Battery grip pins / UART

[kitor]

MPU... but do you know from what camera? K429 rings a bell?



Anybody?



Well, that's EOS R Battery grip! 



Interesting thing is that you won't get shell unless poked RST pin (not sure to what level, i just attached my UARTs TX temporary and pressed any key).
EDIT: this may be related to me having grip on/off switch in off position when the tests were done. YMMV.

You need to almost completely disassemble grip first. It will not work without camera attached.

More details on MPU itself in DIGIC 8 MPU investigation

If you come here from Twitter, please note that post thumbnail had wrong pins described for RX/RST (they were accidently shifted to the right)

[deviousfusion]

X-Post from https://www.magiclantern.fm/forum/index.php?topic=17969.msg233932#msg233932

Some updates:
The 1300D has UART port accessible by removing the thumb grip above the DPAD. Some 1300D do not have the connector soldered on, but the pads on the PCB are visible. I was able to probe test the pins and got a pinout:

Pin No.

|

1

|

2

|

3

|

4

|

5

|

6

|

STATE

|

0V

|

3V3

|

3V3

|

G

|

3V3

|

3V3

|

Func.

|

MPU Rx

|

MPU Tx

|

(?)

|

GND

|

CPU Rx

|

CPU Tx

|

Console outputs
Probing pin 2 gives:


Probing Pin 6 gives:

Code: [Select]

#
  2010: 14066.703 [FM] FM_Suspend : Normal
 Firm Jump RAM to ROM 0xFE0C0000
K404 READY
     0:    13.602 [STARTUP]
K404 ICU Firmware Version 1.1.0 ( 4.4.6 )
    57:   119.351 [RSC] hMemoryQueue (0x660012) hStorageQueue (0x680014)
   121:   137.499 [RTC] PROPAD_GetPropertyData : PROP_RTC 0xfd
   122:   138.857 [RTC] ChangePropertyCBR 0x0, 0x4000
   123:   139.113 [RTC] RTC_Permit 0x20
   134:   139.440 [SND] Seq LPC fin
   151:   142.332 [ENG] [ENGIO](Addr:0x4fb40000, Data:0x   30000)
   154:   150.577 [WB] AdjustWb Done.
   168:   152.797 [TERMINATE] SHUTDOWN init comp
   170:   152.884 [TERMINATE] Abort init comp
   192:   156.561 [MC] PROP_GUI_STATE 0
   197:   156.859 [MC] JobState 0
   200:   157.573 [MC] PROP_LCD_OFFON_BUTTON : 1
   202:   157.758 [MC] PROP_VARIANGLE_GUICTRL : Enable
   205:   158.770 [MC] regist master CardCover
   248:   174.656 [PRP] M:37 F:0 L:0 P:B T:1
   378:   254.481 [LV] [GMT] PROP_TEMP_STATUS : STATUS_NORMAL
   498:   264.995 [LV] InitializeLiveViewDefectDetection
   902:   299.478 [MD] Init RCh1=0, RCh2=0
   905:   300.002 [MD] Set RCh1=d, RCh2=18
  1292:   863.742 [INDEV] INDEV_Initialize
  1299:   865.931 [HDMI] [MID] HDMI_IP_Initialize
  1315:   885.667 [IMPP] H264E InitializeH264EncodeFor1080pDZoom
  1316:   885.741 [IMPP] H264E InitializeH264EncodeFor1080p25fpsDZoom
  1352:   906.774 [MR_MOV] (Empty Func) MVW_RegisterXmpDataCallback
  1422:   929.689 WARN [LVDS] First Get DTS_GetAllRandomData
  1524:   940.646 [GUI] MainEventHandler PROP_QR_DIDNOT_EXECUTE(0)(0)
  1570:   945.934 [STARTUP] startupInitializeComplete
  1572:   946.095 [MC] cam event guimode comp. 0
  1732:   996.044 [MC] cam event guimode comp. 0
  1829:  1171.131 [DISP] TurnOnDisplay action Type=0
Now here is where I'm stuck. I do not know what the connector is called.  This is what it looks like (its not JST):

[coon]

The connector is a 6 pin vertical JST 0.8mm:
https://de.aliexpress.com/item/4001088873723.html

A matching cable is available here:
https://de.aliexpress.com/item/4001144163609.html

[a1ex]

EOS M2 has the same UART connector as 1300D (photo from Walter's; TX pins matching the above description from deviousfusion):

Code: [Select]

MON>>>
E1OFF


Code: [Select]

SD Detect High
K355 READY
128K Sector FROM From BL 0xffff
[SF] InstallSerialFlash 6 0xc022c0d4 0x0 0x1000000 1

[SF] Bufcon Base 0xc022c0d4
SerialFlash Initialize
     0:    55.279 [STARTUP]
K355 ICU Firmware Version 1.0.3 ( 6.0.6 )
     4:    57.627 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
     5:    58.313 [PROPAD] SerialFlash Packages!! 0x2d0000
...

760D appears to be similar (photo from igoro00 on Discord):


Matching cable also available on Digikey:
https://www.digikey.com/en/products/detail/jst-sales-america-inc/A06SUR06SUR32W51A/6009351

[Walter Schulz]

Spoiler alert: 250D / SL3 allows a somehow convinient access to UART, too. There is a rectangular hole under rubber cover (thumb rest). My 250D doesn't have a connector but solder pads are the same as shown for 200D here: https://www.magiclantern.fm/forum/index.php?topic=7531.msg224730#msg224730
Don't know if there are cameras in the wild where Canon soldered a connector (see 1300D). Pictures will follow.