Messages

Hi,

FYI, Canon has changed the way signature and encryption is done for EOS R and EOS RP (FIR version 5).

Previous versions were:
https://magiclantern.fandom.com/wiki/Firmware_file
https://magiclantern.fandom.com/wiki/Fir_Security

As soon as debugging EOS R or RP will be possible within QEmu, I'll continue my investigations started with Alex. He owns holidays after giving years of time to ML.

Kind regards
Indy

Boy, really hate to read that!

Working on it with Alex :-)

Hi,

Did you try measuring entropy on it?
Could you please dump of first 0x40 bytes in hex + ascii?

Indy

Lens firmware of EF-S 55-250 and EF-S 40 f2.8 are downloadable on Canon offical site ,
with great help from a1ex , i tried to analyze 55-250 firmware , but no progress ,
the BIN seems to be encrypted or i was wrong somewhere.
Now start to analyze Lens firmware of Sigma 24-105mm f4.0 .

Hi,

I know it is certainly off topic, but for the curious, as they use SREC format as well as some parts of DSLR updates:

https://www.contextis.com/resources/blog/hacking-canon-pixma-printers-doomed-encryption/

http://magiclantern.wikia.com/wiki/Update_records

Indy

and there are compressed bitmaps, see this code:
https://bitbucket.org/hudson/magic-lantern/src/705d001cb9d5fa37b0b62f10442f754db37f8dc3/contrib/indy/gui_bitmaps.py?at=unified

Indy

The bootcode can also receive input chars, but how ? using a serial connector through the battery connector or USB ?
On 550D at least, the grip (connected through by battery port) can be upgraded via the camera body.
Canon must have a dedicated device to do low level debugging/finetuning through bootcode.

Indy

Hi,

550D 1.0.8 = sub_FFFF5ECC (in bootcode)
6D = sub_FFFE5018 (in rcbind.bin)

with 550D I was also able to autodetect and call FIO_CreateFile, FIO_Write and FIO_Close to dump the memory, but it did not work on all models.

Indy

First a memory 'backup' of the 70D is needed and I do not know if it is available yet.

Indy

bspatch for 1.1.0  has been written by Trammel...

http://magiclantern.wikia.com/wiki/7D_support#Status_Before_g3gg0.27s_hack

Indy

550d 1.0.9
19259c ( pTgRegister->dwSrFstAdtg[4] & 0xFFFF0000 ) == 0x81720000
1925dc ( pTgRegister->dwSrFstAdtg[5] & 0xFFFF0000 ) == 0x81730000

26efb4 [REG] @@@@@@@@@@@@ Start ADTG[CS:%lx]
26efe8 [REG] ADTG:[0x%08x]
26effc [REG] ADTG:[%08x] <----- Excel Tab Number
26f270 [REG] ############ Start CMOS
26f29c [REG] CMOS:[0x%04x]
26f2b0 [REG] CMOS:[%04x] <----- Excel Tab Number

ff0c0000 main firmware
ffc00000 gui_resources

FF33E2F0 FIO_OpenFile
FF33E3AC FIO_CreateFile
FF33E6A0 FIO_WriteFile
FF33E750 FIO_CloseFile

Yes, it is interesting to dump this firmware. This version numbering looks like the internal version number

Updater code (at least 7d one) can run partially on qemu.

no they are different
with 24-105mm f/4 (lens_id=237) lens data for vignetting and chromatic aberration corrections is 2704 bytes long, and for lens optimization length is 54 102 768 bytes (downloaded 3005.bin in Canon/DPP/bin).

in EOS Utility  i can load  to camera Lens Profiles and  i got there all my two lenses profiles (in EOU Utility )..so  if im right  profiles from EOS Utility are same lenses profiles what in DPP ,,

RAW are RGBG values (CFA), SRAW YUV

http://magiclantern.wikia.com/wiki/Properties

Should we contact them so that they do not reveal all open doors publically and to Canon ?

http://www.insinuator.net/2013/02/paparazzi-over-ip/
https://www.troopers.de/agenda13/troopers13-presentations/index.html#paparazzi

Indy

nice picture!
see also http://www.canon.com/technology/canon_tech/explanation/cp_tech.html#dryos

on APS-C, values are very close to 24x36

24mm, 550d (APS-C), 24-105mm
239, f4.0, 8191 7888 7185 5231 3781 1770
240, f4.5, 8191 7897 7224 5598 4363 2208
241, f5.0, 8191 7902 7246 5781 4645 2391
242, f5.6, 8191 7910 7276 6057 5081 2716
243, f6.3, 8191 7917 7248 6151 5378 3022
222, f7.1, 8191 7921 7232 6205 5542 3132
223, f8.0, 8191 7929 7206 6300 5832 3436
224, f9.0, 8191 7929 7205 6301 5840 3704
225, f10,  8191 7930 7203 6305 5859 3912
226, f11,  8191 7931 7201 6308 5874 4161
227, f13,  8191 7931 7200 6310 5887 4379
228, f14,  8191 7932 7199 6312 5894 4510
229, f16,  8191 7932 7199 6313 5904 4678
230, f18,  8191 7933 7198 6315 5913 4828
231, f20,  8191 7933 7197 6316 5919 4921
232, f22,  8191 7934 7197 6318 5926 5041

varying the focal, this time. 24-105mm (lens_id=237) on 5dm3

f/8.0
515, 24mm, 8191 7933 7197 6316 5919 4955
516, 28mm, 8191 7945 7257 6410 6000 4684
518, 32mm, 8191 7958 7297 6491 6119 5600
521, 35mm, 8191 7967 7334 6562 6207 5711
524, 40mm, 8190 7980 7384 6658 6323 5858
527, 45mm, 8191 7991 7423 6732 6414 5973
530, 47mm, 8191 7994 7436 6757 6446 6012
533, 50mm, 8191 8000 7456 6795 6492 6069
536, 55mm, 8191 8008 7490 6858 6568 6163
538, 58mm, 8191 8013 7508 6891 6608 6212
540, 60mm, 8191 8016 7519 6911 6632 6241
543, 65mm, 8191 8022 7543 6957 6686 6310
545, 67mm, 8191 8025 7551 6973 6706 6334
548, 70mm, 8191 8028 7563 6995 6733 6367
549, 73mm, 8191 8031 7574 7016 6757 6397
552, 75mm, 8191 8033 7581 7029 6773 6416
553, 80mm, 8191 8037 7597 7058 6808 6459
556, 82mm, 8191 8038 7602 7068 6821 6475
557, 84mm, 8191 8040 7608 7078 6833 6490
559, 85mm, 8191 8040 7612 7084 6840 6499
561, 88mm, 8191 8042 7619 7098 6857 6520
563, 90mm, 8191 8044 7624 7107 6868 6533
564, 92mm, 8191 8045 7628 7116 6878 6546
565, 93mm, 8191 8045 7630 7120 6883 6552
566, 95mm, 8191 8047 7635 7128 6892 6563
567, 96mm, 8191 8047 7637 7131 6897 6569
568, 97mm, 8191 8048 7639 7135 6901 6575
569, 99mm, 8191 8049 7642 7141 6909 6584
570, 105 ,  8191 8052 7653 7162 6934 6614

found measurements:
http://www.photozone.de/canon_eos_ff/420-canon_24105_4_5d?start=1
http://www.dxomark.com/index.php/Lenses/Camera-Lens-Database/Canon/EF24-105mm-f-4L-IS-USM/%28camera%29/483/%28cameraname%29/Canon-EOS-5D-Mark-II
http://www.cameralabs.com/reviews/Canon24105mmL_with_400D_XTi/vignetting.shtml

Indy

236   = Canon EF-S 60mm f/2.8 Macro USM

Lens_id= 236, offset=0x5360
60-60
000001 003c 003c 00cd0000000000000000000000000000000000000000000000
3c00 0000 0000 0000 0a13210d8606 00000000 b203ea0522089d091a0a
1c00 2800 3900 4001
8191 8125 7921 7357 6724 6507, 8191 8113 7993 7823 7684 7634, 8191 8112 7992 7820 7679 7629, 8191 8111 7990 7817 7675 7624
8191 8111 7990 7817 7675 7624, 8191 8142 7796 6994 6172 5853, 8191 8144 8089 7962 7749 7483, 8191 8144 8072 7971 7890 7861
8191 8144 8072 7971 7890 7861, 8191 8142 8071 7972 7891 7862, 8191 7725 6783 5591 4735 4417, 8191 8169 8151 7843 7279 6991
8191 8169 8151 7843 7279 6991, 8191 8154 8100 8025 7965 7999, 8191 8155 8102 8030 7974 7953, 8191 6660 5413 4168 3402 3140
0000 0000 0000 0000
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
0000 0000 0000 0000
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
0000 0000 0000 0000
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191 8191
4444444400000000000000000000000000000000

[8191 7888 7185 5226 3771 1754]

Some tests, pictures at 24mm and varying the aperture:

all @24mm on 24-105mm f/4.0, 5dm3, RAW
values from Makernote Tag#4015, at offset 26. See http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/Canon.html#VignettingCorr
picture#, aperture, vignetting correction values (6 attenuation values from center to border? 8191=no attenuation?)
495, f4.0, 8191 7888 7185 5226 3771 1754
496, f4.5, 8191 7897 7225 5585 4333 2156
497, f5.0, 8191 7902 7246 5776 4633 2370
501, f5.6, 8191 7909 7277 6047 5057 2674
502, f6.3, 8191 7916 7249 6144 5355 2973
503, f7.1, 8191 7922 7230 6211 5563 3183
504, f8.0, 8191 7930 7205 6302 5841 3462
505, f9.0, 8191 7930 7203 6304 5856 3763
506, f10,  8191 7931 7202 6306 5866 3941
507, f11,  8191 7931 7201 6308 5874 4161
508, f13,  8191 7932 7200 6311 5890 4410
509, f14,  8191 7932 7199 6312 5897 4542
510, f16,  8191 7933 7198 6314 5906 4710
511, f18,  8191 7933 7198 6315 5914 4861
512, f20,  8191 7933 7197 6316 5919 4955
513, f22,  8191 7934 7197 6318 5926 5075

from lens00.bin, lens_id=237 (these data seems identical for 60mm and 6D)
we suppose there is one table for each 4 different focals, here 24(0x18), 32, 49, and 105mm (0x69)
so at 24mm, the first table should be used...

000001 0018 0069 00c20100000000000000000000000000000000000000000000
1800 2000 3100 6900 ae08c905e502 00000000 7004df08920c0c0eff0f
2800 3900 5000 e200
8191 7887 7188 5158 3640 1535, 8191 7906 7296 5948 4819 2373, 8191 7925 7223 6262 5651 3053, 8191 7933 7197 6321 5931 4249
8191 7933 7197 6321 5931 4249, 8191 7888 7186 5211 3740 1701, 8191 7909 7281 6030 5016 2601, 8191 7929 7209 6295 5806 3361
8191 7929 7209 6295 5806 3361, 8191 7934 7197 6319 5927 4944, 8191 7888 7185 5250 3820 1836, 8191 7911 7273 6074 5121 2787
8191 7911 7273 6074 5121 2787, 8191 7932 7201 6314 5896 3620, 8191 7934 7197 6317 5925 5279, 8191 7888 7182 5289 3887 1913
2800 3900 5000 e200
8191 7943 7176 5882 5112 3706, 8191 7958 7297 6498 6133 5498, 8191 7958 7298 6496 6127 5611, 8191 7959 7300 6495 6124 5604
8191 7959 7300 6495 6124 5604, 8191 7944 7168 5887 5167 3605, 8191 7957 7296 6494 6126 5341, 8191 7958 7297 6492 6121 5602
8191 7958 7297 6492 6121 5602, 8191 7959 7299 6492 6119 5595, 8191 7945 7163 5895 5204 3479, 8191 7957 7296 6492 6124 5210
8191 7957 7296 6492 6124 5210, 8191 7958 7297 6491 6119 5600, 8191 7959 7299 6491 6118 5594, 8191 7946 7158 5903 5234 3389
2800 3900 5000 e200
8191 8007 7165 5927 5363 4047, 8191 7998 7453 6794 6493 6118, 8191 7999 7453 6794 6493 6079, 8191 7999 7454 6794 6492 6076
8191 7999 7454 6794 6492 6076, 8191 8006 7160 5916 5347 3920, 8191 7998 7450 6785 6479 6010, 8191 7998 7451 6785 6480 6056
8191 7998 7451 6785 6480 6056, 8191 7999 7452 6786 6480 6056, 8191 8005 7156 5908 5337 3819, 8191 7998 7448 6779 6471 5902
8191 7998 7448 6779 6471 5902, 8191 7998 7449 6780 6472 6044, 8191 7999 7451 6781 6473 6044, 8191 8005 7153 5902 5330 3708
2800 3900 5000 e200
8191 7808 6772 5661 5190 3668, 8191 8053 7660 7178 6955 6546, 8191 8052 7658 7174 6951 6641, 8191 8052 7656 7171 6946 6634
8191 8052 7656 7171 6946 6634, 8191 7807 6745 5566 5026 3452, 8191 8052 7656 7168 6942 6366, 8191 8052 7655 7166 6939 6622
8191 8052 7655 7166 6939 6622, 8191 8052 7655 7163 6935 6616, 8191 7801 6714 5424 4719 3271, 8191 8052 7654 7162 6933 6178
8191 8052 7654 7162 6933 6178, 8191 8052 7653 7160 6930 6608, 8191 8052 7654 7159 6928 6604, 8191 7675 6544 5172 4405 3093

nice

Excellent!
this is for LV, so for exposim, right ?
the digic must also be used for image data (written to SDcard)

Indy