Author Topic: Canon 5DS / 5DS R (Read 10201 times)

g3gg0 · « **on:** February 10, 2018, 01:14:29 PM »

just for the record, i pushed some 5Ds experiments.

booting the firmware is a bit different now, but works.
the code is hardcoded right now and just meant as experiment / documentation.

i wasnt able to display something meaningful yet.
could write into some YUV buffers or modify the graphics processor's RAM.
but not really usable at all.

THIS DOES NOT MEAN 5Ds WILL GET ML SOON!

https://bitbucket.org/hudson/magic-lantern/commits/branch/5Ds_experiments

DrEVILish · « **Reply #1 on:** June 11, 2018, 08:36:35 PM »

There's been a youtube Experimental test of the 5Ds.

I'd like to know if there is any more details on this video there is nothing in the comments or if the video is as long as it could have been or if more can be made.

Walter Schulz · « **Reply #2 on:** June 12, 2018, 12:07:11 AM »

https://www.magiclantern.fm/forum/index.php?topic=20516

DrEVILish · « **Reply #3 on:** June 15, 2018, 11:24:33 PM »

I've just ordered a 5Ds, mainly for photography, I've been a big fan of the ML RAW video output from the 550D I've been rocking for a few years now. I've been using ML for a while now and if there is anything I can do to help the effort of getting this project working onto such a device I'd love to get stuck in, with a nod in the right direction.

a1ex · « **Reply #4 on:** January 19, 2019, 09:33:53 AM »

To my knowledge, there wasn't a ROM dumper published for the 5DS/R yet, so here's one:

Quote from: a1ex on January 16, 2019, 09:06:18 AM

Master/Slave: 5DS 5DSR 7D2 7D

I have no way to test it, so it may not work out of the box. All I know is that an older version of this codebase worked for 7D2 after some fiddling.

Edit Feb.10: confirmed working on the 5DS R.

a1ex · « **Reply #5 on:** February 14, 2019, 10:40:46 PM »

I've merged the 5Ds_experiments branch into digic6-dumper, to use the same codebase as 80D, 5D4, 7D2 and all other recent models. It appears to work in QEMU, but could only test it to a very limited extent. Also added initial support for 5DS R; this one was confirmed to work on real hardware by @jcareaux on twitter.

Back then, g3gg0 enabled the boot flag on 5DS without any issue, so... here it goes.

Enabling the boot flag

* BFE_5DSR.FIR (works on any^*) firmware version; confirmed by jcareaux)
* BFE__5DS.FIR (works on any^*) firmware version; not yet confirmed, but an older version of this code was used by g3gg0)
* source code

These will modify your camera.

^*) The boot flag enabling procedure is firmware-agnostic (it runs from bootloader, so it's compatible with any Canon firmware version). However, what you can do afterwards may be affected by Canon firmware version; read on.

To disable the boot flag: see these notes.

Warranty

If it breaks, you get to keep both pieces. Sorry.

What to do with it?

After enabling the boot flag on your camera, you may run:

a) with any firmware version:

- the portable display test (copy autoexec.bin and make your card bootable - EosCard/MacBoot/make_bootable.sh)
- the portable ROM dumper (you need a FAT12/16/32 SD card)
- anything compiled from the recovery branch, platform/portable.000 (it runs from bootloader context); check Makefile.user.default for options.

b) with 5DS R firmware 1.1.2 only, OR
c) with 5DS firmware 1.1.1 only:

- the digic6-dumper branch (5DS R will run the experiments previously tested on 80D/5D4; 5DS will run g3gg0's experiments)

- example code to get started - a simple intervalometer (not tested, previous attempts did not work on this model, but worked on 80D, 200D, M50 etc):

Code: [Select]

    /* this goes into dump_task in minimal-d6.c (digic6-dumper branch) */
    for (int i = 0; i < 10; i++)
    {
        call("Release");
        msleep(10000);
    }

Next steps

Roughly the same as 5D4. The basic functionality should not require any kind of dual core trickery; ML can run on the master core only, similar to 7D (there, the main core is called "slave"). In particular, I don't expect any difficulties in printing Hello World; just don't reuse the 80D addresses, as they won't work.

I'm here to help, if you have questions, but I expect you to read at least the other DIGIC 6/7/8 topics first

That's it for today.

martin.nieuwoudt · « **Reply #6 on:** April 08, 2019, 02:40:41 PM »

Hi A1ex,

Has there been any further development on ML support for the 5DSr?

I've used ML extensively with other cameras, just not this one.

I am a little confused about the installation procedure you proposed:

1. Install Boot flag .fir file
2. Install Digix 6 dumper.

Is that correct?

regards,
Martin

ilia3101 · « **Reply #7 on:** January 23, 2020, 02:45:29 PM »

I want to help port the 5Ds. I know, dual digic 6, but I found a really cheap one and want to see how far we can get.

I think this camera is much better than a 5D4, as it has potential for 3K non cropped raw video, compared to what the mark 4 offers: 1.7x cropped 4K or full frame 2.2k

It also has anti aliased fonts, so the menus look really beautiful 🥰

ilia3101 · « **Reply #8 on:** January 23, 2020, 04:54:58 PM »

My 5Ds has latest firmware 1.1.3 and I tried to enable the bootflag with BFE_5DS.FIRm but the camera said "Firmware older than ver 1.1.3 is on memory card"...

So I opened the file up with a hex editor and changed the string at the beginning to 1.1.4, now the camera does accept it, but shows "Firmware Update Program" and "Update file error... " after trying to run it.

flostro · « **Reply #9 on:** January 23, 2020, 05:46:11 PM »

Maybe it's possible to downgrade with EOS Utility via USB

https://www.magiclantern.fm/forum/index.php?topic=18941.msg220980#msg220980

ilia3101 · « **Reply #10 on:** January 23, 2020, 06:02:48 PM »

I couldn't find old versions of the firmware online

But I only did a quick search. Does that site we always use around here have 5Ds firmware?

Walter Schulz · « **Reply #11 on:** January 23, 2020, 07:27:16 PM »

https://pel.hu/eoscard
But I'm afraid ATM there is only CPS able to downgrade ”hardened" PTP fix.

ilia3101 · « **Reply #12 on:** January 23, 2020, 08:01:22 PM »

Thanks!!! I am not able to install it though, even with EOS utility. Not worth sending it to CPS.

So I think work should move to 1.1.3, as it's the latest and greatest anyway.

Need to find a way to enable bootflag and dump it...

ilia3101 · « **Reply #13 on:** January 24, 2020, 06:39:57 PM »

Quote from: a1ex on February 14, 2019, 10:40:46 PM

Back then, g3gg0 enabled the boot flag on 5DS without any issue, so... here it goes.

Enabling the boot flag

* BFE_5DSR.FIR (works on any^*) firmware version; confirmed by jcareaux)
* BFE__5DS.FIR (works on any^*) firmware version; not yet confirmed, but an older version of this code was used by g3gg0)
* source code

These will modify your camera.

I can't figure out how to compile that 'source code' file, I need to compile it with a higher version number so that it can run on my camera. But I just don't see what makefile I should use. Please help.

Then I will be able to run the dumper... and then will have to adapt current progress to firmware 1.1.3 - this shouldn't be massively difficult (?)

Then the difficult stuff will come... I will be reading digic 6 threads now.

Update: compiled portable.000 from recovery branch with CONFIG_BOOT_BOOTFLAG=y added to makefile, got an autoexec.bin file, not a .FIR file, not sure if I should run it. It does not have any version number when I look at it with a hex editor, does not look like the FIR files shared by a1ex on the forum. Should I look at the 5Ds experiments branch? I just want a fir that will enable the bootflag.

ArcziPL · « **Reply #14 on:** January 24, 2020, 11:05:06 PM »

You won't be able to create a working *.FIR until you sign it with a proper key. This key is not made public. You have two options: ask a1ex for an updated boot-flag-enabler or dig in disassembly + RAM dumps to find it on your own.

ilia3101 · « **Reply #15 on:** January 24, 2020, 11:12:51 PM »

So this key is hidden within the camera's memory? Anyone who has a dump can find it?

Why is the key not made public then?

Is it different for each model?

This is a new magic lantern fact for me.

@a1ex if you could, could you please help me out with getting a 5Ds firmware dumper/bootflag enabler for firmware version 1.1.3

Walter Schulz · « **Reply #16 on:** January 25, 2020, 01:04:01 AM »

Quote from: ilia3101 on January 24, 2020, 11:12:51 PM

So this key is hidden within the camera's memory? Anyone who has a dump can find it?

Why is the key not made public then?

Is it different for each model?

This is a new magic lantern fact for me.

@a1ex if you could, could you please help me out with getting a 5Ds firmware dumper/bootflag enabler for firmware version 1.1.3

Normally I don't do full quotes...

Sorry for rocking the boat but as a moderator you are responsible for users to comply with forum rules and "ML work ethics". I'm worried because IMO you don't understand some basic rules. One of them (as explained in forum rules) is never to post Canon's IP in public. This applies to ROM dumps, for example. Encryption keys ... Well, I think you get the idea now.
IMO you should ask some seasoned mod or dev for a serious primer.

ilia3101 · « **Reply #17 on:** January 25, 2020, 01:42:24 AM »

Thank you.

ilia3101 · « **Reply #18 on:** April 17, 2020, 08:57:45 PM »

I cannot get disassemble.pl to work right. ROM1.BIN.labels and ROM1.BIN.dis are always zero bytes in size. Maybe I need a different address?

I have used this so far:

Code: [Select]

perl disassemble.pl 0xFE000000 ROM1.BIN
What do I do next to get hello world? Which branch is all the action for 5Ds/r happening in, is it 5Ds_experiments? Or digic 6?

ilia3101 · « **Reply #19 on:** April 20, 2020, 02:12:18 AM »

I tried compiling 5Ds_experiments 5Ds.111 with "make install" - but it doesnt create a .FIR, so the camera cannot see it. I guess this is a step main devs with signing key need to do? How does the .FIR step even work when we normally compile?

I am much more serious about helping than the "hey I have 80d i know javascript" people, I really want to spend time on this. I have good knowledge of C, I have implemented card spanning in mlv_lite, I just don't really know much about ARM and embedded hardware. Does that qualify me to be any help? Honest question. Do I need a lot more knowledge of ARM?

a1ex · « **Reply #20 on:** April 20, 2020, 07:16:53 AM »

Reply #5 provides the answer to most of your questions. You don't need our signing key.

You do need some embedded programming knowledge, but I've tried to cover the EOS-specific details in QEMU guides (linked from the homepage).

Unfortunately I'm unable to provide any significant assistance these days (a technical reply might require a few hours of preparation on my side), so... I'm afraid you will have to figure out most of the stuff on your own. Sorry about that. On the upside, the Hello World code was confirmed to work on most DIGIC 6/7/8 models announced at the time of writing that piece of code, so following the discussion from those other models, and the source code commits, should provide the hints you need.

ilia3101 · « **Reply #21 on:** April 20, 2020, 12:03:41 PM »

Thank you.

Quote from: a1ex on April 20, 2020, 07:16:53 AM

Reply #5 provides the answer to most of your questions. You don't need our signing key.

I see, digic6-dumper is latest branch.

Also I got disassemble.pl working, it had some paths that were wrong in my case. I see lots of strings inside the 5Ds dump like "AAAAAAAAAAAAAAAAAAAAAAAA" and "DDDDDDDDDDDDAADDDDDDDDDA..." ? There is plenty of normal strings as well though. Could just be that I don't have the right start address.

Edit: about to try disassemblev7.pl

Quote from: a1ex on April 20, 2020, 07:16:53 AM

You do need some embedded programming knowledge, but I've tried to cover the EOS-specific details in QEMU guides (linked from the homepage).

Ok good to know.

Quote from: a1ex on April 20, 2020, 07:16:53 AM

Unfortunately I'm unable to provide any significant assistance these days (a technical reply might require a few hours of preparation on my side), so... I'm afraid you will have to figure out most of the stuff on your own. Sorry about that.

No worries.

Just small hints about what to do will be massively helpful.

Quote from: a1ex on April 20, 2020, 07:16:53 AM

On the upside, the Hello World code was confirmed to work on most DIGIC 6/7/8 models announced at the time of writing that piece of code, so following the discussion from those other models, and the source code commits, should provide the hints you need.

Is that code in digi6-dumper? I compiled digid6-dumper and put it on a card I made bootable, and it seems to run. The red led blinks and the camera eventually locks up (a sign code is running I think). I don't see any hello world though, even after uncommenting the hello world line in minimal.c

Tried putting this in minimal-d678, but nothing happens. Is that code even still being called from platform 5DS.111?

Code: [Select]

    /* this goes into dump_task in minimal-d6.c (digic6-dumper branch) */
    for (int i = 0; i < 10; i++)
    {
        call("Release");
        msleep(10000);
    }

But at least I got some rectangles to show up on the screeen by uncommenting this:

Code: [Select]

        void *(*cmd_StartFlatDisplay)(int *buffer) = 0xFE2BD1FD;
        uint32_t buffer[4] = { 1, 2, 3, 4};
        cmd_StartFlatDisplay(buffer);

Also I'll see if I can do anything from your 5D4 next steps post.

csoller · « **Reply #22 on:** June 21, 2020, 07:01:00 PM »

This would be the most ambitious crossover event in history.

News:

Author Topic: Canon 5DS / 5DS R (Read 10201 times)