Canon Basic scripting (DIGIC 8, DIGIC X models)

Started by srsa, September 03, 2020, 01:11:27 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

srsa

I'm moving this to a separate thread as it turned out that more models have support for scripting.

So far confirmed to exist on:
PowerShot SX740
EOS M50
EOS R, RP, R5, R6
EOS 250D

About the language. Card setup.
Note that some people have problems making a usable script card. If that happens, try again. If in doubt, a card prepared for scripting can be verified on any older PowerShot from ~2005 on. The card probably needs to be formatted FAT16/32.

Any script error will crash the camera and require a battery pull.

The language used on DIGIC 8 models is the same as described on the above links, but CHDK-related scripts will not work. The reason for this is that the so-called event procedures (named firmware functions) are mostly different.
Unlike on older PowerShots, most of the available event procedures are pre-registered - can be used without running registration procedures.
Also unlike on older cameras, it is possible to try executing an eventproc that may not exist. This can be achieved by using ExecuteEventProcedure.

ExecuteEventProcedure("Peek32",0x1000)
is equivalent to
Peek32(0x1000)
and will return the word read from address 0x1000
ExecuteEventProcedure("arbitrary_invalid_function")
will return -1

Native code can be executed by using ExportToEventProcedure
ExportToEventProcedure("my_func",0xe1234567)
will make the firmware function at 0xe1234566 (with thumb bit) available for script as eventproc my_func

All variables of the script are 32-bit signed integers, interpreted as integer, pointer, pointer to string, as required.
It's worth to note that operator precedence is different from other languages. Negative numbers (that includes pointers to ROM) can have funny effects in expressions involving more than two numbers.

File handling capabilities are quite limited when using only available event procedures - native code must be found and used for reading anything from file, writing a binary file, erasing a file, etc.
String constants are limited to 127 bytes. sprintf() only allows up to 8 substitutions (probably a language limit).

The available event procedures can be harvested from ROM, by looking up the registration functions in the disassembly.

Some example scripts
ROM dumper (main image from 0xe0040000, without bootloader)

private sub Initialize()
    SaveBootableToFile()
end sub

ROM dumper, not working on M50 due to missing eventproc

private sub Initialize()
    SaveAllRomImageToFile()
end sub

Enable bootflag

private sub Initialize()
EnableBootDisk()
end sub

Disable bootflag

private sub Initialize()
DisableBootDisk()
end sub

Dumping camera log (current session)

private sub Initialize()
dumpf()
end sub


I posted a slow dumper script in this older post.

Finally, the usual warning: do not post your ROM dumps publicly.

a1ex

Very cool, thanks for sharing the low-level details!

Also confirmed to work on EOS RP.

kitor

So all eyes are now on R5/R6?  8)

Thank you srsa! I'm still amazed how we overlooked your original post for a few months.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

chris_overseas

Is there any chance someone could create a known-working 256MB SD card image that contains a sample (ROM dumper or otherwise) script, compress it and get that added to the first post? I for one would like to try it with the R5, to eliminate any possibility I messed up when trying to create my own scriptable card.

I'd also like to try this on a CFExpress card to eliminate any drive letter issues. I have one on order but unfortunately it might not arrive in time for my departure on a long trip next week. If it does get here before then I'll test and report back. The SD card slot shows up as "Card 2" in the Canon menus, if that helps (the 5D Mark IV also shows its SD slot as "Card 2").
EOS R5 1.1.0 | Canon 16-35mm f4.0L | Tamron SP 24-70mm f/2.8 Di VC USD G2 | Canon 70-200mm f2.8L IS II | Canon 100-400mm f4.5-5.6L II | Canon 800mm f5.6L | Canon 100mm f2.8L macro | Sigma 14mm f/1.8 DG HSM Art | Yongnuo YN600EX-RT II

c_joerg

How do you test Canon basic scripts?
Is there a syntax check or debug facility?
Or do you have to take out the card every time and try again?
EOS R

Walter Schulz


kitor

When I got ERR70 due to calling wrong (not existing?) function on R, it was enough to open card door. Error disappeared from top screen, camera booted as usual.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

yourboylloyd

Quote from: chris_overseas on September 03, 2020, 08:08:00 AM
Is there any chance someone could create a known-working 256MB SD card image that contains a sample (ROM dumper or otherwise) script, compress it and get that added to the first post? I for one would like to try it with the R5, to eliminate any possibility I messed up when trying to create my own scriptable card.

I second this statement. It is super unlikely that we both messed up, but this would be to make sure that we didn't mess up.

Can someone please create that working SD card image so that we can try it on the R5 and R6?
Join the ML discord! https://discord.gg/H7h6rfq

kitor

Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

kitor

Card image

Image of 512MB card. Uncompress, and use DD or Win32DiskImager to write to any card of the same size, or above.
Has rom dumper script. Worked fine on R.

After you put card in your camera, go to play mode and press ???. In case of R it was Q/Set, but those are separate buttons now. Set is better candidate as it's Func./Set on powershots :)
If access led will go red, or camera will crash - we are golden.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

chris_overseas

Thanks kitor, much appreciated. I tried various combinations of Play followed by buttons and dials, pulling the battery each time (not sure that's needed or not?) using your image. I also tried it with and without an image on the card in case that matters, and with the card write protected. Unfortunately still no luck on the R5, so either the way to trigger it isn't very obvious or scripting doesn't work at all :(
EOS R5 1.1.0 | Canon 16-35mm f4.0L | Tamron SP 24-70mm f/2.8 Di VC USD G2 | Canon 70-200mm f2.8L IS II | Canon 100-400mm f4.5-5.6L II | Canon 800mm f5.6L | Canon 100mm f2.8L macro | Sigma 14mm f/1.8 DG HSM Art | Yongnuo YN600EX-RT II

Walter Schulz

Maybe subject needs to be chanced a bit. My 250D/200D Mark II/Rebel SL3/Kiss X10 does execute Canon Basic script and produces ROM.TXT. Zero Bytes but it is written nevertheless!
Correction: 2 129 920 Bytes
Want to have a look? -> PN

Any hints what is needed to dump valid bits and bytes?

90D, M6 II, G7X III: Users around? Making a script card is easy!
If there are troubles I promise to assist via Teamviewer (or else).

srsa

Quote from: Walter Schulz on September 04, 2020, 05:14:00 PM
Maybe subject needs to be chanced a bit. My 250D/200D Mark II/Rebel SL3/Kiss X10 does execute Canon Basic script and produces ROM.TXT.
Hmmm, what an avalanche. Changed the 1st post and thread title.
If you want something more useful and faster, try
private sub Initialize()
    r = ExecuteEventProcedure("SaveAllRomImageToFile")
    if r = -1 then
        ExecuteEventProcedure("SaveBootableToFile")
    end if
end sub

I gladly accept (links to) dumps in PM.

Walter Schulz


srsa


kitor

Quote from: chris_overseas on September 04, 2020, 05:07:06 PM
I also tried it with and without an image on the card in case that matters, and with the card write protected

Have you tried both card slots? It was mentioned a couple of times that this needs to be B:\ from DryOS PoV, and we don't know the actual mapping.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

yourboylloyd

Quote from: kitor on September 04, 2020, 08:10:42 PM
Have you tried both card slots?

I tried the Kitor card.img on both slots on the R6. Nothing
Join the ML discord! https://discord.gg/H7h6rfq

Walter Schulz

Card verified to work in other cam?
If not: Card size? Partition size? File system?

yourboylloyd

Yes. Kitor sent us his card image that has been verified. If you have another working card image I'll be happy to try that
Join the ML discord! https://discord.gg/H7h6rfq

Walter Schulz

No, there is no verification this card is working. It is verified Kitor's card is working not the one in your hand.
Use a Digic 8 camera or almost any PowerShot codebased cam produced after 2005.

kitor

Just FYI - in both cases (512MB SD and 32GB via adapter) it was Sandisk cards.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

Ant123

Quote from: yourboylloyd on September 04, 2020, 08:36:29 PM
I tried the Kitor card.img on both slots on the R6. Nothing
What is the size of the card you tried?

yourboylloyd

The card I tried is 128GB originally. I don't have any other card size. I'll go out and try to buy a cheap sd card that's smaller.

I also don't have any other camera. ( I do know someone with an M50 though. Maybe I can try to borrow that one but I won't be able to do that until sunday or monday.)
Join the ML discord! https://discord.gg/H7h6rfq


Ant123

There need to try SD or SDHC(not SDXC) card first. Is that so hard?