Author Topic: Battery grip pins / UART  (Read 32861 times)

kitor

  • Developer
  • Member
  • *****
  • Posts: 225
Re: Battery grip pins / UART
« Reply #50 on: January 07, 2021, 09:56:42 PM »


MPU... but do you know from what camera? K429 rings a bell?



Anybody?



Well, that's EOS R Battery grip!  :P



Interesting thing is that you won't get shell unless poked RST pin (not sure to what level, i just attached my UARTs TX temporary and pressed any key).
EDIT: this may be related to me having grip on/off switch in off position when the tests were done. YMMV.

You need to almost completely disassemble grip first. It will not work without camera attached.

More details on MPU itself in DIGIC 8 MPU investigation

If you come here from Twitter, please note that post thumbnail had wrong pins described for RX/RST (they were accidently shifted to the right)
EOS R, 200d

deviousfusion

  • New to the forum
  • *
  • Posts: 4
Re: Battery grip pins / UART
« Reply #51 on: February 01, 2021, 11:54:42 AM »
X-Post from https://www.magiclantern.fm/forum/index.php?topic=17969.msg233932#msg233932

Some updates:
The 1300D has UART port accessible by removing the thumb grip above the DPAD. Some 1300D do not have the connector soldered on, but the pads on the PCB are visible. I was able to probe test the pins and got a pinout:

Pin No.|    1|    2|    3|   4|    5|    6|
STATE|   0V|  3V3|  3V3|   G|  3V3|  3V3|
Func.|MPU Rx|MPU Tx| (?) |GND|CPU Rx|CPU Tx|

Console outputs
Probing pin 2 gives:


Probing Pin 6 gives:
Code: [Select]
#
  2010: 14066.703 [FM] FM_Suspend : Normal
 Firm Jump RAM to ROM 0xFE0C0000
K404 READY
     0:    13.602 [STARTUP]
K404 ICU Firmware Version 1.1.0 ( 4.4.6 )
    57:   119.351 [RSC] hMemoryQueue (0x660012) hStorageQueue (0x680014)
   121:   137.499 [RTC] PROPAD_GetPropertyData : PROP_RTC 0xfd
   122:   138.857 [RTC] ChangePropertyCBR 0x0, 0x4000
   123:   139.113 [RTC] RTC_Permit 0x20
   134:   139.440 [SND] Seq LPC fin
   151:   142.332 [ENG] [ENGIO](Addr:0x4fb40000, Data:0x   30000)
   154:   150.577 [WB] AdjustWb Done.
   168:   152.797 [TERMINATE] SHUTDOWN init comp
   170:   152.884 [TERMINATE] Abort init comp
   192:   156.561 [MC] PROP_GUI_STATE 0
   197:   156.859 [MC] JobState 0
   200:   157.573 [MC] PROP_LCD_OFFON_BUTTON : 1
   202:   157.758 [MC] PROP_VARIANGLE_GUICTRL : Enable
   205:   158.770 [MC] regist master CardCover
   248:   174.656 [PRP] M:37 F:0 L:0 P:B T:1
   378:   254.481 [LV] [GMT] PROP_TEMP_STATUS : STATUS_NORMAL
   498:   264.995 [LV] InitializeLiveViewDefectDetection
   902:   299.478 [MD] Init RCh1=0, RCh2=0
   905:   300.002 [MD] Set RCh1=d, RCh2=18
  1292:   863.742 [INDEV] INDEV_Initialize
  1299:   865.931 [HDMI] [MID] HDMI_IP_Initialize
  1315:   885.667 [IMPP] H264E InitializeH264EncodeFor1080pDZoom
  1316:   885.741 [IMPP] H264E InitializeH264EncodeFor1080p25fpsDZoom
  1352:   906.774 [MR_MOV] (Empty Func) MVW_RegisterXmpDataCallback
  1422:   929.689 WARN [LVDS] First Get DTS_GetAllRandomData
  1524:   940.646 [GUI] MainEventHandler PROP_QR_DIDNOT_EXECUTE(0)(0)
  1570:   945.934 [STARTUP] startupInitializeComplete
  1572:   946.095 [MC] cam event guimode comp. 0
  1732:   996.044 [MC] cam event guimode comp. 0
  1829:  1171.131 [DISP] TurnOnDisplay action Type=0

Now here is where I'm stuck. I do not know what the connector is called.  This is what it looks like (its not JST):

coon

  • Developer
  • Freshman
  • *****
  • Posts: 98
Re: Battery grip pins / UART
« Reply #52 on: February 11, 2021, 11:27:40 PM »
The connector is a 6 pin vertical JST 0.8mm:
https://de.aliexpress.com/item/4001088873723.html

A matching cable is available here:
https://de.aliexpress.com/item/4001144163609.html
EOS RP

a1ex

  • Administrator
  • Hero Member
  • *****
  • Posts: 12564
Re: Battery grip pins / UART
« Reply #53 on: April 10, 2021, 04:23:14 PM »
EOS M2 has the same UART connector as 1300D (photo from Walter's; TX pins matching the above description from deviousfusion):



Code: [Select]
MON>>>
E1OFF

Code: [Select]
SD Detect High
K355 READY
128K Sector FROM From BL 0xffff
[SF] InstallSerialFlash 6 0xc022c0d4 0x0 0x1000000 1

[SF] Bufcon Base 0xc022c0d4
SerialFlash Initialize
     0:    55.279 [STARTUP]
K355 ICU Firmware Version 1.0.3 ( 6.0.6 )
     4:    57.627 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
     5:    58.313 [PROPAD] SerialFlash Packages!! 0x2d0000
...

760D appears to be similar (photo from igoro00 on Discord):


Matching cable also available on Digikey:
https://www.digikey.com/en/products/detail/jst-sales-america-inc/A06SUR06SUR32W51A/6009351

Walter Schulz

  • Contributor
  • Hero Member
  • *****
  • Posts: 7912
Re: Battery grip pins / UART
« Reply #54 on: April 10, 2021, 05:52:42 PM »
Spoiler alert: 250D / SL3 allows a somehow convinient access to UART, too. There is a rectangular hole under rubber cover (thumb rest). My 250D doesn't have a connector but solder pads are the same as shown for 200D here: https://www.magiclantern.fm/forum/index.php?topic=7531.msg224730#msg224730
Don't know if there are cameras in the wild where Canon soldered a connector (see 1300D). Pictures will follow.


kitor

  • Developer
  • Member
  • *****
  • Posts: 225
Re: Battery grip pins / UART
« Reply #55 on: May 07, 2021, 08:29:04 PM »
EOS M50

Good news: UART found


Code: [Select]
eEC412 READY                                                                 
        0:      3.281 [STARTUP]                                             
EC412 ICU Firmware Version 1.1.0 ( 7.3.0 )                                   
       31:     12.869 [SHTV] ShtPmaPath Init                                 
       49:     25.268 [STARTUP] St Reason 0                                 
      113:     66.185 [PROPAD] ERROR GetPropertyData ID = 0x01000013         
      114:     66.191 [PRP] ERROR NOT FOUND PROPERTY ID = 0x01000013 L:2992 
      188:     79.808 [PRP] ERROR TWICE PROPERTYMASTER 0x80020037 L:2454     
      189:     79.825 [PRP] ERROR EventDispatch : Current = 0, dwEventID = 0, dwParam = 0xd31154
      299:    117.433 [MR] MRIPC_Initilaize (28)                             
      309:    117.765 [MR] mvrChangeAckCBR : Video - Mode=0,Type=0,Rate=2500,GOP=12
      327:    118.142 [PROPAD] ERROR GetPropertyData ID (0) = 0x02010008
      328:    118.147 [PRP] ERROR NOT FOUND PROPERTY ID = 0x02010008 L:2992
      339:    118.461 [MR] [TCTEST]FreeRunBase RTC:0(h)0(m)0(s)->0
      340:    118.469 [MR] FreeRun/1 [0][0][0][0][0][0]
      404:    128.589 [PROPAD] ERROR GetPropertyData ID (0) = 0x00020005
      405:    128.605 [PROPAD] ERROR GetPropertyData ID (0) = 0x0001002B
      406:    128.614 [PROPAD] ERROR GetPropertyData ID (0) = 0x00010025
       43:    130.592 [EPPVRM] InitializeVramSubTest
      416:    132.067 [PA] WARN EventDispatch Current=1,dwEventID=3,dwParam=0x0


Bad news: Requires a complete disassembly to gain access  :(


EOS R, 200d

Ant123

  • Contributor
  • Member
  • *****
  • Posts: 164
Re: Battery grip pins / UART
« Reply #56 on: May 07, 2021, 10:18:38 PM »

kitor

  • Developer
  • Member
  • *****
  • Posts: 225
Re: Battery grip pins / UART
« Reply #57 on: May 07, 2021, 10:50:15 PM »
No, I had M50 just for a few days to play, I already shipped it back. And I don't have JTAG interface anyway...
But yes, it reminded me pads I have seen in old PowerShots, which confirms that despite having EOS-alike firmware it was designed by "the other team"
EOS R, 200d