[ML] t1i/500d firmware devel

[SPGWhistler]

I own a T1i and I want to get Magic Lantern working with it. I am an
experienced web developer (php, javascript, ActionScript, etc, etc).

I have read through several posts about this, but none of them seem to
go anywhere.

The last post about this on this mailing list appeared to be focused
on a mac developer. Unfortunately I am not a mac developer (I run
Ubuntu or Windows), so I couldn't gleam much information from it.

Can any one point me to the resources I need to get started with this
project?

At this point, I'm not even fully certain of what needs to happen to
get Magic Lantern working on the T1i, so to start with, even basic
information on how to go about this would be great.

--
http://magiclantern.wikia.com/

To post to this group, send email to ml-d...@googlegroups.com
To unsubscribe from this group, send email to ml-devel+u...@googlegroups.com
For more options, visit this group at http://groups.google.com/group/ml-devel?hl=en

[tester13]

For starters, you need to buy IDA 5.6 Pro (as Canon uses ARM
processor) for reversing.
This is $819. And you don't want to be prosecuted for software pirace,
right?
Plus invest many hours learning low level stuff, ARM assembler and
reversing practices.
You could also use already developed code for 5DMII and mapped
functions (some of them are mapped for 500D already),
but you couldn't do much, as many things are different and without
reversing it won't be possible to know why.
This is sad truth.
So, go and buy some other DSLR and sell this while you can.

On Apr 22, 6:35 am, SPGWhistler <spgwhist...@gmail.com> wrote:
> I own a T1i and I want to get Magic Lantern working with it. I am an
> experienced web developer (php, javascript, ActionScript, etc, etc).
>
> I have read through several posts about this, but none of them seem to
> go anywhere.
>
> The last post about this on this mailing list appeared to be focused
> on a mac developer. Unfortunately I am not a mac developer (I run
> Ubuntu or Windows), so I couldn't gleam much information from it.
>
> Can any one point me to the resources I need to get started with this
> project?
>
> At this point, I'm not even fully certain of what needs to happen to
> get Magic Lantern working on the T1i, so to start with, even basic
> information on how to go about this would be great.
>

> --http://magiclantern.wikia.com/

[Anthony Petty]

Can't I use the freeware version of IDA? (I never pirate software any more - I'm an opensource guy now.) I've been looking over the DryOS porting instructions at the CHDK site to get an idea of the process involved, and from them it looks like I might be able to use the freeware version of IDA to get started at this.

Also, I'm very good at learning new technologies - I doubt I'll have trouble picking up assembly quickly enough to do this - hopefully.

No - I LOVE my T1i - and the T2i doesn't offer anything worth upgrading for - that software can't fix in the T1i... like controlling aperture in video mode. I'm sure Canon will eventually (in like 5 years) release a firmware upgrade for the T1i to offer these things any way - I just don't want to wait. :-)

Also - if there has already been some work done for this - does anyone know where I can get that so I have a starting point to look at?

- Tony

[tester13]

No you can't use IDA Free, many of CHDK board guys work on illegal
copies of IDA.

I use IDA Free for my projects, but I use thirdparty processor modules
available freely (not for ARM).
ARM module is shipped with IDA and it is closed.
Only way to reverse ARM is to buy IDA Pro.

And try to hear me. Forget about any upgrades, price for 500D is
already falling down rapidly.
550D is real upgrade for 450D. Any video upgrades are not possible,
sensor have slow readout speed,
this is not fixable by any firmware.
550D is also not best choise, as firmware is AES encrypted and I
really don't think that anyone without a leak could decrypt it in near
future.

> > ml-devel+u...@googlegroups.com<ml-devel%2Bunsubscribe@googlegroups.c­om>

> > > For more options, visit this group athttp://
> > groups.google.com/group/ml-devel?hl=en
>
> > --
> >http://magiclantern.wikia.com/
>
> > To post to this group, send email to ml-d...@googlegroups.com
> > To unsubscribe from this group, send email to

> > ml-devel+u...@googlegroups.com<ml-devel%2Bunsubscribe@googlegroups.c­om>

> > For more options, visit this group at
> >http://groups.google.com/group/ml-devel?hl=en
>

> --http://magiclantern.wikia.com/
>
> To post to this group, send email to ml-d...@googlegroups.com
> To unsubscribe from this group, send email to ml-devel+u...@googlegroups.com

> For more options, visit this group athttp://groups.google.com/group/ml-devel?hl=en- Hide quoted text -
>
> - Show quoted text -

[Anthony Petty]

Yes, I found out today about IDA Free not working.

I did read some place that someone had free GNU utilities to do ARM stuff... the process was: Use GNU utilities to get the firmware to a state that IDA free can import and read it, then use IDA Free to do the real work. But it sounds rather complex, and I don't have the time to learn 10 to 15 new tools, each with their their own book long documentation.

Why would Canon AES encrypt the T2i's firmware? Are you sure about this? How do you know if no one has a firmware dump from the T2i? Has Canon released a firemware upgrade for it?

I realize the physical limits of the hardware can not be changed by firmware - but things like aperture settings in video mode can be.

I have looked at the differences between the T2i and the T1i - and most of them are software.... well... at least a few of them are software! Obviously it has a different aspect ratio screen, and a faster sensor with more mega pixels... but other then that - I'd bet all of the software upgrades could be done on the T1i.... things like manual control of the video mode, sound level meters, etc, etc...

So if anyone knows how to reverse with FREE software, do let me know.

- Tony

[tester13]

OK, if you just want to wast your time, you are welcome to T1i
project. :-)
IDA database format is tightly linked to processor module and you
couldn't do any serious research without this tool.
So, no such GNU things exist. Never heard of them.

As for 550D encryption. We have 550D service firmware it is legit and
works on 550D.
It don't use XOR tables (believe me, I know this field). And every
Canon firmware have AES implementation.
So according to distribution statistics and this logic we have AES.
And it leaves no chance.

500D have no mic-in.
Sensor is totally different. LSI is different.
Only outer shell is similar.
t is just old camera with best option to sell it ASAP.

> > <ml-devel%2Bunsubscr...@googlegroups.c­om>

> > > > > For more options, visit this group athttp://
> > > > groups.google.com/group/ml-devel?hl=en
>
> > > > --
> > > >http://magiclantern.wikia.com/
>
> > > > To post to this group, send email to ml-d...@googlegroups.com
> > > > To unsubscribe from this group, send email to
> > > > ml-devel+u...@googlegroups.com<ml-devel%2Bunsubscribe@googlegroups.c­om>

> > <ml-devel%2Bunsubscr...@googlegroups.c­om>

> > > > For more options, visit this group at
> > > >http://groups.google.com/group/ml-devel?hl=en
>
> > > --http://magiclantern.wikia.com/
>
> > > To post to this group, send email to ml-d...@googlegroups.com
> > > To unsubscribe from this group, send email to

> > ml-devel+u...@googlegroups.com<ml-devel%2Bunsubscribe@googlegroups.c­om>
> > > For more options, visit this group athttp://

[Trammell Hudson]

On Fri, Apr 23, 2010 at 09:37:20AM -0400, Anthony Petty wrote:
> Can't I use the freeware version of IDA?

After I used the free version for a week and spent the money on the
full thing. It really is a great program and well worth the money
($539 for the standard license) if you do much reverse engineering.
It is licensed to you, not to your computer, so you can install it
on any machine you use.

There are limitations on how long you can work on a project (45
minutes at a time) and you can't save it. I wrote the remake-elf
script in the ML tree to build ELF files for loading with symbols
pre-mapped.

Prior to starting with IDA, I had written some scripts that used
strings and objdump to dissassemble code and provide some
annotations, but once I used IDA I never went back to them again.
It really is that good.

> [...] Also, I'm very good at learning new technologies - I doubt

> I'll have trouble picking up assembly quickly enough to do this -
> hopefully.

ARM is one of the nicer assemblies. I especially like the predicate
bits on every instruction so that you can make conditional versions
of every possible instruction, not just branches.

"Write great code" by Hyde is a really good introduction to machine
architectures if you have never worked with assembly before. It is
about the i386, but they are all very similar.

> No - I LOVE my T1i - and the T2i doesn't offer anything worth upgrading for
> - that software can't fix in the T1i...

The mic input is what differentiates them in my mind. Without the
mic, the T1i isn't as interesting to me since many of the most
useful Magic Lantern features are audio related.

Good luck!

--
Trammell

[tester13]

Trammell, you said some confusing things.
First, you worked with IDA Demo version, it is curent version,
restricted as hell, useless.
I am working with IDA 4.9 Free, this is full version, but old.
Do not have native modules other than x86.

Plus it is good to understand that none in their mind will spend $530
(computer based license is $820). Not only this, but almost anyone
who'll want to buy IDA will be rejected :-)

> --http://magiclantern.wikia.com/

[arm.indy]

other ways to help on the 500D is to try to compile this and after
test it on the camera.
http://groups.google.com/group/ml-devel/browse_thread/thread/7b7fee6ff03c7897#

Arm.Indy

[Trammell Hudson]

On Sat, Apr 24, 2010 at 06:18:41AM -0700, tester13 wrote:
> First, you worked with IDA Demo version, it is curent version,
> restricted as hell, useless.

When I downloaded the demo last year it was pretty restricted, but
had the ARM module and could load ELF files. It wouldn't save the
IDB and would exit after 45 minutes, so I had to update my stubs.S
file with the new symbols and re-run remake-elf after each crash to
make forward progress. I'm not sure what restrictions the current
demo version has.

> I am working with IDA 4.9 Free, this is full version, but old.
> Do not have native modules other than x86.

I'm using 5.6.0, although my one year support contract expires in
two days, so unless they release a new version before then that is
what I will be stuck with...

> Plus it is good to understand that none in their mind will spend $530
> (computer based license is $820). Not only this, but almost anyone
> who'll want to buy IDA will be rejected :-)

The only major difference that I saw between the Standard and Pro
version was x86_64 support. Since I'm not doing any reverse
engineering on 64-bit platforms, it didn't seem like a big win to
me. Are there other significant additions?

--
Trammell

[tester13]

You did not understand my point.
Individual can not buy IDA Pro without providing many details and
proving that it is his professional tool :-)
It is clearly pointed by IDA Pro author. Reason is that leaks make
huge impact on sales. Like 5.5 leak not long ago.
So, simple John Doe do not have any chance.

On Apr 24, 9:10 pm, Trammell Hudson <hud...@osresearch.net> wrote:
> On Sat, Apr 24, 2010 at 06:18:41AM -0700, tester13 wrote:
> > First, you worked with IDA Demo version, it is curent version,
> > restricted as hell, useless.
>
> When I downloaded the demo last year it was pretty restricted, but
> had the ARM module and could load ELF files.  It wouldn't save the
> IDB and would exit after 45 minutes, so I had to update my stubs.S
> file with the new symbols and re-run remake-elf after each crash to
> make forward progress.  I'm not sure what restrictions the current
> demo version has.
>
> > I am working with IDA 4.9 Free, this is full version, but old.
> > Do not have native modules other than x86.
>
> I'm using 5.6.0, although my one year support contract expires in
> two days, so unless they release a new version before then that is
> what I will be stuck with...
>
> > Plus it is good to understand that none in their mind will spend $530
> > (computer based license is $820). Not only this, but almost anyone
> > who'll want to buy IDA will be rejected :-)
>
> The only major difference that I saw between the Standard and Pro
> version was x86_64 support.  Since I'm not doing any reverse
> engineering on 64-bit platforms, it didn't seem like a big win to
> me.  Are there other significant additions?
>
> --
> Trammell
>

> --http://magiclantern.wikia.com/

[JeremyOne]

I am working on porting ML to the t2i/550D and am stuck on the dumping
process. I have done some research on the next step, and I apologize
if my understanding is incorrect.

However, it looks like someone has already dumped the t1i firmware on
the CHDK forums, so you would just need to reverse engineer that
firmware (using IDA) to find the entry points to functions that ML
needs to run.

Once you've done that you can modify ML and build a new loader to work
on the t1i.

Here are some links that may help:
http://chdk.wikia.com/wiki/DryOS_Porting
http://chdk.wikia.com/wiki/500D
http://magiclantern.wikia.com/wiki/Build_instructions
http://chdk.wikia.com/wiki/Compiling_CHDK_under_Linux
http://chdk.wikia.com/wiki/Developer_Technical_Documents

Jeremy

On Apr 21, 5:35 pm, SPGWhistler <spgwhist...@gmail.com> wrote:
> I own a T1i and I want to get Magic Lantern working with it. I am an
> experienced web developer (php, javascript, ActionScript, etc, etc).
>
> I have read through several posts about this, but none of them seem to
> go anywhere.
>
> The last post about this on this mailing list appeared to be focused
> on a mac developer. Unfortunately I am not a mac developer (I run
> Ubuntu or Windows), so I couldn't gleam much information from it.
>
> Can any one point me to the resources I need to get started with this
> project?
>
> At this point, I'm not even fully certain of what needs to happen to
> get Magic Lantern working on the T1i, so to start with, even basic
> information on how to go about this would be great.
>

> --http://magiclantern.wikia.com/

[Anthony Petty]

It's the "reverse engineer the firmware (using IDA) to find the entry points to functions that ML needs to run" where the problem is....

You need to purchase IDA for like $1000 to do this... and it me, it makes no sense to spend that money when you could just buy the T2i for the same....

- Tony

[arm.indy]

look the attached file in the following post, it is for 500D / T1i
http://groups.google.com/group/ml-devel/browse_thread/thread/7b7fee6ff03c7897#
you should find FIO* functions for a 500D dumper, not for 550D / t2i

Arm.Indy

On Apr 22, 9:35 pm, JeremyOne <jeremy....@gmail.com> wrote:
> I am working on porting ML to the t2i/550D and am stuck on the dumping
> process. I have done some research on the next step, and I apologize
> if my understanding is incorrect.
>
> However, it looks like someone has already dumped the t1i firmware on
> the CHDK forums, so you would just need to reverse engineer that
> firmware (using IDA) to find the entry points to functions that ML
> needs to run.
>
> Once you've done that you can modify ML and build a new loader to work
> on the t1i.
>

> Here are some links that may help:http://chdk.wikia.com/wiki/DryOS_Portinghttp://chdk.wikia.com/wiki/500Dhttp://magiclantern.wikia.com/wiki/Build_instructionshttp://chdk.wikia.com/wiki/Compiling_CHDK_under_Linuxhttp://chdk.wikia.com/wiki/Developer_Technical_Documents

[B. Cole]

Folks, you can use the IDA 5.6 demo to analyze rom dumps if you want.
Use trammel's remake-elf to convert dumps into .elf files.
Then from IDA, select file->new->unix->elf executable

You can also use free gnu utils (objdump, part of the gcc package) if
you neither want to use the IDA demo nor buy IDA. I cross-compiled
gcc-4.3.2 and it works just fine. In fact I find is easier to search
around for things such as key mcr instructions using emacs on an
objdump'ed disassembly instead of IDA.

Continuing to claim that you need to purchase IDA to do anything here
is just plain wrong.

[fisuk]

How about contacting the fellow mentioned here:
http://www.highdefedition.com/2010/04/canon-500d-firmware-hack-progress-report-1/
and combine forces? :-)