Author Topic: HDMI reverse engineering  (Read 2152 times)

domasa

  • Freshman
  • **
  • Posts: 87
HDMI reverse engineering
« on: December 19, 2017, 12:30:21 AM »
Topic split from TFT SIO communication (tft_regs.mo).



I run "Brute-force all registres" on 5D3 v123 with HDMI monitor. No registrer change view on monitor (as could be expected).

Is it possible prepare some brute-force test for registeres that could be change view on HDMI monitor?

I am looking for some alternative for magic-zoom on HDMI monitor
(e. g. "Scroll" HDMI output: http://www.magiclantern.fm/forum/index.php?topic=18488.0).

a1ex

  • Administrator
  • Hero Member
  • *****
  • Posts: 12223
  • Maintenance mode
Re: HDMI reverse engineering
« Reply #1 on: December 19, 2017, 06:14:58 AM »
That could be interesting. There is some I2C communication when enabling Control via HDMI in Canon menu in QEMU (or if you get your ROM with that option enabled); you can also get startup logs to see what happens on real hardware with a HDMI monitor attached (ideally different users should do this, to cover various devices). I didn't look into it yet (back then, it was a pipe dream and had no idea where to start), but now that we are starting to understand how these peripherals work (at least well enough to emulate them), this can turn into another nice research topic.

However, the feature you are looking for is really easy to do - just change the display buffer address (start from the full-screen magic zoom code or HDR video flicker workarounds, and tweak from there). Scrolling left to right should be straightforward; scrolling up and down will display additional things (likely noise), but if you can zoom on the external monitor, that should be harmless.

Not sure if there are registers on the HDMI chip to adjust the position (I'd expect it to transmit the image data it receives, without shifting it around, but who knows).

reddeercity

  • Contributor
  • Hero Member
  • *****
  • Posts: 2039
Re: HDMI reverse engineering
« Reply #2 on: February 04, 2018, 01:06:37 AM »
Sorry to be out topic & maybe this whole post is out topic if so please move it to a more appropriate topic , I'll start a new thread after this post:

On 5D2 run Startup Log build with HDMI attached (atomos ninja 1st gen.) captured startup of cam to prores  here is the log file from my bitbucket download dm-0005_hdmi+raw-recording.log

Some thing interesting
Code: [Select]
0D899>    Startup:00096198:00:00: *** register_interrupt("VIDEODET", 0x45, 0xff81ddd0 "VideoDetectISR %d", 0x0), from ff81e338
 0DA01>    Startup:00096198:00:00: *** register_interrupt("HDMIDET", 0x56, 0xff81dd28 "HDMIDetectISR %d", 0x0), from ff81e374
0DA30> **INT-56h*:ff81dd3c:8a:03: HDMIDetectISR 0
more than likely just for h264 , but from my understanding hdmi shares the same stream as it originate from the Jpgcore chip right ?
Code: [Select]
17575>    PropMgr:ff99bbdc:01:03: MovieParamData
175F2>    PropMgr:ff99b5b4:01:03: #mode 0 size 0x0 , framerate 0x18 , type 0xc
I see it reads user dir. , so type = 0x2, 0x0 is full res image ? & h264.mov 1080p type = 0x20, 0x2
or this something else .
Code: [Select]
DC86B>    FileMgr:ff96e5e4:27:01: ctgFileSet (_MG_8682.CR2, attrib = 0x20, type = 0x2, 0x0)
DC896>    FileMgr:ff96e5f8:27:01:                 (time = 0x449d)
DC565>    FileMgr:ff96e5e4:27:01: ctgFileSet (MVI_8680.MOV, attrib = 0x20, type = 0x20, 0x2)
DC590>    FileMgr:ff96e5f8:27:01:                 (time = 0x449d)
this part cycles , seems something to do with lens
Code: [Select]
E1F03>    Startup:ff823d38:83:03: GUI_Initialize ClassID[131]GUI[23]Ctrl[24]
E206B> GuiMainTas:ff892864:83:03: -> handleGuiInit
E3501> GuiMainTas:ff86565c:82:02: FlushPaletteToEngine
E36BF>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E37AC>       HDMI:ff9aed94:88:02: I2C_Read : 0x70, 0x90, len = 1, data = 0x0
E387B>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E394F>       HDMI:ff9aed94:88:02: I2C_Read : 0x70, 0x90, len = 1, data = 0x0
E39C1>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x7, len = 1, data = 0xff
E3A55>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E3B38>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x9c, len = 1, data = 0xe0
E3BCE>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E3CA8>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x98, len = 1, data = 0x11
E3D30>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E3E06>       HDMI:ff9ae984:88:02: I2C_Write : 0x7a, 0x88, len = 1, data = 0xff
E3E90>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E3F7F>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x7, len = 1, data = 0xff
E4009>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E410B>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0xc, len = 1, data = 0x40
E419E>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E429F>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x5, len = 1, data = 0x0
E433B>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E443C>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x16, len = 1, data = 0x4
E44CF>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E45CC>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x20, len = 1, data = 0x33
E4665>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E4767>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0xb, len = 1, data = 0x1
E47F7>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E48F2>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x52, len = 1, data = 0x0
E4986>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E4AC3>       HDMI:ff9ae984:88:02: I2C_Write : 0x72, 0x2, len = 1, data = 0x20
E4B64>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E4C70>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0xb1, len = 1, data = 0x84
E4D08>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E4E15>       HDMI:ff9ae984:88:02: I2C_Write : 0x7a, 0x9c, len = 1, data = 0x2d
E4EAE>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E4FB0>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x98, len = 3, data = 0x57
E4FF1>       HDMI:ff9aea0c:88:02: I2C : 57, 80, 03, 00, 00, 00, 00, 00, 03, 00, 12, 70, 98, 00, 03, 00
E5090>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E51C5>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x9c, len = 1, data = 0xe0
E5265>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E535B>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x9e, len = 1, data = 0x81
E53F5>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E54EB>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x28, len = 1, data = 0x0
E5584>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E5687>       HDMI:ff9ae984:88:02: I2C_Write : 0x7a, 0x8f, len = 1, data = 0x1
E571A>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E5812>       HDMI:ff9ae984:88:02: I2C_Write : 0x70, 0x22, len = 1, data = 0x2
E58A6>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E5A23>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E5AFA>       HDMI:ff9aed94:88:02: I2C_Read : 0x70, 0x8, len = 1, data = 0x18
E5BB4>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E5C82>       HDMI:ff9aed94:88:02: I2C_Read : 0x70, 0x8, len = 1, data = 0x18
E5CE4>       HDMI:ff9ae984:88:02: I2C_Write : 0x7a, 0x88, len = 1, data = 0xff
E5D6D>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E5EA4>       HDMI:ff9ae984:88:02: I2C_Write : 0x7a, 0x80, len = 4, data = 0x0
E5EE8>       HDMI:ff9aea0c:88:02: I2C : 00, 00, 7f, 82, 78, c5, 04, 00, 84, 33, cc, ff, 38, 70, b3, ff
E5F93>       HDMI:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
E60EA>       HDMI:ff9ad7fc:88:05: RESET_COMPLETE
E611B>       HDMI:ff9ad878:88:05: KEY LOAD OK
E6140>       HDMI:ff9ad8e4:88:05: HOT_PULG_DETECT OK
E6162>       HDMI:ff9ad950:88:05: Rx Sense is OK
E6186>       HDMI:ff867374:82:16: SetPBForHDMI DispType=0 fChange=0 HDMIInit=1
E61B2>       HDMI:ff86739c:82:16: SetPBForHDMIInit
E61EF>       HDMI:ff9a77d0:00:01: [CLKSAVER] ��ClockSave In��
E6274>       HDMI:ff8673bc:82:02: MuteON (3125)
E62A1>       HDMI:ff8657a0:82:02: EnableBitmapImageVBufferForPlayBackAndWait (PUB)
E62CB>       HDMI:ff867dbc:82:02: PBPowerOn 2(3127)
E62F3>       HDMI:ff9ad9bc:88:05: pfHdmiPbCBR Done
This looks good and interesting  :D
Code: [Select]
1DDF6>       HDMI:ff9ad9e8:88:05: stat OK
1DE23>       HDMI:ff9b0f00:88:03: [EDID] BasicAudio=1 444=1 222=1
1DE50>       HDMI:ff9b0f48:88:03: [EDID] DetailTimingSupportNum=8
1DE74>       HDMI:ff9b0f60:88:03: [EDID] DetailTimingOffset=32
1DE99>       HDMI:ff9b0f84:88:03: [EDID] DetailTimingOffset=32
1DEBD>       HDMI:ff9b0f9c:88:03: [EDID] TagType=2(132)
1DEEE>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 1
1DF13>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 2
1DF34>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 4
1DF54>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 5
1DF72>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 6
1DF93>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 17
1DFB3>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 19
1DFD5>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 20
1DFF4>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 21
1E015>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 32
1E035>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 33
1E057>       HDMI:ff9b0d58:88:03: [EDID] VideoCode = 34
1E07E>       HDMI:ff9b0e5c:88:03: [EDID] NativeVideoCode 5
1E0A1>       HDMI:ff9b0e70:88:03: [EDID] DefaultVideoCode 2
1E0C4>       HDMI:ff9b0f9c:88:03: [EDID] TagType=1(145)
1E0EB>       HDMI:ff9b0f9c:88:03: [EDID] TagType=4(149)
1E114>       HDMI:ff9b0f9c:88:03: [EDID] TagType=3(153)
1E147>       HDMI:ff9aff44:88:16: [EDID] dwVideoCode = 5
1E171>       HDMI:ff9aff58:88:16: [EDID] dwHsize = 1920
1E199>       HDMI:ff9aff6c:88:16: [EDID] dwVsize = 1080
1E1BD>       HDMI:ff9aff88:88:16: [EDID] ScaningMode = EDID_INTERLACE(i)
1E1E1>       HDMI:ff9affd4:88:16: [EDID] VerticalFreq = EDID_FREQ_60Hz
1E204>       HDMI:ff9afff0:88:16: [EDID] AspectRatio = EDID_ASPECT_16x9
1E228>       HDMI:ff9b000c:88:16: [EDID] AudioMode = EDID_AUDIO_LINEAR_PCM
1E24D>       HDMI:ff9b1534:88:16: [EDID] ColorMode = EDID_COLOR_444
1E33C>       HDMI:ff9b155c:88:16: [EDID] MovieStatus = 0
1E427>       HDMI:ff9ada88:88:05: snik_status : 2
1E46C>       HDMI:ff9adb68:88:05: Get EDID Success
1E499>       HDMI:ff867374:82:16: SetPBForHDMI DispType=0 fChange=0 HDMIInit=2
1E4C9>       HDMI:ff86761c:82:16: HDMI PB for init finish (2)
1E4F2>       HDMI:ff9adbf4:88:05: Pana_Init End : EDID = 4
1E51A>       HDMI:ff8682a4:88:16: ConnectHDMI : End
1E544>       HDMI:ff871b44:00:01: [PM] EnablePowerSave (Counter = 1)
1E5AC>       HDMI:ff9a77d0:00:01: [CLKSAVER] ��ClockSave In��
1E5E6>       HDMI:ff9a77d0:00:01: [CLKSAVER] ��ClockSave In��
1E620>       HDMI:ff9a77d0:00:01: [CLKSAVER] ��ClockSave In��

I guess this prove it , HDMI is 444 interlaced & I know it's 8bit  :)
Code: [Select]
1E1BD>       HDMI:ff9aff88:88:16: [EDID] ScaningMode = EDID_INTERLACE(i)
1E1E1>       HDMI:ff9affd4:88:16: [EDID] VerticalFreq = EDID_FREQ_60Hz
1E204>       HDMI:ff9afff0:88:16: [EDID] AspectRatio = EDID_ASPECT_16x9
1E228>       HDMI:ff9b000c:88:16: [EDID] AudioMode = EDID_AUDIO_LINEAR_PCM
1E24D>       HDMI:ff9b1534:88:16: [EDID] ColorMode = EDID_COLOR_444
Sorry to be out topic & maybe this whole post is out topic if so please move it to a more apprate topic , I'll start a new thread after this post
a few more interesting things
could this be canon can save vga h264 (maybe a potentially proxies at vga resolution , that would save space & bandwidth)
Code: [Select]
1EABF> GuiMainTas:ffa4b678:1a:01: H264E InitializeH264Encode
1EB4D> GuiMainTas:ffa4b7b0:1a:01: H264E InitializeH264EncodeForVGA
there is some many "SendPipeEvent"
I thing this "tv 65" refers to D65 white point and of course in broadcast range (16-235)
Code: [Select]
566E0>   MainCtrl:ff83a9dc:33:01: SendPipeEvent [2][0][10]
56769>   MainCtrl:ff8a6ee0:9f:01:     tv 65
56796>   MainCtrl:ff8a6efc:9f:01:     range tv a0,10
Well ! could hdmi audio be turn on ? , as we know there no audio thought hdmi at least from 5d2 and I assume on all  digic iv
It looks like it has "mute enabled"
Code: [Select]
6405F> GuiLockTas:ff9ade94:88:03: Pana_TurnOnHDMI (Audio = 1)
640A1> GuiLockTas:ff9ae7d0:88:05: hdmiWaitForStat (stat = 1)
640D3> GuiLockTas:ff9ae858:88:05: hdmiWaitForStat : OK (3)
6414F> GuiLockTas:ff9a77d0:00:01: [CLKSAVER] ��ClockSave In��
64188> GuiLockTas:ff9a77d0:00:01: [CLKSAVER] ��ClockSave In��
641BD> GuiLockTas:ff867374:82:16: SetPBForHDMI DispType=3 fChange=0 HDMIInit=0
64247> GuiLockTas:ff8675ec:82:02: MuteON (3220)
again RGB 444 color  :D
Code: [Select]
64390> GuiLockTas:ff9adfb0:88:16: ### 0x148ecd, EOS 5D Mark II
643D3> GuiLockTas:ff9ae020:88:16: Pana_TurnOnHDMI : EDID_COLOR_444
643FC> GuiLockTas:ff9ae20c:88:16: Pana_TurnOnHDMI : FULL_HD_60
64474> GuiLockTas:ff9adc38:88:05: hdmiWaitForAvreq (V = 1, 3, A = 1, 1)
644B1> GuiLockTas:ff9adcc8:88:02: stav = 1, stat = 1, V = 3, A = 1
64561> GuiLockTas:00096198:00:00: *** register_interrupt(0x0, 0x34, 0xff871c50, 0x1), from ff871db8
64647> GuiLockTas:ff9aed94:88:02: I2C_Read : 0x70, 0x90, len = 1, data = 0x0

Ok Ok I'll stop , Sorry again just on a roll , lots of interesting stuff .
I'll run the tft_regs.mo and see what comes up , but I will post in a different thread
no to distract from the other models .

a1ex

  • Administrator
  • Hero Member
  • *****
  • Posts: 12223
  • Maintenance mode
Re: HDMI reverse engineering
« Reply #3 on: February 06, 2018, 12:51:11 AM »
Found out what the HDMI chip is on 5D2 "TDA19989AET/" data sheet below
https://media.digikey.com/pdf/Data%20Sheets/NXP%20PDFs/TDA19989.pdf

This is interesting; the HDMI chip is definitely I2C. Checking the address (that should be the first character from the I2C messages):
- the log has I2C_Read: 0x70, 7a, a few 72 and 7c, and I2C_Write: 70, 7a, a few 72 and 7e.
- HDMI core address (from datasheet): 0x70
- CEC core address (from datasheet): 0x34

Running with -d debugmsg,io in QEMU, after changing the HDMI CONNECT GPIO to 1, gives these messages, but the low-level I/O activity doesn't make much sense to me. The debug messages say I2C, but the communication looks more like SPI, with some unusual encoding of the address and data. There's probably a small controller between the DIGIC and the HDMI chip, which talks to the former via SPI and to the latter via I2C.

A good initial step would be to replay the I2C data from the logs in QEMU, hopefully initializing the HDMI display in the emulator. This is quite difficult for a beginner (it's not straightforward for me either), but I'm pretty sure it's doable.



I2C_Write:
If data size is 1, the following int32 is written to SPI: (addr << 20) | (sub << 11) | (data << 2) | 0x80402.
Cross-check: I2C_Write : 0x70, 0x98, len = 1, data = 0x11 => 0x70CC446 written to SIO1 TX register (visible with -d debugmsg,io in qemu).

Otherwise, (addr << 19) | (sub << 10) | (data[0] << 1) | 0x40201 (everything shifted by 1 bit to the right), followed by N-2 bytes encoded as (x<<1)+1, followed by the last byte encoded as (x<<2)+2. Guess: this SPI to I2C bridge is some logic function, and this weird encoding was chosen to reduce the number of logic gates.
Cross-check: I2C_Write : 0x70, 0x98, len = 3, data = 0x57; I2C : 57, 80, 03 => 0x38662AF, 0x101, 0xE written to TX register.

I2C_Read:

First, (addr << 11) | (sub << 2) | 0x403 is written to TX, regardless of data size.

If data size (known in advance) is 1, (addr << 11) | 0xFFE is written to SIO1 TX; the response is expected on RX, shifted by 1: out = *sio1_rx >> 1.
Cross-check (returning random values): I2C_Read : 0x70, 0x95, len = 1, data = 0xa0 => 0x38657 and 0x38FFE to TX, 0x677C8741 from RX.

Otherwise, (addr << 9) | 0x3FF is written to TX, and the response is bit-shifted: first read from the RX register gives the most significant 7 bits of the first response char (mask 0xFE, data shifted by 1), second read gives the least significant bit from the first char (mask 1<<8 ) and the most significant 7 bits from the second char (mask 0xFE after shifting left by 1), and so on. The last RX has LSB for char n-1 with mask 1<<10, and all 8 bits for the last char shifted by 1.

Cross-check:

Code: [Select]
[        HDMI:ff9aed94 ] (88:02) I2C_Read : 0x7c, 0xc0, len = 64, data = 0x91
[        HDMI:ff9aee1c ] (88:03) I2C : 91, e4, 71, c7, 95, 85, de, 8e, 7d, 60, 66, 2c, 9f, 19, 28, 35
[        HDMI:ff9aee1c ] (88:03) I2C : 54, 7a, a4, 31, 46, a5, ed, 25, 5a, 29, 1c, 5c, dc, a1, 7e, bd
[        HDMI:ff9aee1c ] (88:03) I2C : f1, 96, 78, ce, 7b, e4, a6, d1, 8d, c2, 4f, 67, 94, 2f, dd, e5
[        HDMI:ff9aee1c ] (88:03) I2C : 23, 62, 40, 5b, a5, 24, 47, 4b, ee, 7d, 2c, 68, ea, d5, 84, e5

=> 0x3E703, 0xFBFF to TX.

Random values were sent to RX to get the above numbers:
Code: [Select]
0x3D666748 -> 0x90 (shl 1, mask 0xFE)
0x352FF5A6 -> 0x91 (mask 0x100, shr 8)
0xEA1E5F2 -> 0xE4 (shl 1, mask 0xFE) [ same register read twice, but... random didn't know that ]
...
0x283B642 -> 0x84
0x75FDEBDC -> 0 (mask 0x400?)
0x7EF1AFCA -> 0xE5 (shl 1, mask 0xFF?)

reddeercity

  • Contributor
  • Hero Member
  • *****
  • Posts: 2039
Re: HDMI reverse engineering
« Reply #4 on: February 06, 2018, 04:42:30 AM »
Here is more info on 12 IC  on page 167 , I believe this is for 5D2 D4 camera , I search the chip ID from images of the main board & things seem to line up , information wise.
 http://www.ti.com/lit/ds/symlink/tms320dm368.pdf

reddeercity

  • Contributor
  • Hero Member
  • *****
  • Posts: 2039
Re: HDMI reverse engineering
« Reply #5 on: February 25, 2019, 02:27:28 AM »
Stumbled upon something interesting , no sure if it belong here
Code: [Select]
c0f1155cIt's  LV-resolution(raw.j.height | HD Width)
default in 1:1 FHD ,
Code: [Select]
4d703ff1239x1023 , kind of matches images buffers read out in Debug (720x480 , 1024x680) at lest in width
and if you switch to 3xcrop_mode buffers changes to (720x480, 1120x752) and c0f1155c read out
Code: [Select]
2ef045f751x1119 , will that matches the image buffer but off by 1 , getting interesting
if you change the last 3 numbers e.g. 868 , nothing happen in Canon liveview
but play a video file e.g. h264.mov and the screen is changed (scrambled)
So I set c0f1155c to
Code: [Select]
0x4d703ff->0x2ef085f


Once reg is disabled playback is normal .
So there more to it then that , looking to find a way to resize canon liveview .
Notice if HDMI is connected and then playback a h264.mov with that modified
Reg set as before (0x2ef085f) everything plays normal , so this thing doesn't effect HDMI side of things just LCD.

DeafEyeJedi

  • Hero Member
  • *****
  • Posts: 3171
  • 5D3 / M1 / 7D / 70D / SL1 / M2
Re: HDMI reverse engineering
« Reply #6 on: February 25, 2019, 04:38:59 AM »
Notice if HDMI is connected and then playback a h264.mov with that modified
Reg set as before (0x2ef085f) everything plays normal , so this thing doesn't effect HDMI side of things just LCD.

This is good to know. Thanks for confirming @reddeercity!
5D3.113 • 5D3.123 • EOSM.203 • 7D.203 • 70D.112 • 100D.101 • EOSM2.*