Canon Basic scripting (DIGIC 8, DIGIC X models)

Started by srsa, September 03, 2020, 01:11:27 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

c_joerg

Quote from: c_joerg on February 08, 2022, 11:24:59 AM
' Not tested!
' author c_joerg

dim count = 0

private sub Initialize()
  fileName = "B:/CCDTemp.TXT"
  RemoveFile(fileName)

  f = OpenFileCREAT(fileName)
  CloseFile(f)

  f = OpenFileWR(fileName)
 
  do while count < 10
     WriteFileString(f, "CCDTemperature: 0x%08X  ", GetCCDTemperature())
     WriteFileString(f, "BatteryVoltage: 0x%08X\n", GetBatteryVoltage())
     SleepTask(1000)
     count = count + 1
  loop
   
  CloseFile(f)

end sub


The script did not crash but delivers just 0

CCDTemperature: 0x00000000  BatteryVoltage: 0x00000000

May be i have to call some 'Create' stuff...

EOS R

kitor

In EOS world, A: is CF card, B: is SD, C: is USB drive connected to WFT on older models (gone from references on D8, maybe earlier).

Not sure how this is assigned on R6 (which card is which), but holds up true on "supported" D8 models.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

kitor

I have bad news for you. Checked the decomp, GetCCDTemperature is a dummy function (return 0). GetBatteryVoltage goes through a few jumps, but ends up in dummy function too.
It is not that uncommon to have "do nothing" evprocs, I already saw a few of those.

On R180.739 you can see temperature sensors readout at e01ae6f8, including conversion from raw to Celcius.

StartAllTempMeasurement will result in following on UART (seems that there's no actual sensor in ICU (WARP is ARM core on D8), or something is needed to initialize it):

     3567: 363770.123 WARP : -256.0
     3568: 363770.131 SH   : 23.0
     3569: 363770.136 MAIN : 29.7
     3570: 363770.140 A    : 29.5
     3571: 363770.143 WM   : 30.0
     3572: 363770.146 BACK : 25.2
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

c_joerg

Quote from: kitor on February 10, 2022, 03:18:59 PM
I have bad news for you. Checked the decomp, GetCCDTemperature is a dummy function (return 0). GetBatteryVoltage goes through a few jumps, but ends up in dummy function too.


Too bad, it would be too easy.
Thank you for looking.

Quote from: kitor on February 10, 2022, 03:18:59 PM
On R180.739 you can see temperature sensors readout at e01ae6f8, including conversion from raw to Celcius.

I have  R180.740. The address is probably different then.


Quote from: kitor on February 10, 2022, 03:18:59 PM
StartAllTempMeasurement will result in following on UART (seems that there's no actual sensor in ICU (WARP is ARM core on D8), or something is needed to initialize it):

     3567: 363770.123 WARP : -256.0
     3568: 363770.131 SH   : 23.0
     3569: 363770.136 MAIN : 29.7
     3570: 363770.140 A    : 29.5
     3571: 363770.143 WM   : 30.0
     3572: 363770.146 BACK : 25.2


Do you know what value of it goes in the EXIF ​​of the RAW file?
EOS R

kitor

Quote from: c_joerg on February 10, 2022, 03:51:51 PM
I have  R180.740. The address is probably different then.
Yep, those are very close (you can usually find strings on the same page while diffing both in vbindiff) but all offsets are different due to that.
Every time in the past I referred to anything R related as R180, it is for 7.3.9.
With one year of ghidra project, no way to avoid confusion for users, and ability just to flash both versions without triggering downgrade check - we continue to work based out of that one.

Quote from: c_joerg on February 10, 2022, 03:51:51 PM
Do you know what value of it goes in the EXIF ​​of the RAW file?
No idea, I never explored code around file metadata.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

lorenzo353

Hum,

Already posted in another thread, sorry, but it seems a better place here.

I posted a CBasic script that determine in a portable way model ID and firmware version:
https://discord.com/channels/671072748985909258/936696899120005230/944929235070484511

Could you please check it ?

on my R6.150 :
model_id : 0x80000453
rom version: 4.9.0
GetFirmwareVersion: 150
fw signature from 0xe0100000: 0x129372a8
fw signature from 0xe0040000: 0xce84b41f
at e0100000: 09480cee100fbff36f8f42f20000c0f20000854610eeb05f15f00f0001
at e0040000: cef81cc143f2300cddf81ce0cef820c14ef22e7cddf81ce0cef824c1dd


Lorenzo

c_joerg

Quote from: lorenzo353 on February 20, 2022, 01:24:52 PM
I posted a CBasic script that determine in a portable way model ID and firmware version:
https://discord.com/channels/671072748985909258/936696899120005230/944929235070484511

Is the source also available outside of Discord?
I got no access...
EOS R


c_joerg

Thanks, I thought the sources are shared on github...

On my R.180

model_id : 0x80000424
rom version: 7.4.0
GetFirmwareVersion: 180
fw signature from 0xe0100000: 0x5a746fa0
fw signature from 0xe0040000: 0x14f9273a
at e0100000: 6b680022102011469847a06a012804d16b680022000311469847b9f100
at e0040000: 0d480cee100fbff36f8f42f20000c0f20000854610eeb05f15f00f000a
EOS R

lorenzo353

Thank you!
Expected sequence at 0xe0040000 !
But, I did not find a way to compare bytes seq in CBasic to find automatically the right address, using if or strcmp, memcmp...

the code here is requested:

' tested on R6.150 and R.180
' source : https://discord.com/channels/671072748985909258/761652283724922880/933858470262882314
' should work on Digix8 and Digic10 at least

dim pRom0BaseAddressD10 = 0xE0100000
dim pRom0BaseAddressD8 = 0xE0040000
dim pRom1BaseAddress = 0xF0000000
dim sigLen          = 0x10000

' checksum code by Coon
private sub compute_signature(startSign, sLen)
  p = startSign
  c = 0
     
  For i = 0 To (sLen - 1)
    c = c + *p
    p = p + 4   
  Next
 
  compute_signature = c
end sub

private sub disp_hex_string(address, len, file)
  memStart = address
  WriteFileString(file, "at %x: ", memStart) 
  For i = memStart To (memStart+len)
    WriteFileString(file, "%02x", Peek8(i) & 255 )
  Next     
  WriteFileString(file, "\n" ) 
end sub
 
private sub Initialize()
 
  fileName = "B:/FW_SIGN.TXT"
  RemoveFile(fileName)

  f = OpenFileCREAT(fileName)
  CloseFile(f)

  f = OpenFileWR(fileName)

  WriteFileString(f, "model_id : 0x%08x\n", *pRom1BaseAddress)
  WriteFileString(f, "rom version: %s\n", pRom1BaseAddress +4)
  WriteFileString(f, "GetFirmwareVersion: %d\n", GetFirmwareVersion() ) 

  WriteFileString(f, "fw signature from 0x%x: 0x%08x\n", pRom0BaseAddressD10, compute_signature(pRom0BaseAddressD10, sigLen ) ) 
  WriteFileString(f, "fw signature from 0x%x: 0x%08x\n", pRom0BaseAddressD8, compute_signature(pRom0BaseAddressD8, sigLen) ) 
 
  'should look like: xx 48 0C EE 10 0F BF F3 6F 8F 42 F2 00 00 C0 F2 00 00 85 46 10 EE B0 5F 15 F0 0F 00
  disp_hex_string( pRom0BaseAddressD10, 28, f )
  disp_hex_string( pRom0BaseAddressD8, 28, f )

  CloseFile(f)
 
  ' dumpf()
end sub


c_joerg

On my M100 I can control the focus with the following functions

call_event_proc("EFLensCom.FocusSearchNear")
call_event_proc("EFLensCom.MoveFocus",steps,speed)


I found the following features on the EOS R and hoped I could do something similar with Canon Basic

MoveLensToFirstPoint()
MoveFocusDistance(10,10)


But nothing happens. At least there are no crashes.
May be also dummy function?

I have not checked

lensdrivefocus
EOS R

kitor

Two first are dummy. `lensdrivefocus` seems to have implementation.
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.

c_joerg

EOS R

Vector54

This exist on eos 90d as well. I was able to execute some scripts.

c_joerg

EOS R

kitor

"this" -> BASIC ROM dumper works, in both variants (bootable only and both ROMs).
Too many Canon cameras.
If you have a dead R, RP, 250D mainboard (e.g. after camera repair) and want to donate for experiments, I'll cover shipping costs.