Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - srsa

Pages: [1]
It appears to use the same file format as EOS R/RP and 250D.
Thanks. That means, reversing the new format will be mandatory before any serious development effort on these new (and future) models.

Canon has released a firmware update for the recent PowerShot G7X III. Can someone take a look at the FIR and tell whether the current decoder/decrypter can still cope with it?

http ://

upon clicking next, the camera shows blank screen, and on the computer it shows "Press SET button to continue installing the firmware"
I believe that's a feature of the latest (1.3.6) firmware. It was introduced in response to this recently published "Missing authorization vulnerability". I would imagine most of the camera's buttons are blocked when an USB connection is active. Don't know whether removing the cable would allow dismissing that dialog, or cause some sort of problem.

General Development Discussion / Re: when to use task_create?
« on: July 07, 2019, 06:50:08 PM »
If you start do_stuff() the first way, it will obviously execute in the same task.

If you launch it as a new task, it will run independently, in parallel. Also, you get to specify the task priority (0x1e), and the amount of stack space (0x1000).

Camera-specific discussion / Re: Canon EOS R / RP
« on: April 27, 2019, 09:54:36 PM »
Simple registering here (...)
gives you enough information.
Those who wish to work on ML in the future may want to read the terms & conditions, especially the section "Confidentiality". Their stuff is not open source.

Module writing Q&A / Re: use canon icons in module
« on: March 13, 2019, 07:47:32 PM »
last time I checked, the RBF editor required an old version of Qt. We may have to dust off some old VM just for editing the fonts, unless someone updated the editor meanwhile.
I have made another RBF editor (with its own quirks), currently available as Win32 binary (Wine compatible).

Just FYI, Canon has released firmware updates for
EOS M50 (1.0.2)
PowerShot SX740 (1.0.1)
PowerShot SX70 (1.1.0)

Reverse Engineering / Re: MFA on 60D - reversing calibration
« on: February 24, 2019, 12:13:56 PM »
I guess it can't hurt if you make a ROM dump before sending it in and another after receiving it.
But that of course doesn't guarantee anyone will jump and implement any calibration related feature.

Not sure where to post this as it's both DIGIC 7 and 8 related.
I've noticed that D7 and D8 ports still have
Code: [Select]
-march=armv7-rin platform/(cam)/Makefile.platform.default
"armv7-r" means ARM Cortex R. The Cortex R supports integer divide instructions in Thumb mode, whereas the Cortex A9 does not. To avoid getting undefined instruction exceptions in the future, I'd suggest using
Code: [Select]

Camera-specific discussion / Re: Canon 80D
« on: February 06, 2019, 12:28:23 AM »
- there is a frame buffer in the main RAM (like before, just with a different image format: uyvy; previous models were palette-based)
On D6 PowerShots, the overlay uses two buffers at the same time: one uyvy plus one "opacity" (1 byte per pixel). The opacity buffers are usually located close to the uyvy ones. If these cameras have the same display config, and you're planning to write to the uyvy buffers, you'll need to write the opacity buffers too.
- the frame buffer address only changes when the GUI subsystem goes into some different mode (e.g. from shooting mode to Canon menu)
On newer D6 Powershots, buffers are switched continuously when there are animations on screen.

General Help Q&A / Re: Recover .DAT movie file from camera?
« on: January 16, 2019, 06:40:10 PM »
Try recover_mp4. It's a Windows command-line utility, also runs on Linux with Wine.

I know what it is, but not spoiling the game.
@a1ex Can it save files yet?

sorry, but I didnt have success on my M50, I prepared the Card with EOSCard after true formating in the M50
(but with my M50 I also did not have success with the dumper scripts)
Thanks for trying. I guess we'll know more when emulation of the M50 becomes possible.
Is there a bootflag enabler for the real (not emulated) M50 body?
Wondering if I missed something ...
EOSCard can also set PowerShot-related flags, in this case the SCRIPT signature.

After exploring the D8 disassembly I have (I was given a reconstructed M50 dump) I decided to publish my findings here.

- The camera does appear to have the scripting language we (@CHDK) refer to as Canon Basic.
- I have the impression that the card setup is the same as described here:
- Event procedures (short: eventproc) do exist, the eventproc handling firmware routines seem to be the same as on PowerShots.
- There seems to be support for extend.m and autotest.m scripts, but their invocation may differ from what's described here:

- Now, the differences:
 - Most event procedures that appear in CHDK related scripts do not exist. That means, CHDK scripts will not work on D8 cams.
 - Many event procedures seem to be pre-registered, so registration functions such as System.Create() are not necessarily needed.
 - In file names, the card root is B:/
 - I have not yet found an eventproc to write binary files from script, or, to write text on screen.
Problem is, I can't say for sure whether using a prepared script card is enough to run scripts. So, everything below is speculation.

Script support seems to be enabled when the cam is in factory mode - the factory mode flag is at 0xE1FF802C.
I think it is also enabled when there's a script named "AutoTest.m" in the root of the card. The code I found loads "AutoTest.m" automatically at the end of the startup procedure.

The following minimal script should make a hex dump of the first 0x40000 bytes of ROM. I'm not certain that my WriteFileString interpretation is correct.
For a first try, name the script "AutoTest.m".

Code: [Select]
dim startadr=0xe0000000
dim romsize=0x40000
dim fname="B:/ROM.TXT"

private sub Initialize()
    p = startadr
    f = OpenFileCREAT(fname)
    do while p < (startadr+romsize)
        WriteFileString(f,"%08X: %08x %08x %08x %08x\n",p,*p,*(p+4),*(p+8),*(p+12))
        p = p + 16
end sub

This script is not camera specific, so it can be tried on any D8 cameras (assuming that all D8 cams share the same codebase):
EOS M50, R; PowerShot SX740, SX70

To make sure the card is correctly prepared for scripting, get any older PowerShot (2005...2017) and use the universal dumper script ( to check.

I can't guarantee success, but I think it's worth to try this route.

General Development Discussion / Unused (unnecessary) firmware tasks
« on: January 04, 2017, 04:01:07 PM »
I read that some ports (EOS M) experience a shortage of tasks. If this is related to the hardcoded limit of DryOS tasks, the following might help. Quoting an old post of mine:
Looking at the output of 'extask' (extended task information for DryOS), I noticed that a task named EvShel (event shell) has unusually large stack space (0x8000 bytes aka 32kB). This task is only used for debugging over the UART, but it's sitting idle in all cameras used by ordinary people - waste of RAM.
As an experiment, I have prevented this task from starting (on the a470) - it's usually started from the last BL in the 'CommonDrivers' task. Side effect is that this prevents two other tasks from being started (ConsoleSvr, LowConsole) - these would be started by EvShel itself.
That was a PowerShot cam. If cameras on the EOS codebase also survive if those 3 tasks are missing, ML could start 3 tasks more.
I only verified that the above task names are present in the 550d dump. Somebody will have to check if Evshel task's creation can indeed be removed from the boot process, without penalties.

Just an idea.

General Chat / Re: 19Lights / GingerHDR gone forever?
« on: August 15, 2015, 12:01:27 PM »
Some site content is available from*/
Last captured content

Pages: [1]