Short answer: because nobody tried yet.
Long answer: generally it won't work out of the box, even on nearly identical generations, because the code is tightly tied to Canon firmware. Being "mostly identical" just means most of the code can be reused (i.e. not rewritten from scratch), but it generally needs some adjustments.
Nearly every minor firmware update has the functions we want to call at
different addresses. At least these will have to be adjusted, but this is generally the easiest step (a bit time-consuming, but can be automated to some extent).
Besides, each camera model has its own quirks; even cameras from the same generation will have differences beyond just different stubs. Some very close models are 650D and 750D, for example, but even there, not everything works just by changing the stub addresses. Other close models are 80D, 750D and 760D - in this case, I'd expect the startup code to work out of the box just by tweaking the addresses, but nobody tried. Beyond startup code, I'd expect 750D and 760D to start diverging from 80D.
Here, DIGIC 7 is definitely not the same DIGIC 6. There is a new processor, a new startup code, two cores that have to run in sync, a new memory layout, a memory mapping unit (previous models only had a memory protection unit) and so on. Overall, they are based on the same EOS codebase we are familiar with, but that doesn't mean the old code will run out of the box.
The similarity I've mentioned was at hardware level, i.e. many peripherals (things other than CPU and RAM) identified on DIGIC 6 could be used to emulate DIGIC 7 firmware either out of the box or with minor adjustments (such as different register addresses).
The screenshots you have seen were created with portable code (the
recovery branch, which is limited to bootloader experiments). This code attempts to locate firmware functions on the fly, with pattern matching, and can run from DIGIC 2 all the way to DIGIC 7. However, what can be done in a portable way is quite limited and relies on similarity between Canon firmwares. Sooner or later, you will need "if" branches with model-specific or generation-specific code.
The DIGIC 7 cameras appear to be very similar; that is, I'd expect most of the knowledge gained by analyzing one model to apply to all others in this group. DIGIC 8 starts to diverge a bit, but I still believe D7 and D8 are a lot more similar than D6 and D7 (they have the same ROM layout, the same startup code, similar - possibly the same - dual-core configuration and so on). Maybe it's best to move M50 in its own thread, but for now I'm analyzing all these models together.
One significant difference between D7 and D8: the portable code did not quite work out of the box on M50. Expecting the bootloader changes to be minor, but unable to guess them from the firmware update. The portable code ran, to some extent, so we could tell the code is running and we could change the error screen, but could not display any custom things and could not guess the LED address. Figuring things out that way would have been possible, but tedious; luckily, the firmware update came out earlier than expected.
I'm going to implement the startup code for M50, so you can compare it to 80D and see what are the parts that may need tweaking.
Edit: committed startup code for both
M50 and
200D, as it was easier to debug this way. Testers welcome (contact me by PM).
Porting to 6D2, 77D and 800D should now be just a matter of
pattern matching (in theory).
