I've ran the script on the Canon 500D firmware posted here: http://magiclantern.wikia.com/wiki/500D
. Here is an updated version of the script.
I've followed these steps:
1) Open 500d_t1i_ff010000.bin in ghex2 and look for patterns like this: 0a 00 00 00 xx xx xx xx 0b 00 00 00 xx xx xx xx ...
2) Found such a pattern near a string named USB20State. Address: 0x42B770 + 0xFF010000 = 0xFF42B770.
3) Tried to guess the number of states and inputs, by giving small values. The script tries to guess the number of states automatically.
Result: 11 states, 13 inputs. From Anthony's Table, this is USB20State - USBControlPipe. Yay, it seems correct!
4) The pattern continues after this 11x13 matrix, so there should be more states available. The script outputs:
Structure start: FF42B770
Structure end : FF42BBE8
So, the next structure address is at FF42BBE8. The same guesswork results in 9 states / 11 inputs, which is USBDataPipeBulkIn. Repeat steps 3 and 4 until USBDeviceEvent.
5) After looking again for state machine patterns in ghex2, I've found another one at 0xFF41E544. Guessed 14 states/23 inputs. From AJ's table, this is LV_StateObj. A huge one! The matrix seems to be consistent to AJ's description (the big colorful tables). I've tweaked a little the script to output shorter labels.
So, right now you have the diagram for LV_StateObj in the attached PDF. Without names for inputs/states, though...
After LV state, there seem to be more states, probably some small ones, but I can't figure out which they are.
The new script outputs:
- lots of .gv sources, one for each state machine
- a .png and a .pdf for each SM
- a big PDF with all the state machines, one per page.
If you want to try the script on another firmware image, you may have to edit the first lines (the ones before 'import' statement). I hope their names and comments are enough for understanding what they do.
Now I'm looking for the state names. Right after the state number, in the code, there is a pointer (I remember reading it's for a subroutine). However, I've tried a few pointers and did not find any subroutine at those addresses.
E.g. FF42B770 00 00 00 00 34 3D 18 FF 00 00 ...
So, the subroutine address should be FF183D34. No subroutine found here... just a big 32-bit integer which I don't know what means.