Canon EOS R5 / R6

[Walter Schulz]

Proper connector for UART? Accessible when rubber (if any) is removed?
Q: Are those new things or do they exist in other Canon EOS designs?

[yourboylloyd]

The EOS R & RP have no rubber at the arc.

The rubber is there for a (hopeful) reason on the R5.

The R6 does not have the rubber though

[kitor]

Yes, I'm almost sure it's UART, same connector as R, RP, and similar location hidden in plain sight (under rubber).

The EOS R & RP have no rubber at the arc.

Indeed, it's hidden under thumb rubber on R. Similar in RP, just a little higher.



And R pinout: https://www.magiclantern.fm/forum/index.php?topic=7531.msg212071#msg212071
and BL dumper: https://www.magiclantern.fm/forum/index.php?topic=22770.msg212069#msg212069

Unfortunately v1.1 means that 1.0 is probably lost for now, considering how many of those were shipped / people wanting to upgrade.
I keep my R v1.0 backup as a relic

[Walter Schulz]

Thanks! I really wonder why they decided to change design to an easily accessible one (which adds costs). I'm guessing they realized it would reduce costs on the long run. Just a guess, really!

[kitor]

For R6, as there's no teardown yet (?), after a little digging I found this highres render/photo:



I don't see anything that recalls our familiar connector, but there's this FPC 8 pin connector on top left of PCB, which look suspicious to me, with all the testpads around.
Judging from external photos, this would be not accessible without taking whole port cover part of camera case off, so I'm skeptical about this one.

[yourboylloyd]

You mean this thing?



It looks too small to be the same thing from the R5's PCB.

[Walter Schulz]

Take a ruler. They are pretty close (y-scale).

[yourboylloyd]

Unfortunately it looks like you're right... Even the pins line up


Hopefully it's hidden in plain sight to access like the R and RP.

[c_joerg]

Unfortunately v1.1 means that 1.0 is probably lost for now, considering how many of those were shipped / people wanting to upgrade.
I keep my R v1.0 backup as a relic

I'm not very familiar with ML yet. But from CHDK I know that you can do a dump of the firmware in the camera. Isn't that possible with ML?
If the camera supports Canon Basic, it should be possible ...

[Walter Schulz]

But it doesn't make life that much easier. You cannot install a ROM dump file like a firmware file just by using Canon's menu ...

[kitor]

@yourboylloyd, Walter - yup, I was talking about this exact connector.

We need to wait for any teardown to see if it's actually used, but I highly doubt. If you check any other one, they have black markings on pcb, showing where ribbon goes. This one has none.
Plus connector just below that is recessed in PCB so ribbon can pass freely. This one is so close to edge that it looks intentional for easy external access.

[Walter Schulz]

A detailed pic showing an opened HDMI/USB latch should give a hint.
I agree: It doesn't make sense to build it like this without an "easy way out".

[yourboylloyd]

No hints from what I can see on R6. Unless the screws right there are suspicious. (not to scale, slightly photoshopped to show both rubber ports open).


Edit: The R5 and R6 screws on the right do look a little different though

[Walter Schulz]

Yes, nothing to be found there. USB- and HDMI-connectors are soldered onto the other side, our UART (or else) should be located slighty to the right (vertically in line with screw?) and well above the top-right screw.

[kitor]

If this trail is correct, it would mean that you need to dismount whole part of case assembly. Looks like 4 screws, unless port cover and entire camera back is one assembly (hopefully not)
What I can tell you is that with patience it was possible to disassemble R to motherboard, without leaving any visible marks

[ruthenianboy]

Aligned R6 connector and PCB photo based on assumption silver pads on PCB are for USB-C and micro HDMI respectively (sorry for low res). Then FFC/FPC connector is evidently hidden above screw if not used for something else.

I am definitelly up for ML developement for R5/R6 without doubts.

[yourboylloyd]

So I just got the R6, but unfortunately I noticed that this:



It looks like Canon probably had a huge liability with ver 1.0.0 and the overheating thing if they're shipping it WITH 1.1.0.

Sucks. Looks like we'll never have the original firmware. Might as well call this one the original.

But anyways, let's look for that bootflag UART port!!

[Ant123]

But anyways, let's look for that bootflag UART port!!

Have you tried to dump firmware?

[yourboylloyd]

Not yet, will try first thing in the morning! (los angeles time)

[yourboylloyd]

There is no ROM dumper for the R6.

I've been getting help from guys on discord. I'm going to try to pop open the side panel (with the hdmi/usb/ port) today and see if I can reach the theorized UART port.

[kitor]

There is no ROM dumper for the R6.

Ant123 linked to test if Canon Basic works. This could lead into dumping rom without opening case.

If not, and you'll find UART, you'd probably be able to enable bootflag through it (if you're brave enough) and then use portable dumper compiled as autoexec.bin - the way we did this with R, after confirming with serial bootloader dump that there are no surprises (IIRC it was identical to M50)

And if you will succeed in any way, remember not to share the rom dump, as it obviously contains Canon's copyrighted code.

[yourboylloyd]

Okay sorry. Didn't know that that was a difference. I'll do that now

[yourboylloyd]

Okay so I couldn't get EOScard to work. I kept getting the Drive: 1 ERROR Write Failed message so I decided to skip that step after a while and procedded to open up the camera with the help of the guys on discord.

The camera's screws uses a rare "000 phillips screw" that I had to go out and buy a screwdriver set for. I took apart the 4 screws from the side ports and found that the camera actually is accessible on the side like so:


The green is another screw that I had to take out in order to let that part of plastic come off.

Now when I did that, I was given acess to the board. Unfortunately I tried my hardest but I could not get the entire thing to come off. But it did allow me to see inside where the suspected UART port is:


So it looks easy to get to. The problem is that the pins are extremely tiny. I'm going to try to measure the distance between them once I get a good battery for my calipers. But it's so small that I probably won't be able to tell if the pitch was between 0.4mm or 0.3mm or something.

Does anyone have advice on a way to probe the pins? I have an arduino uno, usb host shield,  FTDI USB UART IC ‘FT232RL’ adapter that can run at 3.3V or 5V, and all the accessories that come with an arduino (breadboard, wires etc). But I don't know how to make a connector that could probe pins that are that small.

@names_are_hard and @coon suggested these two links to try to make a custom connector. But I have little experience in that.

[coon]

I am going to try out the Jtagulator: http://www.grandideastudio.com/jtagulator/

This device can scan up to 24 pins simultaneously and figures out the pinout of UART or JTAG. You can also set the voltage via software at which the device scans the pins (pretty handy for 1.8V pins).
It is a bit expensive but it is also open source so I will solder it by myself within the next few days.

I will let you let you know once I've tried that out but first the PCB and the parts needs to arrive...

[Ant123]

Okay so I couldn't get EOScard to work. I kept getting the Drive: 1 ERROR Write Failed message so I decided to skip that step after a while and procedded to open up the camera with the help of the guys on discord.

Good job! But I suggest you to try again with EOScard. Maybe there need to run it as administrator?