DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2)

[feedrail]

Ive used ML on my t2i for years and loved it, now I want to do my part and bring ML to my t7i. Point me in the right direction and a few do's and don't s and I'll do whatever I can. I had some coding years ago vb+, c++, java. I don't know it that will be any use but I'm willing and want to try.

(was: Newbie Here wantingg to help on 800d)

[a1ex]

A few days ago I've tried to find the LED address on a 77D (also digic 7), on IRC, without success. If you want to try the same steps, just get in touch with me.

The good news is that we can run code on the camera. The next step would be to produce some sort of side effects (such as LED blinks, or even variations in power consumption, that can be noticed with a multimeter).

What we know about D7 can be found on the EOS M5 thread, but that model runs PowerShot firmware. It's very likely a dual-core Cortex A9, with MMU, and runs Thumb-2 code (therefore, we might have some luck matching code patterns from some D6 models).

Caching issues (not yet solved on D6) are probably similar (that is, once it's solved for one model, it will very likely apply to all others).

[GabrielJLozano]

So I tried looking all over the forums and the only information I could find about anyone even remotely talking about working on the t7i is this thread. Is anyone trying to port it at all? I'd love to help as well so long as someone points me in the right direction.

[Walter Schulz]

Read the post above yours.

[a1ex]

Some of the easier things you can do to help, in order of increasing difficulty:

- wait for a firmware update
- open your camera and take high-resolution pictures of the mainboard
- hook a multimeter / Arduino / oscilloscope / whatever to an external power supply (see above)
- find some UART or JTAG port and attempt to communicate with it
- read the Cortex A9 manuals and the PowerShot ROM dumps (CHDK forum), then suggest things to try running on the camera, in order to get any kind of side effects (LED blinks, display activity, writing to SD, variations in power draw)

If you want to run your own code on the camera, I recommend starting from either recovery or digic6-dumper branches. However, you'll need to sign the code, and the tools for doing that are not public, but I can help with that - just drop me a PM.

Good luck!

[A8M]

Okay.  Just got off the phone with Canon.  No good news.  According to their techs, the company has NO PLANS to release a firmware update for this model until 2019!!!  Could be a lie, but if it is, the company's personnel told it.  Sucks to be us I guess as the new kids on the block.

Having said that, is it still possible to go forward and try to figure out a ML for this model?  I'm somewhat skeptical it will happen since the T6i hasn't had any good luck thus far, along with other models that have been out there on the block longer than this one with the newer chipsets.  Al3x has already said he isn't going to invest the time/energy into building newer model MLs from scratch leaving the burden on others, but most of us are just not coders/assemblers/hackers like that.  At most I think you have more script kiddies at the site's disposal than actual hardcore coders that know enough C++, Python, or Linux enough to be viable.  If I had 2 of these I'd be willing to try, but with only one as my daily driver for projects I can't afford a brick tinkering with it.   

I've trolled a little bit in the forums trying to see if there were any people actively figuring this out and so far there hasn't been a lot of discussion threads about the 800D.  But from what I've seen this is all I've been able to answer:
1.  Chipset is Digic7.  Haven't found on the forums yet whether or not there is a specific dumper for this digic, as what digic6 has.
2.  Can't open the camera to take pics of the hardware; don't have the right bits for these screws and that's sad considering I tried 25 different pieces.
3.  Dont have a  multimeter / Arduino / oscilloscope / whatever to hook to an external power supply.
4.  JTAG port can't say yay or nay because of #2. 

[TheCallumP]

Is there a version of ML that can be used with this camera? I bought this camera for content creation not realising that it doesn't offer a clean HDMI output ('clean' in the respect that it hides all of the on-screen information). I literally have everything set up, but could not for the life of me figure out a way to hide the on-screen information...until I found Magic Lantern. Sadly, I've found that my camera is not supported.

Are there any plans to support this camera, or is there a version that I can use that will work with my 200D? Sorry if either of these are dumb questions, I'm completely new to this and am grasping at straws here.

Many thanks.

[Walter Schulz]

Short A: No.

Long A:
There is no such thing as project management, masterplan, schedule in ML development. If someone takes up the task of porting a cam it's a start. But again: That's not a promise you will see a port going "full ML" at a given time or at all.
At time of writing there are serious efforts to port ML to cams housing Digic 6 processors. But 200D doesn't run on Digic 6 but Digic 7. And porting ML to an unknown processor generation is a very hard task to master.
And dev time is sparce. Devs made it pretty clear they will help in development for new ports but do not have the time to maintain newer cams. Each and every cam needs a maintainer for long time support.


My general advice: If there is no ML port for your cam act like there will be no ML for your cam ever.

Or you have a spare dev at hand: Skilled in embedded devices (preferable ARM architecture), assembler and C programming. And some time to waste.

[TheCallumP]

Thank you for taking the time to respond, I appreciate it. Bummer, but totally understandable. 

Are there any alternatives to ML that I may be unaware of? Literally all I'm looking for is a way to turn off the on-screen overlay entirely.

[dfort]

This is the least expensive of the Digic 7 DSLR's.

Would asking for a ROM dumper be unreasonable? Maybe Digic 7 code isn't all that different from Digic 6?

[a1ex]

Answered at http://www.magiclantern.fm/forum/index.php?topic=19737.

[deathline]

Answered at http://www.magiclantern.fm/forum/index.php?topic=19737.

Canon released a firmware update for eos 200d but Firload can't decrypt it.Is another solution is avaible?

http://gdlp01.c-wss.com/gds/8/0400003508/01/v101-sl2-200d-x9-win.zip

[a1ex]

Dual-core Cortex A9 (just like M5). The firmware is still based on the EOS codebase and doesn't look too different from DIGIC 6.

Main firmware: 0xE0040000, starts as Thumb, entry point code different from D6.
Bootloader: no idea how it looks like, we'll need to run some code blindly until we manage to dump its contents.
MPU (microcontroller) present (similar to other EOS models, same interrupts as D6, didn't look further).
MMU (memory management unit) present (likely configured in the same way as M5).
All previous Canon models use a MPU - memory protection unit (not to be confused with the microcontroller with the same name). D7 uses a MMU instead.
Interrupt system: same as D6.
Some DryOS tasks are starting with single-core emulation (unlike 7D/7D2), even with this (incomplete) ROM.
The DryOS shell works out of the box!

Code: [Select]

K417 READY
K417 ICU Firmware Version 1.0.1 ( 5.0.2 )
ICU Release DateTime 2017.09.21 12:53:23

Open Console K417[1]>...

Dry[MusaPUX]> ?
[Kern]
 extask  memmap  meminfo  mkcfg  dminfo  exobjinfo  stdlibcfg  efatcfg
 sysvers  xd  xm  prio  resume  suspend  release  sem  mutex  event  mq  exit

Dry[MusaPUX]> sysvers
SystemIF 0.88
DRYOS version 2.3, release #0059+p4
 MACH 0.83+p1

WLAN led at 0xD2080190: 0x20D0002 (on), 0x20C0003 (off)
Could not find the SD card led yet.

There are many early tests I can run with the above knowledge, on any DIGIC 7 model:
- blink the LED
- identify the SD card LED (we did that on DIGIC 6)
- dump the bootloader using CHDK soundcard method (requires extra hardware)
- attempt to jump to main firmware (assuming it's the same as D6)

Ready to try?

[a1ex]

6D Mark II also has a firmware update available (just noticed it):

Code: [Select]

K406 READY
K406 ICU Firmware Version 1.0.3 ( 6.4.4 )
ICU Release DateTime 2017.08.28 12:49:25

Dry[MusaPUX]> sysvers
SystemIF 0.88
DRYOS version 2.3, release #0059+p4
 MACH 0.83+p1

WLAN led not found (does it have one?)

[grtor]

No, the 6dii doesn't have a WLAN led only an SD card led

[a1ex]

Tried scanning 0xD2080000 - 0xD2081FFC and 0xD2080000 - 0xD20BFFFC on a 77D, with led_on = 0x20D0002 and led_off = 0x20C0003 (based on the above info). No success.

Would be helpful (for all D7 models) if a 200D owner would be willing to run the LED blinking test, since it's the only model with a known LED address.

[deathline]

Tried scanning 0xD2080000 - 0xD2081FFC and 0xD2080000 - 0xD20BFFFC on a 77D, with led_on = 0x20D0002 and led_off = 0x20C0003 (based on the above info). No success.

Would be helpful (for all D7 models) if a 200D owner would be willing to run the LED blinking test, since it's the only model with a known LED address.

Is  this https://www.magiclantern.fm/forum/index.php?topic=2296.0 generic one?

[a1ex]

No, it would be a FIR crafted specifically for this camera (I can create one on request).

Source: https://bitbucket.org/hudson/magic-lantern/src/digic6-dumper/src/reboot-dumper.c

[gunny2k6]

Interesting Topic to read ML is already maybe possible on DIGIC 7... traded my 450D for a 77D and wasnt even thinking of asking about ML running on it at all as the work on the DIGI 6 is still ongoing

[deathline]

No, it would be a FIR crafted specifically for this camera (I can create one on request).

Source: https://bitbucket.org/hudson/magic-lantern/src/digic6-dumper/src/reboot-dumper.c

Hi alex, you can send me blink test for eos200d, i will try it

[DieHertz]

I have a 6D2, is there anything I could help with without taking the camera apart? :-)

[topit1972]

Wish i had researched my camera, 200D, prior to buying.  This 29min is a real paid as i record and manage a band.  I had a Sony HVR 5ZE Pro cam, but having to use MiniDV tapes was a pain, so thought i'd go digital not knowing the 29min cap!

Pity there isn't a generic one for 200D

Is there a version of ML that can be used with this camera? I bought this camera for content creation not realising that it doesn't offer a clean HDMI output ('clean' in the respect that it hides all of the on-screen information). I literally have everything set up, but could not for the life of me figure out a way to hide the on-screen information...until I found Magic Lantern. Sadly, I've found that my camera is not supported.

Are there any plans to support this camera, or is there a version that I can use that will work with my 200D? Sorry if either of these are dumb questions, I'm completely new to this and am grasping at straws here.

Many thanks.

[a1ex]

200D LED blinking test didn't work, but here's a small detail I've overlooked: bootloader seems to loads external code as Thumb (as opposed to ARM on DIGIC 6 and earlier). [ edit: confirmed, IT WORKS! ]

6D2: not much luck finding the LED address, but found out this instead.

@ all DIGIC 7 EOS owners (800D, 77D, 6D2): let's retry the LED brute-forcing test (PM me if you don't mind running some blind code that pokes some GPIOs hoping to find the right one).

Source code for previous experiments committed to the digic6-dumper branch.


Next step is to dump the bootloader with one of these methods:
- CHDK soundcard method (phototransistor connected to PC soundcard input)
- a photodiode/phototransistor connected to an Arduino board or similar.

Please PM me once you have the hardware ready.

[a1ex]

77D: LED address identified, thanks @alpha232

Blinking pattern:



Wide black bar = 1, narrow black bar = 0, pattern repeats 3 times. Scan range started at 0xD2080000, 32-bit aligned addresses only => 77D LED address is 0xD2080000 + 0b00001011011 * 4 = 0xD208016C.

Background info.

Next step: please see previous post.


Edit: the EOS M50 appears to run EOS firmware (other recent models, i.e. M3, M5, M6, M10 and M100, are based on PowerShot firmware). Looking for a volunteer to try the LED blinking test on this camera, too

[a1ex]

Portable ROM dumpers ready

77D_DUMP.FIR (confirmed by alpha232)
200DDUMP.FIR (confirmed by deathline)
6D2_DUMP.FIR (confirmed by DieHertz)
800DDUMP.FIR (confirmed by ids1024)
M50_DUMP.FIR (TODO; please use this one instead)

Emulation coming soon.