Here's a quick example on how adtg_gui can be used to find interesting stuff.
In the crop_rec_4k branch
I've used raw type 0x12 (DIGIC 5) in order implement
8..12-bit lossless compression. This works by keeping the 14-bit container (as
I don't know how to reconfigure the encoder for other bit depths) and darkening the image (applying a digital gain aka SHAD_GAIN) so it ends up with fewer levels (
as many as a real 8..12-bit image).
This trick appears to work - it improves the compression ratio.
Problem: LiveView also gets darkened (as a side effect of bit depth reduction).
By default, ML uses
raw type CCD (0x10 on D5, 0x5 on D4), as this one gives consistent white levels. This raw type is not affected by ISO changes, therefore it doesn't react to digital gain (so there's no easy way to darken it digitally). I could darken it from analog controls, but didn't want to touch them for bit depth reduction.
Anyway - I'm currently trying to find a way to brighten the image of raw type 0x12 (DEFCORRE, apparently after SHAD in the pipeline, but before other image processing steps, such as the picture style), but *without* brightening the raw buffer contents. That means, I'm looking for some sort of digital gain later in the pipeline (after DEFCORRE).
Incidentally, I've noticed our low-light exposure simulation feature (Expo Override + ExpSim enabled), after a certain threshold (a few seconds of exposure at some high ISO), it brightens the LiveView image, but the raw histogram is no longer pushed to the right. In these (extreme) cases, on DIGIC 5, ML uses something like this:
call("lvae_setdispgain", some_gain); /* 1024 = 1.0 */
Problem: on 5D3, this call only works in photo mode...
On DIGIC 4, we've identified this register
by brute force:
#define ISO_PUSH_REGISTER 0xc0f0e0f8
But that doesn't work on 5D3.
Looking in lvae_setdispgain (FF72C0B0 in 5D3 1.2.3), it stores the gain at 0x68C8C, prints a message and sets some flags. The actual configuration is likely done by some other code that reads this value. Unfortunately, that code was not identified by IDA's autoanalysis.
How to find it? This is likely some register used to configure LiveView, like those handled by adtg_gui. So, I've tried to find it using this tool.
How?
1) entered photo mode LiveView (where our function works), enabled ADTG Registers, DIGIC registers and selected "Modified from now on"
2) back to LiveView, then back to ML menu -> a bunch of registers changed. Selected "Modified from now on" again until things settled.
3) called the analyzed function (had it on "don't click me" with random gains) and noticed how the LiveView brightness changed
4) went back to adtg_gui menu and it printed these modified registers (5D3 1.1.3):
C0F42730: 0x1010202 (was 0x1) - from AeWb:ff33ff94:6b84fc
C0F4273C: 0x46f076c (was 0x5640483) - from AeWb:ff33ff94:6b8514
C0F42740: 0x6900690 (was 0x3fd03fd) - from AeWb:ff33ff94:6b851c
C0F42744: 0x4040404 (was 0x0) - from AeWb:ff33ff94:6b8524
5) Locked the above registers and confirmed the brightness could no longer be changed with lvae_setdispgain. That's a good sign - it means the register I'm looking for is one of these (or maybe all of them).
6) Changed the above registers to their old value (the "was" one). Result: LiveView back to original brightness (before calling lvae_setdispgain). Another good sign.
7) Now, to find out what they do - the "trial and error" part:
C0F42730 looks like a series of 4 8-bit values. Each of them appears to be a boost of the 4 Bayer channels. Valid values: 0...3 (4 is the same as 0). Making them equal will make the image brighter; otherwise, the colors will be changed.
C0F42744 is similar, but valid values go from 0 to 7. It also gives some Bayer artifacts.
The remaining two are 16-bit values (two values packed in one register). Probably some sort of WB gains.
C0F4273C: the lower half looks like red gain, the higher half looks like blue gain (range 0 - 7FF)
C0F42740: these look like green gains; if the two are different, some interesting artifacts appear - just like with C0F42744.
8.) With the above registers 4 locked, white balance controls (from Canon menu) are no longer working. This makes sense - these are all changed from the AeWb task.
Overriding just C0F4273C/40 does not completely lock WB controls - they still work in some rough increments.
9) Switched to Movie mode and tried to adjust the above registers. It works!
