Wikia

CHDK Wiki

Changes: UART

Edit

Back to page

m (cat)
(uart connections for some cameras)
 
(9 intermediate revisions by 4 users not shown)
Line 2: Line 2:
 
i investigated this a little and located the UART connections for all cameras i had on hand...
 
i investigated this a little and located the UART connections for all cameras i had on hand...
   
{| align="right" style="border-collapse:collapse; font-size: x-small;"
+
{| style="border-collapse:collapse; font-size: x-small;" align="right"
 
| __TOC__
 
| __TOC__
 
|}
 
|}
   
== about the UART port in general ==
+
== About the UART port in general ==
   
it appears that every canon camera has a serial port that gives access to a shell (command line interface) that lets you control the camera even without chdk loaded.
+
It appears that every canon camera has a serial port that gives access to a shell (command line interface) that lets you control the camera even without CHDK loaded.
 
it might also be useful to recover possibly bricked cameras by giving access to a bootloader.
 
it might also be useful to recover possibly bricked cameras by giving access to a bootloader.
   
on all cameras you get access to the [[Event Shell]], DryOS cameras also have a [[DryOS Shell]].
+
An all cameras you get access to the [[Event Shell]], DryOS cameras also have a [[DryOS Shell]].
   
note that this is not _that_ interesting, as with CHDK's [[PTP Extension]] you can accesss the camera more conveniently via USB, without requuiring hardware modificationss.
+
NOTE: for general purpose remote camera control, CHDK's [[PTP Extension]] is likely to be more convenient, provided USB is available.
   
 
== locating the uart connection points ==
 
== locating the uart connection points ==
Line 44: Line 44:
   
 
[http://dangerousprototypes.com/docs/Bus_Pirate Bus Pirate] is also a very nice hacking tool (supports UART 3.3V & 5.0V, JTAG, I2C, SPI and more).
 
[http://dangerousprototypes.com/docs/Bus_Pirate Bus Pirate] is also a very nice hacking tool (supports UART 3.3V & 5.0V, JTAG, I2C, SPI and more).
  +
  +
===Changing UART settings===
  +
On VxWorks cameras, it is possible to change the UART speed etc. using VxWorks ioctl calls. This can be done from CHDK Lua using the [[Lua/Lua Reference/Native Function Calls]] call_func_ptr function. To do this, you will need the addresses of the following functions: open ioctl close
  +
  +
These can usually be found in the stubs_entry.S file for your platform in the CHDK source tree. The following Lua example changes the UART speed to 9600 for a530 (note, based on user report, actual code is untested! Speed down to 300baud tested and works on a530)
  +
  +
FIOBAUDRATE=4 -- vxworks IOCTL number, found on google
  +
-- function addresses from stubs_entry.S
  +
fptr_open=0xffec8b34
  +
fptr_ioctl=0xffec8630
  +
fptr_close=0xffec84f0
  +
  +
-- open the file console device r/w
  +
fd=call_func_ptr(fptr_open,"/tyCo/0",2,0)
  +
print('open returned',fd) -- >= 0 indicates open works
  +
if fd < 0 then
  +
error('open failed')
  +
end
  +
-- call the ioctl
  +
status=call_func_ptr(fptr_ioctl,fd,FIOBAUDRATE,9600)
  +
print('ioctl returned',status) -- 0 probably means success
  +
-- close the fd
  +
call_func_ptr(fptr_close,fd)
   
 
== uart connections for some cameras ==
 
== uart connections for some cameras ==
Line 78: Line 101:
 
[[File:A810_uart.jpg|512px|Canon A810 UART Pinout]]<br />
 
[[File:A810_uart.jpg|512px|Canon A810 UART Pinout]]<br />
 
Source: [http://chdk.setepontos.com/index.php?topic=8148.0]
 
Source: [http://chdk.setepontos.com/index.php?topic=8148.0]
  +
  +
=== [[A1100IS]] ===
  +
[[File:Canon_a1100_uart_rx_tx.jpg|400px|Canon PowerShot A1100IS UART pinout]]
  +
  +
=== [[A460]] ===
  +
[[File:Canon_a460_uart_rx_tx.jpg|400px|Canon PowerShot A460 UART pinout]]
  +
  +
=== [[ELPH135|Ixus145 / Elph135]] ===
  +
[[File:Ixus145_uart_crop.jpg|512px|Canon Ixus145 / Elph135 UART pinout]]<br />
  +
Source: [http://chdk.setepontos.com/index.php?topic=11374.msg112090#msg112090]
 
[[Category:UART]]
 
[[Category:UART]]
[[Category:Hardware]]
+
  +
=== [[SX230HS|SX230]] ===
  +
[[File:20140527 151201.jpg|left|thumb|451x451px]]
  +
  +
Sorry for breaking the coloring convention as above, but these are the UART pad locations for the SX230.
  +
  +
115200 baud 8n1 as above.
  +
  +
[https://www.youtube.com/watch?v=iH7C41HmKfw YouTube video showing how to dismantle] [[Category:Hardware]]

Latest revision as of 16:43, May 27, 2014

...after reading User:Pixeldoc2000's description of the UART port on the SD4000, i investigated this a little and located the UART connections for all cameras i had on hand...

About the UART port in general Edit

It appears that every canon camera has a serial port that gives access to a shell (command line interface) that lets you control the camera even without CHDK loaded. it might also be useful to recover possibly bricked cameras by giving access to a bootloader.

An all cameras you get access to the Event Shell, DryOS cameras also have a DryOS Shell.

NOTE: for general purpose remote camera control, CHDK's PTP Extension is likely to be more convenient, provided USB is available.

locating the uart connection points Edit

this is relatively simple if you have access to an oscilloscope or logic analyzer. it took me only a few minutes on most cameras.

the camera will always send a short string (just the event-shell prompt) when booting. so just probe on the pcb while power-cycling the camera until you find that transmission, then you have the TxD pin... RxD is usually right next to it. (but testing RxD takes a little more care, as you have to connect an external signal here, and might break something when connecting to the wrong pin.)


Canon ixus300 sd4000 uart rigol

Canon SD4000 UART RX Scope Screenshot


(todo: note idle voltages of both pins).

almost all camera have an (usually unpopulated) debug/factory test connector on the pcb, usually close to the USB port. and usually the first pin on that connector is RxD and the second is TxD. also both signals are in most cases available on test-points right next to the connetor (more convenient to solder). (GND can be grabbbed at the connector shield/mount, or any convenient point.)

see the pictures below for some examples.

settings/usage Edit

to connect to the port you will need a serial interface with 3.3V TTL levels.

UART Settings: 115200/8/1/N (115200 Baud)
Voltage Level: 3.3V (TTL)

USB to Serial Interfaces can for example be bought on ebay (search for "ttl rs232" and include international sellers, they are just a few bucks, with shiping from china).

FTDI sells USB TTL Serial Cables like TTL-232R-3V3 which are perfect for the job.

Bus Pirate is also a very nice hacking tool (supports UART 3.3V & 5.0V, JTAG, I2C, SPI and more).

Changing UART settingsEdit

On VxWorks cameras, it is possible to change the UART speed etc. using VxWorks ioctl calls. This can be done from CHDK Lua using the Lua/Lua Reference/Native Function Calls call_func_ptr function. To do this, you will need the addresses of the following functions: open ioctl close

These can usually be found in the stubs_entry.S file for your platform in the CHDK source tree. The following Lua example changes the UART speed to 9600 for a530 (note, based on user report, actual code is untested! Speed down to 300baud tested and works on a530)

FIOBAUDRATE=4 -- vxworks IOCTL number, found on google
-- function addresses from stubs_entry.S
fptr_open=0xffec8b34
fptr_ioctl=0xffec8630
fptr_close=0xffec84f0

-- open the file console device r/w
fd=call_func_ptr(fptr_open,"/tyCo/0",2,0)
print('open returned',fd) -- >= 0 indicates open works
if fd < 0 then
  error('open failed')
end
-- call the ioctl
status=call_func_ptr(fptr_ioctl,fd,FIOBAUDRATE,9600)
print('ioctl returned',status) -- 0 probably means success
-- close the fd
call_func_ptr(fptr_close,fd)

uart connections for some cameras Edit

in all my pictures:
red=TxD (this is an output, be careful not to short it, that might break the camera)
green=RxD
BLACK=GND

SD4000 Edit

Canon ixus300 sd4000 uart

Canon ixus300 sd4000 uart buspirate

SD900Edit

SD900 also have UART. ToDo: add PCB Picture and Pinout.

IXUS 40 Edit

Canon IXUS40 UART

Powershot A530 Edit

Canon Powershot A530 UART

Ixus750 Edit

Canon IXUS750 UART

Powershot S2 Edit

i had no luck here, the debug connector is actually soldered in, but you need to almost completely disassemble the camera to get to it, it's a ZIF connector for a ribbon cable of very fine pitch that i did not have around. also be careful, this camera appears very sensitive due to high integration and the many PCBs... i actually broke one camera when taking it apart. :(

A800 Edit

A800 uart
Source: [1]

A810 Edit

A810 uart
Source: [2]

A1100IS Edit

Canon a1100 uart rx tx

A460 Edit

Canon a460 uart rx tx

Ixus145 / Elph135 Edit

Ixus145 uart crop
Source: [3]

SX230 Edit

20140527 151201

Sorry for breaking the coloring convention as above, but these are the UART pad locations for the SX230.

115200 baud 8n1 as above.

YouTube video showing how to dismantle

Around Wikia's network

Random Wiki