Canon Basic scripting (DIGIC 8, DIGIC X models)

[c_joerg]

Code: [Select]

' Not tested!
' author c_joerg

dim count = 0

private sub Initialize()
  fileName = "B:/CCDTemp.TXT"
  RemoveFile(fileName)

  f = OpenFileCREAT(fileName)
  CloseFile(f)

  f = OpenFileWR(fileName)
 
  do while count < 10
     WriteFileString(f, "CCDTemperature: 0x%08X  ", GetCCDTemperature())
     WriteFileString(f, "BatteryVoltage: 0x%08X\n", GetBatteryVoltage())
     SleepTask(1000)
     count = count + 1
  loop
   
  CloseFile(f)

end sub


The script did not crash but delivers just 0

Code: [Select]

CCDTemperature: 0x00000000  BatteryVoltage: 0x00000000
May be i have to call some 'Create' stuff...

[kitor]

In EOS world, A: is CF card, B: is SD, C: is USB drive connected to WFT on older models (gone from references on D8, maybe earlier).

Not sure how this is assigned on R6 (which card is which), but holds up true on "supported" D8 models.

[kitor]

I have bad news for you. Checked the decomp, GetCCDTemperature is a dummy function (return 0). GetBatteryVoltage goes through a few jumps, but ends up in dummy function too.
It is not that uncommon to have "do nothing" evprocs, I already saw a few of those.

On R180.739 you can see temperature sensors readout at e01ae6f8, including conversion from raw to Celcius.

StartAllTempMeasurement will result in following on UART (seems that there's no actual sensor in ICU (WARP is ARM core on D8), or something is needed to initialize it):

Code: [Select]

     3567: 363770.123 WARP : -256.0
     3568: 363770.131 SH   : 23.0
     3569: 363770.136 MAIN : 29.7
     3570: 363770.140 A    : 29.5
     3571: 363770.143 WM   : 30.0
     3572: 363770.146 BACK : 25.2


[c_joerg]

I have bad news for you. Checked the decomp, GetCCDTemperature is a dummy function (return 0). GetBatteryVoltage goes through a few jumps, but ends up in dummy function too.

Too bad, it would be too easy.
Thank you for looking.

On R180.739 you can see temperature sensors readout at e01ae6f8, including conversion from raw to Celcius.

I have  R180.740. The address is probably different then.

StartAllTempMeasurement will result in following on UART (seems that there's no actual sensor in ICU (WARP is ARM core on D8), or something is needed to initialize it):

Code: [Select]

     3567: 363770.123 WARP : -256.0
     3568: 363770.131 SH   : 23.0
     3569: 363770.136 MAIN : 29.7
     3570: 363770.140 A    : 29.5
     3571: 363770.143 WM   : 30.0
     3572: 363770.146 BACK : 25.2


Do you know what value of it goes in the EXIF ​​of the RAW file?

[kitor]

I have  R180.740. The address is probably different then.

Yep, those are very close (you can usually find strings on the same page while diffing both in vbindiff) but all offsets are different due to that.
Every time in the past I referred to anything R related as R180, it is for 7.3.9.
With one year of ghidra project, no way to avoid confusion for users, and ability just to flash both versions without triggering downgrade check - we continue to work based out of that one.

Do you know what value of it goes in the EXIF ​​of the RAW file?

No idea, I never explored code around file metadata.

[lorenzo353]

Hum,

Already posted in another thread, sorry, but it seems a better place here.

I posted a CBasic script that determine in a portable way model ID and firmware version:
https://discord.com/channels/671072748985909258/936696899120005230/944929235070484511

Could you please check it ?

on my R6.150 :

Code: [Select]

model_id : 0x80000453
rom version: 4.9.0
GetFirmwareVersion: 150
fw signature from 0xe0100000: 0x129372a8
fw signature from 0xe0040000: 0xce84b41f
at e0100000: 09480cee100fbff36f8f42f20000c0f20000854610eeb05f15f00f0001
at e0040000: cef81cc143f2300cddf81ce0cef820c14ef22e7cddf81ce0cef824c1dd
Lorenzo

[c_joerg]

I posted a CBasic script that determine in a portable way model ID and firmware version:
https://discord.com/channels/671072748985909258/936696899120005230/944929235070484511

Is the source also available outside of Discord?
I got no access...

[Walter Schulz]

https://discord.gg/HJNWuKrW
Invite expires in 7 days.

[c_joerg]

Thanks, I thought the sources are shared on github...

On my R.180

Code: [Select]

model_id : 0x80000424
rom version: 7.4.0
GetFirmwareVersion: 180
fw signature from 0xe0100000: 0x5a746fa0
fw signature from 0xe0040000: 0x14f9273a
at e0100000: 6b680022102011469847a06a012804d16b680022000311469847b9f100
at e0040000: 0d480cee100fbff36f8f42f20000c0f20000854610eeb05f15f00f000a


[lorenzo353]

Thank you!
Expected sequence at 0xe0040000 !
But, I did not find a way to compare bytes seq in CBasic to find automatically the right address, using if or strcmp, memcmp...

the code here is requested:

Code: [Select]

' tested on R6.150 and R.180
' source : https://discord.com/channels/671072748985909258/761652283724922880/933858470262882314
' should work on Digix8 and Digic10 at least

dim pRom0BaseAddressD10 = 0xE0100000
dim pRom0BaseAddressD8 = 0xE0040000
dim pRom1BaseAddress = 0xF0000000
dim sigLen          = 0x10000

' checksum code by Coon
private sub compute_signature(startSign, sLen)
  p = startSign
  c = 0
     
  For i = 0 To (sLen - 1)
    c = c + *p
    p = p + 4   
  Next
 
  compute_signature = c
end sub

private sub disp_hex_string(address, len, file)
  memStart = address
  WriteFileString(file, "at %x: ", memStart) 
  For i = memStart To (memStart+len)
    WriteFileString(file, "%02x", Peek8(i) & 255 )
  Next     
  WriteFileString(file, "\n" ) 
end sub
 
private sub Initialize()
 
  fileName = "B:/FW_SIGN.TXT"
  RemoveFile(fileName)

  f = OpenFileCREAT(fileName)
  CloseFile(f)

  f = OpenFileWR(fileName)

  WriteFileString(f, "model_id : 0x%08x\n", *pRom1BaseAddress)
  WriteFileString(f, "rom version: %s\n", pRom1BaseAddress +4)
  WriteFileString(f, "GetFirmwareVersion: %d\n", GetFirmwareVersion() ) 

  WriteFileString(f, "fw signature from 0x%x: 0x%08x\n", pRom0BaseAddressD10, compute_signature(pRom0BaseAddressD10, sigLen ) ) 
  WriteFileString(f, "fw signature from 0x%x: 0x%08x\n", pRom0BaseAddressD8, compute_signature(pRom0BaseAddressD8, sigLen) ) 
 
  'should look like: xx 48 0C EE 10 0F BF F3 6F 8F 42 F2 00 00 C0 F2 00 00 85 46 10 EE B0 5F 15 F0 0F 00
  disp_hex_string( pRom0BaseAddressD10, 28, f )
  disp_hex_string( pRom0BaseAddressD8, 28, f )

  CloseFile(f)
 
  ' dumpf()
end sub

[c_joerg]

On my M100 I can control the focus with the following functions

Code: [Select]

call_event_proc("EFLensCom.FocusSearchNear")
call_event_proc("EFLensCom.MoveFocus",steps,speed)

I found the following features on the EOS R and hoped I could do something similar with Canon Basic

Code: [Select]

MoveLensToFirstPoint()
MoveFocusDistance(10,10)

But nothing happens. At least there are no crashes.
May be also dummy function?

I have not checked

Code: [Select]

lensdrivefocus

[kitor]

Two first are dummy. `lensdrivefocus` seems to have implementation.

[c_joerg]

But I didn't have any success with either 

[Vector54]

This exist on eos 90d as well. I was able to execute some scripts.

[c_joerg]

With success? You can move the focus?

[kitor]

"this" -> BASIC ROM dumper works, in both variants (bootable only and both ROMs).