Canon 80D

[Ant123]

found in RAM dump provided by sombree:
two uyvy buffers at 0x41785B00, 0x41901800
one RGBA buffer at 0x043ED100

bitmap buffers are 960*540 pixels with black bars:

[a1ex]

Assign this to a hotkey (mpu.c):

Code Select Expand


eos_load_image(s, "RAM4.BIN", 0, s->model->ram_size, s->model->caching_bit, 0);
s->disp.bmp_vram = 0x41901800 + (30 * 960 + 120) * 2;
s->disp.bmp_pitch = 960 * 2;


then, in eos_update_display, pretend it's an EOSM3:



Have fun!

[Ant123]

I'm not sure that this is useful until emulation reaches the mzrm initialization.

[gabi_tro]

Yes I would love to know that as well. I am interested in finding out the shutter counter. I extracted those files but I have no ideea what to do with them

[nitram0]

Used to have ML on my super old 350D but since upgrading to the 80D, I have been looking forward to ML. If anything, would be amazing to have 1080p video in RAW (good 'ol 24fps). In theory, how fast does the card write speed even need to be for 24fps 1080p RAW?

Thanks to all those working on this project. Good luck! 

[Walter Schulz]

You cannot have used ML on 350D because it doesn't exist. You may have used CHDK instead.

[OlRivrRat]

   @ WhomEver is working on the 80D ML

Not trying to be Pushy > But > My Birthday is only about a Week away {:~))

[jackmehoffer]

Hello, I just got an 80D to replace my 60D-ML. I just wanted to let you know that I appreciate all your hard work and thank you for everything that you.

[PeterPan]

Hello, I just recently bought an 80D. As I have used ML on my 550d for a long time, I would lobe to see it on my 80d. I'm not a developer and I can't program, but if there is any way to help you guys, I would love to do that. Like testing some builds for example.
Keep up your great work

[snappy604]

Hi

Like many others, thank you for working on this. I used ML on my 7d and miss it now that I'm on an 80d.

Noticed this was slightly different on home page... what does this mean?

"80D, 750D, 5DS (can run code alongside Canon firmware)"

[a1ex]

On all EOS models we have tried (including DIGIC 7), we can execute custom code. The question is - can we do anything useful with it?

On DIGIC 7, for example, we don't even know how to blink a LED (so our code does not have any visible side effects - we only know it runs because it locks up the camera).

On all DIGIC 6 models we have tried, we can display things on the screen from bootloader. Canon firmware is not running in this case, but it's useful to find out stuff about the hardware (find out what CPU it has, dump the ROM and so on).

On some DIGIC 6 models (including 80D), we can execute this code alongside Canon firmware (for example, by starting DryOS tasks). This is a huge progress (compared to bootloader stage) and you can already start tweaking various functions in Canon firmware. You cannot print things on screen yet, but you can blink the LED and save files on the SD card.

Right now, you can compile from the digic6-dumper branch and experiment. You can run these experiments either on camera, or - with some major limitations - in QEMU. I don't have any DIGIC 6 cameras (sorry, the GAS is over), so please don't wait for me - start experimenting on your own. The codebase is ready for other developers to jump in and start porting. The emulator is also in pretty good shape these days.

Tip: 5DS experiments are also available, and useful as documentation.

Whetting your appetite: put this in dump_task:

Code Select Expand


msleep(5000);
call("Release");


Don't try that with EraseSectorOfRom or other functions you don't know what they do



BTW - if anyone skilled in ARM assembly is reading - this will be very helpful for understanding how DIGIC 6 works. Code won't run out of the box, but can be debugged in QEMU first.

[a1ex]

Today, April 1st, announcing...

Magic Lantern Blind Edition for DIGIC 6

Step 0: make sure you are running firmware 1.0.2 (ML does not check for that!)
Step 1: enable the boot flag (if you haven't already)
Step 2: copy autoexec.bin to your card (download links below)
Step 3: pray that your camera won't explode
Step 4: start the camera
Step 6: report back

Release 0.001
Features:
- LED blinking
- Still photo capture after 10 seconds
- Diagnostic log

Release 0.002
Features:
- LED blinking
- Silent photo capture (without shutter actuation) after 10 seconds (camera must be in PLAY mode started from LiveView; ML does NOT check for that!)
- Diagnostic log

Keep in mind these binaries are truly blind (I could not test this functionality in QEMU). Anything can happen if you try to run them. Your 80D may very well turn into 1DX or it may explode. If it breaks, I'm unable to pay for repairs, sorry.



Source code: open the binaries with a text editor.
For other D6 models, adapting the source should be straightforward.
For DIGIC 7, see here. Emulation-wise it's mostly identical to D6.

Have fun!

[oc_masta]

Alex, you and the rest of team...Bravo.

I honestly commend your tenacity with the magic lantern project. I feel a thank you doesn't do it justice, so I'll say Alex you sexy man!

[Felipe]

Really  hooo man

[ricflair4life]

Oh sweet! What's the next step you'd recommend?

[OlRivrRat]

                   TWEIMC

   Thanks to an SFDATA Dumper & Help from Thomas Mathieson I have an SFDATA.BIN

from My 80D if anyone is interested ~

                                                                  ORR ~ DeanB

[michael1998]

is this an Aprils fool day joke ? and if it is not and i hope it is not,i have the camera can someone tell me what to exactly do to run some tests on it

[Chellyandruu]

hey Alex,i ran both test .do you need the log files?

[a1ex]

Yes, please. Also whether the tests worked or not, and a silent picture (silent.raw, it's overwritten if you try more than once).

[201400005064]

I just bought 80d and had some exploration on this camera. I wondered about this witch camera. I thank you for doing all this effort, I hope someone can run tests. I'll try what I can do, maybe I'll run a few tests. I'm not a developer or whatever but maybe I can help with the tests. 

[sombree]

I'm not sure if silent photo capture works - I can't open output file with anything.

[a1ex]

The log looks promising! I can already tell a few things from it.

Memory allocation starts at FA_CreateTestImage, photo capture starts at FA_CaptureTestImage, file saving starts right after FA_GetCrawBuf. Buffer address looks sane to me. Exposure settings were: ISO 100 1/200, f/1.8 or manual lens (unsure). 0xD0006008 and 0xD0006014 are FPS timers A and B (closely related to image size). Camera reads 8 columns in parallel (timer A = 0x304 * 8 = 6176, slightly above horizontal resolution). MPU message 0e 2d appears to be sent periodically from LiveView (unknown meaning).

However, the image data was not good. Were the preconditions met when the image was captured? (was the camera in PLAY mode, entered from LiveView?) The MPU messages from the log (0e 2d present during image capture) and the semaphore error are strong hints that the camera was still in LiveView. Please follow the instructions to the letter; at this stage, ML cannot check whether the camera is in the right mode or not.

To open the file, see reply #246 (but only after you are sure the image was captured).

Also, did the regular photo capture test work? How does the log look like? Did the LED blink 10 times before the image capture? The test was really blind, I don't have a DIGIC 6 camera to check whether it works or not. The DIGIC 6 platform is very different from the models I know, so I cannot assume much if you don't report the details. Please read these for some background info:

https://www.chiark.greenend.org.uk/~sgtatham/bugs.html
http://www.catb.org/esr/faqs/smart-questions.html#beprecise

[sombree]

Release 0.001:
Led starts blinking. Sometimes it blinks ten times and takes regular photo. Some other times it blink few times and stops (led is still on) but camera doesn't lock up - entering menu (or pushing any other button) seems to "unlock" led blinking so after ten blinks it takes photo. Output is correct *.cr2 file. Logs.

Release 0.002:
Led blinks ten times and then it stops. After some time it turns on few more times (looks like camera is saving files to the card). I did as you said - entered Live View and then entered PLAY mode and waited until everything is done. I've also tried entering Live View and then entering menu but still no succes - SILENT.RAW looks like nothing in binview.

Btw. you're right about exposure settings (lens with AF but set to manual mode)

[a1ex]

The CR2 logs look good, although some messages are out of order, for some unknown reason. Quirks like this were the reason I wrote a custom logging framework, overriding Canon's DebugMsg.

The silent picture behavior is unexpected - is the 80D the first model that keeps LiveView active when entering PLAY or MENU?! I find it hard to believe, but who knows. Can you try to capture a silent picture outside LiveView? You should get a dark frame.

From this line, we can measure rolling shutter (see FRSP timing analysis):

Code Select Expand


80D: 7130: 11240.552 [CAPE] VSizeSetting Time:91 Acc:3181 loop:1
5D3: 13.715.002  ShootCaptu:ff213688:92:05: VSizeSetting Time:21 Acc:636 loop:1


5D3: Acc = 10000 * Time / 330, main clock = 24 MHz
timer A = 0x318 => one line read out in 0x318 / 24e6 = 33 microseconds
full image read out in 0xF76 * 33 = 130 ms
active area read out in 3870 * 33 = 127.7 ms

80D: Acc = 10000 * Time / 286 => one line read out in 28.6 microseconds
timer A = 0x304 => main clock = 27 MHz? (odd value)
timer B = 0xFDE => full image read out in 116 ms => 8.6 FPS theoretical limit.
Active area (6024 x 4022, from dcraw -i -v) read out in 115 ms.

I've expected the 80D sensor to be a little faster. Doesn't it do 1080p60 with Canon firmware? Tried to find out, but the values I've found in the ROM didn't make much sense to me, although they seemed to match the DIGIC 5 patterns at first sight; more details later.

[sombree]

Camera throws Err 70 when I've tried silent photo without turning live view before. No log or *.RAW file.
I've also tried it while staying in live view and movie mode - still no success, but camera doesn't lock up or throw an error.
Interesting thing - no error when taking silent photo without live view and with half-pressed shutter release button.
Logs.