Author Topic: (M)JPEG encoder (Read 85596 times)

Marvin · « **Reply #50 on:** September 20, 2012, 06:31:22 PM »

I believe the code was written by Japanese programmers, "Jukai" is a place in japan (sea of trees), where many people go there and commit suicide. Jukai is a place that's often associated with death.

nanomad · « **Reply #51 on:** September 20, 2012, 06:51:23 PM »

That means it's probably some sort of cleanup routine. Thanks for the info.

(or maybe the code is so fucked up the programmer hated it

)

Marvin · « **Reply #52 on:** September 20, 2012, 07:29:24 PM »

I guess they did this on purpose to make reverse engineering more difficult...

one off-topic thing, nanomad there is a grammar mistake in your headline "All your websites are belong to us", it should be "All your websites belong to us" or "All your websites are ours"

a1ex · « **Reply #53 on:** September 20, 2012, 07:30:45 PM »

http://en.wikipedia.org/wiki/All_your_base_are_belong_to_us

Marvin · « **Reply #54 on:** September 20, 2012, 07:45:29 PM »

Quote from: a1ex on September 20, 2012, 07:30:45 PM

http://en.wikipedia.org/wiki/All_your_base_are_belong_to_us

that's eye-opening... but it still hurts me when I see grammar mistake $:-\$

Chucho · « **Reply #55 on:** September 20, 2012, 08:45:10 PM »

%1, info on WriteEDmacPackMem can be found here http://magiclantern.wikia.com/wiki/Register_Map

nanomad · « **Reply #56 on:** September 20, 2012, 08:58:06 PM »

Quote from: Marvin on September 20, 2012, 07:29:24 PM

I guess they did this on purpose to make reverse engineering more difficult...

I've actually worked on code where half the functions were documented in Chinese. Never underestimate the laziness of programmers ...
As far as I know most of the "core" development is still done by Canon JP so that actually makes sense

jplxpto · « **Reply #57 on:** September 21, 2012, 01:36:48 AM »

Quote from: nanomad on September 20, 2012, 06:51:23 PM

That means it's probably some sort of cleanup routine. Thanks for the info.

(or maybe the code is so fucked up the programmer hated it )

The life is fucked... be a programmer is like living in a bed of roses with many thorns ... lololol

jplxpto · « **Reply #58 on:** September 21, 2012, 02:01:32 AM »

Quote from: 1% on September 19, 2012, 06:39:23 PM

FA_LvJpegCheck 429392408 << returns this.

called like:

int *foof;
*foof = 24;
FA_LvJpegCheck(&foof);

Also found virtual keyboard but can't get it to come up.
319: 22447.067 [GUI] ERROR ***** GetMenuTypeFromVKType illegal type(0)
320: 22447.176 [GUI] ERROR ***** INPUT_BUF_SIZE = 0

But this OT

----------------------------

Code: [Select]

NSTUB(0xFF8B9B74, StartVirtualKeyboard)           // might be good (dumps=1, score=50)
NSTUB(0xFF8B9F24, DlgVirtualKeyboard)             // might be good (dumps=1, score=0.97)
NSTUB(0xFF8BC060, StopVirtualKeyboard)            // Good. Found matches: ff8bc060/16, ff8bc050/0.18

1% · « **Reply #59 on:** September 21, 2012, 05:16:02 AM »

I tried startvirtualkeyboard but I didn't try the dialog... this would make renaming things, etc much easier, no?

Hehe, there was a reason I didn't want to code for a living....

nanomad · « **Reply #60 on:** September 21, 2012, 09:13:09 AM »

You keep forgetting about function parameters

Try calling StartVirtualKeyboard(0x10) and make sure you have a hidden canon menu in the background

1% · « **Reply #61 on:** September 22, 2012, 06:08:21 AM »

http://imgur.com/KYVQg

Not sure how to set the dmac register.

EngDrvOut(0xC0F27000, 4);

nanomad · « **Reply #62 on:** September 22, 2012, 09:36:01 AM »

So it worked? Great!
Now we need to figure out where the resulting string is stored

nanomad · « **Reply #63 on:** September 22, 2012, 04:48:54 PM »

From the 1100D

Code: [Select]

M:FF10DC10 FA_GetJpegBufForLV                      ; DATA XREF: ROM:FF535FB0o
ROM:FF10DC10                 LDR     R0, =0x50AC
ROM:FF10DC14                 LDR     R0, [R0,#0x38]
ROM:FF10DC18                 BX      LR
ROM:FF10DC18
ROM:FF10DC18 ; End of function FA_GetJpegBufForLV

ROM:FF10DC1C FA_GetJpegSizeForLV                     ; DATA XREF: ROM:FF535FA8o
ROM:FF10DC1C                 LDR     R0, =0x50AC
ROM:FF10DC20                 LDR     R0, [R0,#0x34]
ROM:FF10DC24                 BX      LR
ROM:FF10DC24
ROM:FF10DC24 ; End of function FA_GetJpegSizeForLV

They are never called like on the 600D

1% · « **Reply #64 on:** September 22, 2012, 06:39:44 PM »

Didn't work, was asking if I did that right. Keyboard worked though.

nanomad · « **Reply #65 on:** September 22, 2012, 07:00:12 PM »

I was talking about the keyboard

Did you manage to read the entered string?

1% · « **Reply #66 on:** September 22, 2012, 11:35:15 PM »

Didn't move since I put a canon menu in the background via piggyback function. But I assume where the string goes can be found via looking at the function in firmware. I'd really like to see what how a1ex did pacmem edmac register and see what it does on 600D. Theoretically he shouldn't have LVCDEV running either and when I called the fa test function jpeg has a read buffer or address but not a wire. Better than trying to start it up with all of those parameters.

I think I'm missing a lot of parameters because I'm going off the HTML and not doing it in IDA. Maybe I need to start/learn that and arm console so I can look at more than just what it gives me. I don't see flags or how many parameters it takes, etc.

For me, FA_GetJpegBufferforLV just a pointer.

Chucho · « **Reply #67 on:** September 22, 2012, 11:54:13 PM »

1%, I don't use IDA, I use http://pel.hu/armu/ good free program. Pel is also a good programmer, photographer and friend.

1% · « **Reply #68 on:** September 23, 2012, 01:30:38 AM »

not 100% under wine but I like it much better than IDA.

nanomad · « **Reply #69 on:** September 23, 2012, 09:17:08 AM »

Looks nice, I'm trying it

jplxpto · « **Reply #70 on:** September 23, 2012, 07:50:19 PM »

I found this in the firwmare 5DC v1.1.1

Code: [Select]

ff983150 EnoJPEG4:jpgShare.c::CREATED BY M.ENOKIDA, CANON INC.
ff983b6c EnoJPEG4:jpgRCore.c::CREATED BY M.ENOKIDA, CANON INC.
ff986fe4 EnoJPEG4:jpgRScal.c::CREATED BY M.ENOKIDA, CANON INC.
ff9882e0 EnoJPEG4:jpgRVLC.c::CREATED BY M.ENOKIDA, CANON INC.
ff98b704 EnoJPEG4:jpgRClr.c::CREATED BY M.ENOKIDA, CANON INC.

ffab719e  encdec_jpeg rev2.12 2004/11/11 Yukio Chiba & Satoshi Naito

and this on the 40D firmware v1.1.1

Code: [Select]

ffc170e4 EnoJPEG4:jpgShare.c::CREATED BY M.ENOKIDA, CANON INC.
ffc17b14 EnoJPEG4:jpgRCore.c::CREATED BY M.ENOKIDA, CANON INC.
ffc1b210 EnoJPEG4:jpgRScal.c::CREATED BY M.ENOKIDA, CANON INC.
ffc1c4fc EnoJPEG4:jpgRVLC.c::CREATED BY M.ENOKIDA, CANON INC.
ffc29310 EnoJPEG4:jpgRClr.c::CREATED BY M.ENOKIDA, CANON INC.

ffcfdcb6  jp56_jpeg rev3.31 2007/02/19 Yukio Chiba & Satoshi Naito

1% · « **Reply #71 on:** September 23, 2012, 08:49:08 PM »

There is an enojpeg4.dll in canon zoom browser. Wonder whats in it.

jplxpto · « **Reply #72 on:** September 23, 2012, 09:10:11 PM »

Quote from: Chucho on September 22, 2012, 11:54:13 PM

1%, I don't use IDA, I use http://pel.hu/armu/ good free program. Pel is also a good programmer, photographer and friend.

I also already know that emulator but when I tested had some difficulty. In brief test it again. If I need to, I know who I can ask for help

... my friend

1% · « **Reply #73 on:** September 26, 2012, 01:03:51 AM »

Back OT:

What about:

FF56E9CC: ff111534 ; 0xff111534: pointer to 0xe51f1140
FF56E9D0: ff72db27 ; *'lv_save_jpeg'

a1ex · « **Reply #74 on:** September 26, 2012, 01:05:24 AM »

OK on 5D2, does nothing on 5D3.

News:

Author Topic: (M)JPEG encoder (Read 85596 times)