The Powershot SX 10 IS with its 10 megapixel CCD sensor and a 20x optical zoom is the successor to the S5 IS, released in 2008.


CHDK is available for the SX10 with the firmware versions 1.00C, 1.01A, 1.01B, 1.02B and 1.03A from the Download page

Powershot SX10 IS Front

Powershot SX10 IS Back

Reviews[edit | edit source]

Technical Data[edit | edit source]

  • Digic IV image processor
  • DryOS operating system
  • 10 megapixel CCD sensor, 1/2.3 inch (pixel density: 35 MP/cm²), new 12 bit type
  • 20x wide-angle (28mm) optical zoom lens 28-560mm (35mm equiv), F/2.8 - F/8
  • Image stabilization (lens shift-type)
  • Display: 2.5 inch vari-angle LCD
  • Electronic viewfinder 0.44 inch, 235k pixels
  • ISO 80-1600, limited ISO 3200 mode with fixed 1600x1200, auto exposure, white balance, etc.
  • Built-in pop up flash, hot-shoe for external flash
  • Video: 640 x 480 or 320 x 240 @ 30fps (15fps does not exist in this model)
  • Storage: SD / SDHC / MMC / MMC Plus / HC MMC Plus
  • Power: 4x AA size
  • Weight (without batteries): 560g, Dimensions: 128 x 88 x 87 mm (5 x 3.5 x 3.4 inch)

Hardware Limits:

ISO Range: 10-8000
Aperture, Av: Maximum F/2.8 - F/5.7(depending on focal length), minimum F/8.0 (manufacturer spec)
Shutter speed, Tv: 1/1600 to 15" sec (manufacturer spec) (needs testing for hardware limits).
Fastest motion detection response: 75 ms typical (MDFB-080914 script)
Min. USB-Remote Volts: 3V NOT OK, 4.5V OK / Wake-up: No

Firmware info[edit | edit source]

As on other Canon Powershots, the ver.req method works as well with this model.

Ver.req First Page Data: After holding down FUNCSET then press DISP:

US & Japan NTSC Version Header

Canon Powershot SX10 IS
P-ID:318D NT D

European PAL Version Header

Canon PowerShot SX10 IS
P-ID: 318D PAL D

Version 1.00C

Firmware Ver GM1.00C
No Error
Sep 14 2008 14:57:56

Version 1.01A

Firmware Ver: GM1.01A
Oct 3 2008 10:47:12

Version 1.01B

Firmware Ver: GM1.01B
Nov 13 2008 09:03:39

Version 1.02B

Firmware Ver: GM1.02B
Jan  9 2009  15:10:11

Version 1.03A

Firmware Ver: GM1.03A
Ap 16 2009 09:16:03

Ver.req Second Page Data: After holding down FUNCSET then pressing DISP twice.

Version 1.00C, 1.01A

Adj Ver.019.007

Version 1.01B, 1.02B, 1.03A

Adj Ver.019.013

Ver.req Third Page Data: After holding down FUNCSET then pressing DISP three times:

Version 1.00C

IS Firm Ver.  2.33
IS Param Ver.  2.03
VcmCPU Ver.  0.40

Version 1.01A

IS Firm Ver.  2.33
IS Param Ver.  2.03
VcmCPU Ver.  0.42

Version 1.01B, 1.02B, 1.03A

IS Firm Ver.  3.02
IS Param Ver.  2.03
VcmCPU Ver.  0.42

vers.req Third Page Data: After holding down FUNCSET then pressing DISP three times:

Version 1.00C, 1.01A, 1.01B, 1.02B

Total Shoot: xx
Zoom Retry Count: 0
Mecha Condition: 0x00000000

CHDK Specialities[edit | edit source]

This section describes special CHDK-related things...

  • To turn the camera on directly in record mode, hold the POWER button for 1 second
  • When powered on in playback mode, just press the shutter button full or halfway once to switch to record mode
  • CHDK on the SX10 has support for long exposures, this means: no more limit to 64 seconds, exposures up to ~2000 seconds are possible
  • The SX10's hi-speed ISO3200 scene mode can be used with CHDK ISO override (and also with the manual force flash feature !) for fast image sequences with up to 4-5 images per second: ISO3200 mode & flash (Forum link)

Shortcuts[edit | edit source]

  • CHDK User Menu: To add menu items while you're in edit mode, use the DELETE button (also called "AF Frame Selector" or "Single Image Erase" button)
  • RAW on/off: press DELETE in <Alt> mode

For Developers[edit | edit source]

Note: porting the SX10 is done, the following informations may be outdated

General info:

  • Parts of the SX10 code seem to be similar to the S5, so the S5 should be the base for a port.
  • Loading dump in IDA:
ROM start:       0xFF810000
ROM Size:        0x003FFFFF
Loading address: 0xFF810000
Loading size:    0x003FFFFF
  • GrAnd's DryOS signatures ('CanonFW_DryOS_A-Series, "DryOS Canon Firmware; A720-based") also works on the SX10
  • The IDC files are also working
    • Since the original CHDK.idc script does not run all sub scripts correctly, i use modified versions of the IDC scripts: ida-chdk-idc-dryos-singlerun.7z @ google drive. The main script CHDK.idc runs all other scripts automatically, manual definition of the ROM_START address is not required anymore (MinEA() used instead).
  • The Signature_finder is also working well with the SX10 dump
  • diskboot.bin must be encoded as all newer ones, set NEED_ENCODED_DISKBOOT=very_yes in the makefile for dancingbits...
  • Note:
By default, IDA disassembles MVN as 'MOVL', but MOVL will be rejected by the compiler...
IDA uses some macros (by default) which replace some native asm commands - this option should be switched off in
the 'Options' -> 'General' -> 'Analysis' -> 'Processor specific analysis options' -> 'Enable Macros' menu to get direct usable code.

loader[edit | edit source]

The following code originally was used for porting the SX10 1.01A and may be different from the final one in the trunk...

entry.S[edit | edit source]

(address is the same as in the S5)

// Turn OFF SD Card power
// to support autostart
	LDR     R3, =0xC0220018
	MOV     R2, #0x44
	STR     R2, [R3]
  • The resetcode is here:
ROM:FF82984 sub_FF829848

main.c[edit | edit source]

void __attribute__((noreturn)) copy_and_restart(void *dst_void, const void *src_void, long length) {
        //DEBUG: blink again  power (orange)
        counter = DELAY; *pPB = 0x46;  while (counter--) { asm("nop\n nop\n"); };
        counter = DELAY; *pPB = 0x44;  while (counter--) { asm("nop\n nop\n"); };
        // DEBUG: jump to regular firmware-boot (causing a boot loop)
        // dst_void = (void*) 0xFF810000;

        // resetcode here:		// sub_FF829848   restartcode SX10
	 asm volatile (
					"MRS	R0, CPSR\n"
					"BIC	R0, R0,	#0x3F\n"
					"ORR	R0, R0,	#0xD3\n"
					"MSR	CPSR, R0\n"
					"LDR	R1, =0xC0200000\n"
					"MVN  R0, #0\n"					//MOVL when macros are enabled in IDA
					"STR	R0, [R1,#0x10C]\n"
					"STR	R0, [R1,#0xC]\n"
					"STR	R0, [R1,#0x1C]\n"
					"STR	R0, [R1,#0x2C]\n"
					"STR	R0, [R1,#0x3C]\n"
					"STR	R0, [R1,#0x4C]\n"
					"STR	R0, [R1,#0x5C]\n"
					"STR	R0, [R1,#0x6C]\n"
					"STR	R0, [R1,#0x7C]\n"
					"STR	R0, [R1,#0x8C]\n"
					"STR	R0, [R1,#0x9C]\n"
					"STR	R0, [R1,#0xAC]\n"
					"STR	R0, [R1,#0xBC]\n"
					"STR	R0, [R1,#0xCC]\n"
					"STR	R0, [R1,#0xDC]\n"
					"STR	R0, [R1,#0xEC]\n"
					"CMP	R4, #7\n"
					"STR	R0, [R1,#0xFC]\n"
					"LDMEQFD	SP!, {R4,PC}\n"
					"MOV	R0, #0x78\n"
					"MCR	p15, 0,	R0,c1,c0\n"
					"MOV	R0, #0\n"
					"MCR	p15, 0,	R0,c7,c10, 4\n"
					"MCR	p15, 0,	R0,c7,c5\n"
					"MCR	p15, 0,	R0,c7,c6\n"
					"MOV  R0, #0x80000006\n"	// all others have 0x4...
					"MCR	p15, 0,	R0,c9,c1\n"
					"MCR	p15, 0,	R0,c9,c1, 1\n"
					"MRC	p15, 0,	R0,c1,c0\n"
					"ORR	R0, R0,	#0x50000\n"
					"MCR	p15, 0,	R0,c1,c0\n"
					"LDR	R0, =0x12345678\n"
					"MOV  R1, #0x80000000\n"	// all others have 0x4...
					"STR	R0, [R1,#0xFFC]\n"
					//"LDR  R0, =loc_FF810000\n"			 // original jump-vector
					"MOV     R0, %0\n"				// new jump-vector
					"LDMFD	SP!, {R4,LR}\n"
					//"BX        %0\n"										
					"BX	R0\n"  //now with new jump-vector in R0
					: : "r"(dst_void) : "memory","r0","r1","r2","r3","r4");

→ now boot() in \platform\sx10\sub\101a\boot.c is executed...

platform[edit | edit source]

The following code originally was used for porting the SX10 1.01A and may be different from the final one in the trunk...

lib.c[edit | edit source]

some things we need...

#define LED_PR 0xC0220060 //SX10

void debug_led(int state)//SX10 blue LED
    volatile long *p=(void*)LED_PR;
    if (state)

int get_flash_params_count(void) //SX10
/*IDA  searched for "PropertyTableManagerCore.c"
	ROM:FF974104 loc_FF974104                            ; CODE XREF: _sub_FF9740E0__PropertyTableManagerCore.c__249+3C j
	ROM:FF974104                 LDR     R1, [R5]
	ROM:FF974108                 MOV     R0, R4
	ROM:FF97410C                 BL      sub_FFA7A81C
	ROM:FF974110                 ADD     R0, R4, #1
	ROM:FF974114                 BIC     R4, R0, #0x10000
	ROM:FF974118                 CMP     R4, #0x69     <----------------------
	ROM:FF97411C                 BCC     loc_FF974104
	ROM:FF974120                 LDR     R0, [R5]
	ROM:FF974124                 BL      sub_FFA7AF3C
	ROM:FF974128                 LDR     R0, [R5,#4]
	ROM:FF97412C                 LDMFD   SP!, {R4-R6,LR}
	ROM:FF974130                 B       sub_FFA7AF3C
	ROM:FF974130 ; End of function _sub_FF9740E0__PropertyTableManagerCore.c__249
	return 105; //0x69

platform/sub[edit | edit source][edit | edit source]








stubs_min.S[edit | edit source]

→ NOT completed yet, see //todo...

#include "stubs_asm.h"

DEF(physw_status, 0x11EC4)	//ROM:FF821824 

DEF(physw_run, 0x1C30) //R4 -> 0x1C24 + 0xC
//ROM:FF82133C                 LDR     R4, =0x1C24
//ROM:FF821340                 SUB     SP, SP, #0x9C
//ROM:FF821344                 LDR     R0, [R4,#0xC]

DEF(led_table, 0x25B0) // R0 -> 0x25A8 + #8
//ROM:FF84A5C0                 LDR     R0, =0x25A8
//ROM:FF84A5C4                 STMFD   SP!, {R4,LR}
//ROM:FF84A5C8                 LDR     R0, [R0,#8]
//ROM:FF84A5CC                 BL      sub_FF827700
//ROM:FF84A5D0                 TST     R0, #1
//ROM:FF84A5D4                 LDMNEFD SP!, {R4,LR}
//ROM:FF84A5D8                 MOVNE   R1, #0x42
//ROM:FF84A5DC                 ADRNE   R0, aLeddrv_c   ; "LEDDrv.c"
//ROM:FF84A5E0                 BNE     DebugAssert
//ROM:FF84A5E4                 LDMFD   SP!, {R4,PC}
//ROM:FF84A5E4 ; End of function _sub_FF84A5C0__LEDDrv.c__66

DEF(FlashParamsTable,0xFFB7455C)	// ROM:FFA799A4
//ROM:FFA799A4 sub_FFA799A4                            ; CODE XREF: sub_FFA7A918+10 p
//ROM:FFA799A4                                         ; _sub_FFA7A9A8__ParameterManager.c__90+1C p ...
//ROM:FFA799A4                 LDR     R1, =off_FFB7455C
//ROM:FFA799A8                 LDR     R0, [R1,R0,LSL#2]
//ROM:FFA799AC                 BX      LR
//ROM:FFA799AC ; End of function sub_FFA799A4

DEF(focus_busy, 0x8F8C) //0x8F84 + 0x8
//ROM:FF939804                 STMFD   SP!, {R4-R6,LR}
//ROM:FF939808                 LDR     R4, =0x8F84     <------------------
//ROM:FF93980C                 MOV     R5, R0
//ROM:FF939810                 LDR     R0, [R4,#0xC]
//ROM:FF939814                 CMP     R0, #1
//ROM:FF939818                 LDREQ   R0, [R4,#4]
//ROM:FF93981C                 ADDEQ   R0, R0, #2
//ROM:FF939820                 STREQ   R0, [R4,#4]
//ROM:FF939824                 LDMEQFD SP!, {R4-R6,PC}
//ROM:FF939828                 LDR     R0, [R4]
//ROM:FF93982C                 CMP     R0, #0
//ROM:FF939830                 MOVEQ   R1, #0xC9
//ROM:FF939834                 ADREQ   R0, aFocuslenscontr ; "FocusLensController.c"
//ROM:FF939838                 BLEQ    DebugAssert
//ROM:FF93983C                 LDR     R1, =0x7530
//ROM:FF939840                 LDR     R0, [R4,#0x24]
//ROM:FF939844                 MOV     R3, #0xCA
//ROM:FF939848                 ADR     R2, aFocuslenscontr ; "FocusLensController.c"
//ROM:FF93984C                 BL      sub_FF827DF8
//ROM:FF939850                 MOV     R0, R5
//ROM:FF939854                 BL      sub_FF9397B8
//ROM:FF939858                 CMP     R0, #1
//ROM:FF93985C                 LDRNE   R0, [R4,#0x24]
//ROM:FF939860                 BNE     loc_FF939890
//ROM:FF939864                 LDR     R0, [R4,#8] <----------------
//ROM:FF939868                 CMP     R0, #0
//ROM:FF93986C                 MOVNE   R1, #0xCC
//ROM:FF939870                 ADRNE   R0, aFocuslenscontr ; "FocusLensController.c"
//ROM:FF939874                 BLNE    DebugAssert
//ROM:FF939878                 LDR     R0, [R4,#4]
//ROM:FF93987C                 ADD     R0, R0, #2
//ROM:FF939880                 STR     R0, [R4,#4]
//ROM:FF939884                 LDR     R0, [R4,#0x24]
//ROM:FF939888                 BL      eventproc_export_GiveSemaphore ; LOCATION: KerSem.c:0
//ROM:FF93988C                 LDR     R0, [R4,#0x20]

DEF(zoom_busy, 0x9100)	//Offset UNSURE !!!!!!   0x90E4 + 0x1C
//ROM:FF940B70                 STMFD   SP!, {R4-R10,LR}
//ROM:FF940B74                 MOV     R10, R2
//ROM:FF940B78                 MOV     R8, R0
//ROM:FF940B7C                 MOV     R5, R1
//ROM:FF940B80                 BL      GetZoomLensCurrentPosition
//ROM:FF940B84                 LDR     R7, =0x90E4   <---------------------------
//ROM:FF940B88                 MOV     R6, R0
//ROM:FF940B8C                 LDR     R1, [R7,#8]
//ROM:FF940B90                 BL      sub_FFA5AD40
//ROM:FF940B94                 MOV     R4, R0
//ROM:FF940B98                 LDR     R0, [R7,#4]
//ROM:FF940B9C                 CMP     R0, #0
//ROM:FF940BA0                 MOVEQ   R1, #0xD6
//ROM:FF940BA4                 ADREQ   R0, aZoomlenscontro ; "ZoomLensController.c"
//ROM:FF940BA8                 BLEQ    DebugAssert
//ROM:FF940BAC                 LDR     R0, [R7,#0x10]
//ROM:FF940BB0                 CMP     R0, #0
//ROM:FF940BB4                 LDMEQFD SP!, {R4-R10,PC}
//ROM:FF940BB8                 LDR     R0, [R7,#0x18]
//ROM:FF940BBC                 LDR     R9, =0x7530
//ROM:FF940BC0                 CMP     R0, #0
//ROM:FF940BC4                 BEQ     loc_FF940BE4
//ROM:FF940BC8                 LDR     R0, [R7,#0x44]
//ROM:FF940BCC                 MOV     R3, #0xDB
//ROM:FF940BD0                 ADR     R2, aZoomlenscontro ; "ZoomLensController.c"
//ROM:FF940BD4                 MOV     R1, R9
//ROM:FF940BD8                 BL      sub_FF827DF8
//ROM:FF940BDC                 LDR     R0, [R7,#0x44]
//ROM:FF940BE0                 BL      eventproc_export_GiveSemaphore ; LOCATION: KerSem.c:0
//ROM:FF940BE4 loc_FF940BE4                            ; CODE XREF: _sub_FF940B70__ZoomLensController.c__214+54 j
//ROM:FF940BE4                 LDR     R0, [R7,#0x14]
//ROM:FF940BE8                 CMP     R0, #0
//ROM:FF940BEC                 MOVEQ   R1, #0xDE
//ROM:FF940BF0                 ADREQ   R0, aZoomlenscontro ; "ZoomLensController.c"
//ROM:FF940BF4                 BLEQ    DebugAssert
//ROM:FF940BF8                 LDR     R0, [R7,#0x1C]

DEF(canon_menu_active,0x6E3C) // 0x63E8 + 4
DEF(canon_shoot_menu_active,0xC05D) // 0xC05C + 1
DEF(recreview_hold, 0xBE2C) // 0xBD60 + 0xCC
DEF(zoom_status, 0x68F8) //

//not used by S5/SX10 ?
//DEF(movie_status, 0x53c8)	//from A590
//DEF(some_flag_for_af_scan, 0xD688) //from A590

lib.c[edit | edit source]

the complete thing...

#include "platform.h"

void *hook_raw_fptr() //unused
	return (void*)0; // What does this do? Doesn't seem to be called

void *hook_raw_ret_addr() //unused
	return (void*)0; // What does this do? Doesn't seem to be called

char *hook_raw_image_addr() //SX10
/* IDA, searched for aCrawBuffP
	ROM:FFA11E84                 LDR     R6, =0x1163B8E0  <---R6
	ROM:FFA11E88                 LDR     R5, =0x10407AA0
	ROM:FFA11E8C                 LDR     R4, =0x10EF2DC0
	ROM:FFA11E90                 STR     R0, [SP,#0xA8+var_1C]
	ROM:FFA11E94                 STR     R0, [SP,#0xA8+var_20]
	ROM:FFA11E98                 STR     R0, [SP,#0xA8+var_70]
	ROM:FFA11E9C                 STR     R0, [SP,#0xA8+var_6C]
	ROM:FFA11EA0                 STR     R1, [SP,#0xA8+var_78]
	ROM:FFA11EA4                 STR     R2, [SP,#0xA8+var_74]
	ROM:FFA11EA8                 ADR     R0, aJpegBuffPLx ; "JPEG BUFF       %p ( %lx )"
	ROM:FFA11EAC                 STR     R6, [SP,#0xA8+var_60]
	ROM:FFA11EB0                 STR     R5, [SP,#0xA8+var_64]
	ROM:FFA11EB4                 STR     R4, [SP,#0xA8+var_68]
	ROM:FFA11EB8                 BL      sub_FFA13590
	ROM:FFA11EBC                 MOV     R1, R4
	ROM:FFA11EC0                 ADR     R0, aImgVramBuffP ; "IMG VRAM BUFF   %p"
	ROM:FFA11EC4                 BL      sub_FFA13590
	ROM:FFA11EC8                 MOV     R1, R5
	ROM:FFA11ECC                 ADR     R0, aThumVramBuffP ; "THUM VRAM BUFF  %p"
	ROM:FFA11ED0                 BL      sub_FFA13590
	ROM:FFA11ED4                 MOV     R1, R6		<------ R6
	ROM:FFA11ED8                 ADR     R0, aCrawBuffP  ; "CRAW BUFF       %p"     <-- the call !
	return (char*)0x40F65B18; 

long hook_raw_size() //SX10
ROM:FFAD3A30                 LDR     R1, =0xEC04F0
ROM:FFAD3A34                 ADR     R0, aCrawBuffSizeP ; "CRAW BUFF SIZE  %p"
	return 0xEC04F0; 

void *vid_get_viewport_live_fb() //done
	// Deprecated, still exists for historical reasons.
	// Should return null pointer.
	return (void*)0x0;

void *vid_get_bitmap_fb() //SX10   ~ 1MB, 256kB on S5 ?
/* IDA, searched for BmpDDev.c , 2 DebugAssert before & big number in R0
	ROM:FF8F3790 ; LOCATION: BmpDDev.c:134
	ROM:FF8F3790                 EXPORT _sub_FF8F3790__BmpDDev.c__134
	ROM:FF8F3790 _sub_FF8F3790__BmpDDev.c__134           ; CODE XREF: sub_FF9DB358+48 p
	ROM:FF8F3790                 STMFD   SP!, {R4-R8,LR}
	ROM:FF8F3794                 LDR     R8, =0x8378
	ROM:FF8F3798                 MOV     R4, R0
	ROM:FF8F379C                 LDR     R0, [R8,#4]
	ROM:FF8F37A0                 MOV     R5, R1
	ROM:FF8F37A4                 CMP     R0, #1
	ROM:FF8F37A8                 MOVEQ   R1, #0x86
	ROM:FF8F37AC                 ADREQ   R0, aBmpddev_c  ; "BmpDDev.c"
	ROM:FF8F37B0                 MOV     R7, R3
	ROM:FF8F37B4                 MOV     R6, R2
	ROM:FF8F37B8                 BLEQ    DebugAssert
	ROM:FF8F37BC                 CMP     R4, #0
	ROM:FF8F37C0                 CMPNE   R5, #0
	ROM:FF8F37C4                 CMPNE   R6, #0
	ROM:FF8F37C8                 CMPNE   R7, #0
	ROM:FF8F37CC                 MOVEQ   R1, #0x89
	ROM:FF8F37D0                 ADREQ   R0, aBmpddev_c  ; "BmpDDev.c"
	ROM:FF8F37D4                 BLEQ    DebugAssert
	ROM:FF8F37D8                 MOV     R0, #0x2D0
	ROM:FF8F37DC                 MOV     R1, #0xF0
	ROM:FF8F37E0                 STR     R0, [R4]
	ROM:FF8F37E4                 STR     R1, [R5]
	ROM:FF8F37E8                 STR     R0, [R6]
	ROM:FF8F37EC                 LDR     R0, =0x403B1000   <---------- !!!!
	ROM:FF8F37F0                 STR     R0, [R7]
	ROM:FF8F37F4                 MOV     R0, #1
	ROM:FF8F37F8                 STR     R0, [R8,#4]
	ROM:FF8F37FC                 MOV     R0, #0
	ROM:FF8F3800                 LDMFD   SP!, {R4-R8,PC}
	ROM:FF8F3800 ; End of function _sub_FF8F3790__BmpDDev.c__134
	return (void*)0x403B1000;

void *vid_get_viewport_fb() //SX10  0x10D29360 on S5
/*IDA searched for aVramAddressP with big number in R1
	ROM:FFAD159C loc_FFAD159C                            ; CODE XREF: sub_FFAD1560+28 j
	ROM:FFAD159C                 MOV     R2, R7
	ROM:FFAD15A0                 MOV     R1, R6
	ROM:FFAD15A4                 MOV     R0, R5
	ROM:FFAD15A8                 BL      sub_FF83CCFC
	ROM:FFAD15AC                 LDR     R1, =0x4070D9D0  <----------- !!!
	ROM:FFAD15B0                 LDR     R0, =0x7E900
	ROM:FFAD15B4                 STR     R1, [R4]
	ROM:FFAD15B8                 STR     R0, [R4,#4]
	ROM:FFAD15BC                 ADR     R0, aVramAddressP ; "VRAM Address  : %p\r"
	ROM:FFAD15C0                 BL      sub_FF90D410
	ROM:FFAD15C4                 LDR     R1, [R4,#4]
	ROM:FFAD15C8                 ADR     R0, aVramSize0xX ; "VRAM Size     : 0x%x\r"
	ROM:FFAD15CC                 BL      sub_FF90D410
	ROM:FFAD15D0                 MOV     R0, #0
	ROM:FFAD15D4                 LDMFD   SP!, {R4-R8,PC}
	ROM:FFAD15D4 ; End of function sub_FFAD1560
	return (void*)0x4070D9D0;

void *vid_get_viewport_fb_d() //SX10 not sure, 95%
/*IDA searched for aImageplayer_c, small sub with R0+offset &BX LR, ref to sclideeffect.c
	ROM:FF85D660 sub_FF85D660                            ; CODE XREF: sub_FFA513D0+18 p
	ROM:FF85D660                                         ; ROM:FFA514BC p ...
	ROM:FF85D660                 LDR     R0, =0x5260    <--------
	ROM:FF85D664                 LDR     R0, [R0,#0x54]  <------
	ROM:FF85D668                 BX      LR
	ROM:FF85D668 ; End of function sub_FF85D660
	return (void*)(*(int*)0x52B4);  // 0x5260 + 0x54

long vid_get_bitmap_screen_width() //SX10 (as on all other cams) ?
	return 360;

long vid_get_bitmap_screen_height() //SX10 (as on all other cams) ?
	return 240;

long vid_get_viewport_height() //SX10 (as on all other cams) ?
	return 240;

char *camera_jpeg_count_str() //SX10
/*IDA searched for a9999
	ROM:FF9D2840 loc_FF9D2840                            ; CODE XREF: sub_FF9D2744+48 j
	ROM:FF9D2840                                         ; sub_FF9D2744:loc_FF9D279C j
	ROM:FF9D2840 ; jumptable FF9D278C entry 2
	ROM:FF9D2840                 SUBS    R12, R2, #0x2700
	ROM:FF9D2844                 SUBCSS  R12, R12, #0xF
	ROM:FF9D2848                 BCC     loc_FF9D285C
	ROM:FF9D284C                 LDR     R0, =0x4C138
	ROM:FF9D2850                 ADR     R1, a9999       ; "9999"
	ROM:FF9D2854                 BL      eventproc_export_sprintf
	ROM:FF9D2858                 B       loc_FF9D2868
	ROM:FF9D285C ; ---------------------------------------------------------------------------
	return (char*)0x4C138;

int movie_status = 0; //SX10 - like S5, since no video overrides ?

long vid_get_bitmap_buffer_width() { return 360; } //SX10 (as on all other cams) ?

long vid_get_bitmap_buffer_height() { return 240; } //SX10 (as on all other cams) ?

LED addresses[edit | edit source]

0xC0220060  Shortcut/Print button  (blue)
0xC02200B4  AF lamp                (green)
0xC02200B8  Power lamp/button      (orange)

Available firmware dumps[edit | edit source]


Download location for firmware dumps:
P&S firmware dumps mirror

Porting process & links[edit | edit source]

  • The origin porting thread for the SX10 with firmware 1.01A is here: forum link, porting was done by ewavr.
  • Firmware 1.00C port by Cormac is being tested: Forum link - Please report problems to that thread.
  • Firmware 1.01B port by nimrod is being tested: Forum link - Please report problems to that thread.
  • Firmware 1.02B is done: forum link, by Grin.


  • (08-Nov-2009) Official Release #831: Beta label was removed from 1.00C, 1.01B, 1.02B, 1.03A
  • (12-Jul-2009) CHDK for fw 1.03A is in the trunk now
  • (02-Jul-2009) CHDK for fw 1.00C is in the trunk now
  • (23-Jun-2009) The first alpha version and sources for 1.01b can be found here: Forum link
  • (12-Jun-2009) Changeset #776: beta version for fw 1.02B is added to the autobuild
  • (20-Mar-2009) Changeset #725: Video quality control is now available
  • (18-Mar-2009) CHDK for the SX10 1.01A is available from the Autobuild server →Downloads
  • (11-Mar-2009) The first Beta version & the sources for the fw 1.01A port can be found here: Forum link
Community content is available under CC-BY-SA unless otherwise noted.