CHDK Wiki
Register
(→‎Universal dumper: Added start at FE020000 for SX280HS)
Tag: Source edit
 
(16 intermediate revisions by 7 users not shown)
Line 1: Line 1:
  +
 
__TOC__
 
__TOC__
  +
{{Notice|read this first : [http://chdk.wikia.com/wiki/Canon_Basic/Card_Setup Canon_Basic Card_Setup]}}
+
{{Notice|Read this first : [[Canon_Basic/Card_Setup|Canon Basic Card Setup]]}}
   
 
==Universal dumper==
 
==Universal dumper==
VxWorks and dryos compatible dumper. Log file records status, start and OS. Shows how to safely call event procs that might not be registered. If this doesn't work on your camera, you can try the original.
+
VxWorks and dryos compatible dumper. Log file records status, start and OS. Shows how to safely call event procs that might not be registered. If this doesn't work on your camera, you can try the original. For a dumper that works on DIGIC 7 cameras, see the next script.
   
 
'''IMPORTANT:''' While this script attempts to display status messages on the screen, the text message may not be visible. '''If the camera appears not to respond to the script, check the card'''. If the script ran, status will be recorded in CBDUMPER.LOG and if the dump was successful, the ROM image will be saved in PRIMARY.BIN
 
'''IMPORTANT:''' While this script attempts to display status messages on the screen, the text message may not be visible. '''If the camera appears not to respond to the script, check the card'''. If the script ran, status will be recorded in CBDUMPER.LOG and if the dump was successful, the ROM image will be saved in PRIMARY.BIN
   
   
  +
Save this script as the file 'extend.m' on your card.
   
 
<source lang="thinbasic">
 
<source lang="thinbasic">
Line 17: Line 20:
 
DIM lcdmsg=0
 
DIM lcdmsg=0
 
DIM msgstr=0
 
DIM msgstr=0
  +
DIM romsize=0
 
 
 
' detect start address and OS
 
' detect start address and OS
Line 32: Line 36:
 
end if
 
end if
 
if memcmp(0xFF810004,"gaonisoy",8) = 0 then
 
if memcmp(0xFF810004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFF810000
  +
os = "dry"
  +
exit sub
  +
end if
  +
if memcmp(0xFF820004,"gaonisoy",8) = 0 then
 
startaddr = 0xFF810000
 
startaddr = 0xFF810000
 
os = "dry"
 
os = "dry"
Line 46: Line 55:
 
exit sub
 
exit sub
 
end if
 
end if
if memcmp(0xFE020004,"gaonisoy",8) = 0 then
+
if memcmp(0xFF020004,"gaonisoy",8) = 0 then
startaddr = 0xFE020000
+
startaddr = 0xFF010000
 
os = "dry"
 
os = "dry"
  +
exit sub
  +
end if
  +
if memcmp(0xFC020004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFC000000
  +
os = "dry"
  +
romsize = 0x2000000
  +
exit sub
  +
end if
  +
if memcmp(0xE0020004,"gaonisoy",8) = 0 then
  +
startaddr = 0xE0000000
  +
os = "dry"
  +
romsize = 0x2000000
 
exit sub
 
exit sub
 
end if
 
end if
Line 98: Line 119:
 
sprintf(msgstr,"%0X %s",startaddr,os)
 
sprintf(msgstr,"%0X %s",startaddr,os)
 
PutMsg(msgstr)
 
PutMsg(msgstr)
romsize = 0xFFFFFFFC - startaddr
+
if romsize = 0 then
  +
romsize = 0xFFFFFFFC - startaddr
  +
end if
 
dumpfile = Fopen_Fut("A/PRIMARY.BIN","w")
 
dumpfile = Fopen_Fut("A/PRIMARY.BIN","w")
 
if dumpfile <> 0 then
 
if dumpfile <> 0 then
Line 114: Line 137:
 
end sub
 
end sub
 
</source>
 
</source>
  +
  +
==Improved universal dumper==
  +
Modified version of the original universal dumper. Kept here until there's evidence that it works better than the original.
  +
It tries to overcome two weak points of the original script:<br />
  +
- The status message should now appear on all DryOS cameras, though good visibility is not guaranteed.<br />
  +
- It attempts to detect the firmware's actual address range and should now be compatible with DIGIC 7 cameras.<br />
  +
VxWorks cameras won't display any messages during dumping. Does not work on very early VxWorks models (Ixus 30/40, S1IS).
  +
  +
'''IMPORTANT:''' While this script attempts to display status messages on the screen, the text message may not be visible. '''If the camera appears not to respond to the script, check the card'''. If the script ran, status will be recorded in CBDUMPER.LOG and if the dump was successful, the ROM image will be saved in PRIMARY.BIN
  +
  +
  +
Save this script as the file 'extend.m' on your card.
  +
  +
<source lang="thinbasic">
  +
' dump ROM to A/PRIMARY.BIN
  +
' log to A/CBDUMPER.LOG
  +
' progress is not displayed on VxWorks cams
  +
' a working script blocks the camera until finished
  +
  +
DIM startaddr=0
  +
DIM foundaddr=0
  +
DIM os="unk"
  +
DIM lcdmsg=0
  +
DIM msgstr=0
  +
DIM romsize=0
  +
  +
' detect start address and OS
  +
' order must be from highest to lowest, since accessing outside of ROM may trigger an exception
  +
private sub GetStart()
  +
' get an address that is hopefully in ROM area
  +
foundaddr=CreateProxyOfEventProcedure("CreateTask")
  +
DeleteProxyOfEventProcedure("CreateTask")
  +
if foundaddr > 0xffc00000 then
  +
if memcmp(0xFFC00004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFFC00000
  +
os = "dry"
  +
exit sub
  +
end if
  +
if memcmp(0xFFC00008,"Copyrigh",8) = 0 then
  +
startaddr = 0xFFC00000
  +
os = "vx"
  +
exit sub
  +
end if
  +
if memcmp(0xFF810004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFF810000
  +
os = "dry"
  +
exit sub
  +
end if
  +
if memcmp(0xFF820004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFF810000
  +
os = "dry"
  +
exit sub
  +
end if
  +
if memcmp(0xFF810008,"Copyrigh",8) = 0 then
  +
startaddr = 0xFF810000
  +
os = "vx"
  +
exit sub
  +
end if
  +
end if
  +
if foundaddr > 0xff800000 then
  +
if memcmp(0xFF810004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFF810000
  +
os = "dry"
  +
exit sub
  +
end if
  +
if memcmp(0xFF820004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFF810000
  +
os = "dry"
  +
exit sub
  +
end if
  +
if memcmp(0xFF810008,"Copyrigh",8) = 0 then
  +
startaddr = 0xFF810000
  +
os = "vx"
  +
exit sub
  +
end if
  +
end if
  +
if foundaddr > 0xff000000 then
  +
if memcmp(0xFF000004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFF000000
  +
os = "dry"
  +
exit sub
  +
end if
  +
if memcmp(0xFF020004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFF010000
  +
os = "dry"
  +
exit sub
  +
end if
  +
end if
  +
if foundaddr > 0xfc000000 then
  +
if memcmp(0xFC020004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFC000000
  +
os = "dry"
  +
romsize = 0x2000000
  +
exit sub
  +
end if
  +
end if
  +
if foundaddr > 0xf8000000 then
  +
if memcmp(0xFF000004,"gaonisoy",8) = 0 then
  +
startaddr = 0xFF000000
  +
os = "dry"
  +
exit sub
  +
end if
  +
end if
  +
if foundaddr > 0xe0000000 then
  +
if memcmp(0xE0020004,"gaonisoy",8) = 0 then
  +
startaddr = 0xE0000000
  +
os = "dry"
  +
romsize = 0x2000000
  +
exit sub
  +
end if
  +
end if
  +
end sub
  +
  +
private sub RegisterProcs()
  +
' Newest cams (Dryos rel 43 and later) only have System.Create()
  +
' on older dryos cams SystemEventInit is an alias for System.Create()
  +
' ExecuteEventProcedure does is not registered by default on vx,
  +
' but calling an unregistered is not fatal
  +
if System.Create() = -1 then
  +
SystemEventInit()
  +
end if
  +
if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
  +
ExecuteEventProcedure("UI.CreatePublic")
  +
end if
  +
end sub
  +
  +
private sub InitMsg()
  +
lcdmsg = ExecuteEventProcedure("LCDMsg_Create",10,10,"Started",2)
  +
if lcdmsg >= 0 then
  +
LCDMsg_ChangeColor(lcdmsg,2)
  +
end if
  +
msgstr = AllocateMemory(80)
  +
' truncate log
  +
msgfile = Fopen_Fut("A/CBDUMPER.LOG","w")
  +
if msgfile <> 0 then
  +
Fclose_Fut(msgfile)
  +
end if
  +
end sub
  +
  +
private sub PutMsg(msg)
  +
if lcdmsg >= 0 then
  +
LCDMsg_SetStr(lcdmsg,msg,0)
  +
end if
  +
msgfile = Fopen_Fut("A/CBDUMPER.LOG","a")
  +
if msgfile <> 0 then
  +
Fwrite_Fut(msg,strlen(msg),1,msgfile)
  +
Fwrite_Fut("\n",1,1,msgfile)
  +
Fclose_Fut(msgfile)
  +
end if
  +
end sub
  +
  +
private sub Initialize()
  +
RegisterProcs()
  +
InitMsg()
  +
PutMsg("Started")
  +
  +
GetStart()
  +
  +
if startaddr <> 0 then
  +
sprintf(msgstr,"%0X %s",startaddr,os)
  +
PutMsg(msgstr)
  +
if romsize = 0 then
  +
romsize = 0xFFFFFFFC - startaddr
  +
end if
  +
dumpfile = Fopen_Fut("A/PRIMARY.BIN","w")
  +
if dumpfile <> 0 then
  +
Fwrite_Fut(startaddr,romsize,1,dumpfile)
  +
Fclose_Fut(dumpfile)
  +
Wait(500)
  +
PutMsg("done")
  +
else
  +
PutMsg("file error")
  +
end if
  +
else
  +
sprintf(msgstr,"proxy found at %0X",foundaddr)
  +
PutMsg(msgstr)
  +
PutMsg("Firmware start not found!")
  +
end if
  +
FreeMemory(msgstr)
  +
end sub
  +
</source>
  +
  +
==Blind dumper for DIGIC 7 cameras==
  +
Below script should work on DIGIC 7 (EOS M and PowerShot) models. It does not check for firmware signature. This is a temporary solution until the universal script becomes compatible with DIGIC 7.
  +
  +
<source lang="thinbasic">
  +
dim f,a,startadr=0,romsize=0x2000000,msgstr=0
  +
  +
private sub mydump(c)
  +
startadr = c * 0x1000000
  +
startadr = startadr + 0xe0000000
  +
sprintf(msgstr,"A/PRIMARY.BIN")
  +
LCDMsg_SetStr(a,msgstr)
  +
f=Fopen_Fut(msgstr,"w")
  +
Fwrite_Fut(startadr,romsize,1,f)
  +
Fclose_Fut(f)
  +
Wait(500)
  +
end sub
  +
  +
private sub Initialize()
  +
UI.CreatePublic()
  +
a=LCDMsg_Create()
  +
LCDMsg_SetStr(a,"Running")
  +
System.Create()
  +
msgstr = AllocateMemory(80)
  +
  +
mydump(0)
  +
  +
LCDMsg_SetStr(a,"Done")
  +
FreeMemory(msgstr)
  +
end sub
  +
</source>
  +
  +
2018/08/12 User Comment from [[chdk:User:Colin_of_Rame|Colin]] : ''"This did not work for me. I used standard script and took a photo which appears to have worked (SX730HS)"''
   
 
==Original simple dumper==
 
==Original simple dumper==

Latest revision as of 13:56, 6 May 2021

Notice

Read this first : Canon Basic Card Setup


Universal dumper

VxWorks and dryos compatible dumper. Log file records status, start and OS. Shows how to safely call event procs that might not be registered. If this doesn't work on your camera, you can try the original. For a dumper that works on DIGIC 7 cameras, see the next script.

IMPORTANT: While this script attempts to display status messages on the screen, the text message may not be visible. If the camera appears not to respond to the script, check the card. If the script ran, status will be recorded in CBDUMPER.LOG and if the dump was successful, the ROM image will be saved in PRIMARY.BIN


Save this script as the file 'extend.m' on your card.

' dump ROM to A/PRIMARY.BIN 
' log to A/CBDUMPER.LOG
 
DIM startaddr=0
DIM os="unk"
DIM lcdmsg=0
DIM msgstr=0
DIM romsize=0
 
' detect start address and OS
' order must be from highest to lowest, since accessing outside of ROM may trigger an exception
private sub GetStart()
	if memcmp(0xFFC00004,"gaonisoy",8) = 0 then
		startaddr = 0xFFC00000
		os = "dry"
		exit sub
	end if
	if memcmp(0xFFC00008,"Copyrigh",8) = 0 then
		startaddr = 0xFFC00000
		os = "vx"
		exit sub
	end if
	if memcmp(0xFF810004,"gaonisoy",8) = 0 then
		startaddr = 0xFF810000
		os = "dry"
		exit sub
	end if
	if memcmp(0xFF820004,"gaonisoy",8) = 0 then
		startaddr = 0xFF810000
		os = "dry"
		exit sub
	end if
	if memcmp(0xFF810008,"Copyrigh",8) = 0 then
		startaddr = 0xFF810000
		os = "vx"
		exit sub
	end if
	if memcmp(0xFF000004,"gaonisoy",8) = 0 then
		startaddr = 0xFF000000
		os = "dry"
		exit sub
	end if
	if memcmp(0xFF020004,"gaonisoy",8) = 0 then
		startaddr = 0xFF010000
		os = "dry"
		exit sub
	end if
	if memcmp(0xFC020004,"gaonisoy",8) = 0 then
		startaddr = 0xFC000000
		os = "dry"
		romsize = 0x2000000
		exit sub
	end if
	if memcmp(0xE0020004,"gaonisoy",8) = 0 then
		startaddr = 0xE0000000
		os = "dry"
		romsize = 0x2000000
		exit sub
	end if
end sub
 
private sub RegisterProcs()
	' Newest cams (Dryos rel 43 and later) only have System.Create()
	' on older dryos cams SystemEventInit is an alias for System.Create()
	' ExecuteEventProcedure does is not registered by default on vx, 
	' but calling an unregistered is not fatal
	if System.Create() = -1 then
		SystemEventInit()
	end if
	if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
		ExecuteEventProcedure("UI.CreatePublic")
	end if
end sub
 
private sub InitMsg()
	lcdmsg = ExecuteEventProcedure("LCDMsg_Create")
	msgstr = AllocateMemory(80)
	' truncate log
	msgfile = Fopen_Fut("A/CBDUMPER.LOG","w")
	if msgfile <> 0 then
		Fclose_Fut(msgfile)
	end if
end sub
 
private sub PutMsg(msg)
	if lcdmsg >= 0 then
		LCDMsg_SetStr(lcdmsg,msg)
	end if
	msgfile = Fopen_Fut("A/CBDUMPER.LOG","a")
	if msgfile <> 0 then
		Fwrite_Fut(msg,strlen(msg),1,msgfile)
		Fwrite_Fut("\n",1,1,msgfile)
		Fclose_Fut(msgfile)
	end if
end sub
 
private sub Initialize()
	RegisterProcs()
	InitMsg()
	PutMsg("Started")
 
	GetStart()
 
	if startaddr <> 0 then
		sprintf(msgstr,"%0X %s",startaddr,os)
		PutMsg(msgstr)
		if romsize = 0 then
			romsize = 0xFFFFFFFC - startaddr
		end if
		dumpfile = Fopen_Fut("A/PRIMARY.BIN","w")
		if dumpfile <> 0 then
			Fwrite_Fut(startaddr,romsize,1,dumpfile)
			Fclose_Fut(dumpfile)
			Wait(500)
			PutMsg("done")
		else
			PutMsg("file error")
		end if
	else
		PutMsg("not found!")
	end if
	FreeMemory(msgstr)
end sub

Improved universal dumper

Modified version of the original universal dumper. Kept here until there's evidence that it works better than the original. It tries to overcome two weak points of the original script:
- The status message should now appear on all DryOS cameras, though good visibility is not guaranteed.
- It attempts to detect the firmware's actual address range and should now be compatible with DIGIC 7 cameras.
VxWorks cameras won't display any messages during dumping. Does not work on very early VxWorks models (Ixus 30/40, S1IS).

IMPORTANT: While this script attempts to display status messages on the screen, the text message may not be visible. If the camera appears not to respond to the script, check the card. If the script ran, status will be recorded in CBDUMPER.LOG and if the dump was successful, the ROM image will be saved in PRIMARY.BIN


Save this script as the file 'extend.m' on your card.

' dump ROM to A/PRIMARY.BIN 
' log to A/CBDUMPER.LOG
' progress is not displayed on VxWorks cams
' a working script blocks the camera until finished
 
DIM startaddr=0
DIM foundaddr=0
DIM os="unk"
DIM lcdmsg=0
DIM msgstr=0
DIM romsize=0
 
' detect start address and OS
' order must be from highest to lowest, since accessing outside of ROM may trigger an exception
private sub GetStart()
	' get an address that is hopefully in ROM area
	foundaddr=CreateProxyOfEventProcedure("CreateTask")
	DeleteProxyOfEventProcedure("CreateTask")
	if foundaddr > 0xffc00000 then
		if memcmp(0xFFC00004,"gaonisoy",8) = 0 then
			startaddr = 0xFFC00000
			os = "dry"
			exit sub
		end if
		if memcmp(0xFFC00008,"Copyrigh",8) = 0 then
			startaddr = 0xFFC00000
			os = "vx"
			exit sub
		end if
		if memcmp(0xFF810004,"gaonisoy",8) = 0 then
			startaddr = 0xFF810000
			os = "dry"
			exit sub
		end if
		if memcmp(0xFF820004,"gaonisoy",8) = 0 then
			startaddr = 0xFF810000
			os = "dry"
			exit sub
		end if
		if memcmp(0xFF810008,"Copyrigh",8) = 0 then
			startaddr = 0xFF810000
			os = "vx"
			exit sub
		end if
	end if
	if foundaddr > 0xff800000 then
		if memcmp(0xFF810004,"gaonisoy",8) = 0 then
			startaddr = 0xFF810000
			os = "dry"
			exit sub
		end if
		if memcmp(0xFF820004,"gaonisoy",8) = 0 then
			startaddr = 0xFF810000
			os = "dry"
			exit sub
		end if
		if memcmp(0xFF810008,"Copyrigh",8) = 0 then
			startaddr = 0xFF810000
			os = "vx"
			exit sub
		end if
	end if
	if foundaddr > 0xff000000 then
		if memcmp(0xFF000004,"gaonisoy",8) = 0 then
			startaddr = 0xFF000000
			os = "dry"
			exit sub
		end if
		if memcmp(0xFF020004,"gaonisoy",8) = 0 then
			startaddr = 0xFF010000
			os = "dry"
			exit sub
		end if
	end if
	if foundaddr > 0xfc000000 then
		if memcmp(0xFC020004,"gaonisoy",8) = 0 then
			startaddr = 0xFC000000
			os = "dry"
			romsize = 0x2000000
			exit sub
		end if
	end if
	if foundaddr > 0xf8000000 then
		if memcmp(0xFF000004,"gaonisoy",8) = 0 then
			startaddr = 0xFF000000
			os = "dry"
			exit sub
		end if
	end if
	if foundaddr > 0xe0000000 then
		if memcmp(0xE0020004,"gaonisoy",8) = 0 then
			startaddr = 0xE0000000
			os = "dry"
			romsize = 0x2000000
			exit sub
		end if
	end if
end sub
 
private sub RegisterProcs()
	' Newest cams (Dryos rel 43 and later) only have System.Create()
	' on older dryos cams SystemEventInit is an alias for System.Create()
	' ExecuteEventProcedure does is not registered by default on vx, 
	' but calling an unregistered is not fatal
	if System.Create() = -1 then
		SystemEventInit()
	end if
	if ExecuteEventProcedure("UI_RegistDebugEventProc") = -1 then
		ExecuteEventProcedure("UI.CreatePublic")
	end if
end sub
 
private sub InitMsg()
	lcdmsg = ExecuteEventProcedure("LCDMsg_Create",10,10,"Started",2)
	if lcdmsg >= 0 then
		LCDMsg_ChangeColor(lcdmsg,2)
	end if
	msgstr = AllocateMemory(80)
	' truncate log
	msgfile = Fopen_Fut("A/CBDUMPER.LOG","w")
	if msgfile <> 0 then
		Fclose_Fut(msgfile)
	end if
end sub
 
private sub PutMsg(msg)
	if lcdmsg >= 0 then
		LCDMsg_SetStr(lcdmsg,msg,0)
	end if
	msgfile = Fopen_Fut("A/CBDUMPER.LOG","a")
	if msgfile <> 0 then
		Fwrite_Fut(msg,strlen(msg),1,msgfile)
		Fwrite_Fut("\n",1,1,msgfile)
		Fclose_Fut(msgfile)
	end if
end sub
 
private sub Initialize()
	RegisterProcs()
	InitMsg()
	PutMsg("Started")
 
	GetStart()
 
	if startaddr <> 0 then
		sprintf(msgstr,"%0X %s",startaddr,os)
		PutMsg(msgstr)
		if romsize = 0 then
			romsize = 0xFFFFFFFC - startaddr
		end if
		dumpfile = Fopen_Fut("A/PRIMARY.BIN","w")
		if dumpfile <> 0 then
			Fwrite_Fut(startaddr,romsize,1,dumpfile)
			Fclose_Fut(dumpfile)
			Wait(500)
			PutMsg("done")
		else
			PutMsg("file error")
		end if
	else
		sprintf(msgstr,"proxy found at %0X",foundaddr)
		PutMsg(msgstr)
		PutMsg("Firmware start not found!")
	end if
	FreeMemory(msgstr)
end sub

Blind dumper for DIGIC 7 cameras

Below script should work on DIGIC 7 (EOS M and PowerShot) models. It does not check for firmware signature. This is a temporary solution until the universal script becomes compatible with DIGIC 7.

dim f,a,startadr=0,romsize=0x2000000,msgstr=0

private sub mydump(c)
        startadr = c * 0x1000000
        startadr = startadr + 0xe0000000
        sprintf(msgstr,"A/PRIMARY.BIN")
        LCDMsg_SetStr(a,msgstr)
        f=Fopen_Fut(msgstr,"w")
        Fwrite_Fut(startadr,romsize,1,f)
        Fclose_Fut(f)
        Wait(500)
end sub

private sub Initialize()
	UI.CreatePublic()
	a=LCDMsg_Create()
	LCDMsg_SetStr(a,"Running")
	System.Create()
	msgstr = AllocateMemory(80)

        mydump(0)

        LCDMsg_SetStr(a,"Done")
	FreeMemory(msgstr)
end sub

2018/08/12 User Comment from Colin : "This did not work for me. I used standard script and took a photo which appears to have worked (SX730HS)"

Original simple dumper

dim f,a,startadr=0,romsize
 
private sub Initialize()
	UI.CreatePublic()
	a=LCDMsg_Create()
	LCDMsg_SetStr(a,"Running")
	System.Create()
 
	if memcmp(0xFFC00004,"gaonisoy",8) = 0 then
		startadr = 0xFFC00000
		LCDMsg_SetStr(a,"FFC00000")
	else
		if memcmp(0xFF810004,"gaonisoy",8) = 0 then
			startadr = 0xFF810000
			LCDMsg_SetStr(a,"FF810000")
		else
			LCDMsg_SetStr(a,"start not found!")
			Wait(1000)
		end if
	end if
 
	if startadr <> 0 then
		romsize = 0xFFFFFFFC - startadr
		f=Fopen_Fut("A/PRIMARY.BIN","w")
		Fwrite_Fut(startadr,romsize,1,f)
		Fclose_Fut(f)
		LCDMsg_SetStr(a,"done")
	end if
end sub