Talk: Obtaining a firmware dump

Perhaps this page is unnecessary, since now there is Vitaly's more detailed article here?

Receiver scheme

To GrAnd: instead of a phototransistor, isn't the thing on the scheme a photodiode? --Melado 23:23, 11 July 2007 (UTC)

It can be a photodiode. But I did not test such scheme, because I used a phototransistor. But, the A700 firmware was gotten by a photodiode in the line-in input, AFAIK. So, just try... --GrAnd 12:23, 15 July 2007 (UTC)

Hm, I see. But I have another doubt. If I want to dump the A540 firmware, I will have to use the blue LED instead the AF one. Since BPW96C is only sensible from 620 to 980 nm (and blue is about 450-500), I guess I should use another phototransistor. Any advices? Thanks. --Melado 16:00, 17 July 2007 (UTC)

I tested BPW96C with blue led and it is sensible enough. The following graph demonstrates the signal strength for comparison:

The first part is the signal from AF beam (red lamp). The second - from blue led. This couple was captured by BPW96C inserted in mic-in.
And the last part is the signal from blue led captured by photodiode inserted in the line-in of soundcard.
BTW. A700 firmware was dumped with the signal strength showed in the last part of the graph.--GrAnd 10:01, 18 July 2007 (UTC)

Thanks again. I bought a BPW77NB, that should be the same. I build the scheme and, more or less, it works. I recorded a piece of 1 minute of blinking, and ran adc.exe. It gave a dump file of 0 bytes. I recompiled adc.exe to change the values of the defines to the A610's blue led ones (the values you wrote in the wiki), and the problem that I have now is that adc.exe gives thousands of SYNC ERRORS and creates a dump file with some bytes.

Maybe I should tweak the values of the defines? How? And which ones? The ones within the adc program, the ones from the FIR executable, both? --Melado 23:24, 18 July 2007 (UTC)

If the signal looks readable (at least as the third part on the picture above) you have to tune adc program only. If the signal has small amplitude you have to reduce threshold levels (the baseline is 0x80). The lowest possible values are (0x80 +-1):

LEVEL_THRES_HI: 0x81
LEVEL_THRES_LO: 0x7F

The other values are numbers of samples:

LEN_SYNC: Spacing between bytes
LEN_SPACE: Spacing between bits
LEN_0: Narrow pulse - logical "0"
LEN_1: Wide pulse - logical "1"

If it does not help then just send me the file you recorded and I'll send you appropriate adc.exe.

--GrAnd 12:08, 19 July 2007 (UTC)

Hello, Melado & GrAnd. I found an A540 at half price last week and have started to look at it.

Melado, the orange LED does work at 0xc0220080 (from the A530 page).

I eventually found a transistor in my junk box that works in the visual (SD5410 photodarlington) so I can probably get a capture the next time I work on it.

GrAnd, pakwif did not work on a big-endian host; can I give you a patch?

Nobody has used big-endian machine yet. I think it could be useful if you share the patch. --GrAnd 04:37, 30 July 2007 (UTC)

I'll do that as soon as I test that I didn't break it for little-endian host.

Addendum-- It looks like I am going to have to do the actual recording on a Windows (XP) machine, which I am not familiar with; can someone recommend a suitable free recording program? --kps 02:27, 30 July 2007 (UTC)

I think any recording program which can record at least 6 hours and save a data as PCM will be suitable. I used Adobe Audition (Adobe has the trial version). --GrAnd 04:37, 30 July 2007 (UTC)

Thanks, that works. I have a partial dump. My audio problems are:

Sound card only goes up to 48KHz; not really a problem, because...
Sound card has very high impedance input, so the transistor is slow.
Lots of noise, especially 60Hz (mains power). I used the AF LED to get more signal than noise.

So right now I have checksum errors on about half the blocks. Now, Eric below has posted while I was writing this, so I will try his work -- thanks, Eric! But for the benefit of someone working on a different camera in the future, this is what I would have tried next:

Tweak thresholds and lengths to try to get more data.
Run the signature finder and try to find enough I/O to dump to SD instead.
Run the signature finder on the camera, reporting by LED very slowly.
Repeat the audio dump in full, or modified to dump only my missing blocks, until I get everything.--kps 13:45, 2 August 2007 (UTC)

As an experiment I was able to get the dump of A610 using AF-assist lamp on 96KHz sampling rate at ~9200 bps. It took me just 1 hour. There was no errors at all.

As for A700 there was only 5 (five!) CRC errors despite on low amplitude of signal (just +-1 sample). In this case 11KHz sampling rate was used. And there was no noise at all unless I touched the bared end of wire I used to connect the phototransistor to my sound card.

--GrAnd 15:10, 2 August 2007 (UTC)

Hello, I have a patch for the A540 Camera on http://www.datenschleuder.eu/get_b9243b5d034d34f6874390073f83de0d.html (Password is 'a540'). I don't sure on the values zoom_busy, focus_busy and nrflag in capt_seq_hook_set_nr(). You can use this patch to write the firmware onto the SD-Card (debug.c). Have fun, Eric!

So, it seems that you've got the dump of A540? Could you share 'PRIMARY.BIN' file? --GrAnd 15:10, 2 August 2007 (UTC)

Hello, GrAnd. You can download the dump on here (Password is also 'a540').

I can't download the file. The reason is incorrect password (Das eingegebene Kennwort war falsch). --GrAnd 21:38, 2 August 2007 (UTC)

Sorry, The password is 'a504'. I've mistype. --Eric 212.89.134.28 05:46, 3 August 2007 (UTC)

Thanks. I've got it. BTW, how did you get the dump? Did you use blinker? I'm asking just for statistics. --GrAnd 06:24, 3 August 2007 (UTC)

I've got dump it by orange AF-LED and use the BPW40 sensor. The absolute time for download was 45 Minutes.

You can download the dump program here. But it's a hack and not to distributed ;-).

My problems:

soundcard only goes up to 48KHz
the hi- and low-level was changed. I don't know wherefore.
the time for CRC-check is not deterministic. The consequence is a different length of sync space and a new tune on the sensor. I've calc it befor send the data.

--Makalu 10:17, 3 August 2007 (UTC)

The time of CRC calculation does not affect the consequence recognition. It is always calculated while SYNC is sent. The main idea is the SYNC signal have to be longer than 'between-bits' signal. So, if 'between-bits' signal has length, for instance, 5 samples, and SYNC signal (usually) - 10 samples, the length of SYNC signal can reach 1000 samples (due to CRC calculation) without any negative effect on transmitted sequence. --GrAnd 11:24, 3 August 2007 (UTC)

Oops, it looks that I arrived late. It looks like you have the A540 dump now. Is it possible now getting the CHDK ported to it? --Melado 13:14, 6 August 2007 (UTC)

Unfortunately, Vitaly and I have no free time at this moment. Vitaly promised that the ported version will be available in September. The version, sources of which are mentioned above, is not fully completed (autoboot feature won't work, many addreses are not found/incorrect, etc). --GrAnd 13:39, 6 August 2007 (UTC)

Ah, don't worry. I just wanted to know if now that you have the dump it was possible to port it. Take your time and thanks for all the work :) --Melado 14:07, 6 August 2007 (UTC)

IXUS 700 firmware

Here is a IXUS 700 firmware link

http://web.canon.jp/imaging/ixus700/frm/d1-e.html?

Getting blinker to work on a SD300?

I've gotten blinker to build and the camera sees the PS.FIR file as a valid firmware for the camera (ID 0x30BF), but when I run the "firm update" menu item, the screen goes blank then half a second later the lower indicator LED (next to the optical viewfinder) lights up solid, then the camera becomes unresponsive. The only way to recover is to remove the battery. I tried swapping some values around to make do_bit use the Print LED, but that also yielded no results. Perhaps something is terribly wrong with my PS.FIR file, would someone else mind building one with a camera ID of 0x30bf so I can test it? Myself, and several thousand of my co workers would really appreciate it. (all Canon USA employees received SD300's as a bonus in 2004)