Portable ROM dumper

g3gg0 · October 27, 2017, 05:58:36 PM

wondering why it failed in the first place.
maybe some counter overflowing? hmmm

dfort · April 10, 2018, 08:17:19 PM

Got my hands on a 500D and thought I'd try dumping the 1.1.2 firmware but ran into this:

Same issue with 1.1.1. I have used the portable dumper a few times and have never seen this before.

a1ex · April 10, 2018, 08:26:27 PM

Old-style model; covered in first post.

The good old blind dumper appears to work in QEMU (should work on all D4 and D5 models with bootflag enabled, except 7D). Make sure you have a valid image on the card, then go to PLAY mode. Split the dump in two, like you did on M2.

dfort · April 10, 2018, 09:18:10 PM

Well that does look similar to what we were doing a year ago. Tried the "blind dumper" and it gave me a file named "As" that was apparently the ROM1.BIN and didn't need to be split. Disassembled it and it looks good.

Thanks again!

a1ex · April 24, 2018, 09:54:20 AM

Quote from: a1ex on July 29, 2016, 12:06:45 PM
The issue: Canon's bootloader routines for file I/O copy the data to some cacheable (!) memory; when that buffer reaches 0x4000 bytes, it's written to card using DMA.

Canon finally fixed this in DIGIC 7

The bug is, however, present in DIGIC 6 and earlier.

Updated autoexec.bin (first post) with:
- DIGIC 6 support, including serial flash dump (thanks t3r4n)
- DIGIC 7 support, when the time will come
- same portable binary loads on DIGIC 2, 3, 4, 5, 6, 7 AND 8!

ROM dumpers ready for 200D, 77D, 6D2 and 800D; will post the FIR versions in the DIGIC 7 thread.

These dumpers still require a very small card, but just formatting with a smaller filesystem will do the trick. The easiest way is (still) to write the QEMU SD image onto the card (howto).

The issue can be reproduced in QEMU on a large SD image (or by running from a physical card), so it's clearly not a caching issue. It can be reproduced from the FROMUTILITY menu, without loading AUTOXEC.BIN (proof of concept and details available on request). I believe are two different issues in Canon code: writing from cacheable memory (fixed on D7) and large card support (still present on D7).

rafaelbf · June 01, 2018, 04:50:44 AM

Quote from: dfort on April 10, 2018, 08:17:19 PM
Got my hands on a 500D and thought I'd try dumping the 1.1.2 firmware but ran into this:

Same issue with 1.1.1. I have used the portable dumper a few times and have never seen this before.

Hi dfort,

sorry for the late reply... I've tried Portable Dumper on my 500D, same screen on booth firmware, even with low capacity card.

dfort · June 01, 2018, 10:29:20 PM

@rafaelbf -- We need to use the blind dumper on the 500D.

Quote from: a1ex on January 25, 2016, 09:29:53 AM
Supported cameras:
- most DIGIC 4 (exceptions: 500D, 50D, 5D2, 7D)

Quote from: a1ex on April 10, 2018, 08:26:27 PM
The good old blind dumper appears to work in QEMU (should work on all D4 and D5 models with bootflag enabled, except 7D). Make sure you have a valid image on the card, then go to PLAY mode. Split the dump in two...

At first I had some issues splitting the dump in two but eventually figured it out.

DrEVILish · June 15, 2018, 11:54:04 PM

I have just ordered a 5Ds, which has D6+ like the 7D2, let me know if I can be of assistance, with testing and dumping.

JagoUK · August 29, 2018, 04:15:14 AM

7Dmk2 (Dual digic 6) dumped

Had to tell it to dump to CF but it actually dumped to the SD.

a1ex · October 06, 2018, 06:18:53 PM

Updated with serial flash support for DIGIC 5 models (first post). Tested only in QEMU; please try and report back.

To check:
- make sure the MD5 sums are correct for all files (including SFDATA.BIN if present)
- make sure SFDATA.BIN looks like valid data (i.e. not full of zeros or full of FF or otherwise containing garbage - this condition is not covered by the checksums)

QEMU test results:

News:

Portable ROM dumper

dfort

dfort

dfort

dfort

dfort

dfort

dfort

dfort

dfort

dfort