Author Topic: Canon EOS 1300D / Rebel T6  (Read 115798 times)

critix

  • Contributor
  • Member
  • *****
  • Posts: 134
Re: Canon EOS 1300D / Rebel T6
« Reply #350 on: January 30, 2020, 01:43:05 PM »
I try to run in qemu ML on 1300D, but when I run
Code: [Select]
./run_canon_fw.sh 1300D, firmware="boot=1" I get the error
Quote
Model detection error.
If I run
Code: [Select]
./run_canon_fw.sh 1300D, firmware="boot=0" is ok.
I get the error after I commented on rom0_size in model_list.c
Comment out rom0_size in model_list.c. Will fix ASAP.
, because I received the error:
Quote
[EOS] mirrored data; unique 0x4 bytes repeated 0x800000 times
qemu-system-arm: /home/cristi/qemu-eos/qemu-2.5.0/hw/arm/../eos/eos.c:407: check_rom_mirroring: Assertion `0' failed.
./run_canon_fw.sh: line 153:   988 Aborted                 (core dumped) env QEMU_EOS_DEBUGMSG="$QEMU_EOS_DEBUGMSG" $QEMU_PATH/arm-softmmu/qemu-system-arm -drive if=sd,format=raw,file=sd.img -drive if=ide,format=raw,file=cf.img -chardev socket,server,nowait,path=qemu.monitor$QEMU_JOB_ID,id=monsock -mon chardev=monsock,mode=readline -name $CAM -M $*
Canon 1300D, 500D, EOS M, EOS M2

critix

  • Contributor
  • Member
  • *****
  • Posts: 134
Re: Canon EOS 1300D / Rebel T6
« Reply #351 on: January 31, 2020, 08:27:15 AM »
I run the
Code: [Select]
sure_copy_from_contrib.sh script and it is ok now.
Canon 1300D, 500D, EOS M, EOS M2

cin

  • New to the forum
  • *
  • Posts: 3
  • cin
Re: Canon EOS 1300D / Rebel T6
« Reply #352 on: February 07, 2020, 06:41:24 AM »
I ran the
Code: [Select]
sure_copy_from_contrib.sh script and it is ok now.

It's ready to use on 1300D?
Canon 1300D

critix

  • Contributor
  • Member
  • *****
  • Posts: 134
Re: Canon EOS 1300D / Rebel T6
« Reply #353 on: February 07, 2020, 12:22:43 PM »
ML is not running on 1300D yet.
Canon 1300D, 500D, EOS M, EOS M2

ROME

  • New to the forum
  • *
  • Posts: 2
Re: Canon EOS 1300D / Rebel T6
« Reply #354 on: February 12, 2020, 05:32:34 PM »
What else are we missing to keep the progress moving in the right direction?

Walter Schulz

  • Contributor
  • Hero Member
  • *****
  • Posts: 7067
Re: Canon EOS 1300D / Rebel T6
« Reply #355 on: February 12, 2020, 07:09:46 PM »
Unicorn level: A person skilled with C, assembler and reverse engineering embedded devices (ARM architecture) with lots of free time at hand.
Photogs and videographers: Assist in proof reading upcoming in-camera help!. Your input is wanted and needed!

critix

  • Contributor
  • Member
  • *****
  • Posts: 134
Canon 1300D, 500D, EOS M, EOS M2

rubiaso

  • New to the forum
  • *
  • Posts: 2
Re: Canon EOS 1300D / Rebel T6
« Reply #357 on: March 21, 2020, 01:37:50 PM »

alawiggle

  • New to the forum
  • *
  • Posts: 24

critix

  • Contributor
  • Member
  • *****
  • Posts: 134
Re: Canon EOS 1300D / Rebel T6
« Reply #359 on: March 30, 2020, 07:18:26 PM »
is good:
Quote
1. Corrects a PTP communications vulnerability.
2. Corrects a vulnerability related to firmware update.
Canon 1300D, 500D, EOS M, EOS M2

alawiggle

  • New to the forum
  • *
  • Posts: 24
Re: Canon EOS 1300D / Rebel T6
« Reply #360 on: March 31, 2020, 02:13:54 AM »
is good:

Are we still waiting on Alex? My understanding wa that we needed him to publish a .FIR file to set camera bootflag? That's the last I heard and why I haven't bothered with this thread in a year lol

critix

  • Contributor
  • Member
  • *****
  • Posts: 134
Re: Canon EOS 1300D / Rebel T6
« Reply #361 on: March 31, 2020, 10:40:01 AM »
We still do not need the FIR file for bootflag.
We must first solve the problems for this device.
Read:
https://www.magiclantern.fm/forum/index.php?topic=17969.msg211084#msg211084
The new firmware only solves some problems, but does not mean we can run ML on the 1300D.
I would have liked to be able to run ML, but it still has not succeeded (at least I can't) to solve the problem reported in the link above.
Maybe @a1ex can make a little time and help us, we can overcome this hop.
The same problem is with 2000D, 3000D, 4000D ...
Canon 1300D, 500D, EOS M, EOS M2

heder

  • Contributor
  • Freshman
  • *****
  • Posts: 69
  • No time for caution
Re: Canon EOS 1300D / Rebel T6
« Reply #362 on: March 31, 2020, 12:35:03 PM »
This one is hard to fix - branch instructions in ARM code cannot go "too far" (they are limited to +/- 32MB around the address of the branch instruction). Normally, the compiler takes care of this (e.g. by using long jumps or inserting veneers - intermediate jumps), but here we are patching existing binary code in the firmware, to jump to our code instead.

I couldn't find an easy fix for this one; while a long jump can be implemented, it may require patching 2 instructions for one function. It's doable though, and other cameras will benefit from this (60D, which has the same problem in some experimental branches, and maybe some newer models too).

On 1300D I'm afraid we can't just use the workaround for 60D (where we load ML at a different address in order to be able to patch things), so a proper fix will be required in order to get some useful debug logs.

I'll try, but the solution is not straightforward.

Previously covered in replies #120 and #239.

Edit: confirmed the dm-spy-experiments branch is not working, even with minimal logging options (dm_spy_extra* commented out).

Need to use a long jump for patching DebugMsg. It started to work - to some extent - with this:
Code: [Select]
        int err = patch_instruction(DebugMsg_addr, MEM(DebugMsg_addr), FAR_CALL_INSTR, "dm-spy: log all DebugMsg calls");
        err |= patch_instruction(DebugMsg_addr + 4, MEM(DebugMsg_addr + 4), &my_DebugMsg, "dm-spy: log all DebugMsg calls");

The semaphore error appears to come from beep() - somebody's calling that before beep_init. Disabled beeps, it went further.

When trying to save the log, it fails with:
Code: [Select]
[dm-spy] captured 128kB of messages
[NotifyBox] Pretty-printing... (128kB)
[     CtrlSrv:fe49c7fc ] (83:02) DlgShootOlc.c LOCAL_DIALOG_REFRESH
qemu: fatal: Trying to execute code outside RAM or ROM at 0x87274218

That was because I've patched two instructions from DebugMsg, to implement the long call, but when uninstalling the logging hook, I should have "unpatched" both instructions. Rookie mistake.

Now, the hard part - clean up the code and commit it :D

Still need to find a general solution for patching arbitrary functions in Canon code (i.e. to implement long jump support in the patch manager).

The firmware is located at the end, and ends at 0xFFFFFFFF

What happens if you try to jump over 0xFFFFFFFF (relative), do the address wrap into 0xxxxxxx ram ? (or do we get an exception, possibly yes ?)

But if we dont get an exception -  we could steal the first useable location in ram and make patch_instruction/gdb call this ram
function (using a single branch relative instruction). Then we could let this function analyze the lr and jump to the correct
location based on the lr value. This also requires that patch_instructions/gdb make a table of pc/lr's and where to jump to / jump back to
Embedded SW engineer. Current Cameras: Canon 20d, 40d, 350d

alawiggle

  • New to the forum
  • *
  • Posts: 24
Re: Canon EOS 1300D / Rebel T6
« Reply #363 on: March 31, 2020, 05:54:40 PM »
We still do not need the FIR file for bootflag.
We must first solve the problems for this device.
Read:
https://www.magiclantern.fm/forum/index.php?topic=17969.msg211084#msg211084
The new firmware only solves some problems, but does not mean we can run ML on the 1300D.
I would have liked to be able to run ML, but it still has not succeeded (at least I can't) to solve the problem reported in the link above.
Maybe @a1ex can make a little time and help us, we can overcome this hop.
The same problem is with 2000D, 3000D, 4000D ...


You've told me before Alex was necessary to solve this - now he may not be, just that he's currently the only one here who has the known how to?

heder

  • Contributor
  • Freshman
  • *****
  • Posts: 69
  • No time for caution
Re: Canon EOS 1300D / Rebel T6
« Reply #364 on: March 31, 2020, 06:35:56 PM »

You've told me before Alex was necessary to solve this - now he may not be, just that he's currently the only one here who has the known how to?

Wise words from Walter Schulz

Unicorn level: A person skilled with C, assembler and reverse engineering embedded devices (ARM architecture) with lots of free time at hand.

People with thsee skills (including myself) have wife, kids, boats, dogs, cats and a job and a lots of hobbies, amongst those one called ML. Guess the priority ..   :o
Embedded SW engineer. Current Cameras: Canon 20d, 40d, 350d

alawiggle

  • New to the forum
  • *
  • Posts: 24
Re: Canon EOS 1300D / Rebel T6
« Reply #365 on: April 06, 2020, 03:03:53 AM »
Wise words from Walter Schulz

People with thsee skills (including myself) have wife, kids, boats, dogs, cats and a job and a lots of hobbies, amongst those one called ML. Guess the priority ..   :o

Yes, I understand and I get it - but I was told that, specifically, Alex was the *only* one that could move this particular project forward. Now it seems this may not be the case? I'm just trying to determine if this is doable by somebody other than him. I understood that he had some "key" or some sort to the Canon firmware that was needed.

heder

  • Contributor
  • Freshman
  • *****
  • Posts: 69
  • No time for caution
Re: Canon EOS 1300D / Rebel T6
« Reply #366 on: April 06, 2020, 11:46:57 AM »
Yes, I understand and I get it - but I was told that, specifically, Alex was the *only* one that could move this particular project forward. Now it seems this may not be the case? I'm just trying to determine if this is doable by somebody other than him. I understood that he had some "key" or some sort to the Canon firmware that was needed.

Hes not the only one, but there are only a few of us with the rigth skills and time. Ok, I will take a look later this month, and try to get qemu running with a modifed patch instruction. My Main focus is however 40d.

First issue is getting qemu to run then later the bootflag issue., But i cant solve the last as i dont own that camera.
Embedded SW engineer. Current Cameras: Canon 20d, 40d, 350d

critix

  • Contributor
  • Member
  • *****
  • Posts: 134
Re: Canon EOS 1300D / Rebel T6
« Reply #367 on: April 06, 2020, 05:43:03 PM »
If you can help us with modifying patch instruction so we can start in qemu. I have 1300D and I want to continue with this project.
Thank you.
Canon 1300D, 500D, EOS M, EOS M2