Bricked 60D - no sign of life except for the SD card light with one ML card

Started by tjrobinson, September 23, 2014, 05:10:32 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

tjrobinson

Because it had been working fine for years, then within a few minutes of using it with ML it froze up and never started again.

Why are you so convinced it's not ML?

a1ex

Diagnosed. The entire ROM0 was erased. The first 0x26000 bytes from ROM1 were erased (overwritten with garbage). ROM0 appears to be unused (this tricked me).

After 0x26000 bytes, ROM1 appears normal. Confirmed in QEMU: after replacing the first 0x26000 bytes from ROM1 with the ones from my 60D, ML is able to boot in the emulator.

The bootloader is OK (it's at the end of ROM1).

At this point I need help from g3gg0; it will need reflashing, but we never did that. I'm trying to understand the flash ROM routines here.

tjrobinson

I've got a video of the full startup LED blink sequence from an autoexec.bin a1ex sent me.

It was recorded at 1/8th speed (I think, might have been 1/4 speed) on a phone.

I've trimmed it and shrunk it down to about 24MB.

Would anyone you be able to see if they can deblink it?

https://www.dropbox.com/s/8kqc9ow674vf2gw/Note%20II%20Recording%20%28trimmed%20and%20resized%29.mp4?dl=0

Thanks,

Tom


Walter Schulz

Your problem has already been diagnosed ...
What do you expect? Second opinion?

tjrobinson

Walter,

Sorry, I have been speaking with a1ex over this issue for a number of weeks now and the latest information hasn't been posted here. His most recent post is now out of date.

Without going into too much detail, it turns out there is nothing wrong with ROM1 and the next step a1ex suggested was to use the deblink module to decode the startup messages, hence my previous post.

I don't have access to a camera to run the deblink module myself, so was hoping somebody might be able to attempt it remotely, by pointing their camera at the video I posted (see my previous message).

a1ex said he may be able to do this but hasn't replied for a while so I expect he is busy or away. I was hoping somebody else might be able to have a go so that I can send a1ex the additional diagnostic information.

Walter Schulz

Understood. Deblinking works right now.

EDIT: I think it didn't work as expected. Wild guess: Sync issues. May I ask where you're located?

tjrobinson

I'm based in Reading, England.

The video was recorded using my phone's slow-motion mode. It may not be great - if it's an unsuitable then I'll need to think of another plan.

angelsl

I wrote a little utility to deblink it programmatically, using ffmpeg to convert your video to frames and then detecting the LED blinks from there.

Here is the result. 8519 (8480 actual data) bits read from 53391 frames.

      init:ff071ffc:00:01: [PM] DisablePowerSave (Counter = 1)
      init:ff0122e4:8b:16:
K287 ICU Firmware Version 1.1.1 ( 3.3.7 )
      init:ff0122f8:8b:05:
ICU Release DateTime 2012.05.14 13:18:25
      init:ff02b744:00:03: [SEQ] CreateSequencer (Startup, Num = 6)
      init:ff02b994:00:02: [SEQ] NotifyComplete (Startup, Flag = 0x10000)
      init:ff02b9f8:00:03: [SEQ] NotifyComplete (Cur = 0, 0x10000, Flag = 0x10000)
   Startup:ff02b664:00:05: [SEQ] seqEventDispatch (Startup, 0)
   Startup:ff012624:8b:05: startupEntry
   Startup:ff1b9340:81:03: Initialize Adjective & Situation
   Startup:ff0125e4:8b:05: startupPropAdminMain : End
   Startup:ff02b994:00:02: [SEQ] NotifyComplete (Startup, Flag = 0x20000000)
   Startup:ff02b9f8:00:03: [SEQ] NotifyComplete (Cur = 1, 0x20000002, Flag = 0x20000000)
   Startup:ff071ffc:00:01: [PM] DisablePowerSave (Counter = 2)
   Startup:ff07206c:00:01: [PM] EnablePowerSave (Counter = 1)
**INT-50h*:ff071ffc: 0:01: [PM] DisablePowerSave (Counter = 2)
**INT-50h*:ff07206c:00:01: [PM] EnablePowerSave (Counter = 1)


The code I wrote, as well as the deblink result is here. There is a missing zero bit at index 0x647 that I added when converting to ASCII to get the result above. The corrected result is also there.


tjrobinson

angelsl, that's brilliant, thank you for doing this. Hopefully the output means something to somebody - fingers crossed.

With some help from a fellow ML user locally I managed to run the deblink module live, though the results don't look as good as what you've managed.

Here's a time-compressed video of the output:
https://www.youtube.com/watch?v=UAfnCgaSspU

I didn't have a chance to recompile the module with output to a text file enabled unfortunately :/ I have high quality stills of the final output but the video gets the general idea across.

I'll probably blog about the process properly soon, we had some camera inception going on!

a1ex

Great progress.

The log stops very early; a full log is much longer. Did the blinking stop all of a sudden?

For the live deblinker, can you double-check:
- frame rate (I've used 60fps in my tests)
- exposure (maybe increase the ISO?)
- ambient light (it helps if you can cover the two cameras with something)

tjrobinson

Alex,

The real duration was about 15 minutes. The light changed to a solid red after that time - we left it for a couple of minutes then stopped.

The framerate was 50fps - it was a 5D Mark 3 - does that do 60fps?

I'm not in a position to try this again for a while but can try adjusting the exposure and ambient light if we do it again. Is there anything else that would help? What's the best way of checking that the output is being decoded correctly? Readable text and no strange characters?

What do you make of the log from angelsl?

Quote from: angelsl on November 08, 2014, 08:07:11 PM
I wrote a little utility to deblink it programmatically, using ffmpeg to convert your video to frames and then detecting the LED blinks from there.

Here is the result. 8519 (8480 actual data) bits read from 53391 frames.

      init:ff071ffc:00:01: [PM] DisablePowerSave (Counter = 1)
      init:ff0122e4:8b:16:
K287 ICU Firmware Version 1.1.1 ( 3.3.7 )
      init:ff0122f8:8b:05:
ICU Release DateTime 2012.05.14 13:18:25
      init:ff02b744:00:03: [SEQ] CreateSequencer (Startup, Num = 6)
      init:ff02b994:00:02: [SEQ] NotifyComplete (Startup, Flag = 0x10000)
      init:ff02b9f8:00:03: [SEQ] NotifyComplete (Cur = 0, 0x10000, Flag = 0x10000)
   Startup:ff02b664:00:05: [SEQ] seqEventDispatch (Startup, 0)
   Startup:ff012624:8b:05: startupEntry
   Startup:ff1b9340:81:03: Initialize Adjective & Situation
   Startup:ff0125e4:8b:05: startupPropAdminMain : End
   Startup:ff02b994:00:02: [SEQ] NotifyComplete (Startup, Flag = 0x20000000)
   Startup:ff02b9f8:00:03: [SEQ] NotifyComplete (Cur = 1, 0x20000002, Flag = 0x20000000)
   Startup:ff071ffc:00:01: [PM] DisablePowerSave (Counter = 2)
   Startup:ff07206c:00:01: [PM] EnablePowerSave (Counter = 1)
**INT-50h*:ff071ffc: 0:01: [PM] DisablePowerSave (Counter = 2)
**INT-50h*:ff07206c:00:01: [PM] EnablePowerSave (Counter = 1)


The code I wrote, as well as the deblink result is here. There is a missing zero bit at index 0x647 that I added when converting to ASCII to get the result above. The corrected result is also there.



a1ex

Hm, after 15 minutes there might be a watchdog stopping the camera. I remember this problem when trying to figure out what happens when you start the camera with the main switch turned off (Canon code starts for a few seconds).

Possibilities:
- IIRC you said you can record at 240 fps - that is, we could blink a little faster
- you could hook a photodiode to a microcontroller, and blink much faster (I have the code for arduino)
- you could hook a photodiode to your soundcard input (instructions on CHDK wiki)
- we could check if we have file write access, to save the logs to the card
- if all else fails: skip the first 1000 bytes, and wait 15 minutes to get 1000 more bytes; repeat until finding the failure (binary search may help, because the logs are usually huge)

tjrobinson

My phone (Samsung Note II) can record in slow motion at 1/8 speed so in theory that's 240fps. I'm not sure whether it's actually capable of recording individual frames at 240fps though - there's probably some fakery going on as it is just a "toy" compared to proper cameras.

I've not got the skills/time for the microcontroller option though I could probably give the photodiode and soundcard a go.

A new autoexec.bin which attempts to write to a log file would be useful for sure.

How much bigger is a full log that the 15 minutes worth I've got so far?

The bigger question - is there anything specific we're looking for? An error message I assume? Could the blinker seek the log bytes looking for certain patterns perhaps?

a1ex

Yes, I'm looking for an error message, or the point where it stops logging (it locks up or whatever).

The blinker is slow - a short bit takes 3 frames, a short bit takes 6 frames (50fps), so a bit takes about 0.09 seconds. That is, a character is sent in 0.7 seconds. In 15 minutes you can send a little over 1000 characters - exactly what you've got.

angelsl

Quote from: tjrobinson on November 08, 2014, 10:51:30 PM
My phone (Samsung Note II) can record in slow motion at 1/8 speed so in theory that's 240fps. I'm not sure whether it's actually capable of recording individual frames at 240fps though - there's probably some fakery going on as it is just a "toy" compared to proper cameras.

That video you had was about 30 minutes at 29.97 fps, so if the real duration was 15 minutes then seems like it only recorded at 59.94 fps? Unless you sped up the footage when editing.

Anyhow, I'll be around if there's any way I can help. I can't seem to subscribe to this topic though.. (or any topic in the Using ML section).

tjrobinson

Thanks for your attempts to get things working again - much appreciated. Unfortunately I ran out of things I could try and there's only so long I could be without the camera so had to resort to paying for it to be repaired. Hopefully the stuff we tried will help somebody else out in future though.

tjrobinson

I've written my experiences up if anyone is interested. The blog post could do with some more detail in places but hopefully it's accurate and may be of interest/help to others in a similar situation.

http://www.tjrobinson.net/?p=171