How does the camera take a picture?

Started by a1ex, August 06, 2012, 11:12:37 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

a1ex

Like title says. What parts of Canon code are running when you take a pic?

Background:

The tasks which handle picture taking, including RAW/JPEG compression, vignette correction and dark frame subtraction are designed as state machines.

http://magiclantern.wikia.com/wiki/StateObjects
http://a1ex.bitbucket.io/ML/states/

Some examples from 5D2:

SCSState, take a pic:

(1) -- 17 scsReleaseOn        -->(1)
(1) --  1 scsReleaseStart     -->(2)
(2) --  2 scsReleaseData      -->(4)
(4) --  3 scsDummyCapEnd      -->(5)
(5) --  4 scsDummyReadoutDone -->(6)
(6) --  5 scsCapReady         -->(7)
(7) --  6 scsCapEnd           -->(8)
(8) -- 10 scsReleaseEnd       -->(8)
(8) -- 18 scsReleaseOff       -->(8)
(8) --  7 scsFinalReadoutDone -->(1)


SCSState, bulb pic:


(1)  --  1 scsReleaseStart    -->(2)  // tg start, lock engine resources...
(2)  --  2 scsReleaseData     -->(4)  // lots of initializations, iso, tv, av, tp, po, register head1 interrupt to dummy cap...
(4)  --  3 scsDummyCapEnd     -->(5)  // some engio; register head1 interrupt to dummy readout done
(5)  --  4 scsDummyReadoutDone-->(6)  // engio, decides between normal capture, srcapture or eshutcapture
(6)  --  5 scsCapReady        -->(10) // setup image pass, engio, head1 interrupt to CapEnd, register vd interrupt
(10) --  8 scsVdInterrupt     -->(10)
(10) --  8 scsVdInterrupt     -->(10) // calls GetImageBuffer and seems to re-setup the sensor (also setting the FPS override registers)
....                                  // so maybe a long exposure is done by adding a few short ones?!
(10) --  8 scsVdInterrupt     -->(10)
(10) -- 11 scsBulbEnd         -->(10) // scs_struct.bulb_end = 1 => this causes scsVdInterrupt to "stop accumulation" (whatever that means)
(10) --  8 scsVdInterrupt     -->(10) // stop accumulation => NotifyLastVdTimerCBR => post event 9 to something
(10) -- 10 scsReleaseEnd      -->(10) // scs_struct.release_end = 1
(10) --  9 scsCapReady        -->(7)
(7)  --  6 scsCapEnd          -->(8)  // register head1 to readout done, RealtimeDefectsGrade -> 0xC0F0814C, post event 0xB to something else
(8)  --  7 scsFinalReadoutDone-->(1)  // huge, probably does raw conversion, noise reduction...


2.5s pic with dark frame NR:


FSS  :(0)  --  7 fssSW1On            -->(0)
SBS  :(1)  -- 13 sbsIgnoreRelease    -->(1)
SCS  :(1)  --  1 scsReleaseStart     -->(2)
SCS  :(2)  --  2 scsReleaseData      -->(4)
SCS  :(4)  --  3 scsDummyCapEnd      -->(5)
FSS  :(0)  --  8 fssSW2On            -->(0)
SCS  :(5)  --  4 scsDummyReadoutDone -->(6)
SCS  :(6)  --  5 scsCapReady         -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(10) --  8 scsVdInterrupt      -->(10)
SCS  :(7)  -- 10 scsReleaseEnd       -->(7)
FSS  :(0)  --  9 fssSW2Off           -->(0)
SCS  :(10) --  9 scsCapReady         -->(7)
SCS  :(7)  --  6 scsCapEnd           -->(8)
SCS  :(8)  --  7 scsFinalReadoutDone -->(1)
SBS  :(1)  --  1 sbsPostJob?         -->(2)
SBS  :(2)  --  2 sbsPrepareDark      -->(3)
SBS  :(3)  --  3 sbsDummyCapEnd      -->(4)
SBS  :(4)  --  4 sbsDummyReadoutDone -->(5)
SBS  :(5)  --  5 sbsDark             -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  6 sbsVdInterrupt      -->(6)
SBS  :(6)  --  7 sbsLongSecondTimer  -->(7)
SBS  :(7)  --  8 sbsCapEnd           -->(8)
SBS  :(8)  --  9 sbsReadoutDone      -->(9)
SBS  :(9)  -- 10 sbsDarkSub          -->(10)
SBS  :(10) -- 11 sbsWbDetect         -->(11)
SBS  :(11) -- 12 sbsWbDetectDone     -->(1)
SPS  :(2)  --  2 spsPostJob          -->(3)
SPS  :(3)  --  3 spsStartProcess     -->(3)
SDSf1:(2)  --  2 sdsPostJob          -->(2)
SDSr :(2)  --  2 sdfGetDevelopDevType?->(5)
SPS  :(3)  --  4 spsStartProcess_main-->(2)
SDSf3:(0)  --  3 sdsMem1toRAWcompressg-->(1)
SDSf3:(1)  --  3 sdsMem1toJpegDevelop-->(1)
SDSr :(5)  --  5 sdsYuvToDcfCompression>(5)
SDSr :(5)  --  5                     -->(2)
FCS  :(1)  --  1 fcsPostJob          -->(1)
FCS  :(1)  --  2 fcsExecJob          -->(1)
FSS  :(0)  --  2 fssNotifyJob        -->(0)
FSS  :(0)  --  3 fssPostJob          -->(0)
FSS  :(0)  --  4 fssAvailable        -->(0)
FSS  :(0)  --  6 fssCompleteJob      -->(0)
FSS  :(0)  --  7 fssSW1On            -->(0)


Code for getting these logs (5D2 only!):

/**
* Experiments on state objects
*
* http://magiclantern.wikia.com/wiki/StateObjects
*
**/

#include "dryos.h"
#include "bmp.h"
#include "state-object.h"
#include "property.h"

// 550D:
//~ #define SCS_STATE (*(struct state_object **)0x31cc)
//~ #define SCSES_STATE (*(struct state_object **)0x31D0)
//~ #define SCSSR_STATE (*(struct state_object **)0x31D4)

// 5D2:
#define SCS_STATE (*(struct state_object **)0x3168)
#define SCSES_STATE (*(struct state_object **)0x316c)
#define SCSSR_STATE (*(struct state_object **)0x3170)

#define SBS_STATE (*(struct state_object **)0x31C4)
#define SDS_REAR_STATE (*(struct state_object **)0x363C)
#define SDS_FRONT1_STATE (*(struct state_object **)0x36B0)
#define SDS_FRONT2_STATE (*(struct state_object **)0x36B4)
#define SDS_FRONT3_STATE (*(struct state_object **)0x36B8)
#define SDS_FRONT4_STATE (*(struct state_object **)0x36BC)

#define SPS_STATE (*(struct state_object **)0x320C)
#define FSS_STATE (*(struct state_object **)0x3c24)
#define FCS_STATE (*(struct state_object **)0x3c34)

#define LOG_SIZE 10000
static char log[LOG_SIZE] = "";

static int (*StateTransition)(void*,int,int,int,int) = 0;
static int stateobj_spy(struct state_object * self, int x, int input, int z, int t)
{
    int old_state = self->current_state;
    int ans = StateTransition(self, x, input, z, t);
    int new_state = self->current_state;
   
    if (self == SBS_STATE) { STR_APPEND(log, "SBS  :"); }
    else if (self == SCS_STATE) { STR_APPEND(log, "SCS  :"); }
    else if (self == SCSES_STATE) { STR_APPEND(log, "SCSes:"); }
    else if (self == SCSSR_STATE) { STR_APPEND(log, "SCSsr:"); }
    else if (self == SDS_REAR_STATE) { STR_APPEND(log, "SDSr :"); }
    else if (self == SDS_FRONT1_STATE) { STR_APPEND(log, "SDSf1:"); }
    else if (self == SDS_FRONT2_STATE) { STR_APPEND(log, "SDSf2:"); }
    else if (self == SDS_FRONT3_STATE) { STR_APPEND(log, "SDSf3:"); }
    else if (self == SDS_FRONT4_STATE) { STR_APPEND(log, "SDSf4:"); }
    else if (self == SPS_STATE) { STR_APPEND(log, "SPS  :"); }
    else if (self == FSS_STATE) { STR_APPEND(log, "FSS  :"); }
    else if (self == FCS_STATE) { STR_APPEND(log, "FCS  :"); }
   
    STR_APPEND(log, "(%d) -- %2d -->(%d)\n", old_state, input, new_state);
   
    return ans;
}

static int stateobj_start_spy(struct state_object * stateobj)
{
    if (!StateTransition)
        StateTransition = (void *)stateobj->StateTransition_maybe;
   
    else if ((void*)StateTransition != (void*)stateobj->StateTransition_maybe) // make sure all states use the same transition function
    {
        beep();
        return;
    }
  stateobj->StateTransition_maybe = (void *)stateobj_spy;
  return 0; //not used currently
}

static void shootspy_init(void* unused)
{
    log[0] = 0;
    stateobj_start_spy(SCS_STATE);
    stateobj_start_spy(SCSES_STATE);
    stateobj_start_spy(SCSSR_STATE);
    stateobj_start_spy(SBS_STATE);
    stateobj_start_spy(SDS_REAR_STATE);
    stateobj_start_spy(SDS_FRONT1_STATE);
    stateobj_start_spy(SDS_FRONT2_STATE);
    stateobj_start_spy(SDS_FRONT3_STATE);
    stateobj_start_spy(SDS_FRONT4_STATE);
    stateobj_start_spy(SPS_STATE);
    stateobj_start_spy(FSS_STATE);
    stateobj_start_spy(FCS_STATE);
}

void save_log()
{
    NotifyBox(1000, "%d ", strlen(log));
    FILE* f = FIO_CreateFileEx(CARD_DRIVE"shoot.log");
    FIO_WriteFile(f, UNCACHEABLE(log), strlen(log));
    FIO_CloseFile(f);
    beep();
}

INIT_FUNC("shootspy_init", shootspy_init);


What does it mean, in plain English?

* Bulb exposure seems to be done in small steps (smaller exposures added digitally). Not yet sure, but if it's true, it can be used to implement a lot of things from feature requests area.
* Dark frame duration can probably be controlled by user. That would mean, 5-minute exposure and 10-second dark frame. Could this be useful?
* Maybe understanding how to take pics without moving the shutter mechanism? This would be huge!


3pointedit

No mechanical shutter that is the first benefit I thought of. Isn't that another 5D mkIII feature? Quite shooting mode (it needs it too, so clunky).
Dark frame sets equal exposure for accurate noise accumulation to subtract doesn't it? Really worth modifying to improve intervalometer exposures.

Well if the long exposure is just an accumulation of shorter exposures, can that be interrupted to produce multiple exposures? That is kill accumulation of image and re-trigger image capture (without mechanical shutter).

Sounds so exciting a1ex, hope something comes from it.
550D on ML-roids

ilguercio

Quiet shooting mode is another thing and that involves lifting the mirror before the shutter to redure the overall generated noise.
Being able to take pictures in LV without the shutter would be... revolutionary ;)
Canon EOS 6D, 60D, 50D.
Sigma 70-200 EX OS HSM, Sigma 70-200 Apo EX HSM, Samyang 14 2.8, Samyang 35 1.4, Samyang 85 1.4.
Proud supporter of Magic Lantern.

g3gg0

thanks alex,
a really useful log :)

i just looked deeper into movie recording state machine.
i think i will apply your logging routines to the movierecorder also.
especially file opening and closing is some unclear stuff.

br,
g3gg0
Help us with datasheets - Help us with register dumps
magic lantern: 1Magic9991E1eWbGvrsx186GovYCXFbppY, server expenses: [email protected]
ONLY donate for things we have done, not for things you expect!

scrax

What about 0 time pics? Also for noise reduction.
I'm using ML2.3 for photography with:
EOS 600DML | EOS 400Dplus | EOS 5D MLbeta5- EF 100mm f/2.8 USM Macro  - EF-S 17-85mm f4-5.6 IS USM - EF 70-200mm f/4 L USM - 580EXII - OsX, PS, LR, RawTherapee, LightZone -no video experience-

3pointedit

g3gg0 I wondered if it is possible to switch WB or Picture Style in movie mode like HDr adjusts ISO? As there is an autowhite balance already I thought it could call presets too.

But yes, multiple clip opening would be very neat for continuous recording sessions.
550D on ML-roids

g3gg0

you mean, switching WB/Picstyle on a per-frame basis?
what use is that for?
Help us with datasheets - Help us with register dumps
magic lantern: 1Magic9991E1eWbGvrsx186GovYCXFbppY, server expenses: [email protected]
ONLY donate for things we have done, not for things you expect!

3pointedit

I recently used the HDR video feature to record an interior exposure and an exterior exposure, then I performed a psuedo iris pull (really ISO pull) in post to nail the right time to change the exposure.

It would be nice to record 2 white balance options in frame. That is to adjust WB on the fly between to locations or within the frame, between extreme WB values. As the recording format is a meagre 8bit h264, it does not grade well (luma ok, chroma hardly at all!), so having baked in choice (on alternating frames) would be nice.
550D on ML-roids

1%

What is being loaded from bin?


F08B310: 'WbDetection Complete(%d)' FF08B254
FF08B6E8: '->sbsWbDetect(%d):%#lx' FF08B380
FF08B708: '->sbsWbDetectDone(%d):%#lx' FF08B4F8
FF08B73C: '!!!!! WBB ExtractStageJob(%d)' FF08B6CC
FF08BA1C: '->sbsIgnoreRelease' FF08B7E4
FF08BA34: '->sbsDarkRelease(%d):%#lx' FF08B840
FF08BA54: '->sbsWbRelease(%d):%#lx' FF08B8E8
FF08BA78: '->sbsIgnore(%d) Current=%d' FF08B9F0
FF08BC24: 'sbsExit' FF08BAB8
FF08C0AC: 'WB RectH:(%d, %d)' FF08BD00
FF08C0C0: 'WB RectV:(%d, %d)' FF08BD14
FF08C0D4: 'WB Limit:(H:%d) (L:%d) )' FF08BD3C
FF08C0F0: 'WB R =%d' FF08C048
FF08C0FC: 'WB G1=%d' FF08C060
FF08C108: 'WB G2=%d' FF08C078
FF08C114: 'WB B =%d' FF08C090
FF08C424: 'WB Num=%d' FF08C148
FF08C430: 'WB R =%d(%d)' FF08C1A8
FF08C440: 'WB G1=%d(%d)' FF08C1D4
FF08C450: 'WB G2=%d(%d)' FF08C200
FF08C460: 'WB B =%d(%d)' FF08C22C
FF08C470: 'BLKITG%02d.BIN' FF08C25C
FF08C480: 'FileCreateError\n' FF08C288
FF08C498: 'FileWriteError\n' FF08C34C
FF08C4A8: 'WS%02d.BIN'

g3gg0

nothing.
if you enable the flag at this location:
LDR     R11, =unk_3564
LDR     R0, [R11,#0x30]

the camera will write two files on shooting:
http://upload.g3gg0.de/pub_files/24765bcf500210a789475f646b002805/BLKITG01.BIN
http://upload.g3gg0.de/pub_files/60415441719ef3b7bd40e50d40c2c925/WS01.BIN

not sure what they contain. its something from 0x40........ area, maybe some defects data or such.
Help us with datasheets - Help us with register dumps
magic lantern: 1Magic9991E1eWbGvrsx186GovYCXFbppY, server expenses: [email protected]
ONLY donate for things we have done, not for things you expect!

g3gg0

alex, can you do one try again with mirror lockup enabled? :)
Help us with datasheets - Help us with register dumps
magic lantern: 1Magic9991E1eWbGvrsx186GovYCXFbppY, server expenses: [email protected]
ONLY donate for things we have done, not for things you expect!

a1ex

Yep.

1/30, ISO 6400 D+, dark frame, MLU:

FSS  :(0)  --  7 fssSW1On            -->(0)
SBS  :(1)  -- 13 sbsIgnoreRelease    -->(1)
SCS  :(1)  --  1 scsReleaseStart     -->(2)
SCS  :(2)  --  2 scsReleaseData      -->(4)
SCS  :(4)  --  3 scsDummyCapEnd      -->(5)
FSS  :(0)  --  8 fssSW2On            -->(0)
SCS  :(5)  --  4 scsDummyReadoutDone -->(6)
SCS  :(6)  --  5 scsCapReady         -->(7)
SCS  :(7)  --  6 scsCapEnd           -->(8)
SCS  :(8)  -- 10 scsReleaseEnd       -->(8)
FSS  :(0)  --  9 fssSW2Off           -->(0)
SCS  :(8)  --  7 scsFinalReadoutDone -->(1)
SBS  :(1)  --  1 sbsPostJob?         -->(1)
SPS  :(2)  --  2 spsPostJob          -->(3)
SPS  :(3)  --  3 spsStartProcess     -->(3)
SDSf1:(2)  --  2 sdsPostJob          -->(2)
SDSr :(2)  --  2 sdfGetDevelopDevType?->(5)
SPS  :(3)  --  4 spsStartProcess_main-->(2)
SDSf3:(0)  --  3 sdsMem1toRAWcompressg-->(1)
SDSf3:(1)  --  3 sdsMem1toJpegDevelop-->(1)
SDSr :(5)  --  5 sdsYuvToDcfCompression>(5)
SDSr :(5)  --  5                     -->(2)
FCS  :(1)  --  1 fcsPostJob          -->(1)
FCS  :(1)  --  2 fcsExecJob          -->(1)
FSS  :(0)  --  2 fssNotifyJob        -->(0)
FSS  :(0)  --  3 fssPostJob          -->(0)
FSS  :(0)  --  4 fssAvailable        -->(0)
FSS  :(0)  --  6 fssCompleteJob      -->(0)
FSS  :(0)  --  7 fssSW1On            -->(0)

g3gg0

Help us with datasheets - Help us with register dumps
magic lantern: 1Magic9991E1eWbGvrsx186GovYCXFbppY, server expenses: [email protected]
ONLY donate for things we have done, not for things you expect!

a1ex

Got a more complex log:

FSS  :(0) --  7 -->(0)
  x:682D28:{'Fstorage' 682DB0:{'StageClass' 'Fstorage' 1 DA0024 ... } 682D84:{'StateObject' 'FSSState' 0 892DC ... } 158 ... }
  z:0
  t:0
SBS  :(1) -- 13 -->(1)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SCS  :(1) --  1 -->(2)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 0; vd count: 7
SCS  :(2) --  2 -->(4)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:40949e0c
  t:37
fps timer: 0; vd count: 7
SCS  :(4) --  3 -->(5)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 0; vd count: 7
FSS  :(0) --  8 -->(0)
  x:682D28:{'Fstorage' 682DB0:{'StageClass' 'Fstorage' 1 DA0024 ... } 682D84:{'StateObject' 'FSSState' 0 892DC ... } 158 ... }
  z:515F1A:{1050000 1000003 0 0 ... }
  t:0
SCS  :(5) --  4 -->(6)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 9
SCS  :(6) --  5 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 9
SCS  :(10) --  8 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 8
SCS  :(10) --  8 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 7
SCS  :(10) --  8 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 6
SCS  :(10) --  8 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 5
SCS  :(10) --  8 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 4
SCS  :(10) --  8 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 3
SCS  :(10) --  8 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 2
SCS  :(10) --  8 -->(10)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 1
SCS  :(10) --  9 -->(7)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 1
SCS  :(7) --  6 -->(8)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 1
SCS  :(8) -- 10 -->(8)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 1
FSS  :(0) --  9 -->(0)
  x:682D28:{'Fstorage' 682DB0:{'StageClass' 'Fstorage' 1 DA0024 ... } 682D84:{'StateObject' 'FSSState' 0 892DC ... } 158 ... }
  z:0
  t:5E38:{B401F1:{fd5fdfdc 9f7fd76d 5f9ffbd8 57ffeffd ... } BB0231:{3fffdbbf d5fd1fdf 7df9bf5d df564db7 ... } C2026C:{fffdffff ffebeaef afe3be7e afaeffff ... } CA02A6:{aecfff3b bfbbedef feaeffff 7fdfefbf ... } ... }
SCS  :(8) --  7 -->(1)
  x:63FEC4:{'ShootCapture' 7 63FF7C:{'StageClass' 'ShootCapture' 1 98001C ... } 63FEF8:{'StateObject' 'SCSState' 0 892DC ... } ... }
  z:0
  t:0
fps timer: 4004; vd count: 1
SBS  :(1) --  1 -->(2)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:42000064
  t:4
SBS  :(2) --  2 -->(3)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:48000064
  t:25d0000
SBS  :(3) --  3 -->(4)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(4) --  4 -->(5)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(5) --  5 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  6 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  6 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  6 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  6 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  6 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  6 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  6 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  6 -->(6)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(6) --  7 -->(7)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(7) --  8 -->(8)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(8) --  9 -->(9)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(9) -- 10 -->(10)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(10) -- 11 -->(11)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SBS  :(11) -- 12 -->(1)
  x:681594:{'ShootBlack' 7f9797ff 6815EC:{'StageClass' 'ShootBlack' 1 C8001E ... } 6815C0:{'StateObject' 'SBSState' 0 892DC ... } ... }
  z:0
  t:0
SPS  :(2) --  2 -->(3)
  x:681860:{'ShootPreDevelop' 3f4c77ff 6818B4:{'StageClass' 'ShootPreDevelop' 1 CE0020 ... } 681888:{'StateObject' 'SPSState' 0 892DC ... } ... }
  z:42000064
  t:4
SPS  :(3) --  3 -->(3)
  x:681860:{'ShootPreDevelop' 3f4c77ff 6818B4:{'StageClass' 'ShootPreDevelop' 1 CE0020 ... } 681888:{'StateObject' 'SPSState' 0 892DC ... } ... }
  z:0
  t:0
SDSf1:(2) --  2 -->(2)
  x:702F20:{'FrontShtDevelop' 101 702FF8:{'StageClass' 'FrontShtDevelop' 1 72a002c ... } 702F48:{'StateObject' 'SDSFrontState' 0 892DC ... } ... }
  z:42000064
  t:4
SDSr :(2) --  2 -->(5)
  x:703264:{'RearShtDevelop' 0 7032B8:{'StageClass' 'RearShtDevelop' 1 72e002e ... } 70328C:{'StateObject' 'SDSRearState' 0 892DC ... } ... }
  z:42000064
  t:4
SPS  :(3) --  4 -->(2)
  x:681860:{'ShootPreDevelop' 3f4c77ff 6818B4:{'StageClass' 'ShootPreDevelop' 1 CE0020 ... } 681888:{'StateObject' 'SPSState' 0 892DC ... } ... }
  z:0
  t:0
SDSf3:(0) --  3 -->(1)
  x:702F20:{'FrontShtDevelop' 101 702FF8:{'StageClass' 'FrontShtDevelop' 1 72a002c ... } 702FA0:{'StateObject' 'SDSFrontState' 0 892DC ... } ... }
  z:MemSuite(1,4976439)=>A:/0-0.dat
  t:80000003
SDSf3:(1) --  3 -->(1)
  x:702F20:{'FrontShtDevelop' 101 702FF8:{'StageClass' 'FrontShtDevelop' 1 72a002c ... } 702FA0:{'StateObject' 'SDSFrontState' 0 892DC ... } ... }
  z:MemSuite(1,1167015)=>A:/1-0.dat
  t:80000003
SDSr :(5) --  5 -->(5)
  x:703264:{'RearShtDevelop' 0 7032B8:{'StageClass' 'RearShtDevelop' 1 72e002e ... } 70328C:{'StateObject' 'SDSRearState' 0 892DC ... } ... }
  z:0
  t:80000006
SDSr :(5) --  5 -->(2)
  x:703264:{'RearShtDevelop' 0 7032B8:{'StageClass' 'RearShtDevelop' 1 72e002e ... } 70328C:{'StateObject' 'SDSRearState' 0 892DC ... } ... }
  z:MemSuite(1,8054)=>A:/2-0.dat
  t:80000003
FCS  :(1) --  1 -->(1)
  x:78D7D8:{'Fcreate' 78E51C:{'StageClass' 'Fcreate' 1 874005a ... } 78E4F0:{'StateObject' 'FCSState' 0 892DC ... } 157 ... }
  z:42000064
  t:4
FCS  :(1) --  2 -->(1)
  x:78D7D8:{'Fcreate' 78E51C:{'StageClass' 'Fcreate' 1 874005a ... } 78E4F0:{'StateObject' 'FCSState' 0 892DC ... } 157 ... }
  z:0
  t:0
FSS  :(0) --  2 -->(0)
  x:682D28:{'Fstorage' 682DB0:{'StageClass' 'Fstorage' 1 DA0024 ... } 682D84:{'StateObject' 'FSSState' 0 892DC ... } 158 ... }
  z:42000064
  t:4
FSS  :(0) --  3 -->(0)
  x:682D28:{'Fstorage' 682DB0:{'StageClass' 'Fstorage' 1 DA0024 ... } 682D84:{'StateObject' 'FSSState' 0 892DC ... } 158 ... }
  z:42000064
  t:4
FSS  :(0) --  4 -->(0)
  x:682D28:{'Fstorage' 682DB0:{'StageClass' 'Fstorage' 1 DA0024 ... } 682D84:{'StateObject' 'FSSState' 0 892DC ... } 158 ... }
  z:42000064
  t:5190b7f0
FSS  :(0) --  6 -->(0)
  x:682D28:{'Fstorage' 682DB0:{'StageClass' 'Fstorage' 1 DA0024 ... } 682D84:{'StateObject' 'FSSState' 0 892DC ... } 158 ... }
  z:42000064
  t:0
FSS  :(0) --  7 -->(0)
  x:682D28:{'Fstorage' 682DB0:{'StageClass' 'Fstorage' 1 DA0024 ... } 682D84:{'StateObject' 'FSSState' 0 892DC ... } 158 ... }
  z:0
  t:0

a1ex

Some success with overriding shutter speed (5D3 113).

In ./Param/AccumulateTime.c, it says something like:

if arg0 <= 160:
    return *(0xFF9268B4 + 4*arg0)

From 0xFF9268B4 (that is, arg0=16), there starts an array with timer values, from 32320 down to 10, probably miliseconds.

16 and 160 are the shutter codes for 32" and 1/8000, so this array is indexed by lens_info.raw_shutter.

If you patch this table like this:

    uint32_t a = 0xFF9268B4 + 4 * lens_info.raw_shutter;
    uint32_t v = MEM(a);
    cache_fake(a, v/2, TYPE_DCACHE);


then, for a 5-second exposure you will get a picture identical to a 2.5-second exposure. The shutter mechanism is still actuated for 5 seconds.

At 1 second patched, the picture is a little bit brighter than at 0.5s unpatched. At 1/10 patched, the brightness in the picture is no longer uniform.

If you patch with v*2 instead of v/2, for a 5s exposure, the brightness does not change, the shutter is still actuated for 5s, but the display says BUSY for another 5 seconds.

I hoped to get arbitrary shutter speed values (this would reduce bulb ramping flicker a lot).

a1ex

From SCS state it's possible to override ISO in very fine steps.

e.g. MEM(0xc0f08030) = 1000 will underexpose by around 2 EV.

=> flicker-free bulb ramping for the entire shutter speed range is now possible?

a1ex

SDSf3:(0)  --  3 sdsMem1toRAWcompress-->(1)

Here, parameter z from the state object routine is a memsuite; initial size (before the call) is 0x2880000 (42MB), after the call, it shrinks to around 20MB. I believe it contains lossless JPEG data (compressed RAW). Signature: FFD8FFC4 (huffman compression).

SDSf3:(1)  --  3 sdsMem1toJpegDevelop-->(1)

Here, z is again a memsuite, initial size is 0xb58000 (11MB) and it shrinks to around 500K. It looks like JPEG data (FFD8FFDB).

a1ex

14-bit data found at EDMAC #10 (0x4000048) on 5D2 :)

[TTJ] START RD1:0x4000048 RD2:0x64d1864

1%

So this is that shutter table the functions talk about? Maybe can override for 1/8k or at least longer bulb.


a1ex

Overriding at fast shutter speed didn't work. For bulb ramping I can just tweak the ISO to account for 1/8 EV steps and remove most of the flicker.

The 14-bit data is gold mine for RAW histogram and zebras.

g3gg0

Help us with datasheets - Help us with register dumps
magic lantern: 1Magic9991E1eWbGvrsx186GovYCXFbppY, server expenses: [email protected]
ONLY donate for things we have done, not for things you expect!

a1ex

No idea, the channels are camera-specific, and I've only looked at 5D2.

Des219

Since this is about how the camera takes the picture, is it possible to control ISO for each pixel?  For example the dual_iso feature alternates lines with a whole row being ISO setting 1 and the next ISO setting 2.  So is it possible to change the sensitivity of the pixel for each pixel dependent on the scene?  Like sections where the white is clipping automatically decrease the sensitivity and where the pixels are reading no signal to increase the sensitivity.

Challenge would be not to make it too flat, and of course to program it.  I was trying to follow the code that 1% developed and was not able to determine if pixel level is possible.  Also this would have to be a two step process; read an image determine the problem spots, adjust each pixel and take the picture.

g3gg0

Help us with datasheets - Help us with register dumps
magic lantern: 1Magic9991E1eWbGvrsx186GovYCXFbppY, server expenses: [email protected]
ONLY donate for things we have done, not for things you expect!

Des219


dmilligan


Des219

Thanks for sharing.  It brings up two things; one I am amazed at what is unveiled here, two I see the mention of only two cameras that are capable of this because of the dual channel, but I thought the team cracked more cameras so how did they do that?

Audionut

The answer will be in here somewhere:  http://www.magiclantern.fm/forum/index.php?topic=7139.0   ;D

Finer control of the sensor readout would be a godsend.  From what I understand, just slowing the readout speed reduces noise.

dmilligan

Quote from: Des219 on February 07, 2014, 04:59:19 AM
but I thought the team cracked more cameras so how did they do that?
There were only two cameras with the repeating values for the CMOS register that were aligned on 4bit values so the repeating nature was obvious when looking at it in hex: 0x11x, 0x22x, 0x33x, etc. All of the cameras have duplicated values though, they just might only be 3 bits for example. The pattern is obvious if you look at them in binary, but might not be so apparant from the hex:
001|001|000 => 0x48
010|010|000 => 0x90
011|011|000 => 0xD8
100|100|000 => 0x120
etc.
It took a little while for this to be noticed.

Des219

Quote from: dmilligan on February 07, 2014, 12:57:32 PM
The pattern is obvious if you look at them in binary, but might not be so apparant from the hex:

Good find by the team.  It is surprising how different each camera models are.  Is it not even consistent from DIGIC processor versions?  From a Canon development standpoint you would think they would standardize.

a1ex


a1ex


a1ex


a1ex

Very detailed image capture log from 5D2 (thanks reddeercity):

Quote from: reddeercity on August 06, 2018, 06:50:20 AM
Ran the io-trace-full outside of Liveview , here's the dm-0000_io-trace-full-outside-liveview-8-5-2018.log (for those just joining in it's from 5D2)
Looks much better ! closer to the dm-spy but many more MMIO logging , it took a long time just to quickly look though it .