Canon 1200D

[dmilligan]

Do you know C? Embedded programming? ARM assembly language? If not, those would be good places to start. If you do, then start digging into the ML code base (see reply #36), and post any specific questions you might have.

[BigMikeD]

To all those working on this..THANK YOU!!! 

[epiclegotyler]

My head is spinning, does ML work for the T5 or not? Is it 100% or some kind of beta. That's all I want to know.
Oh and if it does work is it really complicated? Why is there no sticky?

[dmilligan]

No. It's in an extremely early stage of porting, nothing you would consider remotely "usable", and there doesn't seem to be anyone actively working on it.

[BigMikeD]

shameless bump!

[mbit]

+1 Big Thanks for all involved on developing ML for 1200D.


I was used to work with chdk on my SXs and realized i made a huge mistake acquiring the 1200D before checking ML support list.
I do know a little bit of programming (academic level).
Willing and available for some betatesting 

[artur_d]

@dmilligan wrote about 100d:
>What's next:
>
> Receive the body done.
> Order a lens
> Ask a1ex to do the fir installers (we got at least 2 fw revisions)   
> Bring "da magic" to 100D

@a1ex:
Can You do the firmware installer for our 1200d?
What do you need to do this?
If do You have not enough time, maybe there is some way, You can write about? Probably it is too difficult, but I think about some kind of tutorial, some kind of tools.

[BallisticHugs]

I need this so bad guys... If anyone is still working on it, I appreciate it!

[Bcordeiro]

to all who are working on this project my thanks! I am eager and hopeful to get my hands on the Magic Lanternet in my 1200D! 

[Walter Schulz]

I suppose no one is working on this right now.
See replies 77 and 78.

[BigMikeD]

can anyone explain the differences (from a programming standpoint) between the T3 and the T5?  both digic 4 and what appears to be the same button layout.  was curious as to the difficulty of using the t3 build on the T5.  anyone care to elaborate for me?

[dmilligan]

ML works by calling functions that were found in the Canon firmware by disassembling it. We have to hardcode the specific addresses of these functions where they are stored in ROM (or in some cases RAM), because there is no API or linking faculties. In other words we only have an ABI, not an API. The locations of these functions are different for different cameras and even different revisions of firmware for the same camera. This is because when Canon compiles their firmware, the compiler is just going to put functions wherever it sees fit, so if Canon changed anything about the code at all (even something as simple as changing a single string literal) all the function locations are going to shift around. Therefore an ML build will only work on a specific camera and firmware version. It can't work on anything else, because it doesn't know the location of any functions it needs to work. ML actually does a checksum of the Canon firmware at startup to make sure it is the correct one and refuses to boot otherwise.

[BigMikeD]

that was all greek to me but thank you for the reply none the less.  i was hoping it was simpler than that but oh well.  does give my curiosity some reading material though.

[alfonsofernandezyf]

I'd love to help make this happen, I just got a Rebel T5.

What can I do to help bring Magic Lantern to the T5s and 1200Ds of the world?

[Walter Schulz]

See reply #75.
+ Willing to spend several hundred hours to make it work.

[Phant]

See reply #75.
+ Willing to spend several hundred hours to make it work.

I've got some stuff to learn, but count me in!

[axelcine]

There is a perfectly beautiful ML for T5 - see downloads > 700d114. Be awestruck. Good luck

Ah... ignore this. I guess I slept through this class. Sorry.

[BigMikeD]

t5i and the t5 are nothing alike.  i dont think that will work.

[Andy12]

I hope ML development gets rollin on this model. Another vote from my side.
Thanks

[Mafketel]

ML works by calling functions that were found in the Canon firmware by disassembling it. We have to hardcode the specific addresses of these functions where they are stored in ROM (or in some cases RAM), because there is no API or linking faculties. In other words we only have an ABI, not an API. The locations of these functions are different for different cameras and even different revisions of firmware for the same camera. This is because when Canon compiles their firmware, the compiler is just going to put functions wherever it sees fit, so if Canon changed anything about the code at all (even something as simple as changing a single string literal) all the function locations are going to shift around. Therefore an ML build will only work on a specific camera and firmware version. It can't work on anything else, because it doesn't know the location of any functions it needs to work. ML actually does a checksum of the Canon firmware at startup to make sure it is the correct one and refuses to boot otherwise.

Luckily no greek in sight here, very well explained thank you.
Makes me want to get the firmware and let the computer find the fingerprints for those functions.....
But I assume that if that was possible that would have been done already.
How do you check for the functions? write a script to test each memory location and see what happens on your camera?

[Andy12]

It close to 2 years since the release  of 1200D & since there seems to be no active development, I fear the ML port is never going to see the light of day.

My budget only allows to buy a 1200D & I would have gotten it in a jiffy even if the development was in (slow) progress (to which I could have contributed, though I am a noob). However, since this seems to be a dead end for now, I will simply wait for 700d prices to get down or switch to something else.

[dmilligan]

@Mafketel,

Yes, many functions can be found by automated scripts, other functions may vary, or may even be altogether not present, and work around must be found. Or perhaps the same function operates altogether differently. It's also not just functions that must be found, things like data structures, register addresses, and locations of various buffers must be found as well, also things like the valid range of values for registers too.

Bottom line is that there's always going to be a non trivial amount of work to do on any new port, and ultimately requires a camera in the hands of a developer to make sure things actually work, and understand and handle the unique aspects of the camera.

[axelcine]

The 700d price is already dropping all over the world, and the ML for this cam is really very good. The 1200 is a nice entry-level camera, but as such comes with a few restrictions compared to the more mature 700d (ISO 25600 on T5i versus 6400 on the T5, fewer video choices... read dpreview's excellent survey of both cameras. So what I'm saying: Save up a little more and get yourself a 700d. I also bought the 760d, but I'm almost certain there will never be a ML for that camera. It's OK, I have plenty use for a non-ML camera (but I'd love to get ML for the 760d.) So my next camera is probably going to be a second-hand 5dIII.

[vanbov]

Hi. I am trying to load dumped ML firmware to qemu, but have some issue. I dumped it with dumper-1200D-qemu.fir (32M). BTW I can confirm that my firmware version showed in  TEST1200.FIR is also 1.0.0/4.4.2 5A(19). I used qemu script https://bitbucket.org/hudson/magic-lantern/src/c295d34b1fc40b7d7f4f25c9cd66d654b814ccd3/contrib/qemu/install.sh?at=unified&fileviewer=file-view-default to build qemu.
There are no 1200d or 1100d in supported machines:

Code Select Expand

~/ml/qemu$ qemu-1.6.0/arm-softmmu/qemu-system-arm -M ?
Supported machines are:
none                 empty machine
collie               Collie PDA (SA-1110)
ML-50D               Magic Lantern on Canon EOS 50D
ML-60D               Magic Lantern on Canon EOS 60D
ML-600D              Magic Lantern on Canon EOS 600D
ML-500D              Magic Lantern on Canon EOS 500D
ML-5D2               Magic Lantern on Canon EOS 5D2
ML-5D3               Magic Lantern on Canon EOS 5D3
ML-650D              Magic Lantern on Canon EOS 650D
ML-100D              Magic Lantern on Canon EOS 100D
ML-7D                Magic Lantern on Canon EOS 7D
ML-550D              Magic Lantern on Canon EOS 550D
ML-6D                Magic Lantern on Canon EOS 6D
50D                  Canon EOS 50D
60D                  Canon EOS 60D
600D                 Canon EOS 600D
500D                 Canon EOS 500D
5D2                  Canon EOS 5D2
5D3                  Canon EOS 5D3
650D                 Canon EOS 650D
100D                 Canon EOS 100D
7D                   Canon EOS 7D
550D                 Canon EOS 550D
6D                   Canon EOS 6D
nuri                 Samsung NURI board (Exynos4210)
smdkc210             Samsung SMDKC210 board (Exynos4210)
connex               Gumstix Connex (PXA255)
verdex               Gumstix Verdex (PXA270)
highbank             Calxeda Highbank (ECX-1000)
midway               Calxeda Midway (ECX-2000)
integratorcp         ARM Integrator/CP (ARM926EJ-S) (default)
kzm                  ARM KZM Emulation Baseboard (ARM1136)
mainstone            Mainstone II (PXA27x)
musicpal             Marvell 88w8618 / MusicPal (ARM926EJ-S)
n800                 Nokia N800 tablet aka. RX-34 (OMAP2420)
n810                 Nokia N810 tablet aka. RX-44 (OMAP2420)
sx1                  Siemens SX1 (OMAP310) V2
sx1-v1               Siemens SX1 (OMAP310) V1
cheetah              Palm Tungsten|E aka. Cheetah PDA (OMAP310)
realview-eb          ARM RealView Emulation Baseboard (ARM926EJ-S)
realview-eb-mpcore   ARM RealView Emulation Baseboard (ARM11MPCore)
realview-pb-a8       ARM RealView Platform Baseboard for Cortex-A8
realview-pbx-a9      ARM RealView Platform Baseboard Explore for Cortex-A9
akita                Akita PDA (PXA270)
spitz                Spitz PDA (PXA270)
borzoi               Borzoi PDA (PXA270)
terrier              Terrier PDA (PXA270)
lm3s811evb           Stellaris LM3S811EVB
lm3s6965evb          Stellaris LM3S6965EVB
tosa                 Tosa PDA (PXA255)
versatilepb          ARM Versatile/PB (ARM926EJ-S)
versatileab          ARM Versatile/AB (ARM926EJ-S)
vexpress-a9          ARM Versatile Express for Cortex-A9
vexpress-a15         ARM Versatile Express for Cortex-A15
xilinx-zynq-a9       Xilinx Zynq Platform Baseboard for Cortex-A9
z2                   Zipit Z2 (PXA27x)


So, I tried to use 60D machine, which are also DIGIC4 according to  https://ru.wikipedia.org/wiki/DIGIC#DIGIC_4

But qemu shows only black screen. and some output:

Code Select Expand

~/ml/qemu$ ./run_canon_fw.sh 60D

make: Entering directory `/home/user/ml/qemu/qemu-1.6.0'
make  all-recursive
Making all in pixman
make  all-am
make[4]: Nothing to be done for `all-am'.
Making all in test
make[3]: Nothing to be done for `all'.
LEX convert-dtsv0-lexer.lex.c
make[1]: flex: Command not found
BISON dtc-parser.tab.c
make[1]: bison: Command not found
LEX dtc-lexer.lex.c
make[1]: flex: Command not found
CHK version_gen.h
make: Leaving directory `/home/user/ml/qemu/qemu-1.6.0'
00000000 - 00000FFF: eos.tcm_code
40000000 - 40000FFF: eos.tcm_data
00001000 - 3FFFFFFF: eos.ram
40001000 - 7FFFFFFF: eos.ram_uncached
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror_F1
F2000000 - F2FFFFFF: eos.rom0_mirror_F2
F3000000 - F3FFFFFF: eos.rom0_mirror_F3
F4000000 - F4FFFFFF: eos.rom0_mirror_F4
F5000000 - F5FFFFFF: eos.rom0_mirror_F5
F6000000 - F6FFFFFF: eos.rom0_mirror_F6
F7000000 - F7FFFFFF: eos.rom0_mirror_F7
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror_F9
FA000000 - FAFFFFFF: eos.rom1_mirror_FA
FB000000 - FBFFFFFF: eos.rom1_mirror_FB
FC000000 - FCFFFFFF: eos.rom1_mirror_FC
FD000000 - FDFFFFFF: eos.rom1_mirror_FD
FE000000 - FEFFFFFF: eos.rom1_mirror_FE
FF000000 - FFFFFFFF: eos.rom1_mirror_FF
C0000000 - CFFFFFFF: eos.iomem
[EOS] loading 'ROM-60D.BIN' to 0xF0000000-0xF1FFFFFF
[EOS] loading 'ROM-60D.BIN' to 0xF8000000-0xF9FFFFFF
I also tried 7D. So question is do I need some specific machine to run It or may be there are some issues with dump? I am able to disassemble second 16M (ROM1) from dump and have next files:

Code Select Expand

$ ls -lh
total 266M
-rwxrwx--- 1 user user  32M гру  6 14:42 AS
-rw-rw-r-- 1 user user 5,2K гру  6 16:21 disassemble.pl
-rw-rw-r-- 1 user user  16M гру  6 17:05 ROM0.bin
-rw-rw-r-- 1 user user  16M гру  6 17:05 ROM1.bin
-rw-rw-r-- 1 user user 181M гру  6 17:09 ROM1.bin.dis
-rw-rw-r-- 1 user user  17M гру  6 17:07 ROM1.bin.elf
-rw-rw-r-- 1 user user 3,2M гру  6 17:07 ROM1.bin.labels
-rw-rw-r-- 1 user user 2,5M гру  6 17:07 ROM1.bin.strings

PS. Thanks to team for help, and especially for detailed explanations for non-obvious things, it helps alot.

[vanbov]

I found 1200D machine in fjriosp repository, but it throws some exception,

Code Select Expand

user@user-VirtualBox:~/ml/code_1200d/qemu$ ./run_canon_fw.sh 1200D
make: Entering directory `/home/user/ml/code_1200d/qemu/qemu-1.6.0'
make  all-recursive
Making all in pixman
make  all-am
make[4]: Nothing to be done for `all-am'.
Making all in test
make[3]: Nothing to be done for `all'.
    LEX convert-dtsv0-lexer.lex.c
make[1]: flex: Command not found
    BISON dtc-parser.tab.c
make[1]: bison: Command not found
    LEX dtc-lexer.lex.c
make[1]: flex: Command not found
   CHK version_gen.h
make: Leaving directory `/home/user/ml/code_1200d/qemu/qemu-1.6.0'
00000000 - 00000FFF: eos.tcm_code
40000000 - 40000FFF: eos.tcm_data
00001000 - 3FFFFFFF: eos.ram
40001000 - 7FFFFFFF: eos.ram_uncached
F0000000 - F0FFFFFF: eos.rom0
F1000000 - F1FFFFFF: eos.rom0_mirror_F1
F2000000 - F2FFFFFF: eos.rom0_mirror_F2
F3000000 - F3FFFFFF: eos.rom0_mirror_F3
F4000000 - F4FFFFFF: eos.rom0_mirror_F4
F5000000 - F5FFFFFF: eos.rom0_mirror_F5
F6000000 - F6FFFFFF: eos.rom0_mirror_F6
F7000000 - F7FFFFFF: eos.rom0_mirror_F7
F8000000 - F8FFFFFF: eos.rom1
F9000000 - F9FFFFFF: eos.rom1_mirror_F9
FA000000 - FAFFFFFF: eos.rom1_mirror_FA
FB000000 - FBFFFFFF: eos.rom1_mirror_FB
FC000000 - FCFFFFFF: eos.rom1_mirror_FC
FD000000 - FDFFFFFF: eos.rom1_mirror_FD
FE000000 - FEFFFFFF: eos.rom1_mirror_FE
FF000000 - FFFFFFFF: eos.rom1_mirror_FF
C0000000 - CFFFFFFF: eos.iomem
[EOS] loading 'ROM-1200D.BIN' to 0xF0000000-0xF1FFFFFF
[EOS] loading 'ROM-1200D.BIN' to 0xF8000000-0xF9FFFFFF
[FlashIF] at [0xFF0C000C]: 'Write enable' enabled
[] [0x00000001] -> [0xC020010C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020000C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020001C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020002C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020003C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020004C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020005C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020006C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020007C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020008C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC020009C] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC02000AC] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC02000BC] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC02000CC] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC02000DC] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC02000EC] PC: 0xFF0C000C
[] [0x000000FF] -> [0xC02000FC] PC: 0xFF0C000C
[Basic] at [0xFF0C000C] [0x00430005] -> [0xC0400008]
[] [0x00000000] <- [0xC0242010] PC: 0xFF0C000C
[] [0x00000001] -> [0xC0242010] PC: 0xFF0C000C
[Int] Write to Int space [0x43210DCB] -> [0xC0201100] PC: [0xFF0C5244]
[Int] Write to Int space [0xFEA98765] -> [0xC0201104] PC: [0xFF0C5244]
[Int] Write to Int space [0x00000001] -> [0xC0201200] PC: [0xFF0C5244]
[] [0x00000008] -> [0xC0203008] PC: 0xFF0C5314
[Int] Enabled interrupt ID 0x0A PC: [0xFF0C5294]
[Basic] at [0xFF0C0AAC] [0x00000000] -> [0xC0400018]
[Basic] at [0xFF0C53D0] [0x00000000] <- [0xC0400008]
[Basic] at [0xFF0C53D0] [0x00001000] -> [0xC0400008]
[Basic] at [0xFF0C0ABC] [0x00000000] <- [0xC0400000]
[Timer] at [0xFF0C5354] [0x80000000] -> [0xC0210200]
[Timer] at [0xFF0C5374] [0x00000002] -> [0xC0210204]
[Timer] at [0xFF0C5374] [0x00000003] -> [0xC0210214]
[Timer] at [0xFF0C0AEC] [0x0000270F] -> [0xC0210208]
[Timer] at [0xFF0C53AC] [0x00000001] -> [0xC0210210]
[Timer] at [0xFF0C53AC] Starting triggering
[EOS] trigger int 0x0A (delayed!)
[Timer] at [0xFF0C53AC] [0x00000001] -> [0xC0210200]
[Int] Enabled interrupt ID 0x2E PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x3A PC: [0xFF0C5274]
[] [0x00000000] <- [0xC05000D0] PC: 0xFF12B4F4
[] [0x00000000] -> [0xC05000D0] PC: 0xFF12B4F4
[] [0x40016900] -> [0xC05000C0] PC: 0xFF12B4F4
[] [0x00000080] -> [0xC05000C4] PC: 0xFF12B4F4
[] [0x40016900] -> [0xC05000C8] PC: 0xFF12B4F4
[] [0x00000080] -> [0xC05000CC] PC: 0xFF12B4F4
[] [0x00000000] -> [0xC05000D4] PC: 0xFF12B4F4
[] [0x00000017] -> [0xC05000D8] PC: 0xFF12B4F4
[] [0x00010023] -> [0xC05000D0] PC: 0xFF12B4F4
[TIO] Reset RX indicator
K327 READY
[GPIO] at [0xFF0C241C] [0x00000010] -> [0xC0222004]
[GPIO] at [0xFF119C00] [0x00000025] -> [0xC0221300]
[] [0x00000004] -> [0xC020302C] PC: 0xFF119C00
[GPIO] at [0xFF119C00] [0x00000024] -> [0xC0221304]
[] [0x00000004] -> [0xC0203030] PC: 0xFF119C00
[GPIO] at [0xFF119C00] [0x00000007] -> [0xC0221308]
[GPIO] at [0xFF119C00] [0x0000004F] -> [0xC022130C]
[] [0x00000004] -> [0xC0203038] PC: 0xFF119C00
[GPIO] at [0xFF119C00] [0x0000004E] -> [0xC0221310]
[GPIO] at [0xFF119C00] [0x0000000D] -> [0xC0221314]
[Int] Write to Int space [0x43210DCB] -> [0xC0201100] PC: [0xFF0C5244]
[Int] Write to Int space [0xFEA98765] -> [0xC0201104] PC: [0xFF0C5244]
[Int] Write to Int space [0x00000001] -> [0xC0201200] PC: [0xFF0C5244]
[] [0x00000000] -> [0xC0243110] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243214] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243214] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024321C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024321C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0243120] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243224] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243224] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024322C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024322C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0243130] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243234] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243234] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024323C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024323C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0243140] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243244] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243244] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024324C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024324C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0243150] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243254] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243254] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024325C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024325C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0243160] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243264] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243264] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024326C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024326C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0243170] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243274] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243274] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024327C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024327C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0243180] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243284] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243284] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024328C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024328C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0243190] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243294] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243294] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC024329C] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC024329C] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC02431A0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432A4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432A4] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02432AC] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC02432AC] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC02431B0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432B4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432B4] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02432BC] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC02432BC] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC02431C0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432C4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432C4] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02432CC] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC02432CC] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC02431D0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432D4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432D4] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02432DC] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC02432DC] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC02431E0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432E4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432E4] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02432EC] PC: 0xFF2B20FC
[] [0x00000000] <- [0xC02432EC] PC: 0xFF2B20FC
[] [0x00000000] -> [0xC0202000] PC: 0xFF2B2138
[] [0x00000000] -> [0xC0242200] PC: 0xFF2B2160
[] [0x00000000] -> [0xC0242204] PC: 0xFF2B2170
[] [0x00000000] -> [0xC0202004] PC: 0xFF2B2138
[] [0x00000000] -> [0xC0242210] PC: 0xFF2B2160
[] [0x00000000] -> [0xC0242214] PC: 0xFF2B2170
[] [0x00000000] -> [0xC0202008] PC: 0xFF2B2138
[] [0x00000000] -> [0xC0242220] PC: 0xFF2B2160
[] [0x00000000] -> [0xC0242224] PC: 0xFF2B2170
[] [0x00000000] -> [0xC020200C] PC: 0xFF2B2138
[] [0x00000000] -> [0xC0242230] PC: 0xFF2B2160
[] [0x00000000] -> [0xC0242234] PC: 0xFF2B2170
[] [0x00000000] -> [0xC0202010] PC: 0xFF2B2138
[] [0x00000000] -> [0xC0242240] PC: 0xFF2B2160
[] [0x00000000] -> [0xC0242244] PC: 0xFF2B2170
[] [0x00000000] -> [0xC0202014] PC: 0xFF2B2138
[] [0x00000000] -> [0xC0242250] PC: 0xFF2B2160
[] [0x00000000] -> [0xC0242254] PC: 0xFF2B2170
[] [0x00000000] -> [0xC0202018] PC: 0xFF2B2138
[] [0x00000000] -> [0xC0242260] PC: 0xFF2B2160
[] [0x00000000] -> [0xC0242264] PC: 0xFF2B2170
[] [0x00000000] -> [0xC020201C] PC: 0xFF2B2138
[] [0x00000000] -> [0xC0242270] PC: 0xFF2B2160
[] [0x00000000] -> [0xC0242274] PC: 0xFF2B2170
[] [0x00000000] -> [0xC0243700] PC: 0xFF2B2200
[] [0x00000000] -> [0xC0243710] PC: 0xFF2B2200
[] [0x00000001] -> [0xC024311C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC024312C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC024313C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC024314C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC024315C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC024316C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC024317C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC024318C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC024319C] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC02431AC] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC02431BC] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC02431CC] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC02431DC] PC: 0xFF2B21A4
[] [0x00000001] -> [0xC02431EC] PC: 0xFF2B21A4
[] [0x00000000] -> [0xC0243800] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243804] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243808] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024380C] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243810] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243814] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243818] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024381C] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243820] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243824] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243828] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024382C] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243830] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243834] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243838] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024383C] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243840] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243844] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243848] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024384C] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243850] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243854] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243858] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024385C] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243860] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243864] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243868] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024386C] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243870] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243874] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243878] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024387C] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243880] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243884] PC: 0xFF2B2214
[] [0x00000000] -> [0xC0243888] PC: 0xFF2B2214
[] [0x00000000] -> [0xC024388C] PC: 0xFF2B2214
[Int] Enabled interrupt ID 0x1A PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x1B PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x1C PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x1D PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x1E PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x1F PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x10 PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x20 PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x21 PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x22 PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x23 PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x24 PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x25 PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x26 PC: [0xFF0C5274]
[Int] Enabled interrupt ID 0x27 PC: [0xFF0C5274]
[] [0x00000000] -> [0xC0243160] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243264] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243264] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC0243170] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243274] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243274] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC0243180] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243284] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243284] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC0243190] PC: 0xFF2B2098
[] [0x00000000] -> [0xC0243294] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC0243294] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02431A0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432A4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432A4] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02431B0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432B4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432B4] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02431C0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432C4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432C4] PC: 0xFF2B20E8
[] [0x00000000] -> [0xC02431D0] PC: 0xFF2B2098
[] [0x00000000] -> [0xC02432D4] PC: 0xFF2B20E8
[] [0x00000000] <- [0xC02432D4] PC: 0xFF2B20E8
[] [0x40000401] -> [0xC0242010] PC: 0xFF2B2000
[Basic] at [0xFF1264C0] [0x00000000] <- [0xC0400008]
[Basic] at [0xFF1264C0] [0x00200000] -> [0xC0400008]
[Basic] at [0xFF126BB0] [0x00000000] <- [0xC0400008]
[Basic] at [0xFF126BB0] [0x01000000] -> [0xC0400008]
[DMA1] [0x00000001] -> [0xC0A10000]
[DMA2] [0x00000001] -> [0xC0A20000]
[DMA3] [0x00000001] -> [0xC0A30000]
[DMA4] [0x00000001] -> [0xC0A40000]
[GPIO] at [0xFF0C29D8] [0x00000012] -> [0xC0222004]
[GPIO] at [0xFF0C27E0] [0x00000012] -> [0xC0222000]
[DMA1] [0x00000000] -> [0xC0A10004]
[DMA1] [0x00000000] -> [0xC0A10010]
[DMA1] [0xF8CA0000] -> [0xC0A10018]
[DMA1] [0x403D3500] -> [0xC0A1001C]
[DMA1] [0x0026BBAC] -> [0xC0A10020]
[DMA1] [0x00000007] -> [0xC0A10014]
[Int] Enabled interrupt ID 0x2F PC: [0xFF0C5274]
[DMA1] Copy [0xF8CA0000] -> [0x403D3500], length [0x0026BBAC], flags [0x00030001]
[DMA1] OK
[EOS] trigger int 0x2F
[Int] Requested int reason [0x000000BC] <- [0xC0201004] PC: [0x0000050C]
[DMA1] [0x00000000] -> [0xC0A10010]
ASSERT : Startup\Startup.c, Task = Startup, Line 364
ASSERT : Multicast\PropertyMgr.c, Task = Startup, Line 452
... more same asserts
[DM] ASSERT! TryPostEvent() fail.ASSERT : Multicast\PropertyMgr.c, Task = Startup, Line 452
ASSERT : Multicast\PropertyMgr.c, Task = Startup, Line 452
... more same asserts
ASSERT : Multicast\PropertyMgr.c, Task = Startup, Line 452
ASSERT : Multicast\PropertyMgr.c, Task = , Line 452
... more same asserts
< Error Exception>
TYPE        : 4
ISR         : 0
TASK IDSR   : 453
TASK Name   : (null)
R 0         : 0
R 1         : 0
R 2         : 0
R 3         : 0
R 4         : 0
R 5         : 0
R 6         : 0
R 7         : 0
R 8         : 0
R 9         : 0
R10         : 0
R11         : 0
R12         : 0
R13         : 1603c
R14         : 0
PC          : 0
CPSR        : 0
[DM] Fail!!! DM_WriteLogToFROM< Error Exception>
TYPE        : 4
ISR         : 0
TASK IDSR   : 453
TASK Name   : (null)
R 0         : 0
R 1         : 0
R 2         : 0
R 3         : 1
R 4         : 0
R 5         : 0
R 6         : 0
R 7         : 0
R 8         : 0
R 9         : 0
R10         : 0
R11         : 0
R12         : 0
R13         : 20f000
R14         : ff0c71b0
PC          : 4
CPSR        : 60000093
qemu: fatal: Trying to execute code outside RAM or ROM at 0xeeeeeeee


R00=00000000 R01=00000000 R02=00000000 R03=00000001
R04=eeeeeeee R05=eeeeeeee R06=eeeeeeee R07=00000000
R08=00000000 R09=00000000 R10=00000000 R11=00000000
R12=00000000 R13=0020f010 R14=ff0c71b0 R15=eeeeeeee
PSR=60000013 -ZC- A svc32
FPSCR: 00000000./run_canon_fw.sh: line 5: 20357 Aborted                 (core dumped) $QEMU_PATH/arm-softmmu/qemu-system-arm -M $1

So reason in DM_WriteLogToFROM, interesting it function from firmware or from qemu itself.