I'm posting here as reference y best guess why my hack is working.
It may be useful for a possible software side app at one point.
Canon do a very simple calculation.
When camera is running, a counter is setup. When the counter reach a certain level, you have a warning logo.
If you keep recording, the Logo will become a shut down. This raise a flag that I will call “Fake Overheating flag”
At each of these step Canon is writing the exact time this occurs. Let’s call it the “overheat start time”.
This is done in an EEPROM that is kept even if you remove the battery. The writing occurs when you shut down with the power button. This is the mistake right there.
There are only one way of getting the camera to work again is to wait extra time.
Canon do a simple calculation between “actual time” and “overheat start time”. This way, even if the camera is off without battery, they can keep the time running with the help of the RTC.
It’s a way of doing coding something very fast.
They also put a conditional test on “Fake Overheating flag” to make sure changing the time during the overheat mode will not change this calculation. My best guess is that they modify the “overheat start time” with the same value the camera time is shifted in this condition only. So each tentative to play this way is not working.
But I have the impression that the new“overheat start time” is written ONLY when the camera is power down. The new real time is written immediately.
So by dropping the battery, you are avoiding the “overheat start time” to be written and only the last one is in the memory.
When the power is restored, there is the calculation to see if you have been waiting enough. But based on the old “overheat start time”, not the one shifted by the time modification. BOOOOM.
So the “Fake Overheating flag” is now remove and the camera can start.
Even better, The camera is writing this new “Fake Overheating flag” value into the EEprom. So you can turn off the right way and it will restart without any problem.
You can now shift the time back, there is no check for a possible “overheat start time” cause we are not supposed to be in overheating mode.
So whatever card you are using, whatever R5 or R6, whatever firmware… it’s working.
That was my idea at first when I noticed that the battery drop do not save all parameters. An yes, it works so beautifully.