1.3.6 Firmware 5D Mk3 (and other models) Downgrade / Rollback Tutorial

[Apollo7]

Currently tested to be compatible with the following cameras:
5D Mk3
5D Mk2
5Ds

(please report if you have successfully tested other models)

YouTube tutorial here:

YouTube tutorial short version:

Get two SD cards ready:
Important: if you only have one card, are using a CF card, a CF/SD card combination, or want to take your time without the quick swap over please refer to the "battery door" tutorial provided bellow by a1ex

Card A) 1.3.6 (current firmware)
Card B) 1.2.3 (or whatever you're rolling back to)

In camera - menu - select firmware - update
- Wait for the camera to show "firmware update program"
- Watch the little red light (if you take the card out before it goes off, it won't work, take out the battery if you get stuck at the "firmware update program" screen. The red light informs you of the memory card being read/written on; as soon as it's off, take the card with the 1.3.6 out and put in the 1.2.3
- Select the firmware in the new screen, wait for it to downgrade.. Voila, you're now Magic Lantern ready







Battery door method for CF, CF+SD or solo card use (by a1ex)
This let's you slow things down nice and easy:
- copy firmware 1.3.6 (5D300136.FIR) to the card
- launch Update Firmware from Canon menu, click OK
- open the battery door ASAP, but don't remove the battery!
   - if you did it right, the camera will turn off (wait for a few seconds to make sure it's really off)
   - if you see the Firmware Update Program Loading screen, it means you have opened the battery door a bit too late; wait until it disappears and try again!
- open the card door and remove the card from the camera (do not close the battery door; also leave the power switch on)
- copy firmware 1.1.3 (5D300113.FIR) or 1.2.3 (5D300123.FIR) to the card
   - you may leave the original 1.3.6 FIR on the card, or you may delete it; doesn't matter
- put the card back into the camera, close the card door
- close the battery door; you should see the Firmware Update Program Loading screen
- confirm the firmware downgrade from 1.3.6 to 1.1.3 / 1.2.3
- whatever you do, do not remove the battery in the middle of a firmware update!




__________________________________________________________________________________________________________________
Here is the detailed version of what is happening in the background during this process - (thanks a1ex for clarifying it much better than I could):


Yep, it's probably OK, and here's the long answer:

1. You select Update Firmware from Canon menu (main firmware)
2. Canon code checks the firmware version of every FIR file from the card; if any of them is less than 1.3.6, the update is refused (main firmware)
3. Canon code temporarily disables the main firmware
4. Camera reboots itself
5. Canon bootloader looks for a FIR file on the card
6. Canon bootloader loads the FIR file (card LED on)
7. Canon bootloader decrypts the FIR file (card LED off, simple CPU-based loop, no peripherals checked - that's when you remove the card)
8. Canon bootloader executes the FIR file (the one loaded from the first card) which contains a mini DryOS (and a simplified user interface)
9. Firmware updater mounts the card and reads its contents from scratch
10. You confirm the firmware update (from the simplified user interface of the firmware updating program)

From this point, I can no longer tell what exactly is going on, but apparently the firmware file is read once again from the card. In the past, you were able to place multiple FIR files on the card, and the firmware updating program has a feature that allowed selecting one of these FIR files to perform the update. That feature is still there, and it's probably what makes this trick possible. From my limited understanding, you will be using the 1.3.6 updater code, with the payload from the earlier firmware version.

While trying to test the above, I've found a slightly different method, which requires a single card and - in my opinion - is a little safer:
A. select Update Firmware from menu, click OK
B. open the battery door ASAP (but don't remove the battery!)
C. make sure the Firmware Update Loading screen does not appear!
D. camera remains turned off; do not close the battery door
E. remove the card, replace the FIR file and insert it back
F. close the battery door

At this point, Canon bootloader will load the newly copied FIR file and execute it from scratch, without any trickery.

So simple, yet so un-obvious

BTW - if you close the battery door without inserting the card (step E), the camera will show an error message. Reboot and you are back to the old firmware. Explanation: see step 3 (main firmware was disabled temporarily, only for one reboot).

If anything goes wrong, I can offer remote assistance, but cannot guarantee a prompt response. Cannot guarantee a 100% success rate either; you perform the procedure at your own risk.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
His original response to my post here: https://www.magiclantern.fm/forum/index.php?topic=18941.50
Uploaded it on here for clarity

[yourboylloyd]

Thank you so much for this! I can confidently buy a mk3 on ebay now! I was worried about not being able to use ML.

But now, I have questions for developers (because i am noob).

• Can this possibly be used on all Canon cameras? I want to try it on my 5D2, but I'm not sure if there is a point in that other than to say that it works on another camera.
• Could this also be used to flash custom firmware as an entry point? I know it's way more complicated than that and I know that canon has completely changed the way signature and encryption is done for the new DIGIC cameras. Just wondering if this is game changing, or if this has been thought about already.

edit: this does work on my 5D2. Just tested it from 2.1.2 to 1.0.3 then back to 2.1.2-ML

[IDA_ML]

In my opinion, this is the best present that the ML community could receive for Easter.  In my country, the price of an used 5D3 in a good condition has dropped to 1/3-rd of the original price.  I am sure, those who hesitated to buy this camera because of v.1.3.6 firmware, making usage of ML impossible, will now quickly reconsider their decision.  This will breathe in new life to this fantastic camera and will boost the usage of Magic Lantern, accordingly. 

Thank you so much, Apollo7!

[Apollo7]

Glad I could help :-)

[Kharak]

Nice! sticky this tread!

I feel safer getting my 3rd mkiii now!

[ilia3101]

Can you change the title of this post to be less 5D mark 3 specific? And maybe add a list of tested cameras, 5Ds and 5D2 have been confirmed to work, not sure about others (Don't think 5D2 even needs this trick, but it has been tested by yourboylloyd)

[Walter Schulz]

I'm against it! At the moment there is no official ML for 5DS and 5D3.136 users (the only one in need for this procedure) will have more troubles finding relevant information.

[ilia3101]

Ok maybe it is better not to, as 5D3 1.3.6 users are the ones who need it most.

But this might become an essential step to running magic lantern on many cameras in the future.

[Apollo7]

I have marked the thread as 5D Mk3 + other cameras, if anybody tested other cameras that this is required/working for, please let me know and I will add them to the list

[Walter Schulz]

But this might become an essential step to running magic lantern on many cameras in the future.

This may happen. a1ex hasn't confirmed if this method may offer another way to get ML on Digic 6, 7, 8, ... running. Still no solution for our "work force" problem, though (preaching to the choir).

[neilmx7]

Anyone know where I can find firmware version 1.2.3 for the 5d MkIII? Many thanks in advance.

[Walter Schulz]

Top of page -> Downloads -> Download Nightly Builds -> 5D Mark III 1.2.3
-> Installation
or
-> Useful Links

[miatch]

cheers
This is a great thread, all worked well, until,
My issue is that im in 1.3.6. thanx Canon factory, downloaded 1.1.3 and 1.2.4 however when i switch cards it reads as 1.3.3 and wont load ML. Cant figure out for the life of me. Unless its a bootdisk issue which i really cant seem to wrap my head around. In manual mode, everything works fine just wont recognize 113 0r 124 as 133, but no ML at startup.
Thanx

[Walter Schulz]

Sorry, unable to understand your problem.
Please tell which firmware version is installed and shown in Canon menu.

[ChiTownBrad]

Thanks for this great tutorial!  I followed the instructions and my camera said it completed the "upgrade" from 1.3.6 to 1.2.3.  However when I shut off and then turn on the camera it still shows 1.3.6.  Any ideas why this might be happening?  Thanks in advance for your help.

[Walter Schulz]

Redo the process by following instructions found here:
Top of page -> Downloads -> Download nightly builds -> 5D Mark III 1.2.3 -> Installation
Report back

[Narkanin]

Ive tried both methods and firmware stays at 1.3.6 any ideas? Everything goes according to the instructions, Im able to select the old firmware, it loads up but then when it's done the camera still reads 1.3.6

[Walter Schulz]

See reply above yours. Redo installation with this method two or three times. If it doesn't work: Make a video about showing your steps. Don't forget to make contents of each card in use visible.

[a1ex]

Maybe it's worth mentioning that, in some edge cases, the method presented in the video (first post) may fail to downgrade, which is why I recommend the method from the download page - which doesn't come with a video, but so far I'm not aware of any cases where it failed. Some users may be searching specifically for a video tutorial, as the procedure can be tricky to get right.

In other words, a video tutorial describing the method recommended on the download page, could be useful.

[Hari]

I decided to make a video tutorial showing the battery door method as it worked well for me.

[yourboylloyd]

This method does NOT work on the EOS R6. There is so far a workaround though: https://www.magiclantern.fm/forum/index.php?topic=25481.msg232557#msg232557

Nevermind it does work. It has to be almost at the same time on the R6 though. Like painfully quick. But the workaround also works as well