EOS 200D Firmware Update Crash

[Mauschel84]

Hello everyone,

I have a Canon EOS 200D with the issue that it keeps stucking in the firmware update program. Every update (1.0.1, 1.0.3 or 1.1.0) runs up to 99% and ends with this text pushed together:



So I guess it isn't a problem with the update files (SD Cards already changed), but with the update program itself. After un- and replug the battery, it starts the update program again.
Is this a known issue that could solved easily? The support center recomments a replace of the PCB.
With the ROM Dumper I was able to find out the MainFirmware Boot Flag is disabled.



While my search, I've found the topic "Magic Lantern for 200D: Not Dead Yet edition" https://www.magiclantern.fm/forum/index.php?topic=26681.0, where names_are_hard provided the bootflag enabler.

Bootflag enabler: https://a1ex.magiclantern.fm/bleeding-edge/200D/BOOT200D.FIR

My hope is with reseting the FIR boot flag, the camera will start normally.
I've found the addresses of the flags here: https://magiclantern.fandom.com/wiki/Bootflags. The FIR flag is just only 4 Bytes before the BOOT flag.
Therefore my question: Could someone provide somewhat like a "Firmware flag switcher" please?

Otherwise it remains electronic waste.

Best Thanks for your help
Mauschel84

[Walter Schulz]

Contact kitor and names_are_hard via Discord.
Invitation is linked above.

[names_are_hard]

This is a slightly strange set of symptoms.  What happens if you start the cam with no card?

[Mauschel84]

Without card or with card but no *.fir file on it, the update program keeps hold and told file cannot be found.



With *.fir File I get the query if I want update. But there is no way to cancel. The only button that works is Set and the update process starts, running to 99% and crashs. I'm caught in a loop.

[Walter Schulz]

Funny. This is the same message I get on my EOS M without card inserted. Not sure if this is related.

[kitor]

We are not able to build .fir anymore.
It has bootflag enabled, so try to run a portable rom dumper in autoexec.bin format (do not put any .fir on the card).

If that boots then probably it can be done.

Another way is to switch flags via UART. In such a state if you try to turn on the camera without any card - it will appear completely dead. But it is not - there's a tool (FROMUTIL) running on UART port that allows you to change flags, flash arbitrary files and so on. If used unwisely it can brick the device to the point where physical soldering is needed, but in this case it is just a matter of using one option to toggle the firmware flag.

How did you end up in this situation?

[Mauschel84]

I took the portable autoexec.bin rom dumper from here: https://www.magiclantern.fm/forum/index.php?topic=16534.0 run with the following result:



Might have worked.
For an access to the cam via UART to reset the flag, I have to read up first - I have no idea about it. Do you have a link?

How did I end up in this situation? I have made an firmware update. I've downloaded the latest zip-file (version 1.1.0) from the official german canon website. It was the first update ever done on this cam. It was purchased new at Media Markt 3 years ago. In my eyes there was no suspicious doing till the crash.

[kitor]

Okey, since autoexec.bin runs... have you tried to put ML "not yet dead" edition on that card? It was made for firmware 1.0.1 so it may boot if firmware is not broken.

If I read the flags correctly, main firmware is disabled at the moment. If ML boots (it doesn't care about that flag), rescue will be much easier.

[Mauschel84]

The latest Version 2022-10-31 of the 200D not dead yet edition doesn't start. The screen stays black, only the LED flashed up one time. I've let the cam approx. 10 minutes in this status, screen stood black.
To be sure, I've installed version 1.0.1 over (received from Canon Hong Kong, https://hk.canon/en/support/EOS%20200D/model). But also no change.
I've let the dumped ROMs in the root. I don't know if they are needed, but I guess it doesn't matters.

I suppose the ROM is corrupted.

[kitor]

Check PM.
I sent you two builds: blink_led.bin + enable_main_firm.bin

Try blink_led.bin. If (and only if) card led blinks constantly, there's a good chance that enable_main_firm.bin will work.
Of course files must be renamed to autoexec.bin.

As for rom dumps - if this won't help, please send them in a private message.

[Mauschel84]

I have downloaded the zip-file, copied the blink_led.bin to the SD-Card and have renamed it to autoexec.bin.
The LED blinked once, directly after closing the battery lid. As you said I did not try the enable_main_firm.bin.

The ROM dumps I've sent via PM.

[kitor]

Ok, that means rom is messed up. As said earlier, please send me those rom dumps you have, in a private message. I'll take a look in qemu to see what's wrong and how to fix it.

In such a (unknown) condition enabling a main firmware may even lead to a semi-brick that will be recoverable only by desoldering rom chips.
Oh, those may be failing too - recently I fixed 1300D that was stuck in a boot loop because the ROM chip had problem reading.
Thus examination of ROM dumps is needed.

[kitor]

Just to share some news: It didn't work as whatever happened, camera thinks it has 1.0.1 firmware but it had 1.0.3.
After another reflash this did change and main firmware booted using Magic Lantern:


In this state camera can be tested. When confirmed working, enable_main_firm.bin should restore its ability to boot without Magic Lantern. (this .bin will call EnableMainFirm evproc which should toggle the flag - this can be done via uart too).

[Walter Schulz]

camera thinks it has 1.0.1 firmware but it had 1.0.3.

WTF? Didn't know such a thing can even happen!

[kitor]

IIRC camera updates in-rom firmware version on first reboot. Tthere's a print early on, like this:

Code Select Expand

      317:    142.522 [STARTUP] update inner version string. "3.9.0 0037(00)"
      318:    142.552 [STARTUP] update outer version string. "1.1.0"

[kitor]

The issue got fixed 
Not sure why using call("EnableMainFirm") did crash (evproc works for sure), but later build when I used stubs to directly call PrepareEnableFirmware, EnableFirmware and EnableMainFirm (in that order) did the trick.

I still woudn't recommend upgrading this camera from 1.0.1. Maybe it is something about MPU firmware (which is flashed late in the proces), maybe something other - hard to tell without UART logs of firmware update process.

[names_are_hard]

Nice work

[Mauschel84]

It was a great job, especially your patience. You saved the cam from an existance as electronic waste. 
This cam will never get an update again!
Thanks a lot to kitor!