: sub_4BB14+4D8r
RAM:FFFFCC66 CrossLeft: .byte 1 # DATA XREF: sub_4BB14+50Cr
RAM:FFFFCC68 RECStartButton: .byte 1 # DATA XREF: sub_4BB14+43Cr
RAM:FFFFCC69 ModeDial: .byte 2 # DATA XREF: sub_4BB14+538r