Author Topic: Battery grip pins / UART (Read 72750 times)

kitor · « **Reply #50 on:** January 07, 2021, 09:56:42 PM »

MPU... but do you know from what camera? K429 rings a bell?

Anybody?

Well, that's EOS R Battery grip!

Interesting thing is that you won't get shell unless poked RST pin (not sure to what level, i just attached my UARTs TX temporary and pressed any key).
EDIT: this may be related to me having grip on/off switch in off position when the tests were done. YMMV.

You need to almost completely disassemble grip first. It will not work without camera attached.

More details on MPU itself in DIGIC 8 MPU investigation

If you come here from Twitter, please note that post thumbnail had wrong pins described for RX/RST (they were accidently shifted to the right)

deviousfusion · « **Reply #51 on:** February 01, 2021, 11:54:42 AM »

X-Post from https://www.magiclantern.fm/forum/index.php?topic=17969.msg233932#msg233932

Some updates:
The 1300D has UART port accessible by removing the thumb grip above the DPAD. Some 1300D do not have the connector soldered on, but the pads on the PCB are visible. I was able to probe test the pins and got a pinout:

Pin No.

|

1

|

2

|

3

|

4

|

5

|

6

|

STATE

|

0V

|

3V3

|

3V3

|

G

|

3V3

|

3V3

|

Func.

|

MPU Rx

|

MPU Tx

|

(?)

|

GND

|

CPU Rx

|

CPU Tx

|

Console outputs
Probing pin 2 gives:

Probing Pin 6 gives:

Code: [Select]

#
  2010: 14066.703 [FM] FM_Suspend : Normal
 Firm Jump RAM to ROM 0xFE0C0000
K404 READY
     0:    13.602 [STARTUP]
K404 ICU Firmware Version 1.1.0 ( 4.4.6 )
    57:   119.351 [RSC] hMemoryQueue (0x660012) hStorageQueue (0x680014)
   121:   137.499 [RTC] PROPAD_GetPropertyData : PROP_RTC 0xfd
   122:   138.857 [RTC] ChangePropertyCBR 0x0, 0x4000
   123:   139.113 [RTC] RTC_Permit 0x20
   134:   139.440 [SND] Seq LPC fin
   151:   142.332 [ENG] [ENGIO](Addr:0x4fb40000, Data:0x   30000)
   154:   150.577 [WB] AdjustWb Done.
   168:   152.797 [TERMINATE] SHUTDOWN init comp
   170:   152.884 [TERMINATE] Abort init comp
   192:   156.561 [MC] PROP_GUI_STATE 0
   197:   156.859 [MC] JobState 0
   200:   157.573 [MC] PROP_LCD_OFFON_BUTTON : 1
   202:   157.758 [MC] PROP_VARIANGLE_GUICTRL : Enable
   205:   158.770 [MC] regist master CardCover
   248:   174.656 [PRP] M:37 F:0 L:0 P:B T:1
   378:   254.481 [LV] [GMT] PROP_TEMP_STATUS : STATUS_NORMAL
   498:   264.995 [LV] InitializeLiveViewDefectDetection
   902:   299.478 [MD] Init RCh1=0, RCh2=0
   905:   300.002 [MD] Set RCh1=d, RCh2=18
  1292:   863.742 [INDEV] INDEV_Initialize
  1299:   865.931 [HDMI] [MID] HDMI_IP_Initialize
  1315:   885.667 [IMPP] H264E InitializeH264EncodeFor1080pDZoom
  1316:   885.741 [IMPP] H264E InitializeH264EncodeFor1080p25fpsDZoom
  1352:   906.774 [MR_MOV] (Empty Func) MVW_RegisterXmpDataCallback
  1422:   929.689 WARN [LVDS] First Get DTS_GetAllRandomData
  1524:   940.646 [GUI] MainEventHandler PROP_QR_DIDNOT_EXECUTE(0)(0)
  1570:   945.934 [STARTUP] startupInitializeComplete
  1572:   946.095 [MC] cam event guimode comp. 0
  1732:   996.044 [MC] cam event guimode comp. 0
  1829:  1171.131 [DISP] TurnOnDisplay action Type=0

Now here is where I'm stuck. I do not know what the connector is called. This is what it looks like (its not JST):

coon · « **Reply #52 on:** February 11, 2021, 11:27:40 PM »

The connector is a 6 pin vertical JST 0.8mm:
https://de.aliexpress.com/item/4001088873723.html

A matching cable is available here:
https://de.aliexpress.com/item/4001144163609.html

a1ex · « **Reply #53 on:** April 10, 2021, 04:23:14 PM »

EOS M2 has the same UART connector as 1300D (photo from Walter's; TX pins matching the above description from deviousfusion):

Code: [Select]

MON>>>
E1OFF

Code: [Select]

SD Detect High
K355 READY
128K Sector FROM From BL 0xffff 
[SF] InstallSerialFlash 6 0xc022c0d4 0x0 0x1000000 1

[SF] Bufcon Base 0xc022c0d4
SerialFlash Initialize 
     0:    55.279 [STARTUP] 
K355 ICU Firmware Version 1.0.3 ( 6.0.6 )
     4:    57.627 [PROPAD] PROPAD_CreateFROMPropertyHandle DRAMAddr 0x416d5b00
     5:    58.313 [PROPAD] SerialFlash Packages!! 0x2d0000
...

760D appears to be similar (photo from igoro00 on Discord):

Matching cable also available on Digikey:
https://www.digikey.com/en/products/detail/jst-sales-america-inc/A06SUR06SUR32W51A/6009351

Walter Schulz · « **Reply #54 on:** April 10, 2021, 05:52:42 PM »

Spoiler alert: 250D / SL3 allows a somehow convinient access to UART, too. There is a rectangular hole under rubber cover (thumb rest). My 250D doesn't have a connector but solder pads are the same as shown for 200D here: https://www.magiclantern.fm/forum/index.php?topic=7531.msg224730#msg224730
Don't know if there are cameras in the wild where Canon soldered a connector (see 1300D). ~~Pictures will follow.~~

kitor · « **Reply #55 on:** May 07, 2021, 08:29:04 PM »

EOS M50

Good news: UART found

Code: [Select]

eEC412 READY                                                                 
        0:      3.281 [STARTUP]                                              
EC412 ICU Firmware Version 1.1.0 ( 7.3.0 )                                   
       31:     12.869 [SHTV] ShtPmaPath Init                                 
       49:     25.268 [STARTUP] St Reason 0                                  
      113:     66.185 [PROPAD] ERROR GetPropertyData ID = 0x01000013         
      114:     66.191 [PRP] ERROR NOT FOUND PROPERTY ID = 0x01000013 L:2992  
      188:     79.808 [PRP] ERROR TWICE PROPERTYMASTER 0x80020037 L:2454     
      189:     79.825 [PRP] ERROR EventDispatch : Current = 0, dwEventID = 0, dwParam = 0xd31154
      299:    117.433 [MR] MRIPC_Initilaize (28)                             
      309:    117.765 [MR] mvrChangeAckCBR : Video - Mode=0,Type=0,Rate=2500,GOP=12
      327:    118.142 [PROPAD] ERROR GetPropertyData ID (0) = 0x02010008
      328:    118.147 [PRP] ERROR NOT FOUND PROPERTY ID = 0x02010008 L:2992
      339:    118.461 [MR] [TCTEST]FreeRunBase RTC:0(h)0(m)0(s)->0
      340:    118.469 [MR] FreeRun/1 [0][0][0][0][0][0]
      404:    128.589 [PROPAD] ERROR GetPropertyData ID (0) = 0x00020005
      405:    128.605 [PROPAD] ERROR GetPropertyData ID (0) = 0x0001002B
      406:    128.614 [PROPAD] ERROR GetPropertyData ID (0) = 0x00010025
       43:    130.592 [EPPVRM] InitializeVramSubTest
      416:    132.067 [PA] WARN EventDispatch Current=1,dwEventID=3,dwParam=0x0

Bad news: Requires a complete disassembly to gain access

Ant123 · « **Reply #56 on:** May 07, 2021, 10:18:38 PM »

Will you try to use JTAG on M50?
https://chdk.setepontos.com/index.php?topic=13408.msg140667#msg140667

kitor · « **Reply #57 on:** May 07, 2021, 10:50:15 PM »

No, I had M50 just for a few days to play, I already shipped it back. And I don't have JTAG interface anyway...
But yes, it reminded me pads I have seen in old PowerShots, which confirms that despite having EOS-alike firmware it was designed by "the other team"

kitor · « **Reply #58 on:** May 21, 2021, 08:37:50 PM »

EOS 50D (and most likely 40D)

It was known already that UART is accessible externally from battery grip pins. It requires a modified grip / battery to access.

I thought for sure there has to be some connector inside for factory tests / programming, and I wasn't wrong.

There are two debug connectors, one on ICU (on the other side of HDMI port), and one for MPU - above CF slots. Test pads are exposed around this area.

For MPU - two topmost testpads are (top) MPU_RX, (bottom) MPU_TX
For ICU - two rightmost testpads are (top) ICU_TX, (bottom) ICU_RX

ICU debug connector is easily accessible after removing just ports cover part of the case.

Code: [Select]

CF is not a startup disk.                                                 
K261 READY                                                                   

     0:     8.308 [STARTUP]  K261 ICU Firmware Version 1.0.9 ( 3.4.5 )
Open Console K261[1]>...
K261[1]>
     7:    45.299 [HPD] add emergency isr.                           
    22:    88.777 [STARTUP] Ceres Disappeared                                
   102:   111.712 [ENG] [ENGIO](Addr:0x5c640000, Data:0x   30000)            
   133:   122.797 [MC] PROP_GUI_STATE 0                                      
   138:   123.116 [MC] JobState 0                                            
   139:   123.304 [MC] HDMIConnect ---> (0)                                  
   142:   124.325 [MC] regist master CardCover
   196:   361.327 [PRP] M:51 F:0 L:0 P:20
   197:   361.636 [STARTUP] internal version 03:04:05:00:51:00:00:20
   211:   369.843 [LVMD] Init RCh1=0, RCh2=0
   213:   370.125 [LVCFG] LV_Initialize Jun 17 2009
   219:   372.766 [LVMD] Set RCh1=a, RCh2=18
   226:   375.385 [LVCFG] PROP_TEMP_STATUS  Temp:0, FrameRate:1
   227:   375.609 [LVCFG] PROP_LV_ACTION STOP
   231:   375.893 [LVCFG] PROP_LV_LOCK PERIMIT
   235:   376.190 [LVCFG] PROP_SHOOTING_TYPE 0
   240:   377.805 [LV] PROP_LIVE_VIEW_FACE_AF
   247:   378.733 [LVCFG] PROP_LIVE_VIEW_VIEWTYPE_SELECT 0->0
   249:   378.959 [LVCFG] PROP_LIGHT_FALLOFF_COMP 0
   269:   389.022 [PTP] LensID:0,0,0
   321:   397.123 [PTP] PhotoStudioMode:0
   374:   403.430 [PTP] LV End Clear LVData
   377:   403.599 [PTPCOM] SetPtpTransportResources:0,319b
   492:   416.092 [DISP] InitializeDisplayDeviceController (PUB)
   493:   416.157 [DISP] Memory Area 0 0 0 0 0 0
   497:   418.039 [HDMI] HPD OFF
   546:   467.916 [LVCFG] PROP_OUTPUT_TYPE 0(0) / 0
   574:   476.772 [GUI] HDMI_VIDEO_CODE 0
   667:   526.338 [STARTUP] startupInitializeComplete
   669:   526.477 [MC] cam event guimode comp. 0
   687:   527.785 [MC] cam event guimode comp. 0
   690:   528.014 [DISP] TurnOffDisplay (PUB) Type=0 fDisplayTurnOn=0
   696:   528.999 [DISP] TurnOffDisplay (PUB) Type=0 fDisplayTurnOn=0
   767:   701.207 [DISP] TurnOnDisplay (PUB) Type=0 fDisplayTurnOn=0
   794:   868.687 [DISP] BackLightOn
   796:   885.114 [DISP] TurnOnDisplay (PUB) Type=0 fDisplayTurnOn=1

Code: [Select]

K261[1]>drysh
=== Dry-shell start ===
Dry> help
[Debug]
 task  sem  event  mq  mutex  cond  timer  mkobjsize  extask  kill  suspend 
 resume  release  delete  prio  mkcfg  meminfo  xd  xm  memmap  objinfo 
[Misc]
 vers  exit  dminfo 

Dry> vers
DRYOS version 2.3, release #0023
  Dry-MK 2.39
  Dry-DM 1.14
  Dry-stdlib 1.33
  Dry-shell 1.11
  Dry-command alpha 029
Dry>

Code: [Select]

E1ON
MON>>about

  MPU Ver...0x51
  MPU code   area check sum...0x0506D389


MON>>
E1OFF

reddeercity · « **Reply #59 on:** May 22, 2021, 05:40:28 AM »

This is great, Thanks!

I was thinking about this the other day on how to do this to D4's without having a battery grip .
This helps me greatly , I have some road blocks with the 5D2/50D in crop_record and this should help me understand the problems
now i just need to get uart device and get my head around this .

kitor · « **Reply #60 on:** May 22, 2021, 07:41:04 AM »

3v3 and as usual 115200,8,n,1. So any USB UART should do.

In fact it had problems with my 1v8 modified UART (with resistor voltage divider on transmit line), it was in "undetermined" range and camera would randomly get some input.

Bonus: 50D doesn't need magic spell to enter EvShell.

Quote

I have some road blocks with the 5D2/50D in crop_record and this should help me understand the problems

Similar to this - I bought it to:
- verify if dev branch from git repo still works properly on old cameras
- have a reference point for how things work on older generations

reddeercity · « **Reply #61 on:** May 25, 2021, 05:13:26 AM »

Thanks for the info , I"ll do some shopping and see what i can find .

kitor · « **Reply #62 on:** August 25, 2021, 08:43:43 AM »

EOS 60D

Not confirmed on any real camera yet, however easy to spot after seeing multiple ones before.

There's a hole under thumb rubber, in bottom right corner - same spot as 5D3 or EOS R.
Motherboard has 6 pin FPC connector there, visually similar to EOS M/M2, however it is flat to motherboard so I have no idea how one would connect anything without disassembly.
There are test points next to connector, so it should be easy to check the pinout with multimeter and USB UART.

theBilalFakhouri · « **Reply #63 on:** August 25, 2021, 11:51:19 AM »

5D3 Connector:

Close-up view:

theBilalFakhouri · « **Reply #64 on:** August 25, 2021, 01:39:56 PM »

My 700D:

If this place was for the UART, then the connector isn't soldered and probably those pins are for the connector.

(Sorry for low image quality, it was a bit challenging to show the pins)

kitor · « **Reply #65 on:** August 25, 2021, 02:28:45 PM »

Quote from: theBilalFakhouri on August 25, 2021, 11:51:19 AM

5D3 Connector:

Pinout here

Quote from: theBilalFakhouri on August 25, 2021, 01:39:56 PM

My 700D:

Looks like 1300D, 760D, etc. I guess they will be the same pinout.

ainu · « **Reply #66 on:** August 25, 2021, 09:49:52 PM »

Canon 70d connector.
Sorry - can't insert image direct from google drive. Here is the link to image.
https://drive.google.com/file/d/1ALmXZdK861ftQMDRvyEEVFGyu-pmosQr/view?usp=sharing

Since the connector is angular, it is impossible to calculate the number of pins without disassembling the camera.
The size of the window for the cord is 6x4 mm, the width of the connector is 5mm.
Does anyone know which connector/cord I need to connect?
Is it possible to get into the shell of the DryOs?

Walter Schulz · « **Reply #67 on:** August 25, 2021, 10:57:19 PM »

It looks like 6 pin connector. Haven't come across high-detail pics so this is an assumption. This is EOS M2 connector: https://cdn.discordapp.com/attachments/789206911886950411/830444158539530270/M2-UART.JPG and I'm convinced it is https://www.jst-mfg.com/product/pdf/eng/eXSR.pdf?60cb966485eee

Their shipment costs are somehow reasonable. You may find samples with wires attached by various distributors (with hellish shipment penalty).

ainu · « **Reply #68 on:** August 25, 2021, 11:23:46 PM »

Quote from: Walter Schulz on August 25, 2021, 10:57:19 PM

It looks like 6 pin connector. Haven't come across high-detail pics so this is an assumption.

Many thanks. I found this connector in my local radiodetail shop (~1$/1pcs). It came to me at next week and I will check it.

ainu · « **Reply #69 on:** September 01, 2021, 09:34:51 PM »

Quote from: Walter Schulz on August 25, 2021, 10:57:19 PM

It looks like 6 pin connector. Haven't come across high-detail pics so this is an assumption. This is EOS M2 connector: https://cdn.discordapp.com/attachments/789206911886950411/830444158539530270/M2-UART.JPG and I'm convinced it is https://www.jst-mfg.com/product/pdf/eng/eXSR.pdf?60cb966485eee

Their shipment costs are somehow reasonable. You may find samples with wires attached by various distributors (with hellish shipment penalty).

I confirm than on 70D connector on mainboard is SM06B-XSRS-ETB (by mistake I buy this. Connector in the mainbord are identical) and we need cable with connector code 06XSR-36S (complete cable code: wire+connector is A06XSR06XSR36R51B).
Complete cable will arrive to me at the middle of october

kitor · « **Reply #70 on:** September 02, 2021, 08:41:34 AM »

Another parallel to PCB, huh.

Quote from: ainu on August 25, 2021, 09:49:52 PM

Does anyone know which connector/cord I need to connect?
Is it possible to get into the shell of the DryOs?

For sure you will get into EvShell. Pinout is the question, but it can be easily probed - you expect two RX/TX pairs (one for ICU, one for MPU), power and ground.
GND can be taken from anywhere, transmit lines can be just guessed by plugging RX from UART adapter to each line and turning camera off/on, RX are usually next to corresponding TX.

Voltage levels needs to be confirmed but for Digic 5 we expect everything to run 3v3.

ainu · « **Reply #71 on:** September 23, 2021, 09:45:15 PM »

Quote from: kitor on September 02, 2021, 08:41:34 AM

For sure you will get into EvShell. Pinout is the question.

The cable came to me. He's exactly fit. Within a week I will try to check the pinout and connect to the EvShell.
EvShell corresponding to MPU or ICU? Or may be my question is wrong?

kitor · « **Reply #72 on:** September 24, 2021, 10:44:31 AM »

EvShell is the "main" shell on ICU on DSLRs. You can access DryOS Shell using 'drysh' command from EvShell.

See https://www.magiclantern.fm/forum/index.php?topic=25662.0 for the general idea, but please note that linked thread is for Digic 8 so not everything will be applicable.

On MPU there's a separate shell like that:
https://www.magiclantern.fm/forum/index.php?topic=25661.0

Easy to distinguish due to different prompts

ainu · « **Reply #73 on:** September 24, 2021, 10:02:44 PM »

Try find pinout.
Numbers From screen side 1 to SD card side 6.

Canon 70D
Screen 1 | 2 | 3 | 4 | 5 | 6| SD card.
Pin 1 - ICU TX (must be connected to usb uart RX)
Pin 2 - ICU RX (must be connected to usb uart TX)
Pin 3 - GND. Connected directly (0 Om) to tripod mount and hot shoe base.
Pin 4 - Power (+). Camera off 3.1v, camera on 3.3v
Pin 5 - MPU TX (must be connected to usb uart RX)
Pin 6 - MPU RX (must be connected to usb uart TX)

Information about EvShell and MPU commands on 70D here:
https://www.magiclantern.fm/forum/index.php?topic=26251.msg236870#msg236870

kitor · « **Reply #74 on:** October 16, 2021, 09:36:26 PM »

750D same style and pinout as 1300D, 700D, 760D, 70D, M2... Located under thumb rubber.

Code: [Select]

Dry[MARIUS]> sysvers
SystemIF 0.28
DRYOS version 2.3, release #0055+p4
 MK 2.63
 DM 1.20
 EFAT 1.18
 stdlib 1.54
 drylib 1.22
 shell 1.18
 command alpha 063
 MACH 0.27

News:

Author Topic: Battery grip pins / UART (Read 72750 times)