How does the camera take a picture?

[dmilligan]

Thanks, too bad.

If you haven't already, read this, it explains a whole lot: http://acoutts.com/a1ex/dual_iso.pdf

[Des219]

Thanks for sharing.  It brings up two things; one I am amazed at what is unveiled here, two I see the mention of only two cameras that are capable of this because of the dual channel, but I thought the team cracked more cameras so how did they do that?

[Audionut]

The answer will be in here somewhere:  http://www.magiclantern.fm/forum/index.php?topic=7139.0   

Finer control of the sensor readout would be a godsend.  From what I understand, just slowing the readout speed reduces noise.

[dmilligan]

but I thought the team cracked more cameras so how did they do that?

There were only two cameras with the repeating values for the CMOS register that were aligned on 4bit values so the repeating nature was obvious when looking at it in hex: 0x11x, 0x22x, 0x33x, etc. All of the cameras have duplicated values though, they just might only be 3 bits for example. The pattern is obvious if you look at them in binary, but might not be so apparant from the hex:
001|001|000 => 0x48
010|010|000 => 0x90
011|011|000 => 0xD8
100|100|000 => 0x120
etc.
It took a little while for this to be noticed.

[Des219]

The pattern is obvious if you look at them in binary, but might not be so apparant from the hex:

Good find by the team.  It is surprising how different each camera models are.  Is it not even consistent from DIGIC processor versions?  From a Canon development standpoint you would think they would standardize.

[a1ex]

A fairly complete log from 550D:

550D-takepic.LOG

[a1ex]

QEMU log from 60D (full-res silent picture):

qemu-60D-FA_CaptureTestImage.log

[a1ex]

Some capture logs from 5D3:

5D3-picture-engio.LOG
5D3-startup-eeko-rawdev-takepic-edmac.LOG

See also these graphs showing EDMAC activity and read/write addresses.

[a1ex]

Very detailed image capture log from 5D2 (thanks reddeercity):

Ran the io-trace-full outside of Liveview , here's the dm-0000_io-trace-full-outside-liveview-8-5-2018.log (for those just joining in it's from 5D2)
Looks much better ! closer to the dm-spy but many more MMIO logging , it took a long time just to quickly look though it .