Messages

Mallowsm you have to enable it yourself "70d B" 0xFF19B6C8 PROP_DUAL_OUTPUT

I found canon fonts in rom0, where in all other cameras the fonts can be found in rom1.
    #define BFNT_CHAR_CODES         0xF73753A0
    #define BFNT_BITMAP_OFFSET     0xF73786F4
    #define BFNT_BITMAP_DATA        0xF737BA48
most likely the fonts are copy into ram from the address above. from function 0xFF4FA7F8 it looks like its getting fonts data from ram offset 0x9DD20
still have to figure out the right ram offset


***edit
confirmed address
function 0xFF4FA804 loads offset 0x9DD20 from ram gets pointer to stack on offset 0x934390

RAM:0093436C         
                0x9343B8
                0x934390
                0x28
                0xF7375390   <-- "HCanonGothic"
                1
                0xFFD49F03
                0x93434C
                0x934398
                0x14
RAM:00934390                 
                0x93436C
                0x9343B8
                0x934384
                0x9343D0
                0x38
                0x92D320
                0xFF4FBCAC
                0xFF4FBE20
                0xFF4FBE6C
                0xFF4FBDF4
                0x934390
                0x93436C
                0x940028
                0xF740BAEC <-- "CanonMonospace"
                2
                0xFFD49F03
                0x934398
                0x93440C
                0x3C
                0xFFD49F1D

A couple of weeks ago I was playing with the HDMI functions on the 70d. The 70d has PROP_TIMECODE_HDMI_REC_COMMAND (0xff19f6d8) PROP_TIMECODE_HDMI_OUTPUT (0xff19f5b4) PROP_DUAL_OUTPUT (0xff19b6c8) (mirroring) and PROR_HDMI_FLAME_RATE (0xff19b6a8) (HDMI frame rate). The 70d is missing the GUI function that display the HDMI menu but with some simple code you can achieve the desire outcome. Maybe debuging the TIMECODE HDMI rec command will give you some usefull information. Debug(GUI, 3, "PROP_TIMECODE_HDMI_REC_COMMAND (%d)", r4 + 0x4)); in cause of the 70d r4 is 0x98E30.

You know, there have been several similar questions regarding the C-series and the 1D series, and ML will not touch then, and explicitly declares so soon after canon officials mentioned they would sic the lawyers on those who tinker with the 1D cameras.

That being said, ML is open source.

I wonder if people who could afford these bodies can, you know, put their money in a pot and hire someone who knows ARM programming to hack away on these cameras.

Just a thought.

C100,C300,C500 don't use arm processor they use m32r processor. You have to rewrite and reverse engineer everything. Take this with a grain of salt but I was told the new 1dc firmware update will update the cipher.bin. *again I was told about the 1dc by someone with a 1dc that's going to send it in for the updated* Personally i don't believe it.

On a Trancend 300x class 10 sdhc 1 32 gig card I can shoot at least 10 shots on continuous burst, probably more Im going to get a 95mbs 16 gig class 10 card and try

I have an extreme pro shdc @ 95mb/s and getting the same results as you.

To fix the meta data would require finding where fps is written. It only has the settings it has in the canon menu and if you try different ones you get crashes.

The Stts atom is the atom that stores fps in the QuickTime container. Search for SetSttsAtom and WriteSttsAtom.
https://developer.apple.com/standards/qtff-2001.pdf
http://aptproxy.willowgarage.com/archive.raspbian.org/raspbian/pool/main/libq/libquicktime/libquicktime_1.2.4.orig.tar.gz

600D detail photos: http://g3gg0.de/gallery/600D_closeup/

btw - i want a datasheet of this device.
anyone who can find out more about this device?
its not listed anywhere, just some internal lifetime lists from Analog Devices accessible from the web.
it seems its a custom chip, not disclosed anywhere. (

i expect this to be the ADTG with a lot of CMOS readout timings and AD converter integrated.

I't looks like its part of the AD800/AD802 family http://www.analog.com/static/imported-files/data_sheets/AD800_802.pdf


http://ystjt.en.seekic.com/product/integrated_circuits_ics/AD80246BBCZ.html

there is no programming needed. first it needs reverse engineering.

understand how to use ADKIZ, TWOADD, HIV, DEFM, SHAD and the other modules, then understand JP62
and finally set up the communication between those modules using EDMAC.

> http://magiclantern.wikia.com/wiki/Register_Map

I still don't understand how to use EMAC, but what about the Projection functions.
"FA_SetProjectionMode"
"FA_SetChannelNum"
"FA_SetProjectionWindow"
"FA_SetHProjectionRange"
"FA_ProjectionTestImage"
the "FA_SetProjectionWindow" function takes two arguments that look like image resolutions to me.

Yeah, everybody here uses water cooling systems when recording more than 10 seconds, something like this:



http://stargazerslounge.com/topic/146756-1100d-cold-finger-sensor-cooling-with-tec-and-water-cooling/

http://www.magiclantern.fm/forum/index.php?topic=5247.0

http://nofilmschool.com/2013/05/magic-lantern-canon-dslr-raw-video-sensor/

Poor camera, it's on life support

I'm a little behide here, so changing the 14bit can be done by code but is the big challenge to find a way to do it in camera? If you search for CrawBit Invalid it will give you the acceptable arguments for FA_SetCRawBitNum() 0x10=16bit, 0xE=14bit, 0xC=12bit, and 0xA=10bit. Doing something this
void foo();
{
        call("FA_CaptureTestImage");                  
   call("FA_GetCrawBuf");
   call("FA_SetCRawBitNum",0xE);
        call("FA_DefectsTestImage");
   call("FA_CreateTestImage");
}

And then looking for the registers that change. Would that give us some sort of hint?

I don't have a dump for 1.0.9 but it's the function right before NSTUB( 0xff9829d0, FIO_WriteFile )
it should start like this

var_8           = -8               
STMFD   SP!, {R3,LR}

In firmware 1.0.7 FIO_SeekFile is in 0xFF98292C
NSTUB( 0xFF98292C, FIO_SeekFile) 1.0.7 50d
if my math is right it should be 0xFF9829A0 in 1.0.9 50d
NSTUB( 0xFF9829A0, FIO_SeekFile) 1.0.9 ?

Good luck chasing the unicorn

Alex have you ever seen the movie Black Moon, chasing taking unicorn and there's even a talking rat. The only way I see in capturing the full sensor frame in a sd cameras is with some sort of SDI mod. Inside camera hijacking the data from sd bus/ribbon to a RF connector. Outside camera RF connector->video demux->HD-SDI driver->RF connector. Where is Juan Pertierra when you need him.

There is no difference between regular DNG and CinemaDNG. CinemaDNG only has 5 more tags that are recommended not mandatory.
Tag 51043 TimeCode in IFD 0 ,
Tag 51044 FrameRate in IFD 0,
Tag 51058 TStop in IFD 0,
Tag 51081 ReelName in IFD 0
and Tag 51105 CameraLabel in IFD 0.
A link to all the version of DNG specs
http://justsolve.archiveteam.org/wiki/DNG
A link to the TIFF specs which DNG is based on
http://www.barrypearson.co.uk/top2009/downloads/TAG2000-22_DIS12234-2.pdf
A link to the first version specs of CinemaDNG
http://www.ikonoskop.com/begood/forum_attach.php?919745734d31d92f2ab5c8.34737310
and a link to version 1.1.0.0 specs of CinemaDNG
http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/cinemadng/pdfs/CinemaDNG_Format_Specification_v1_1.pdf

Supposedly 7D can write video to it?

This from 600d, 0xFF04DF40 which is part of the MovieRecorder calls for WFT PROP_USBDEVICE_CONNECT(%d) at 0xFF04DFC4
This code is clearly recording a video file to an external HDD.

USB 2.0 is theoretically 30+ MB/s... would have to

LOL I didn't realized that USB 2.0 was that slow.

vidalipoly, you can't have the card slot door open the camera won't turn on until you close it.

600d
0xFF03BF54
WFT
" PROP_USBDEVICE_CONNECT : USBDevice = %d"

You need canon's wireless transmitter to connect an external USB hard drive to the camera. Here's link for the WFT-E5 manual for the 7d http://shuttersnitch.com/downloads/manuals/canon/wft-e5-en.pdf look at chapter 8 page 79 it show you how to connect an external hard drive. When the 600d came out one of the specs was that it could record media using external media but they never release a wireless transmitter for the 600d. If someone could figure out how to bypass the wireless transmitter usb and use the cameras usb that really would be the holy grail.

This is very beautiful and exciting. I only wish I had a camera to try this out Congratulations to everybody involved

Hi there, So I got a gopro hero 3 black edition this evening and was wondering if anybody had some scripts to share.

Code Select Expand

######################################################
# Firmware ROM Dumper For GoPro Hero 3 Black edition #
######################################################

savebin D:\ROMFS.bin 0xc0100000 l 0x900000
sleep 2
t app button power P
sleep 5
t app button power R

This script will dump the firmware to your micro sd card. Save this code as a autoexec.ash file and place it in your micro sd root path. You don't have to make your card bootable like you do with canon's. Wait for the camera to shut down and remove the card. Remove the autoexec.ash file when you have a rom dump. Gopro firmware uses µITRON4.0 specification so it looks similar to canon firmware. I like to make it clear this is not an attempted to port ML to gopro. To view the firmware just use your "favorite" disassembler and disassemble it like you could disassemble canon firmware use 0xc0100000 as the starting address. At the moment I have firmware verson HD3.03.02.39. I found some stubs

Code Select Expand

0xC014CE18 fopen
0xC014CDB8 fclose
0xC014CE48 fread
0xC014CF00 _fstat
0xC014CF60 fwrite
0xC02AD93C fseek
I also found what looks to be the gui main task for the lcd touch bacpac at 0xC044BD7C and the switch statement at 0xC044BD9C. If someone could figure out a script command to load a binary file to the memory that would be great some hints may be found here http://spritesmods.com/?art=zx3hack&page=4
This script will enable exposure lock

Code Select Expand

######################################################
#       Enable/Disable exposure module lock          #
#         For GoPro Hero 3 Black edition             #
#         Usage: t ia2 -exp lock [en]                #
#         en = [0|1], 0:disable, 1:enable            #
######################################################

t ia2 -exp lock 1/n
The exposure script seems buggy in photo mode. Hopefully I'll have more time next weekend to look at the firmware and figure out some more scripts.
A reminder this scripts can damage your camera use on your own risk.

Here is the pdf of there presentation https://www.ernw.de/download/publikationen/PaparazzioverIP_shmoo2013.pdf
And here is there presentation on youtube
https://www.youtube.com/watch?v=u7RjJNLnWF8
Basic spoofing nothing to advanced and nothing new. There better information here http://magiclantern.wikia.com/wiki/Remote_control_with_PTP_and_Python
The 6d has a better wifi encyption then the 1dx.

Here is Oren Isacson and Alfredo Ortega presentation at Defcon 18 http://www.youtube.com/watch?v=jp_cwNUGeWU

I don't have my 600d at the moment but has anybody tried calling the actual code the writes the liveview jpegs. In the 600d the fuction starts at 0xFF111928 and you can see the code that writes the jpegs at 0xFF111B7C

Or maybe they just reused some code from video camera division or point and shoots?

It's all about the JPCORE. The 350D has JP52, the newer cameras have JP60 or 61 I can't remember. The 5d3 has the newer JPCORE6' something, it also has the JP57 which it uses for raw pictures? But why did they go back to JP57 wasn't the newer JPCORE good enough?

Funny thing, The 350d is the only Canon dslr with a MPEG1 and MPEG2 encoder string, besides the 1DC. The 350d doesn't even have LIveview. There goes my theory about how dslr were never meant to record video, apparently Canon was development video recording early on.