Canon 40D

[jplxpto]

LV - JPEG

1024 x 680

-----

LCD

mode :  w x h

0 : 720 x 240
1 : 704 x 480
2 : 720 x 576

[jplxpto]

Code Select Expand

51722: 13249.867 [DispCon] TurnOnDisplay (PUB)
51723: 13266.642 [LV] lvSetPsave 0x0
51724: 13267.371 [LV] LV_GetPtpZoomWindowArea IX=1560(16384), IY=1038(0)
51725: 13267.404 [LV] LV_GetPtpZoomWindowArea CX=0, CY=0
51726: 13268.004 [LV] lvSetWbIntegRegisterForAe 1
51727: 13268.045 [LV] StartLiveViewWbPass
51728: 13268.920 [LVCDEV]->lvcdevStartDev
51729: 13270.190 [LV] lvResetPsave
51730: 13270.396 [LV] WB 1974 1151 1151 2533(1377)
51731: 13270.503 [LV] lvResetPsave(1) 0x5A 0x454 0x49E
51732: 13270.528 [LV] lvResetPsave(2) 0x0 0x0 0x0
51733: 13271.801 [LVCDEV]->lvcdevResourceGet(0,1)
[b]51734: 13272.366 [DPATH] LV_JPG START Y:0x1de43c64 J:0x1ca700c8 Y411:0x10798ea0[/b]
51735: 13275.198 [LV] lvVDInterrupt
51736: 13275.363 [LV] WB 1974 1151 1151 2533(1158)
51737: 13279.334 [DEV] LV_JPG YuvWriteCompleteCBR
51738: 13279.373 [DEV] LV_JPG YUVReadCompleteCBR
51739: 13279.499 [DEV] LV_JPG JpCoreCompleteCBR( 0x2e1c6 )
51740: 13279.553 [DEV] LV_JPG JpegPopCompleteCBR
[b] 51741: 13279.672 [DPATH] LV_JPG STOP Y:0x1df97c64 J:0x1ca9e28e Y411:0x107a0e20[/b]
51742: 13280.277 [LVCDEV]->PD(VF:0x107927ec,MS:0x485540)
[b] 51743: 13282.818 [LV] lvReturnVram[/b]
51744: 13282.851 < GUI Lock > GUILock_PermitPowerLock (PUB)
51745: 13283.134 < GUI Lock > GUILockTask 1


[Chucho]

In 2008 dataghost teased the world be getting video from his 40d. Now it looks like it might just happen for other 40d users. Congratulation on your hard work!!!

[a1ex]

Yay!

I think this is a lot better than Dataghost obtained (I've followed the thread back then). If all goes well, we will have MJPEG 422 at 1024x680.

Sure, we need to have a working port first. If you share the current status and code, I can help with this.

[imme]

Congrats you have done marvelous job...........eagerly waiting to use it on my 40d

[jplxpto]

Thank you all, but this would not have been possible without your help.

The Coutts, Chucho and the A1ex helped me a lot.

I have to thank also to the guys of CHDK. In the past they did an excellent job.
Without this work and without tools Alex would be very complicated.

I have spent many hours on it. I'm a little tired. Once you have a little time, I'll share with you my code.

My next steps will be to change the boot process.
I want to do something similar to what exists for other cameras.

I've read some things and did not seem very complex. With time and with your help will be easy.

[a1ex]

Take it easy. This low-level stuff can take a lot of time, even for experienced people.

[jplxpto]

'Vram Instance' : 0xFF9B943C

[ilguercio]

That's the same LV resolution as the 50D, what about frame rates though?

[jplxpto]

Some strings from 40dv111 ...


s vram

Code Select Expand


[b]ffca0178: '[IMP] CreateVram %d' [/b]
ffca0930: '[IMP] CompleteVramSyncroClearCBR err:%d'
ffca0d48: '[IMP] (PUB) SetVramInformation(w:%ld h:%ld) %d'
[b]ffca7528: '[IMPV] MakeHDVram %d' [/b]
ffca0e9c: '[IMP] DrawImageToVram GetJpegInfo():%d'
ffca1298: '[IMP] (PUB) RefreshImageVram %d'
ffca12b8: '[IMP] RefreshImageVram : VramNo not found'
ffca15a8: '[IMP] (PUB) AbortDrawImageToVram %d'
[b]ffca648c: '[IMPV] SetVramImageInfo %d' [/b]
ffca2c04: '[IMP] (PUB) SyncroClearImagePlayVram %d'
ffca089c: '[IMP] ImageVramCompleteCBR err:%d'
ffca349c: '[IMP] (PUB) SetVisibleImageVramOffset %d'
ffca3518: '[IMP]  pVramImagePositionY %d'
ffcaff38: 'Not Exist Bitmap Vram!!'
[b]ffca32fc: '[IMP] (PUB) GetVramImageInfo %d' [/b]
[b]ffca0ec4: '[IMP] ERROR DrawImageToVram %s, %d' [/b]
ffca644c: '[IMPV] Complete MakeHDVram Error(%d)\n'
[b] ffca64a8: '[IMPV] SetVramImageInfo x:%ld y:%ld w:%ld h:%ld' [/b]
ff906cd4: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramWidth(%d)'
ff906d88: '[GUI] uiImageWidth(%d) uiImageHeight(%d) uiVramHeight(%d)'
ffca087c: '[IMP] ImageVramCompleteCBR %d'
[b]ffca12e4: '[IMP] RefreshImageVram VramAdd:0x%lX' [/b]
[b]ffca7b8c: '[IMPV] MakeHDVramFromJpeg Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
[b]ffca7f74: '[IMPV] (PUB) MakeHDVramCheck %d' [/b]
[b]ffca8254: '[IMPV] GetVramImagePosAndSize s:%ld y:%ld w:%ld h:%ld' [/b]
[b]ffca01b4: '[IMP] Vram%d:0x%lX' [/b]
ffca34f8: '[IMP]  pVramImagePositionX %d'
[b]ffcb16fc: '[BmpDDev] RefreshPhysicalVram (PUB)' [/b]
ffca7c84: '[IMPV] MakeHDVram Error!'
ffca02a8: '[IMP] DeleteVram %d'
ffca02bc: '[IMP] CopyCurrentDisplayVramToIdleVram %d'
ffca08c0: '[IMP] CompleteVramSyncroCopyCBR %d'
[b]ffcb0290: '[BmpDDev] CreatePhysicalVram (PUB)' [/b]
[b]ffb2d1d0: 'lv_vram_dump' [/b]
ffca7bd8: '[IMPV] WorkAdd:0x%lX VramAdd:0x%lX RotWork:0x%lX'
[b]ffca7b68: '[IMPV] (PUB) MakeHDVramFromJpeg %d' [/b]
ffca7c50: '[IMPV] VramWork basew:%ld x:%ld y:%ld w:%ld h:%ld'
[b]ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d' [/b]
ffca2984: '[IMP] ERR: Not Found Display Vram'
ffcb03b4: '[BmpDDev] DeletePhysicalVram (PUB)'
ffca822c: '[IMPV] (PUB) GetVramImagePosAndSize %d'
ffcb1ba8: '[ImgDDev] WARNING Divide Zero Vram Width (%d)'
ffca2ff8: '[IMP] (PUB) SyncroAllClearImagePlayWorkVramWithoutEngine %d'
ff9122a4: '[GUI] CalcLvVramSize VramSize X(%d) Y(%d) W(%d) H(%d)'
[b]ffb32b30: '[LV] lvReturnVram' [/b]
ffcb3204: 'Already Vram For Adjust!!'
ff8b30ac: '[GUI] PlayModel.c DrawAspectFrame VramSize X(%d) Y(%d) W(%d) H(%d)'
ffca331c: '[IMP] GetVramImageInfo x:%ld y:%ld w:%ld h:%ld'
ffca334c: '[IMP] (STUB) SetImageVramColorMode(color:%ld) %d'
ffcb3530: 'Not Exist Vram For Adjust!!'
ffb34d94: '[LV] WriteEDmacVramCompleteCBR_x5'
[b]ffca3810: '[IMP] (PUB) GetVramInformation %d' [/b]
ffca08e4: '[IMP] CompleteVramSyncroCopyCBR err:%d'
ffca090c: '[IMP] CompleteVramSyncroClearCBR %d'
ffb361c4: '[LV] WriteEDmacVramCompleteCBR_x10'
ff883b18: '[TestEndDrawToVram] dwErrCode = %d'
ffcb8b6c: '[DispCon] GetVramSize (PUB)'
ffb39140: '[LV] WriteEDmacVramCompleteCBR_x1'
[b]ff9b943c: 'Vram Instance' [/b]
ff9b9558: 'pVram->Image.pPaletteIndex != NULL'
ff9b9594: '!IS_ERROR(pVram->hSemaphore)'
ff9b96b0: 'pVram->Mode == LOGICAL_VRAM'
ffca2e4c: '[IMP] (PUB) SyncroAllClearImagePlayIdleVramWithoutEngine %d'
ffca2e88: '[IMP] ERROR : Vram State'
ffca0e6c: '[IMP] (PUB) DrawImageToVram(rot:%d cb:0x%lX) %d'
ffca0d88: '[IMP] (PUB) SetCopyVramMode(mode=%d) %d'
ff87ece8: '  [Graphics] EndDrawToVram (PRI), err %d'
ffcaa8bc: '[IMP][PBFEN] Fencing_StartVRAMMode'
ffca0e0c: 'SetImageVramParameter x:%ld y:%ld w:%ld h:%ld/* Aspect:%d*/'
ffc9ff6c: '[IMP] GetVramNumber %d'
ffc9ffa0: '[IMP] SetVramImageParameter %d'
ffc9ffc0: '[IMP] SetVramImageParameter add:0x%lX BaseW:%ld'


s 411

Code Select Expand


ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffc492c0: '[DPATH] LV_YPACK START Y411:%#lx YPACK:%#lx'
ffc492ec: '[DPATH] LV_YPACK STOP Y411:%#lx YPACK:%#lx'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc46e00: '[DPATH] LV_JPG START Y:%#lx J:%#lx Y411:%#lx'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffc46fbc: '[DPATH] LV_JPG STOP Y:%#lx J:%#lx Y411:%#lx'
ffc96db0: '[IMP][PBRSZ] GetCnv411Mode %d'


s 422

Code Select Expand


ffc96d90: '[IMP][PBRSZ] GetCnv422Mode %d'
ffc9af8c: '[IMPD] rot:%d cnv411:%d cnv422:%d cnv411_444:%d cnv422_444:%d'
ffc9a10c: '[IMPD] rot:%d block:%d cnv411:%d cnv422:%d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'


s YUV

Code Select Expand


ffc95578: '<RESIZE> SetParameterResizeYuv Abort End Before Lock'
ffc955fc: '[IMP][PBRSZ] RequestResizeYuv RdAdr:%#lx, WrAdr:%#lx'
ffcb56b8: 'gyuv'
ffb301f8: '[LV] YuvAddress = 0x%08lX'
ffb00db8: 'Dp_ReduceImageData_Yuv()'
ffc498dc: 'PonyYuvPath'
ffc95810: '[IMP][PBRSZ] RegisterCBROfCompleteResizeYuv %d'
ffb01094: 'Dp_AdobeRgbToSRgb_Yuv()'
ffcaa86c: '[IMP][PBFEN] Fencing_SetDataYUV411VType'
ffb013c0: 'Dp_ClearWidth_Yuv()'
ffc959b8: '[IMP][PBRSZ] Zoom:%d InYuv:%d OutYuv:%d'
ffafaf14: 'Dp_ExecuteYuvRotatingCBR() ErrorCode [0x%08x]'
ffc49f7c: '[DEV] Pony YuvWriteCompleteCBR'
ffca6754: '[IMPV] Yuv:%d Add:0x%lX BaseW:%ld'
ffb02720: 'Dp_CopyImageData_Yuv()'
ffb02738: 'pDstYuvDataAddress [%d]'
ffb02750: 'pSrcYuvDataAddress [%d]'
ffc45c34: 'FactoryYuvPath'
ffc444b8: '[DEV] JPG_EN YuvWriteCompleteCBR'
ffaf9fa8: 'Dp_YuvToYuv()'
ffca47a8: '[IMPL] Yuv:%d Add:0x%lX BaseW:%ld'
ffca4c1c: '[IMPL] (PUB) CalculateYuvResizeParameter %d'
ffb36258: '[LV] WriteEDmacYuvCompleteCBR_x10'
ffc988b0: '<ROTATE> RequestRotationYuv Before Lock'
ffca5294: '[IMPL]_CalcResizeSizeForRotZoom InYuv:%d OutYuv:%d Aspect:%d'
ff84534c: '[FA] FA_YuvDevelopTestImage'
ffca580c: '[IMPL] _CalcResizeSize InYuv:%d OutYuv:%d Aspect:%d'
ffc4604c: '[DEV] FactoryYuvPath_ChangeCBR(ID=%#lx)'
ffca630c: '[IMPV] GetAjustUnitYUV %d'
ffb018bc: 'Dp_CutImageWidth_Yuv()'
ffca6dec: '[IMPV] YuvMode:%d'
ffc47068: '[DEV] LV_JPG YuvWriteCompleteCBR'
ffca72e0: '[IMPV] YuvMode:%d BaseAdd:0x%lX BaseW:%ld'
ffca730c: '[IMPV] YuvMode:%d  BaseAdd:0x%lX BaseW:%ld'
ffcadf00: '[IMP][DECWIN] SetNQDecParam adr:0x%08lX yuv:%d'
ffb01438: 'Dp_ExpandImageWidth_Yuv()'
ffb01490: 'Dp_ShiftYuvRotationData_Yuv()'
[b]ffca7cc4: '[IMPV] MakeHDVramFromYuv Rot:%d Mag:%d Aspect:%d' [/b]
ffc49c90: '[DPATH] Pony2 START YUV1:%#lx YUV2:%#lx'
ffc9c32c: '[IMPD] (PUB) ExecuteYuvRotating %d'
ffcb6ddc: '[DispCon] Err Factory Adjust For DisplayYUVGain'
ffc49ae4: '[DPATH] Pony1 START C:%#lx YUV:%#lx'
ffc49c2c: '[DPATH] Pony1 STOP C:%#lx YUV:%#lx'
ffc458c0: '[DEV] YuvWriteCompleteCBR'
ffc47048: '[DEV] LV_JPG YUVReadCompleteCBR'
ffb01b2c: 'Dp_AdjustCroppingSize_Yuv()'
ffc49e94: '[DPATH] Pony2 ReStartPonyYuvPath2'
ffb0134c: 'Dp_ClearHeight_Yuv()'
ffc49eb8: '[DPATH] Pony2 STOP YUV1:%#lx YUV2:%#lx'
ffc99db0: '[IMPD] YuvMode:%d'
ffc99de4: '[IMPD] StartYuvResizing Comp'
[b]ffb2d1e0: 'lv_yuv_dump' [/b]
ffcad330: '[IMP][DECWIN] SetResizeParam OutYuv:%d InputSel:%d'
ffcada9c: '[IMP][DECWIN] SetWinResDecParam adr:0x%08lX yuv:%d base:%ld'
ffcb15fc: '[BmpDDev] GetYUVPaletteFromDisplayDevice (PUB)'
ffb02798: 'Dp_ShiftImageHeight_Yuv()'
ffca7ca0: '[IMPV] (PUB) MakeHDVramFromYuv %d'
ffc8f344: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc8f3a0: '[IMP][PBLOT]  RequestRotationYuv Before Lock'
ffcb0608: '[BmpDDev] SetYUVPaletteToDisplayDeviceh (PUB)'
ffad0f50: 'YuvMode[%d]'
ffad0fd0: 'YuvMode[%d] BaseAddress[%d]'
ffafa738: 'ResizeYuvT Input nYuvMode [%d]'
ffb391d4: '[LV] WriteEDmacYuvCompleteCBR_x1'
ffc98708: '[IMP][PBROT]  OUTPUT --- Yuv:%d Add:0x%lX Base:%ld'
ffca6d94: '[IMPV] ZoomMode:%d YuvMode:%d'
ffb0ff6c: 'Dp_YuvToJpeg [0x%08x]'
ffcadfa0: '[IMP][DECWIN] pYuvAddress:%#lx'
ffb02004: 'Dp_AdjustFrameWithWhite_Yuv()'
ffb34e28: '[LV] WriteEDmacYuvCompleteCBR_x5'
ffca5dd0: '[IMPL] rot:%d zoom:%d inYUV:%d outYUV:%d'
ffcb8d9c: '[DispCon] GetYUVGain'
ffc95520: '[IMP][PBRSZ] SetParameterResizeYuvForMovie %d'
ffc95634: '<RESIZE> RequestResizeYuv Abort End Before Lock'
ffc95664: '[IMP][PBRSZ] ERROR pResizeYuvCompleteCBR is NULL'
ffc95698: '[IMP][PBRSZ] CancelResizeYuv %d'
ffc95840: '[IMP][PBRSZ] UnregisterCBROfCompleteResizeYuv %d'
ffc95874: '[IMP][PBRSZ] AbortResizeYuv %d'
ffc96334: '[IMP][PBRSZ] Input:%ld Output:%ld InYuv_f:%ld OutYuv_f:%ld'
ffc46030: '[DEV] YuvWriteCompleteCBR'
ffc4937c: '[DEV] LV_YPACK YuvReadCompleteCBR'
ffb0ff5c: 'Dp_YuvToJpeg()'
ffcb7564: "[DispCon] Warning: YUV Gain Don't Adjust"
ffb17f6c: '[GYO]Dp_YUVDustReduction'
ffc98684: '[IMP][PBROT] SetParameterRotationYuv %d'
ffc986ac: '[IMP][PBROT]  INPUT  --- Yuv:%d Add:0x%lX Base:%ld'
ffc98838: '[IMP][PBROT] RequestRotationYuv %d'
ffc9885c: '<ROTATE> RequestRotationYuv Abort End Before Lock'
ffc98cc0: '[IMP][PBROT] CancelRotationYuv %d'
ffc98ce4: '[IMP][PBROT] RegisterCBROfCompleteRotationYuv %d'
ffc98d18: '[IMP][PBROT] UnregisterCBROfCompleteRotationYuv %d'
ffaf9720: 'Dp_JpegToYuvNew() Layout[0x%08x]'
ffaf97a4: 'Dp_JpegToYuvNew [0x%08x]'
ffcad788: '[IMP][DECWIN] SetResWinParam yuv:%d InputSel:%d'
ffb01160: 'YuvBaseAddress [0x%08x]'
ffc99dc4: '[IMPD] StartYuvResizing TIMEOUT'
ffc9a150: '[IMPD] StartYuvRotating Comp'
ffafa4cc: 'Not Executed Dp_YuvToYuvHalf()'
ffafa6a8: 'Dp_YuvToYuvCopy()'
ffafa6d8: 'Dp_YuvToYuvReduce()'
ffafa720: 'Dp_ExecuteYuvResizing()'
ffafa758: 'ResizeYuvT Output nYuvMode [%d]'
ffafa998: 'Dp_ExecuteYuvResizingCBR() ErrorCode [0x%08x]'
ffafa9dc: 'Dp_YuvRotation() Rotate:%d'
ffc8f1c8: 'EvenSize >= YuvUnit'
ffc9f1e0: '  < IMD > ERR: YUV mode'
ffafaf44: 'ExecuteYuvRotation'
ffc99d44: '[IMPD] StartYuvResizing %d'
ffc955d0: '<RESIZE> SetParameterResizeYuv Before Lock'
ffc99d78: '[IMPD] ZoomMode:%d YuvMode:%d'
ffc99e04: '[IMPD] ResizeYuv:%d'
ffc9b9d8: '[IMPD] ERROR Dpx_ExecuteYuvAngleAdjust %d'
ffc49f9c: '[DEV] PonyYuvPath_ChangeCBR(ID=%#lx)'
ffc9c308: '[IMPD] (PUB) ExecuteYuvResizing %d'
ffc9a0f0: '[IMPD] StartYuvRotating %d'
ffcaf664: '  [BmpDDev] ConvertYUVPaletteToPBPalette (PRI)'
ffc44d70: '[DPATH] DCF_EN START DCF:%#lx YUV:%#lx'
ffc44f24: '[DPATH] DCF_EN STOP DCF:%#lx YUV:%#lx'
ffafa4b8: 'Dp_YuvToYuvHalf()'
ffc9c350: '[IMPD] (PUB) ExecuteYuvRotatingFor2Buffer %d'
ffafa68c: 'Dp_YuvToYuv64up() W:%d H:%d'
ff83e778: 'FA_YuvDevelopTestImage'
ff83e844: 'FA_GetYuvImage'
ffb151a8: 'YUV-Control Done'
ffca62f4: '[IMPV] SetUnitYUV %d'
ffcaa894: '[IMP][PBFEN] Fencing_SetDataYUV422Type'
ffafa9c8: 'ExecuteYuvResize'
ff845488: '[FA] FA_GetYuvImage'
ffca0e48: '[IMP] (PUB) SetYuvColorParameter %d'
ffc95550: '[IMP][PBRSZ] SetParameterResizeYuv %d'


[jplxpto]

something interesting... mbm29lv2mx16

ROM:FFD5D808 aAssertionFai_0 DCB "Assertion failed: (char*)WriteDataInFastModeOnRam > (char*)Erasi"
ROM:FFD5D808                                         ; DATA XREF: sub_FFD5DE00+28o
ROM:FFD5D808                                         ; ROM:off_FFD5DE80o
ROM:FFD5D808                 DCB "ngMethodOnRam, file ../MTD/mbm29lv2mx16/mbm29lv2mx16.c, line 86",0xA

[jplxpto]

some more addresses : 0xC0F1407C , 0xC0F14074
   
In [12]: r 0xC0F1407C

str:[DispCon]_TurnOnDisplay_PUB+172:
str:[DispCon]_ShowBitmap_PUB+60:
str:[DispCon]_HideBitmap_PUB+60:
str:[DispCon]_SetDisplayType_PUB+372:

In [13]: r 0xC0F14074

str:[DispCon]_ShowImage_PUB+60:
str:[DispCon]_HideImage_PUB+60:
str:[DispCon]_SetDisplayType_PUB+356:
str:[DispCon]_TurnOnDisplay_PUB+156:

[jplxpto]

GetDisplayType_FFCB8668

return *0xBEA0

--------------------------------------------------------------------------------

GetDisplayWidth_FFCB6CAC

if *0xBEA4 == 0 /*EQ*/:
    return 720
return 704

--------------------------------------------------------------------------------

GetDisplayHeight_FFCB8B04

if *0xBEA4 == 0 /*EQ*/:
    return 240
if *0xBEA4 == 1 /*EQ*/:
    return 480
return 576

--------------------------------------------------------------------------------


Display Resolution/Mode (maybe):

0 : w = 720, h = 240
1 : w = 704, h = 480
2 : w = 704, h = 576


--------------------------------------------------------------------------------

0x5B74 : unknown
0x5B78 : unknown
0x5BB8 : unknown
0x5BF8 : Vram Instance (maybe)
0x5BFC : unknown
0x5C00 : unknown
0x5C04 : unknown
0x5C08 : unknown
0x5C0C : unknown

0xB854 : unknown

0xBEA0 : DISPLAY TYPE
0xBEA4 : DISPLAY MODE (maybe)


0x1E004 : VRAM SEMAPHORE (maybe)
0x1E010 : VRAM INFORMATION
0x1E0A8 : unknown
0x1E100 : VRAM PARAMETERS  // 0x1E0A8 + 0x58 = 0x1E100

[jplxpto]

   302:   589.004 [GUI] MasterResultCBR
   303:   589.210 [GUI] GUI_Initialize ClassID[21]GUI[23]Ctrl[24]
   304:   589.992 [GUI] -> handleGuiInit
   305:   595.929 [DispCon] InitializeDisplayDeviceController (PUB)
   306:   597.086 [IMP] (PUB) InitializeImagePlayer 1113
   307:   598.805 [CERES] RegisterAdapterStatusCallback
   308:   604.642 [Graphics] GuiStartGraphics (PUB)
   309:   605.045 [IMP] (PUB) StartImagePlayer(mode=0) 1189
   310:   605.096 [IMP] CreateVram 665
   311:   605.252 [IMP] Vram0:0x1065BE00
   312:   605.354 [IMP] Vram1:0x106F3C8C
   ...
   858: 10003.647 myTaskDumpf:80: [MY_TEST] VRAM INFO:
   859: 10003.702 myTaskDumpf:84: [MY_TEST] Show ImageVramParameter : x:0 y:24 w:720 h:216
   861: 10118.505 [IMP] (PUB) GetVramInformation 3766
   862: 10118.608 myTaskDumpf:101: [MY_TEST] GetVramInformation : arg0=1065BE00 ; Vram0
   863: 10118.642 myTaskDumpf:102: [MY_TEST] GetVramInformation : arg1=00000000
   864: 10118.683 myTaskDumpf:103: [MY_TEST] GetVramInformation : arg2=106F3C8C ; Vram1
   865: 10118.708 myTaskDumpf:104: [MY_TEST] GetVramInformation : arg3=00000002
   866: 10118.739 myTaskDumpf:105: [MY_TEST] GetVramInformation : arg4=000002D0 ; 720
   867: 10118.768 myTaskDumpf:106: [MY_TEST] GetVramInformation : arg5=000002D0 ; 720
   868: 10118.798 myTaskDumpf:107: [MY_TEST] GetVramInformation : arg6=000000F0 ; 240


0x1E010+0x00 -> arg0
0x1E010+0x04 -> arg4
0x1E010+0x08 -> arg5
0x1E010+0x0C -> arg6
0x1E010+0x10 -> arg1
0x1E010+0x14 -> arg2
0x1E010+0x24 -> arg3

[jplxpto]

Some more stubs :

Code Select Expand


NSTUB(0xFFCB02B4, CreatePhysicalVram)
NSTUB(0xFFCA01C8, CreateVram)
NSTUB(0xFFCA75C4, MakeHDVram)
NSTUB(0xFFB32EA0, LV_lvReturnVram)
NSTUB(0xFFCA130C, RefreshImageVram)
NSTUB(0xFFCA38DC, SetVramInformation)
NSTUB(0xFFCA432C, GetVramInformation)
NSTUB(0xFFCA3AA0, SetImageVramParameter)
NSTUB(0xFFCA6520, SetVramImageInfo)
NSTUB(0xFFCA3EC4, GetVramImageInfo)
NSTUB(0xFFCA8498, GetVramImagePosAndSize)
NSTUB(0xFFCA35D0, GetWorkImageLengthAndPosition)

[jplxpto]

I did dump some state-objects and found that the structure appears to be the same as 5DC.


NSTUB(0xFFB3D088, LVCDEVState_CreateStateObject);   // Mem 0x7770 / state matrix : 0xFFB3C9D4
NSTUB(0xFFB3BC98, LVCAFState_CreateStateObject);    // Mem 0x7748 / state matrix : 0xFFB3B540
NSTUB(0xFFB3A554, LVCAEState_CreateStateObject);    // Mem 0x7738 / state matrix : 0xFFB39F5C
NSTUB(0xFFB32CB8, LVState_CreateStateObject);      // Mem 0x7628 / state matrix : 0xFFB2EDC4
NSTUB(0xFFD5CEA4, DMState_CreateStateObject);      // Mem 0xEFDC / state matrix : 0xFFD5CD84

   973: 11003.762 logMemory:24: DUMP DMState:
   974: 11003.815 logMemory:30: MEM(0x00201AD8) = 0xFFD4EE3C : type - "StateObject"
   975: 11003.861 logMemory:30: MEM(0x00201ADC) = 0xFFD5CD7C : name - "DMState"
   976: 11003.890 logMemory:30: MEM(0x00201AE0) = 0x00000000 : auto_sequence
   977: 11003.935 logMemory:30: MEM(0x00201AE4) = 0xFFD4F018 : StateTransition_maybe
   978: 11003.980 logMemory:30: MEM(0x00201AE8) = 0xFFD5CD84 : state_matrix
   979: 11004.009 logMemory:30: MEM(0x00201AEC) = 0x0000000E : max_inputs
   980: 11004.039 logMemory:30: MEM(0x00201AF0) = 0x00000002 : max_states
   981: 11004.069 logMemory:30: MEM(0x00201AF4) = 0x00000000 : current_state
   
   983: 11004.124 logMemory:24: DUMP LVState:
   984: 11004.169 logMemory:30: MEM(0x00797940) = 0xFFD4EE3C
   985: 11004.214 logMemory:30: MEM(0x00797944) = 0xFFB2F454
   986: 11004.244 logMemory:30: MEM(0x00797948) = 0x00000000
   987: 11004.289 logMemory:30: MEM(0x0079794C) = 0xFFD4F018
   988: 11004.335 logMemory:30: MEM(0x00797950) = 0xFFB2EDC4
   989: 11004.366 logMemory:30: MEM(0x00797954) = 0x0000000F
   990: 11004.396 logMemory:30: MEM(0x00797958) = 0x0000000E
   991: 11004.426 logMemory:30: MEM(0x0079795C) = 0x00000000

   993: 11004.483 logMemory:24: DUMP LVCAEState:
   994: 11004.528 logMemory:30: MEM(0x00796FB4) = 0xFFD4EE3C
   995: 11004.573 logMemory:30: MEM(0x00796FB8) = 0xFFB39F50
   996: 11004.603 logMemory:30: MEM(0x00796FBC) = 0x00000000
   997: 11004.648 logMemory:30: MEM(0x00796FC0) = 0xFFD4F018
   998: 11004.693 logMemory:30: MEM(0x00796FC4) = 0xFFB39F5C
   999: 11004.724 logMemory:30: MEM(0x00796FC8) = 0x0000000A
  1000: 11004.754 logMemory:30: MEM(0x00796FCC) = 0x00000006
  1001: 11004.784 logMemory:30: MEM(0x00796FD0) = 0x00000002

  1003: 11004.841 logMemory:24: DUMP LVCAFState:
  1004: 11004.887 logMemory:30: MEM(0x0079742C) = 0xFFD4EE3C
  1005: 11004.932 logMemory:30: MEM(0x00797430) = 0xFFB3B534
  1006: 11004.962 logMemory:30: MEM(0x00797434) = 0x00000000
  1007: 11005.007 logMemory:30: MEM(0x00797438) = 0xFFD4F018
  1008: 11005.052 logMemory:30: MEM(0x0079743C) = 0xFFB3B540
  1009: 11005.082 logMemory:30: MEM(0x00797440) = 0x0000000C
  1010: 11005.112 logMemory:30: MEM(0x00797444) = 0x00000009
  1011: 11005.143 logMemory:30: MEM(0x00797448) = 0x00000001

  1013: 11005.199 logMemory:24: DUMP LVCDEVState:
  1014: 11005.245 logMemory:30: MEM(0x0079754C) = 0xFFD4EE3C
  1015: 11005.290 logMemory:30: MEM(0x00797550) = 0xFFB3C9C8
  1016: 11005.320 logMemory:30: MEM(0x00797554) = 0x00000000
  1017: 11005.365 logMemory:30: MEM(0x00797558) = 0xFFD4F018
  1018: 11005.410 logMemory:30: MEM(0x0079755C) = 0xFFB3C9D4
  1019: 11005.440 logMemory:30: MEM(0x00797560) = 0x00000008
  1020: 11005.471 logMemory:30: MEM(0x00797564) = 0x00000003
  1021: 11005.501 logMemory:30: MEM(0x00797568) = 0x00000001

[jplxpto]

DUMP FROM MEMORY ADDRESS 0x0001E000:
   
MEM(0x0001E000) = 0x00000000 (0)         // unknown parameter
MEM(0x0001E004) = 0x0011C1B0 (1163696)      // VRAM SEMAPHORE (maybe)
MEM(0x0001E008) = 0x0011C18C (1163660)      // maybe another semaphore
MEM(0x0001E00C) = 0x00000000 (0)         // unknown parameter
   
MEM(0x0001E010) = 0x1065BE00 (275103232)   // Vram0 address - (GetVramInformation - arg 0)
MEM(0x0001E014) = 0x000002D0 (720)         // Vram0 width (maybe) - (GetVramInformation - arg 4)
MEM(0x0001E018) = 0x000002D0 (720)         // Vram0 pitch (maybe) - (GetVramInformation - arg 5)
MEM(0x0001E01C) = 0x000000F0 (240)         // Vram0 height (maybe) - (GetVramInformation - arg 6)
MEM(0x0001E020) = 0x00000000 (0)         // unknown parameter - (GetVramInformation - arg 1)
   
MEM(0x0001E024) = 0x106F3C8C (275725452)   // Vram1 address - (GetVramInformation - arg 2)
MEM(0x0001E028) = 0x000002D0 (720)         // Vram1 width (maybe)
MEM(0x0001E02C) = 0x000002D0 (720)         // Vram1 pitch (maybe)
MEM(0x0001E030) = 0x000000F0 (240)         // Vram1 height (maybe)
MEM(0x0001E034) = 0x00000002 (2)         // unknown parameter - (GetVramInformation - arg 3)
   
MEM(0x0001E038) = 0x1DBC0064 (498860132) // Some Video memory
MEM(0x0001E03C) = 0x00000798 (1944)         // RAW (w / 2) - SRAW
MEM(0x0001E040) = 0x00000798 (1944)         // RAW (w / 2) - SRAW
MEM(0x0001E044) = 0x00000510 (1296)         // RAW (h / 2) - SRAW
MEM(0x0001E048) = 0x00000798 (1944)         // WorkImageSize - w
MEM(0x0001E04C) = 0x00000510 (1296)         // WorkImageSize - h
   
MEM(0x0001E050) = 0x00000000 (0)
MEM(0x0001E054) = 0x00000000 (0)
MEM(0x0001E058) = 0x00000000 (0)
MEM(0x0001E05C) = 0x00000000 (0)
MEM(0x0001E060) = 0x00000000 (0)
MEM(0x0001E064) = 0x00000000 (0)
MEM(0x0001E068) = 0x00000000 (0)
MEM(0x0001E06C) = 0x00000000 (0)
MEM(0x0001E070) = 0x00000000 (0)
MEM(0x0001E074) = 0x00000000 (0)
MEM(0x0001E078) = 0x00000000 (0)
MEM(0x0001E07C) = 0x00000000 (0)
MEM(0x0001E080) = 0x00000000 (0)
MEM(0x0001E084) = 0x00000000 (0)
   
MEM(0x0001E088) = 0x00484E5C (4738652)
MEM(0x0001E08C) = 0x00400000 (4194304)
MEM(0x0001E090) = 0x00000001 (1)

MEM(0x0001E094) = 0x00000F30 (3888)         // JpegSize - w
MEM(0x0001E098) = 0x00000A20 (2592)         // JpegSize - h

MEM(0x0001E09C) = 0x00001D40 (7488)         // EffectiveSizeOfJpeg - w
MEM(0x0001E0A0) = 0x00001380 (4992)         // EffectiveSizeOfJpeg - h

MEM(0x0001E0A4) = 0x00000000 (0)


MEM(0x0001E0A8) = 0x00000001 (1)   // star of some structure - unknown parameter
MEM(0x0001E0AC) = 0x00000000 (0)
MEM(0x0001E0B0) = 0x00000000 (0)

MEM(0x0001E0B4) = 0x1DBC0064 (498860132)        // SetImageWorkMemory - 1
MEM(0x0001E0B8) = 0x1E26F264 (505868900)         // SetImageWorkMemory - 2
MEM(0x0001E0BC) = 0x106F3C8C (275725452)    // Vram1 address

MEM(0x0001E0C0) = 0x00000000 (0)
   
MEM(0x0001E0C4) = 0x00484E5C (4738652)
MEM(0x0001E0C8) = 0x00400000 (4194304)
MEM(0x0001E0CC) = 0x00000000 (0)
MEM(0x0001E0D0) = 0x00000000 (0)

MEM(0x0001E0D4) = 0x00000F30 (3888)         // RAW w
MEM(0x0001E0D8) = 0x00000A20 (2592)         // RAW h

MEM(0x0001E0DC) = 0x000009C0 (2496)         // SetImageWorkMaxPixel - w
MEM(0x0001E0E0) = 0x00000750 (1872)         // SetImageWorkMaxPixel - h

MEM(0x0001E0E4) = 0x00000000 (0)
MEM(0x0001E0E8) = 0x00000000 (0)
MEM(0x0001E0EC) = 0x00000000 (0)
MEM(0x0001E0F0) = 0x00000000 (0)
MEM(0x0001E0F4) = 0x000002D0 (720)
MEM(0x0001E0F8) = 0x000001E0 (480)
MEM(0x0001E0FC) = 0x000002D0 (720)
   
================================================================
   
DUMP FROM MEMORY ADDRESS 0x0001E100:
   
MEM(0x0001E100) = 0x00000000 (0)         // pVramImagePositionX - ImageVramParameter
MEM(0x0001E104) = 0x00000018 (24)         // pVramImagePositionY - ImageVramParameter
MEM(0x0001E108) = 0x000002D0 (720)         // WholeWidth - ImageVramParameter
MEM(0x0001E10C) = 0x000000D8 (216)         // WholeHeigh - ImageVramParameter
MEM(0x0001E110) = 0x0001DC00 (121856)      // Aspect - ImageVramParameter
MEM(0x0001E114) = 0x00000000 (0)
MEM(0x0001E118) = 0x00000000 (0)
MEM(0x0001E11C) = 0x00000000 (0)
MEM(0x0001E120) = 0x00000000 (0)
MEM(0x0001E124) = 0x00000000 (0)
MEM(0x0001E128) = 0x00000000 (0)
MEM(0x0001E12C) = 0x00000000 (0)
MEM(0x0001E130) = 0x00000000 (0)
MEM(0x0001E134) = 0x00000000 (0)
MEM(0x0001E138) = 0x00000000 (0)
MEM(0x0001E13C) = 0x00000000 (0)
MEM(0x0001E140) = 0x005E5558 (6182232)
MEM(0x0001E144) = 0x00000000 (0)
MEM(0x0001E148) = 0x0001DB90 (121744)
MEM(0x0001E14C) = 0x00000000 (0)
MEM(0x0001E150) = 0xFF8851E4 (-7843356)
MEM(0x0001E154) = 0x00012D6C (77164)
MEM(0x0001E158) = 0x00000000 (0)
MEM(0x0001E15C) = 0x00000000 (0)
MEM(0x0001E160) = 0xFFCA415C (-3522212)
MEM(0x0001E164) = 0x00000000 (0)
MEM(0x0001E168) = 0x00000000 (0)
MEM(0x0001E16C) = 0x00000000 (0)
MEM(0x0001E170) = 0x00000000 (0)

MEM(0x0001E174) = 0x00000000 (0) // SetVramImageInfo - x
MEM(0x0001E178) = 0x00000018 (24) // SetVramImageInfo - y
MEM(0x0001E17C) = 0x000002D0 (720) // SetVramImageInfo - w
MEM(0x0001E180) = 0x000000D8 (216) // SetVramImageInfo - h

MEM(0x0001E184) = 0x00000000 (0)
MEM(0x0001E188) = 0x00000000 (0)
   
MEM(0x0001E18C) = 0x106F3C8C (275725452)   // Vram1 address
MEM(0x0001E190) = 0x000002D0 (720)
MEM(0x0001E194) = 0x000000F0 (240)
MEM(0x0001E198) = 0x00000000 (0)
MEM(0x0001E19C) = 0x00000018 (24)
MEM(0x0001E1A0) = 0x000002D0 (720)
MEM(0x0001E1A4) = 0x000000D8 (216)
   
MEM(0x0001E1A8) = 0x00000000 (0)
MEM(0x0001E1AC) = 0x00000000 (0)
MEM(0x0001E1B0) = 0x00000000 (0)
MEM(0x0001E1B4) = 0x00000000 (0)
MEM(0x0001E1B8) = 0x00000000 (0)
MEM(0x0001E1BC) = 0x00000000 (0)
MEM(0x0001E1C0) = 0x00000000 (0)
MEM(0x0001E1C4) = 0x00000000 (0)
MEM(0x0001E1C8) = 0x00000000 (0)
MEM(0x0001E1CC) = 0x00000000 (0)
MEM(0x0001E1D0) = 0x00000000 (0)
MEM(0x0001E1D4) = 0x00000000 (0)
MEM(0x0001E1D8) = 0x00000000 (0)
MEM(0x0001E1DC) = 0x00000000 (0)
MEM(0x0001E1E0) = 0x00000000 (0)
MEM(0x0001E1E4) = 0x00000000 (0)
MEM(0x0001E1E8) = 0x00000000 (0)
MEM(0x0001E1EC) = 0x00000000 (0)
MEM(0x0001E1F0) = 0x00000000 (0)
MEM(0x0001E1F4) = 0x00000000 (0)
MEM(0x0001E1F8) = 0x00000000 (0)
MEM(0x0001E1FC) = 0x00000000 (0)
   

Vram0:0x1065BE00
Vram1:0x106F3C8C

[jplxpto]

   698:  3711.532 [GUI] StartPlayMain
   699:  3718.551 [Graphics] CreateSharedBuffer !!!
   700:  3719.198 [IMP] (PUB) SetImageWorkMemory 1:0x1dbc0064, 2:0x1e26f264
   701:  3719.274 [IMP] (PUB) SetImageWorkMaxPixel W:2496,H:1872,0x6af200
   702:  3719.292 [Graphics] GuiGraphicsNormalMode (PUB)


ImageWorkMemory 1: 0x1dbc0064
ImageWorkMemory 2: 0x1e26f264


0x1dbc0064 + 0x6af200 = 0x1e26f264

0x6af200 size (maybe)


Maybe YUV422 VRAM - Playback Image

[jplxpto]

I found four 'Vram Instance' strings in memory.
I believe that is the beginning of the structure vram_object.
I think two of them should be cacheable version and the other two uncacheable version.

0x00400B84   
0x00800B84
   
0x10400B84
0x10800B84

[jplxpto]

    I found a service menu on the 40D.
    I ran the function at 0xFF8170D4 and appeared to me an error in the CMOS camera's LCD.

   NSTUB(test_servicemenu_maybe, 0xFF8170D4)  at v1.1.1

   757: 59388.950 [GUI] DlgMnMainTabHeader.c PRESS_MLT_LEFT_BUTTON
   758: 59403.149 [GUI] DlgMnMainPlay1 GOT_TOP_OF_CONTROL
   760: 60043.684 [GUI_E] GUI_Control:60 0x0
   761: 60044.247 [GUI] IDLEHandler SERVICE_MENU
   762: 60044.300 [GUI] SetGUIRequestMode(25)
   763: 60044.324 [GUI] NotifyGUIEvent(1)

---------------------------------------------

ERR    123 123 123 025 032

REL     11709

CMOS  J0369547

---------------------------------------------

[a1ex]

Be careful what you call, some things can do permanent damage.

[jplxpto]

Thank you Alex. I'll be careful. I am aware that there is dangerous.

[nanomad]

no guts no glory they say
As a suggestion stay away from factory mode and prop changes unless you absolutely need them

[a1ex]

For a first port, take a look at 7D changeset, once you find the stubs it's probably a good starting point.

[jplxpto]

Ok, i'll do that...

Thank you