Canon EOS 70D/550D/others - SD card locked

[utigaard]

Hello, im not sure if this is the correct place to put this, but i'll give it a go. I've googled for the last month and have found nothing to help me. Canon here in Norway wants 300 euro to change out the sd slot. I was wondering if there was a way to use ML to just ignore the SD lock sensor. I would change it but I will have to wait for parts, and im not too keen to open the camera without exhausting every option. I'm just looking for a way ignore the sensor. Any replies will be appreciated.

[a1ex]

Should work by patching FF0C4574 from 0x0A00000B to 0xEA00000B (string: "[STARTUP] WriteProtect (%#x)").

The 70D branch already includes the patch manager, so I believe this should work:

Code: [Select]

patch_instruction(0xFF0C4574, 0x0A00000B, 0xEA00000B, "WriteProtect");

This should go right before calling Canon's init_task, e.g. starting from the 70D_merge_fw112 branch:

Code: [Select]

diff -r d048d8447fa3 src/boot-hack.c
--- a/src/boot-hack.c
+++ b/src/boot-hack.c
@@ -41,6 +41,7 @@
 #include "reloc.h"
 #include "ml-cbr.h"
 #include "backtrace.h"
+#include "patch.h"
 
 #if defined(FEATURE_GPS_TWEAKS)
 #include "gps.h"
@@ -756,6 +757,8 @@
         }
     }
 
+    patch_instruction(0xFF0C4574, 0x0A00000B, 0xEA00000B, "WriteProtect");
+
     // memory check OK, call Canon's init_task
     int ans = init_task_func(a,b,c,d);

Tested in QEMU (comment out "case 0x0168" from eos_handle_gpio in eos.c to simulate the WriteProtect switch being enabled). Not sure if the MPU also watches this switch (hopefully not) - will test later on 5D3.

edit: seems to work (5D3.113: 0xFF0C43C4)

[Walter Schulz]

If a1ex's hack doesn't work you may want to contact a mobile phone repair shop (with a good reputation ...). They might be able to replace this part without much hassle and with a lower price tag attached.

[massi0189]

Hi a1ex,

how should I edit this line to make it work on a 550D with 1.09 firmware?

Code: [Select]

patch_instruction(0xFF0C4574, 0x0A00000B, 0xEA00000B, "WriteProtect");


Thanks,
Max

[a1ex]

For 550D 1.0.9, you need:

Code: [Select]

patch_instruction(0xFF012EE0, 0xEB016DBD, MOV_R0_0_INSTR, "WriteProtect");

You will also need a branch that includes the patch manager. For example, the experimental 70D branch should work just fine:

Code: [Select]

hg up 70D_merge_fw112 -C

Then apply the patch and compile ML as usual.

[Banshee]

Alex, I can't express how grateful I am for this fix. It actually worked on my 550D. There are hundreds of reports of this issue on the Internet since like 2009 and here is the solution finally)

The only issue I had was that during ML install SD is still write protected. Install doesn't report any error but it doesn't commit ROM and boot records to the card. So, in order to complete the installation I had to set boot records on SD with hex editor on PC manually.

[a1ex]

Nice to know it helped; maybe I should consider enabling this trick for all SD models. There must be a way to do the same without ROM patching...

[alxjvr]

Hi, I have the same scenario with my 550D.  Could you detail the app and steps you made in setting the boot records via a PC?  Thanks a lot!

Alex, I can't express how grateful I am for this fix. It actually worked on my 550D. There are hundreds of reports of this issue on the Internet since like 2009 and here is the solution finally)

The only issue I had was that during ML install SD is still write protected. Install doesn't report any error but it doesn't commit ROM and boot records to the card. So, in order to complete the installation I had to set boot records on SD with hex editor on PC manually.

[alxjvr]

Woohoo! It works! Haha.

A million thanks Mr. Banshee and a1lex!  Hats off to you both

[Hellmark]

Will this work for the 450D?