DIGIC 8 'PowerShot' development (M50, SX70, SX740)

[ArcziPL]

my best advcie to you is buy an arduino nano or uno (both are arm processors)

None of them has anything to do with ARM. They both utilize ATmega328, which is an 8-bit AVR microcontroller.

Fully agree with the rest of your post though!

[Ant123]

None of them has anything to do with ARM.

No. Some modern Arduinos already contain ARM Cortex-M0.

[reddeercity]

what @heder said ! it can be very hard at times to understand but start by just reading everything .
I'm by not means a programmer but I focus on the things I wanted to do e.g. "Crop_Rec" on 5D2
It took me from April ,2017 to Dec , 2018 to get a working crop_rec  (with help from main dev.a1ex) & now I got the 50D working in crop_rec .
from that I now understand more and can develop more advance features etc. ...
I can't write C code from scratch but I followed code sample , that are all over the forum and in the source code .
Then made the code modifications as needed for the camera I was working on , it's always a work in progress 
Start small and work you way up , before long you will be writing code .....
   

 

[srsa]

Simple and slow dumper script for cameras with Powershot-legacy (EOS M, PowerShot). It works on at least one model. Whether Canon intends to keep scripting is to be found out.

About the language. Card setup. Note that some people have problems making a usable script card. If that happens, try again.

As usual, please do not post ROM dumps publicly.

Code: [Select]

' hex dumper
dim start = 0xe0000000
dim length = 0x100000

private sub save_as_hex(fn,addr,size)
f = OpenFileCREAT(fn)
CloseFile(f)
f = OpenFileWR(fn)
p = addr
' 1MB ~ 64 sec
do while p < (addr+size)
p1 = *p
p = p + 4
p2 = *p
p = p + 4
p3 = *p
p = p + 4
p4 = *p
p = p + 4
p5 = *p
p = p + 4
p6 = *p
p = p + 4
p7 = *p
p = p + 4
p8 = *p
p = p + 4
WriteFileString(f,"%08x%08x%08x%08x%08x%08x%08x%08x\n",p1,p2,p3,p4,p5,p6,p7,p8)
loop
CloseFile(f)
end sub

private sub Initialize()
save_as_hex("B:/ROM.TXT",start,length)
end sub
I have not been able to find "normal" read()- and write()-like event procedures, thus the hex dump. You may want to adjust 'start' and 'length' at the beginning of the script, but note the time requirement. Camera user interface will be locked up while the script runs.
Any error in the script will crash the camera and require a battery pull.
It appeared to me that these file operations happily make multiple files with the same name when used repeatedly, so be careful.

A C program to turn the word based hex dump to binary:

Code: [Select]

#include <stdlib.h>
#include <stdint.h>
#include <stdio.h>

const char *usage = "Decode hex files made with CBasic EOS dumper (LE words)\n"
"\nUsage: %s <input> <output>\n\n";

int32_t hex2char(uint8_t a) {
if (a<0x30) {
return -1;
}
else if (a<=0x39) {
return a-0x30;
}
a = a & 0xdf;
if (a<0x41) {
return -1;
}
else if (a<=0x46) {
return a - 0x41 + 10;
}
return -1;
}

int hex2uint32(FILE *f, uint32_t *u) {
int32_t n,m;
uint8_t c;
int ret = 0;
*u = 0;
for (n=7; n>=0; n--) {
int r;
c = 0;
r = fread(&c,1,1,f);
if (c == '\n') {
r = fread(&c,1,1,f);
}
if (r<1) {
ret = -1;
break;
}
m = hex2char(c);
if (m>=0) {
*u |= ((uint32_t)m)<<(n*4);
}
}
return ret;
}

FILE *fil;
FILE *filp;

int main(int ac, const char **av) {

if (ac < 3) {
fprintf(stderr, usage, av[0]);
exit(0);
}

const char *fi = av[1];
const char *fp = av[2];

filp = fopen(fp, "w+b");
if (!filp) {
fprintf(stderr,"Failed to open output file\n");
return -1;
}
fil = fopen(fi, "r+b");
if (!fil) {
fprintf(stderr,"Failed to open input file\n");
fclose(filp);
return -2;
}

uint32_t u;
while ( !hex2uint32(fil, &u) ) {
fwrite(&u, 1, 4, filp);
}

fclose(filp);
fclose(fil);

exit(0);
}

edit:
It turned out that there are better ways to dump ROM content - I can tell what they are if anyone is interested.
edit2:
Edited previous edit to reduce confusion. There is now a dedicated thread for scripting.

[JoaquinS]

Hi!

I don't know why I upgraded to 1.0.3 before checking here, I use my T5i with ML and I really like it. I am a C dev but a bit short on time lately, it's been a while since I used some assembler... I would love to help, but being short on time and with the upgraded firmware I don't know I can do much.

In any case it would be great to check how things are going and see if I can be of any help. When I have a chance I'll check the git and any availabile resources, and see if I can find a way to downgrade the firmware. Maybe there's a way to tweak the old firmware to make it seem like a newer one. Best would be to appear the 1.0.3 so coming back and forth doesn't require tweaking it every time.

For this finding the way to modify the firmware is one step, and making the checksum give it a pass is another problem. Maybe someone already failed at this and can point me to where to start.

Regards and my support for the developers working on this.

JS

[names_are_hard]

@srsa - weird and fun, thank you!  Can confirm Hello World works on G15, although the message is only visible outside of play mode, so you must play mode -> Func -> exit play mode.  Couldn't trigger it on M2 or 200D - don't know if it's supposed to work there (M2 more likely?).  Wiki said DryOS can have it, but neither of those have a zoom control and they're both Q/Set.  Any ideas on how to trigger it?

Let me know if the G15 rom dump test would be useful to you.

[srsa]

Couldn't trigger it on M2 or 200D - don't know if it's supposed to work there

No, those are fully EOS models codebase-wise.
I posted this in the DIGIC 8 thread because this kind of scripting is expected to work on the mixed codebase models (mostly EOS with some Powershot legacy). Those are the newer Powershots (sx740, sx70, g5xII, g7xIII) and EOS M cameras (M50, M200, M6II). I'm sure about the M50 and sx740 (having seen their firmware), the rest is speculated. No idea about the other DIGIC 8 cameras.
If someone happens to have a firmware dump for any untested models, the presence of some strings ("extend.m", the keywords, etc) may indicate this feature.

I should note that only keywords and syntax are common between the PowerShot and EOS version of Canon Basic, most event procedures are different, the examples from that wiki will not work here.

As for the dump, thanks, but I already have all CHDK-supported fw dumps.

I did not mention it yet, but setting the camera bootflag(s) should also be possible from a script, without requiring an encrypted binary. Executing fw functions (named or not) is also possible.

[Greg]

[names_are_hard]

Nice, proper menus.  Is this based on the infamous "fishy" build?  Have you got a repo?  I'm sure it would help with my 200D work.

[ArcziPL]

You can see on the screenshot: it's based on the digic6-dumper branch.

[names_are_hard]

Yes, he's been working on getting more features into digic6-dumper branch, I'm asking where that code is coming from - I'd assume the fishy m50 build as it's reasonably advanced.  I was ambiguous, sorry!

[ihz03]

What's the current state of the development of ML for the EOS M50?

[Walter Schulz]

See reply #232ff

[Greg]

Is this based on the infamous "fishy" build?

I don't have the "fishy" build code. This is digic6-dumper branch and stubs, consts, button codes, several modifications (bmp_vram, disabled audio tasks etc).

You can load "fishy" autoexec.bin in IDA/ghidra, convert the file M50_101.sym to idc script to name the functions.

[names_are_hard]

Thanks.  Such a shame you have to work from the binaries!  I'll keep watching, and slowly updating my 200D work.

[jarek.em]

Hello, I am total newbie here. Is there a chance that someone kind will tell me step by step how to install ML on EOS M50 1.0.3 ? I have tried it few ways with making card bootable - black screen and installin one of linked on this forum files .FIR As firmware update and I failed. I will be more than thankful for instructions together with links to necessary files. Thank you in advance !

[Greg]

M50 1.0.3

[nikfreak]

A picture is worth a thousand words.
Congrats!

[Danne]

Hell yeah Greg!

[Sténo]

it's genius

you will say to me that "no it's work"

it is true

but there is genius

[tweak]

 

[yokashin]

 

[finnschmolke]

Hey guys, could someone please share the ML-files for the m50 1.0.3 with me. That would be helpful! Thank you
Best regards, Finn

[bhedrington]

so, what now is there to do for getting the M50 with unlocking especially the 30min limit?

also be nice to be able to shoot 120p at 4k

[Greg]

also be nice to be able to shoot 120p at 4k

We can get 8K@120FPS. It will work like 4K in M6II - M6II vs M50 4K