CHDK Wiki
m
m
Line 1: Line 1:
I hope it contains usefull informations for those, who has already built there [http://chdk.wikia.com/wiki/Porting_the_CHDK#Serial_port_download_solution serial IR sensor device] but received nothing via serial port or only corrupted piece of the firmware.
+
I hope it contains usefull informations for those, who has already built there [[Porting_the_CHDK#Serial_port_download_solution|serial IR sensor device]] but received nothing via serial port or only corrupted piece of the firmware.
 
The solution could be: set the correct DEL value in the main.c file.
 
The solution could be: set the correct DEL value in the main.c file.
   
Line 13: Line 13:
 
Well, it's already known for G9 but could be usefull for porting new cameras to CHDK.
 
Well, it's already known for G9 but could be usefull for porting new cameras to CHDK.
   
* First try it with known addresses. (see other cases in the [http://chdk.wikia.com/wiki/For_Developers Develoment])
+
* First try it with known addresses. (see other cases in the [[For_Developers|Development]])
 
* If, it's not usefull try the followings:
 
* If, it's not usefull try the followings:
   
Line 23: Line 23:
 
* Compile it. (Of course you need [http://chdk.wikia.com/wiki/Compiling_CHDK_under_Windows this] to do it.)
 
* Compile it. (Of course you need [http://chdk.wikia.com/wiki/Compiling_CHDK_under_Windows this] to do it.)
   
* Make [http://chdk.wikia.com/wiki/Bootable_SD_card SD card bootable] after it copy the compiled '''diskboot.bin''' to the card.
+
* Make [[Bootable_SD_card|SD card bootable]] after it copy the compiled '''diskboot.bin''' to the card.
 
* Don't forget to close the SD card lock.
 
* Don't forget to close the SD card lock.
 
* Turn on the device in play mode.
 
* Turn on the device in play mode.
* '''Be patient.''' It seems to be froozen, but after a while some LEDs turn on and off.
+
* '''Be patient.''' It seems to be frozen, but after a while some LEDs turn on and off.
   
 
* Start a timer when you turn on the device for blinking (play mode) and record what time which led is lighted.
 
* Start a timer when you turn on the device for blinking (play mode) and record what time which led is lighted.
Line 44: Line 44:
   
 
* Let start with 9600bps, if no success try to decrease your speed.
 
* Let start with 9600bps, if no success try to decrease your speed.
* Use for example [http://realterm.sourceforge.net/#Installing realterm]as described [http://chdk.wikia.com/wiki/Porting_the_CHDK#Serial_port_download_solution here] to set it.
+
* Use for example [http://realterm.sourceforge.net/#Installing realterm]as described [[Porting_the_CHDK#Serial_port_download_solution|here]] to set it.
   
* Start file capture in the realterm program (simultanly monitor on screen also!)
+
* Start file capture in the realterm program (simultaneously monitor on screen also!)
 
* Start blinking, when the program ends the led turns off.
 
* Start blinking, when the program ends the led turns off.
 
* After it view the captured file with a hex editor. (You can also use "Lister" and press '''3''' to switch to hex mode)
 
* After it view the captured file with a hex editor. (You can also use "Lister" and press '''3''' to switch to hex mode)
Line 67: Line 67:
   
 
DEL '''2458''' if you plan to dump at 4800bps
 
DEL '''2458''' if you plan to dump at 4800bps
(I used the last one, beacuse of tricky interferences)
+
(I used the last one, because of tricky interferences)
   
 
==Start the firmware dump with long dummy bytes==
 
==Start the firmware dump with long dummy bytes==
Line 75: Line 75:
 
* If there is an error when started your dump, you have a small time (approx 10 seconds) to move your sensor to the proper place and can fix it)
 
* If there is an error when started your dump, you have a small time (approx 10 seconds) to move your sensor to the proper place and can fix it)
 
* Watch it in the realterm window there is no red "error" or "break" while you dumping.
 
* Watch it in the realterm window there is no red "error" or "break" while you dumping.
* The begining is always '''U''' characters, so you should see it in your realterm window.
+
* The beginning is always '''U''' characters, so you should see it in your realterm window.
   
 
* Firmware dump should be exist 4 parts 4*2MB. (In the case of G9)
 
* Firmware dump should be exist 4 parts 4*2MB. (In the case of G9)
Line 90: Line 90:
 
* copy "diskboot.bin" to the SD card.
 
* copy "diskboot.bin" to the SD card.
 
* SD Lock ON!
 
* SD Lock ON!
* Realterm settings "capture owerwrite"
+
* Realterm settings "capture overwrite"
 
* Start blinking.
 
* Start blinking.
* View it in ascii and hex mode you should see 0x55 and charackter "U" first,
+
* View it in ascii and hex mode you should see 0x55 and character "U" first,
 
* After a wile (15 seconds) check the file "capture.txt" containing char '''UUU''' firstly nothing else unwanted characters
 
* After a wile (15 seconds) check the file "capture.txt" containing char '''UUU''' firstly nothing else unwanted characters
 
and also look for the string "begin"
 
and also look for the string "begin"
Line 105: Line 105:
 
So the whole firmware dump takes minimum 4*40 minutes or more.
 
So the whole firmware dump takes minimum 4*40 minutes or more.
   
Be carefull about increasing and decreasing the speed.
+
Be careful about increasing and decreasing the speed.
 
Can be errors in the transmition.
 
Can be errors in the transmition.
   
 
* After you dumped the 4 parts of the firmware from 0xFF800000 (the first 64kbyes just 0x00 so really the firmware starts from 0xFF810000 as mentioned already above)
 
* After you dumped the 4 parts of the firmware from 0xFF800000 (the first 64kbyes just 0x00 so really the firmware starts from 0xFF810000 as mentioned already above)
* Use hexeditor to cut the unwanted "0x55", "begin and "end." strings. And also the first 64kbyte "0x00"
+
* Use hex-editor to cut the unwanted "0x55", "begin and "end." strings. And also the first 64kbyte "0x00"
   
 
* Copy the four parts them together with binary :
 
* Copy the four parts them together with binary :

Revision as of 20:16, 30 January 2008

I hope it contains usefull informations for those, who has already built there serial IR sensor device but received nothing via serial port or only corrupted piece of the firmware. The solution could be: set the correct DEL value in the main.c file.

This page was born "How I did my G9 firmware dump..." I used BPW96B sensor as my serial blinker HW.

Well, this page is still under edit. --Titan_G9 15:57, 19 January 2008 (UTC)

How to dump the G9 firmware using the 'G7 serial blinker' under Win system.


Finding the LED memory addresses

Well, it's already known for G9 but could be usefull for porting new cameras to CHDK.

  • First try it with known addresses. (see other cases in the Development)
  • If, it's not usefull try the followings:
  • Modify the the source code of the G7 blinker:

Beacuse we do not want to dump via serial at the moment only finding the led's addresses the constant value "DEL" 1260 is OK for this case for "G7 serial blinker" in "main.c"

  • You can start the LED address scan from 0xC0220060 to 0xC02200FF .
  • This is the main.c what I used to do this job.
  • In the "make.bat" exclude the "pakwif ...." line. It's not needed. (Or use this one)
  • Compile it. (Of course you need this to do it.)
  • Make SD card bootable after it copy the compiled diskboot.bin to the card.
  • Don't forget to close the SD card lock.
  • Turn on the device in play mode.
  • Be patient. It seems to be frozen, but after a while some LEDs turn on and off.
  • Start a timer when you turn on the device for blinking (play mode) and record what time which led is lighted.
  • Try to decrease or split the scan address range, till you can find the correct Led address(es). (The addresses of the leds are increased by 4 bytes steps.)
  • If it was successfully then you can go to further steps.
  • Choose the brightest led address for firmware dumping.(Probably AF)

Calibrating the serial speed DELAY in the blinker

"main.c" uses "DEL" constant for proper serial speed (9k6) dumping. See bellow to find out what is the correct value for your camera?

  • Use this main.c to get the correct DEL value for the proper speed.
    • The adventure of this source is : between the "begin" and "end" strings there will be 5 numbers in HEX format.
    • For example: 00 01 02 00 09
    • It means the value is 1209
    • This value is the current value, what the program actually sends data via the led to the serial port.
  • Let start with 9600bps, if no success try to decrease your speed.
  • Use for example realtermas described here to set it.
  • Start file capture in the realterm program (simultaneously monitor on screen also!)
  • Start blinking, when the program ends the led turns off.
  • After it view the captured file with a hex editor. (You can also use "Lister" and press 3 to switch to hex mode)
  • Search for the FIRST correct 20 * 0x55 beginxxxxxend. sting

0x55=U character; "xxxxx" are the values what we looking for.

  • If you found it (you're lucky) memorize the xxxxx values
  • Search for the LAST correct 20 * 0x55 beginxxxxxend. sting
  • If you found it memorize the xxxxx values
  • Now make an average of this 2 values!

!!! This value is what we looking for, you have to use this in your "main.c" as "DEL" !!!

  • Now you are ready to start the real firmware blinking.

For G9 the values are : (instead of 1260 in the original G7 blinker)

DEL 1209 if you plan to dump at 9600bps

DEL 2458 if you plan to dump at 4800bps (I used the last one, because of tricky interferences)

Start the firmware dump with long dummy bytes

  • Now you can compile the blinker with the correct DEL value and the LED you choose. (edit main.c)
  • Place your sensor as close as possible to the led.
  • If there is an error when started your dump, you have a small time (approx 10 seconds) to move your sensor to the proper place and can fix it)
  • Watch it in the realterm window there is no red "error" or "break" while you dumping.
  • The beginning is always U characters, so you should see it in your realterm window.
  • Firmware dump should be exist 4 parts 4*2MB. (In the case of G9)

0xFF800000 + 2MB ( the first 64kbyte is 0x00 so the begin of the firmware is 0xFF810000 but we cut this 64kb when we finish)

0xFFA00000 + 2MB

0xFFC00000 + 2MB

0xFFE00000 + 2MB

  • Compile the blinker with the memory block you choose.
  • copy "diskboot.bin" to the SD card.
  • SD Lock ON!
  • Realterm settings "capture overwrite"
  • Start blinking.
  • View it in ascii and hex mode you should see 0x55 and character "U" first,
  • After a wile (15 seconds) check the file "capture.txt" containing char UUU firstly nothing else unwanted characters

and also look for the string "begin"

  • If yes, it's OK.
  • Leave it to do its job.
  • If the led turns off check again the file, you should see the "end." string at the end of the captured file.

2MB file dump take: 40mins @9600bps; 90 mins @4800bps

So the whole firmware dump takes minimum 4*40 minutes or more.

Be careful about increasing and decreasing the speed. Can be errors in the transmition.

  • After you dumped the 4 parts of the firmware from 0xFF800000 (the first 64kbyes just 0x00 so really the firmware starts from 0xFF810000 as mentioned already above)
  • Use hex-editor to cut the unwanted "0x55", "begin and "end." strings. And also the first 64kbyte "0x00"
  • Copy the four parts them together with binary :

copy firmware_part1.bin /b + ....2.bin /b + ....3.bin + firmware_part4.bin /b Firmware_Canon_Device_model.bin /b

Do the whole dumping procedure again and compare those two files together.

Open a command line window (run "cmd") where the two file exist and

"fc case1.bin case2.bin"

If OK. No errors. You've done it! It can be published.


--Titan_G9 15:57, 19 January 2008 (UTC)