5dc - some problems preventing full functionality

Started by coutts, July 03, 2012, 02:47:54 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

coutts

I've hit a bit of a wall again on the 5dc, it appears there is no gui event for halfshutter press, there's only an unpress event. so, anybody have a creative idea for detecting shutter half press?

nanomad

Wierd, I'd have a look at the focusing routine as Half shutter is used for that. That is, if you know where to look in the firmware  :-\
EOS 1100D | EOS 650 (No, I didn't forget the D) | Ye Olde Canon EF Lenses ('87): 50 f/1.8 - 28 f/2.8 - 70-210 f/4 | EF-S 18-55 f/3.5-5.6 | Metz 36 AF-5

a1ex


ff8ac3e8: '[FSS] fssSW1On'
ff8b735c: '[EM] Already SW1ON'
ff8b7370: '[EM] Already SW1OFF'
ff8b7450: '[EM] emDeliverMulticastEvent : SW1ON'
ff8b7478: '[EM] emDeliverMulticastEvent : SW1OFF'
ff9f5db8: '[RapiSW]  CompRapiActive SW1'


or with memspy, though I don't know how you can run this with display off. Maybe print the results to log file?

In dryos, it's somewhere around main_ctrl_task data structures.

coutts

Quote from: a1ex on July 03, 2012, 02:58:35 PM

ff8ac3e8: '[FSS] fssSW1On'
ff8b735c: '[EM] Already SW1ON'
ff8b7370: '[EM] Already SW1OFF'
ff8b7450: '[EM] emDeliverMulticastEvent : SW1ON'
ff8b7478: '[EM] emDeliverMulticastEvent : SW1OFF'
ff9f5db8: '[RapiSW]  CompRapiActive SW1'


or with memspy, though I don't know how you can run this with display off. Maybe print the results to log file?

In dryos, it's somewhere around main_ctrl_task data structures.
I have those debug messages in my log. Unfortunately those functions don't write any memory locations for me to use as a status check for half shutter press.

Maybe it would be possible to hijack whatever is calling the debug messages for emDeliverMulticastEvent, sort of like the gui task is overridden? Then I'd be able to know when SW1 and SW2 are pressed. Also, maybe I could inject synthetic SW1 and SW2 events to mimic the SW1 and SW2 properties that the 5dc does not have (like DryOS). This could make the bulb timer work.

coutts

Also: I still can't find a property for shutter count :(
I have asked on a photography forum, and I guess Canon can check the shutter count (many people had their shutter count checked when they sent their 5dc in for the mirror fix). So if Canon can check it, then that means the shutter count is being recorded in a property somewhere (just need to find it). No references to it in the rom, so I think I need to get prop spy working and just start probing for changing properties.

a1ex

Looks like if you hijack EMState you will get all the info you need.

You only need to intercept emDeliverMulticastEvent.

http://a1ex.bitbucket.io/ML/states/5Dc-alt/sm3.htm

Look in state-object.c and print the arguments you receive via the state object spy function.

a1ex


coutts

Some new progress:
create_state_object: 0xFFB22574

EMState is created at FF8B7694 (initialize_state_object__EMState).


dword_FF8B7304 is a small list containing pointers to the 3 states of EMState:
- emRegisterMulticastCallback
- emUnregisterMulticastCallback
- emDeliverMulticastEvent


create_state_object creates a struct for EMState using some of the arguments passed to it.
off_0x00: "StateObject"
off_0x04: "EMState"
off_0x08: 0x0 [unknown]
off_0x0C: ptr to state_object_state_handler__maybe (FFB22744) [this seems to trigger state changes i think]
off_0x10: EMState__states [dword_FF8B7304]
off_0x14: 0x3 [unknown]
off_0x18: 0x1 [unknown]
off_0x1C: 0x0 [unknown]

EMState is initialized during startup, called from Canon's startup task. I could re-write emDeliverMulticastEvent to send a GUI event maybe for half shutter press, unless there's an easier way to do it. I would have to somehow hijack Canon's startup task (and have to re-write that too), unless there's an easier method.

I'll dig into this more today. Overall the state machine stuff seems very similar to how it is in DryOS from when I looked into this stuff with the 500d. Identical I'd say.


EDIT
Wait, this will be easier than I thought since I only need to change the pointer in the EMState state object struct.

a1ex


coutts

Quote from: a1ex on July 03, 2012, 03:54:15 PM
For shutter count: I think Indy found the property data in ROM at ff80000.

http://groups.google.com/group/ml-devel/msg/831b0c9ee8765fca
I looked at 0xFF800000, it was just full of 0xFFFFFFFF though, so no luck there.
my card reader just broke (damn walmart and their cheap products), so I can't work on anything until tomorrow now.