(→Firmware progress: Memory maps) |
|||
| Line 23: | Line 23: | ||
* <tt>0x0000_0664</tt>: Some sort pointer to a kernel structure |
* <tt>0x0000_0664</tt>: Some sort pointer to a kernel structure |
||
* <tt>0xC000_0000</tt>: Memory mapped device? |
* <tt>0xC000_0000</tt>: Memory mapped device? |
||
| + | * <tt>0x0000_1900, 0x1928</tt>: Last panic code? |
||
| + | * <tt>0x0000_2DC8</tt>: A kernel structure copied from the stack |
||
| + | |||
* Startup at <tt>0xFF81_0000</tt>, jumps to <tt>0xFF81_000C</tt> |
* Startup at <tt>0xFF81_0000</tt>, jumps to <tt>0xFF81_000C</tt> |
||
Revision as of 22:34, 27 April 2009
|
The 5D Mark II is NOT ported yet, there's NO CHDK available for this camera. |
Technical Details
- Wikipedia page
- Digic IV image processor
- DryOS operating system
- 21.1 megapixel CMOS sensor
- 36x24 mm sensor size
Firmware progress
- Firmware image has been decrypted with dissect_fw3.2 forum discussion
- ROM has been dumped: forum discussion
- Many DryOS functions have been mapped
Memory maps
- 0xFF80_0000 - 0xFFFF_FFFF: RAM image of DryOS and code (copied from ROM0 at boot)
- 0xF800_0000 - 0xF880_0000: ROM0 image of DryOS
- 0xF000_0000 - 0xF080_0000: ROM1 image (strings and other stuff?)
- 0x0080_0000: Flasher code load address
- 0x0000_0000: Reset vectors?
- 0x0000_0480: Reset routine? Copied from 0xFF812B30 to 0x480 at startup
- 0x0027_F000: Interrupt handler stack
- 0x0002_0740: Interrupt handler context buffer
- 0x0000_0664: Some sort pointer to a kernel structure
- 0xC000_0000: Memory mapped device?
- 0x0000_1900, 0x1928: Last panic code?
- 0x0000_2DC8: A kernel structure copied from the stack
- Startup at 0xFF81_0000, jumps to 0xFF81_000C
- Data segment or config? 0x1900 - 0x20740
- BSS? 0x20740 - 0x47750