Eos 2000D

[Thermic]

Hello!
I'm new in the photography. I'm come from Germany and my english isn't the best.
I use a Canon 2000D and i would like to use Magic Lantern on my camera.
Now i've a question...
How can I use Magic Lantern on Canon Eos 2000D?
Who gives me a step by step guide in easy words?
Thanks! 

[Walter Schulz]

Not supported. ROM dumper available:
https://www.magiclantern.fm/forum/index.php?topic=16534.0

[Thermic]

Thank you!
I have seen this, but I didn't really understand what to download and how to use it.
Can you help me, please?
Maybe I can help with the development.
What exactly do I have to do to try this out?
Which programs do I have to download?

[Walter Schulz]

ROM dumper: You just have to click on the link for 2000D, download the fir, copy it to a card, run firmware upgrade with this FIR, check MD5 checksums for your ROM files against the values computed during "firmware update" and stored in *.MD5 files.
If your cam computes any files, of course. Share results in linked thread. Do *not* post BIN files because of copyright infringement.
2000D hasn't been tested within QEMU (software emulator) yet, so I suggest to wait for a1ex (or another dev) to contact you to make 2000D emulation run on QEMU.
If you have another cam supported in QEMU you may want to start there.

[Thermic]

Hello!
I've started the fir-file on my camera with a memory card of 8gb.
But i don't understand the result...




I did the same test with another memory card (64gb). it didn't work with that one.
What i've to do now?

[Walter Schulz]

Worked as expected.
Maybe a1ex feels an itch to make 2000D emulation happen.

Next step is ... well ... not that easy to determine.
Today there is no maintainer in sight willing and able to start porting ML to 2000D. Ever considered spending hundreds of hours building up some codings skills?

[a1ex]

I'm currently (well, when I'm not at work) cleaning up a bunch of QEMU changes, one of them being emulation support for 4000D. I'd expect the 2000D to be very similar (if not nearly identical), so... just PM me a copy of the ROM dump.

Other than that, I have no plans to port ML to this camera, because... it's likely very easy (i.e. doable by other members of the ML community, even without prior experience with Canon internals). It's going to be fully debuggable in QEMU (you can already navigate Canon menus on 4000D and 1300D, and I have no reason to believe it's going to be different on 2000D).

I prefer to focus on researching DIGIC 6/7/8 models, which are a lot more difficult, but even there I need help from somebody who has the camera (and the help should not be just testing, but also coding and debugging). Why? I'm just one random guy doing this in my spare time. There are already 16 camera models already running ML relatively well (not counting 450D, 5D, 1300D and EOSM2), that require maintenance, at least making sure the codebase doesn't break when introducing new features, and so on. Adding nearly 25 new models to the mix is simply not going to scale. To address this, I'm focusing primarily on emulation - both to make it easy for others to get started with development, and also to reduce the need for manual testing (which is extremely time consuming; relying on user feedback is no longer an option).

With emulation, my goal is to be able to check - by pressing a button - whether some code change is going to work on all of the supported camera models, or not. I'm not able to ask 16 people whether the current feature set (with hundreds of menu options) is still working after every code change (let alone 40, after porting ML to the remaining EOS models). I'm able to do so, to a limited extent, in QEMU, although I'm just scratching the surface currently.

Still, every single camera model has specific quirks that are best figured out by somebody who has the camera in their hands. I'm here to help, but unfortunately I'm unable to do much hand-holding (especially on topics previously covered).

[MikeD33]

I'd really like ot get Magic Lantern on my 2000D.

Here's the output of the two MD5 files:

ROM0.MD5
66354cabd287d45faae4c6158ba09606  ROM0.BIN

ROM1.MD5
ae16b4d902d4c02c269b638a6c1b02c8  ROM1.BIN


and the rescue log:

  Magic Lantern Rescue
----------------------------
- Model ID: 0x432 2000D
- Camera model: Canon EOS 2000D / K432
- Firmware version: 1.0.0 / 2.3.2 13(03)
- IMG naming: 100CANON/IMG_0584.JPG
- Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
- ROMBASEADDR: 0xFE0C0000
- card_bootflags 1069ec
- boot_read/write_sector 1071e0 1072d8
- 101F70 Card init => 2
- Dumping ROM0... 100%
- MD5: 66354cabd287d45faae4c6158ba09606
- Dumping ROM1... 100%
- MD5: ae16b4d902d4c02c269b638a6c1b02c8
- No serial flash.
- Saving RESCUE.LOG ...

[neno4real]

same issue, what next?

  Magic Lantern Rescue
----------------------------
- Model ID: 0x432 2000D
- Camera model: Canon EOS 2000D / K432
- Firmware version: 1.0.0 / 2.3.2 13(03)
- IMG naming: 100CANON/IMG_8834.JPG
- Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
- ROMBASEADDR: 0xFE0C0000
- card_bootflags 1069ec
- boot_read/write_sector 1071e0 1072d8
- 101F70 Card init => 2
- Dumping ROM0... 100%
- MD5: 66354cabd287d45faae4c6158ba09606
- Dumping ROM1... 100%
- MD5: 60870008a710d802a9856d8f343a19a8
- No serial flash.
- Saving RESCUE.LOG ...


edit: i just find some new options
thank you

[Walter Schulz]

same issue, what next?

Finding someone willing and able to work on it.
Unicorn level: Developer skilled with C, Assembler and reverse engineering embedded devices (ARM architecture) with a lot of spare time at hand.
If you start learning those skills today we might see an early port in 2023. Estimated workload: 365+ hours. YMMV.

[giuliom92]

I'm very new but if I can help here's my result:


  Magic Lantern Rescue
----------------------------
- Model ID: 0x432 2000D
- Camera model: Canon EOS 2000D / K432
- Firmware version: 1.0.1 / 2.3.3 13(03)
- IMG naming: 100CANON/IMG_1818.JPG
- Boot flags: FIR=0 BOOT=0 RAM=-1 UPD=-1
- ROMBASEADDR: 0xFE0C0000
- card_bootflags 1069ec
- boot_read/write_sector 1071e0 1072d8
- 101F70 Card init => 2
- Dumping ROM0... 100%
- MD5: 66354cabd287d45faae4c6158ba09606
- Dumping ROM1... 100%
- MD5: 408c5701c834d2bbbe03fe724d843fe7
- No serial flash.
- Saving RESCUE.LOG ...

I tried with the canon updated firmware 1.0.1

[Walter Schulz]

@all: Please do not post more dump results. It is already established that ROM dumper on 2000D is working properly: See MikeD33's reply who posted an MD5 checksum validation.

[Uerati]

I used the Magic Lantern on my 1100D but now i have a 2000D. There's a way to use it? I hope ML helps to use third party flashes

[vini-braga]

2000D is the Rebel T7?

[stergro]

2000D is the Rebel T7?

I believe so, yes. For some reason they are marketed differently in the US than in Europe.

I have a very high interest in a port as well. Is there something similar to Bug Bounty for magic latern where we can collect money for anyone who wants to work on it?

[BarrowWight]

Hello to you all. I just created an account as I recently got a Rebel T7 (US Name for EOS 2000D) and dumped the firmware from it onto it. I have some experience with Ghidra (A software RE tool) and with the ARM architecture.

I would be happy to help figure out more about how the 2000D is set up to try to get magic lantern running on it.

Does Magic Lantern have any DIGIC 4+ cameras already working for reference (or with their firmware reverse engineered)? Ghidra has a very useful feature where I can take a already reverse-engineered program and identify matching functions in once that has not been reverse engineered.

So far I have found the following webpages as potentially useful sources for information on the CPU Architecture.
https://foss.heptapod.net/magic-lantern/magic-lantern/-/blob/branch/qemu/contrib/qemu/HACKING.rst
https://magiclantern.fandom.com/wiki/Register_Map

Are there any bits of documentation that might be useful for getting started with figuring out how the code is set up?

[Walter Schulz]

Does Magic Lantern have any DIGIC 4+ cameras already working for reference (or with their firmware reverse engineered)?

Kind of: https://www.magiclantern.fm/forum/index.php?topic=17969.msg235762#msg235762
Most dev talk takes place in Discord (linked top left).

[kitor]

With a little bit of a fiddle it is possible to boot 2000D rom 1.1.0 in QEMU 2.5.0.



Camera is very similar to 1300D, mostly the same tricks are needed (this) as Alex explained in and this, this and this post.

Including requiring ROM1 patching before it will boot:

Code Select Expand

dd if=ROM1.BIN of=BOOT.BIN bs=64k skip=1 count=1
dd if=BOOT.BIN of=ROM1.BIN bs=64k seek=511

Camera has 512MB of RAM. Won't boot straight to GUI because for some reason it thinks it started on HDMI (at least my dump does). Requires a bit of manual fiddling in serial console to bring image on screen.
Print   1128:  1893.120 [LV] Is PROP_OUTPUT_TYPE Real??[H:1][V:0][O:0] may be related, I'm not going to investigate further.

Put rom dumps in 2000D subdir. Do all mods listed below. Boot with following comand:

Code Select Expand

./run_canon_fw.sh 2000D,firmware="boot=0" -d debugmsg -s -S & arm-none-eabi-gdb -x 2000D/debugmsg.gdb
Read 2000D/patches.gdb on how to bring GUI to LCD.

Since I don't have write access to main repo, and my qemu instance is a bit modified, below is a list of changes needed.

qemu-2.5.0/hw/eos/model_list.c

Code Select Expand


// add this section below 1300D
// indents where I'm not sure, however should be the same as 1300D (common for Digic4+).
    {
        .name                   = "2000D",
        .digic_version          = 4,
        .ram_size               = 0x20000000,   /* 512MB */
        .rom0_size              = 0x02000000,   /* 32MB */
        .rom1_size              = 0x02000000,   /* 32MB */
        .firmware_start         = 0xFF0C0000,
        .dryos_timer_id         = 1,            /* set to 10ms; run with -d io,int,v to find it */
        .dryos_timer_interrupt  = 0x09,         /* enabled right before setting the timer value */
          .mpu_request_register   = 0xC022D0C4,   /* written in mpu_send (run with -d io) */
          .mpu_request_bitmask    = 0x00100000,   /* 0x83DC00 request, 0x93D800 idle */
          .mpu_status_register    = 0xC022F484,   /* read in SIO3_ISR and MREQ_ISR (tst 0x40000) */
        .current_task_addr      = 0x31170,
          .sd_driver_interrupt    = 0x4B,
        .sd_dma_interrupt       = 0x32,
          .uart_rx_interrupt      = 0x38,
        .rtc_time_correct       = 0x31,         /* RTC_TIME_CORRECT_CHANGE */
          .rtc_cs_register        = 0xC022D0B8,   /* GPIO set/cleared in rtc_read */
        .dedicated_movie_mode   = 1,
      //.imgpowdet_register     = 0xC022F484,   /* Image Power Failure (FIXME: shared with mpu_status_register)  */
      //.imgpowdet_register_bit = 0x00080000,   /* register and bit checked to print that message */
    },

qemu-2.5.0/hw/eos/engine.c

Code Select Expand


// replace all:
if (strcmp(s->model->name, "1300D") == 0)
// with:
if ( (strcmp(s->model->name, "1300D") == 0) || (strcmp(s->model->name, "2000D") == 0) )


qemu-2.5.0/hw/eos/eos.c

Code Select Expand


// only in static void eos_rom_write(), replace:
if (strcmp(s->model->name, "1300D") == 0)
// with:
if ( (strcmp(s->model->name, "1300D") == 0) || (strcmp(s->model->name, "2000D") == 0) )

// in static int check_rom_mirroring() comment out assert(0) and change return 1 to return 0
// no idea why this check fails.


qemu-2.5.0/hw/eos/mpu.c

Code Select Expand


// below:
MPU_BUTTON_CODES_OTHER_CAM(1300D, 1200D)
// add:
MPU_BUTTON_CODES_OTHER_CAM(2000D, 1200D)

// below:
MPU_SPELL_SET_OTHER_CAM(1300D, 600D)
// add:
MPU_SPELL_SET_OTHER_CAM(2000D, 600D)



2000D/patches.gdb

Code Select Expand

# ./run_canon_fw.sh 2000D -s -S & arm-none-eabi-gdb -x 2000D/patches.gdb
# Only patches required for emulation

source patch-header.gdb

# Specific for ROM 1.1.0
# Break out of loop waiting for HDMI connect
b *0xfe2aa940
commands
    jump *0xfe2aa98c
end

# after it ends booting - starts printing in DebugMsg:
#    DlgShootOlc.c LOCAL_DIALOG_REFRESH
# go to qemu serial console and type:
#    akashimorino
#    DisconnectHDMI
#    SetDisplayType
# this will bring GUI back from HDMI to emulated LCD

source patch-footer.gdb

2000D/debugmsg.gdb

Code Select Expand


# ./run_canon_fw.sh 2000D -d debugmsg
# ./run_canon_fw.sh 2000D -d debugmsg -s -S & arm-none-eabi-gdb -x 2000D/debugmsg.gdb

source -v debug-logging.gdb
source -v 2000D/patches.gdb

# To get debugging symbols from Magic Lantern, uncomment one of these:
#symbol-file ../magic-lantern/platform/2000D.110/magiclantern
#symbol-file ../magic-lantern/platform/2000D.110/autoexec
#symbol-file ../magic-lantern/platform/2000D.110/stubs.o

macro define CURRENT_TASK 0x31170
macro define CURRENT_ISR  (MEM(0x63C) ? MEM(0x640) >> 2 : 0)

# GDB hook is very slow; -d debugmsg is much faster
# ./run_canon_fw.sh will use this address, don't delete it
# b *0xFE11F3C8
# DebugMsg_log

b *0x38FC
task_create_log

b *0x3CBC
assert_log

b *0x2E50
register_interrupt_log

b *0xFE120144
register_func_log

b *0xFE2BDD80
CreateStateObject_log

cont



Bonus, smemShowFix, but from QEMU so take with a grain of salt:

Code Select Expand


[RSC] IMGVRAM1                0x40D00000 0x00410000 4259840
[RSC] FILE_HEADER             0x41110000 0x00200000 2097152
[RSC] DEVELOP_WORK            0x41310000 0x00074000 475136
[RSC] FENCING_WORK            0x41384000 0x00010000 65536
[RSC] LV_QUARK1               0x41394000 0x00064000 409600
[RSC] EXMEM3_AREA             0x42100000 0x02F00000 49283072
[RSC] BMPVRAM1                0x42000000 0x00080000 524288
[RSC] BMPVRAM2                0x42080000 0x00080000 524288
[RSC] EXMEM3_2_AREA           0x5E9E3600 0x007A8A00 8030720
[RSC] --- Usually Mode ----
[RSC] MEMORY_MGR              0x48200000 0x0D200000 220200960
[RSC] ---    NR Mode   ----
[RSC] NR_MEMORY_MGR           0x48200000 0x0D200000 220200960
[RSC] COMPOSITION_WORK_TOP    0x5B6E3600 0x03300000 53477376
[RSC] COMPOSITION_WORK_BOTTOM 0x0 0x00000000 0
[RSC] ---    DP Mode   ----
[RSC] DP_MULTI                0x50000000 0x07E00000 132120576
[RSC] DP_SINGLE               0x48200000 0x07E00000 132120576
[RSC] --- Indev Mode ----
[RSC] [INDVMGR]               0x45800000
[RSC] YUV                     0x5891CA00 0x02DC6C00 48000000
[RSC] YUV_OUT                 0x5B6E3600 0x02DC6C00 48000000
[RSC] INDV_WORK               0x48200000 0x07E00000 132120576
[RSC] --- Common Bottom ----
[RSC] [BOTTOM1]               0x50000000
[RSC] IMGVRAM2                0x58000000 0x00410000 4259840
[RSC] LV_QUARK2               0x58410000 0x00064000 409600
[RSC] IMGPLAY_WORK1           0x45000000 0x00800000 8388608
[RSC] AVERAGE_WORK_TOP        0x5891CA00 0x016E3600 24000000
[RSC] AVERAGE_WORK_BOTTOM     0x5A000000 0x016E3600 24000000
[RSC] IMGVRAM3                0x5F18C000 0x00410000 4259840
[RSC] LV_WB                   0x5F59C000 0x0002BC00 179200
[RSC] LV_FACEYUV              0x5F5C7C00 0x000E1080 921728
[RSC] LV_HIST                 0x5F6A8C80 0x00002000 8192
[RSC] LV_ANGEL                0x5F6AAC80 0x00028A30 166448
[RSC] LV_FENCING              0x5F6D36B0 0x00020C80 134272
[RSC] LV_QUARK3               0x5F6F4330 0x00064000 409600
[RSC] VSHADING_COMP_WORK      0x5F759000 0x00122000 1187840
[RSC] DARKCUR_COMP_WORK       0x5F87B000 0x00021000 135168
[RSC] CAPTURE_WORK1           0x5F89C000 0x00280000 2621440
[RSC] ENGINE_MIRROR           0x5FB1C000 0x00080000 524288
[RSC] DCFNO                   0x5FB9C000 0x00004000 16384
[RSC] IMGPLAY_WORK2           0x5FBA0000 0x00400000 4194304
[RSC] LV_MARGE_PDEFDATA1      0x5FFA0000 0x00010000 65536
[RSC] LV_MARGE_PDEFDATA2      0x5FFB0000 0x00010000 65536
[RSC] LV_MARGE_PDEFDATA3      0x5FFC0000 0x00010000 65536
[RSC] LV_MARGE_CROP           0x0 0x00000000 0
[RSC] LV_MARGE_ZOOM           0x5FFD0000 0x00010000 65536
[RSC] LV_WORK                 0x5FFE0000 0x0001FF80 130944

[kitor]

Please note that post above does not mean that anyone is working on 2000D port. I am not.

However from what I saw during qemu bring up, camera seems similar enough to 1300D Critix port. I expect his progress may be easily ported to this one.

https://github.com/reticulatedpines/magiclantern_simplified/pull/40

[critix]

Yes, 2000D is very similar to 1300D ...
I started looking for stubs values and constants ...

[BARRIIICADE]

Would LOVE to see something come of this though!, i've been sitting on a 2000d for over a year now hoping that one of you smarter people would start picking at it!.

THERE IS HOPE! :O

Please note that post above does not mean that anyone is working on 2000D port. I am not.

However from what I saw during qemu bring up, camera seems similar enough to 1300D Critix port. I expect his progress may be easily ported to this one.

https://github.com/reticulatedpines/magiclantern_simplified/pull/40

[critix]

I found the values for stubs.S and consts.h for 2000D (comparing the values with 1300D and other devices): https://github.com/ccritix/magic-lantern/tree/branches/1300D/platform/2000D.110
In raw.c, dynamic_ranges has the following values:

Code Select Expand

#ifdef CONFIG_2000D
static int dynamic_ranges[] = {1095, 1104, 1075, 1027, 953, 874, 785};
#endif

[kitor]

Buildable / works on qemu / real cam?

[critix]

Not yet...I'm working on this

[BARRIIICADE]

Not yet...I'm working on this

I Believe in you!. I would LOVE to one day actually be able to use my 2000d for longer than 30 minutes lol.