Author Topic: Canon 5DS / 5DS R  (Read 10863 times)

g3gg0

  • Developer
  • Hero Member
  • *****
  • Posts: 3157
Canon 5DS / 5DS R
« on: February 10, 2018, 01:14:29 PM »
just for the record, i pushed some 5Ds experiments.

booting the firmware is a bit different now, but works.
the code is hardcoded right now and just meant as experiment / documentation.

i wasnt able to display something meaningful yet.
could write into some YUV buffers or modify the graphics processor's RAM.
but not really usable at all.

THIS DOES NOT MEAN 5Ds WILL GET ML SOON!

https://bitbucket.org/hudson/magic-lantern/commits/branch/5Ds_experiments
Help us with datasheets - Help us with register dumps
magic lantern: 1Magic9991E1eWbGvrsx186GovYCXFbppY, server expenses: paypal@g3gg0.de
ONLY donate for things we have done, not for things you expect!

DrEVILish

  • New to the forum
  • *
  • Posts: 3
Re: Canon 5DS
« Reply #1 on: June 11, 2018, 08:36:35 PM »
There's been a youtube Experimental test of the 5Ds.


I'd like to know if there is any more details on this video there is nothing in the comments or if the video is as long as it could have been or if more can be made.

Walter Schulz

  • Contributor
  • Hero Member
  • *****
  • Posts: 7501
Re: Canon 5DS
« Reply #2 on: June 12, 2018, 12:07:11 AM »

DrEVILish

  • New to the forum
  • *
  • Posts: 3
Re: Canon 5DS
« Reply #3 on: June 15, 2018, 11:24:33 PM »
I've just ordered a 5Ds, mainly for photography, I've been a big fan of the ML RAW video output from the 550D I've been rocking for a few years now. I've been using ML for a while now and if there is anything I can do to help the effort of getting this project working onto such a device I'd love to get stuck in, with a nod in the right direction.

a1ex

  • Administrator
  • Hero Member
  • *****
  • Posts: 12452
Re: Canon 5DS
« Reply #4 on: January 19, 2019, 09:33:53 AM »
To my knowledge, there wasn't a ROM dumper published for the 5DS/R yet, so here's one:

Master/Slave:  5DS  5DSR  7D2 7D

I have no way to test it, so it may not work out of the box. All I know is that an older version of this codebase worked for 7D2 after some fiddling.

Edit Feb.10: confirmed working on the 5DS R.

a1ex

  • Administrator
  • Hero Member
  • *****
  • Posts: 12452
Re: Canon 5DS / 5DS R
« Reply #5 on: February 14, 2019, 10:40:46 PM »
I've merged the 5Ds_experiments branch into digic6-dumper, to use the same codebase as 80D, 5D4, 7D2 and all other recent models. It appears to work in QEMU, but could only test it to a very limited extent. Also added initial support for 5DS R; this one was confirmed to work on real hardware by @jcareaux on twitter.

Back then, g3gg0 enabled the boot flag on 5DS without any issue, so... here it goes.

Enabling the boot flag

* BFE_5DSR.FIR (works on any*) firmware version; confirmed by jcareaux)
* BFE__5DS.FIR (works on any*) firmware version; not yet confirmed, but an older version of this code was used by g3gg0)
* source code

These will modify your camera.

*) The boot flag enabling procedure is firmware-agnostic (it runs from bootloader, so it's compatible with any Canon firmware version). However, what you can do afterwards may be affected by Canon firmware version; read on.

To disable the boot flag: see these notes.


Warranty

If it breaks, you get to keep both pieces. Sorry.


What to do with it?

After enabling the boot flag on your camera, you may run:

a) with any firmware version:

- the portable display test (copy autoexec.bin and make your card bootable - EosCard/MacBoot/make_bootable.sh)
- the portable ROM dumper (you need a FAT12/16/32 SD card)
- anything compiled from the recovery branch, platform/portable.000 (it runs from bootloader context); check Makefile.user.default for options.

b) with 5DS R firmware 1.1.2 only, OR
c) with 5DS firmware 1.1.1 only:

- the digic6-dumper branch (5DS R will run the experiments previously tested on 80D/5D4; 5DS will run g3gg0's experiments)

- example code to get started - a simple intervalometer (not tested, previous attempts did not work on this model, but worked on 80D, 200D, M50 etc):
Code: [Select]
    /* this goes into dump_task in minimal-d6.c (digic6-dumper branch) */
    for (int i = 0; i < 10; i++)
    {
        call("Release");
        msleep(10000);
    }


Next steps

Roughly the same as 5D4. The basic functionality should not require any kind of dual core trickery; ML can run on the master core only, similar to 7D (there, the main core is called "slave"). In particular, I don't expect any difficulties in printing Hello World; just don't reuse the 80D addresses, as they won't work.

I'm here to help, if you have questions, but I expect you to read at least the other DIGIC 6/7/8 topics first ;)

That's it for today.

martin.nieuwoudt

  • Just arrived
  • *
  • Posts: 1
Re: Canon 5DS / 5DS R
« Reply #6 on: April 08, 2019, 02:40:41 PM »
Hi A1ex,

Has there been any further development on ML support for the 5DSr?

I've used ML extensively with other cameras, just not this one.

I am a little confused about the installation procedure you proposed:

1. Install Boot flag .fir file
2. Install Digix 6 dumper.

Is that correct?

regards,
Martin

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #7 on: January 23, 2020, 02:45:29 PM »
I want to help port the 5Ds. I know, dual digic 6, but I found a really cheap one and want to see how far we can get.

I think this camera is much better than a 5D4, as it has potential for 3K non cropped raw video, compared to what the mark 4 offers: 1.7x cropped 4K or full frame 2.2k

It also has anti aliased fonts, so the menus look really beautiful 🥰

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #8 on: January 23, 2020, 04:54:58 PM »
My 5Ds has latest firmware 1.1.3 and I tried to enable the bootflag with BFE_5DS.FIRm but the camera said "Firmware older than ver 1.1.3 is on memory card"...

So I opened the file up with a hex editor and changed the string at the beginning to 1.1.4, now the camera does accept it, but shows "Firmware Update Program" and "Update file error... "  after trying to run it.

flostro

  • New to the forum
  • *
  • Posts: 34
  • EOS 5D Mark III / EOS 3 / A1
Re: Canon 5DS / 5DS R
« Reply #9 on: January 23, 2020, 05:46:11 PM »
Maybe it's possible to downgrade with EOS Utility via USB

https://www.magiclantern.fm/forum/index.php?topic=18941.msg220980#msg220980

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #10 on: January 23, 2020, 06:02:48 PM »
I couldn't find old versions of the firmware online :(

But I only did a quick search. Does that site we always use around here have 5Ds firmware?

Walter Schulz

  • Contributor
  • Hero Member
  • *****
  • Posts: 7501
Re: Canon 5DS / 5DS R
« Reply #11 on: January 23, 2020, 07:27:16 PM »
https://pel.hu/eoscard
But I'm afraid ATM there is only CPS able to downgrade ‚ÄĚhardened" PTP fix.

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #12 on: January 23, 2020, 08:01:22 PM »
Thanks!!! I am not able to install it though, even with EOS utility. Not worth sending it to CPS.

So I think work should move to 1.1.3, as it's the latest and greatest anyway.

Need to find a way to enable bootflag and dump it...

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #13 on: January 24, 2020, 06:39:57 PM »
Back then, g3gg0 enabled the boot flag on 5DS without any issue, so... here it goes.

Enabling the boot flag

* BFE_5DSR.FIR (works on any*) firmware version; confirmed by jcareaux)
* BFE__5DS.FIR (works on any*) firmware version; not yet confirmed, but an older version of this code was used by g3gg0)
* source code

These will modify your camera.

I can't figure out how to compile that 'source code' file, I need to compile it with a higher version number so that it can run on my camera. But I just don't see what makefile I should use. Please help.

Then I will be able to run the dumper... and then will have to adapt current progress to firmware 1.1.3 - this shouldn't be massively difficult (?)

Then the difficult stuff will come... I will be reading digic 6 threads now.


Update: compiled portable.000 from recovery branch with CONFIG_BOOT_BOOTFLAG=y added to makefile, got an autoexec.bin file, not a .FIR file, not sure if I should run it. It does not have any version number when I look at it with a hex editor, does not look like the FIR files shared by a1ex on the forum. Should I look at the 5Ds experiments branch? I just want a fir that will enable the bootflag.

ArcziPL

  • Contributor
  • Member
  • *****
  • Posts: 148
Re: Canon 5DS / 5DS R
« Reply #14 on: January 24, 2020, 11:05:06 PM »
You won't be able to create a working *.FIR until you sign it with a proper key. This key is not made public. You have two options: ask a1ex for an updated boot-flag-enabler or dig in disassembly + RAM dumps to find it on your own.
70D.112 | M50.102 | M.202

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #15 on: January 24, 2020, 11:12:51 PM »
So this key is hidden within the camera's memory? Anyone who has a dump can find it?

Why is the key not made public then?

Is it different for each model?

This is a new magic lantern fact for me.


@a1ex if you could, could you please help me out with getting a 5Ds firmware dumper/bootflag enabler for firmware version 1.1.3

Walter Schulz

  • Contributor
  • Hero Member
  • *****
  • Posts: 7501
Re: Canon 5DS / 5DS R
« Reply #16 on: January 25, 2020, 01:04:01 AM »
So this key is hidden within the camera's memory? Anyone who has a dump can find it?

Why is the key not made public then?

Is it different for each model?

This is a new magic lantern fact for me.


@a1ex if you could, could you please help me out with getting a 5Ds firmware dumper/bootflag enabler for firmware version 1.1.3

Normally I don't do full quotes...

Sorry for rocking the boat but as a moderator you are responsible for users to comply with forum rules and "ML work ethics". I'm worried because IMO you don't understand some basic rules. One of them (as explained in forum rules) is never to post Canon's IP in public. This applies to ROM dumps, for example. Encryption keys ... Well, I think you get the idea now.
IMO you should ask some seasoned mod or dev for a serious primer.

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #17 on: January 25, 2020, 01:42:24 AM »
Thank you.

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #18 on: April 17, 2020, 08:57:45 PM »
I cannot get disassemble.pl to work right. ROM1.BIN.labels and ROM1.BIN.dis are always zero bytes in size. Maybe I need a different address?

I have used this so far:
Code: [Select]
perl disassemble.pl 0xFE000000 ROM1.BIN
What do I do next to get hello world? Which branch is all the action for 5Ds/r happening in, is it 5Ds_experiments? Or digic 6?

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #19 on: April 20, 2020, 02:12:18 AM »
I tried compiling 5Ds_experiments 5Ds.111 with "make install" - but it doesnt create a .FIR, so the camera cannot see it. I guess this is a step main devs with signing key need to do? How does the .FIR step even work when we normally compile?

I am much more serious about helping than the "hey I have 80d i know javascript" people, I really want to spend time on this. I have good knowledge of C, I have implemented card spanning in mlv_lite, I just don't really know much about ARM and embedded hardware. Does that qualify me to be any help? Honest question. Do I need a lot more knowledge of ARM?

a1ex

  • Administrator
  • Hero Member
  • *****
  • Posts: 12452
Re: Canon 5DS / 5DS R
« Reply #20 on: April 20, 2020, 07:16:53 AM »
Reply #5 provides the answer to most of your questions. You don't need our signing key.

You do need some embedded programming knowledge, but I've tried to cover the EOS-specific details in QEMU guides (linked from the homepage).

Unfortunately I'm unable to provide any significant assistance these days (a technical reply might require a few hours of preparation on my side), so... I'm afraid you will have to figure out most of the stuff on your own. Sorry about that. On the upside, the Hello World code was confirmed to work on most DIGIC 6/7/8 models announced at the time of writing that piece of code, so following the discussion from those other models, and the source code commits, should provide the hints you need.

ilia3101

  • Moderators
  • Hero Member
  • *****
  • Posts: 923
Re: Canon 5DS / 5DS R
« Reply #21 on: April 20, 2020, 12:03:41 PM »
Thank you.

Reply #5 provides the answer to most of your questions. You don't need our signing key.

I see, digic6-dumper is latest branch.

Also I got disassemble.pl working, it had some paths that were wrong in my case. I see lots of strings inside the 5Ds dump like "AAAAAAAAAAAAAAAAAAAAAAAA" and "DDDDDDDDDDDDAADDDDDDDDDA..." ? There is plenty of normal strings as well though. Could just be that I don't have the right start address.

Edit: about to try disassemblev7.pl

You do need some embedded programming knowledge, but I've tried to cover the EOS-specific details in QEMU guides (linked from the homepage).

Ok good to know.

Unfortunately I'm unable to provide any significant assistance these days (a technical reply might require a few hours of preparation on my side), so... I'm afraid you will have to figure out most of the stuff on your own. Sorry about that.

No worries.

Just small hints about what to do will be massively helpful.

On the upside, the Hello World code was confirmed to work on most DIGIC 6/7/8 models announced at the time of writing that piece of code, so following the discussion from those other models, and the source code commits, should provide the hints you need.

Is that code in digi6-dumper? I compiled digid6-dumper and put it on a card I made bootable, and it seems to run. The red led blinks and the camera eventually locks up (a sign code is running I think). I don't see any hello world though, even after uncommenting the hello world line in minimal.c

Tried putting this in minimal-d678, but nothing happens. Is that code even still being called from platform 5DS.111?
Code: [Select]
    /* this goes into dump_task in minimal-d6.c (digic6-dumper branch) */
    for (int i = 0; i < 10; i++)
    {
        call("Release");
        msleep(10000);
    }

But at least I got some rectangles to show up on the screeen by uncommenting this:
Code: [Select]
        void *(*cmd_StartFlatDisplay)(int *buffer) = 0xFE2BD1FD;
        uint32_t buffer[4] = { 1, 2, 3, 4};
        cmd_StartFlatDisplay(buffer);

Also I'll see if I can do anything from your 5D4 next steps post.

csoller

  • New to the forum
  • *
  • Posts: 16
Re: Canon 5DS / 5DS R
« Reply #22 on: June 21, 2020, 07:01:00 PM »
This would be the most ambitious crossover event in history.