Homebrew firmware for the 5D Mark 2 at DVinfo.net

Tramm Hudson · May 17th, 2009, 07:56 PM

I've figured out a way to build a firmware file that will disable the automatic audio gain, leaving the default +36 dB gain in place, and change the firmware version string to read '1.0.7-hudson'. This isn't the final goal, but what is does prove is that we can run our own software on the 5D Mark 2 and make the changes that will make the camera even more suited for our film uses.

A file named '5d2.fir' is copied to the CF card and "Update firmware" is selected from the menu. The running firmware shuts down, loads the file into RAM and starts it running. Rather than reflashing the ROMs, this new program:
* copies itself above the DryOS BSS
* copies part of the DryOS ROM image into the BSS
* modifies it to reserve the new regions
* adjusts the code flow to return to itself
* creates its own task (that doesn't do anything yet)
* installs a hook so that task scheduling will call its own routine
* hooks the sound_dev_task() so that my version is used instead (which just turns off AGC)
* has a periodic timer that writes state information into a logging file for my analysis

Nothing is written into the ROMs. When the camera reboots, the RAM image is flushed and the bootloader FROMUTIL at 0xFFFF0000 starts the pristine copy in ROM at 0xff810000. After any reboot (or even powersave), you must select the "Update firmware" menu item. Eventually we want to be able to boot directly from the AUTOBOOT.BIN file on the CF card.

I haven't bricked my camera yet, but that is no guarantee. It doesn't write to the ROMs at all, so it should be fairly safe, but anytime software is interacting with hardware there is possibility of significant damage. The FROMUTILITY appears to have a way to reflash even a bricked camera, but I don't know how to access the console.

The current code is very tightly integrated with the 1.0.7 firmware image; it modifies specific instructions at hard-coded addresses and uses function addresses that will change in a new firmware. If Canon releases a new firmware version, the reset shim in my code will need to be updated with locations of the functions in the new one before it can be used with it. Since nothing is modified in the camera itself when running the modified firmware, it will be possible to upgrade to Canon's hypothetical new firmware even after running my modified 1.0.7 version.

It is hard to predict how much effort will be required to implement new features like 24p and full manual control. Disabling existing features is fairly easy, which is why AGC support was the first target. Disabling auto-exposure should be easy as well, but an accurate estimate is difficult to give since I'm only working on this in my spare time.

For these reasons it is hard to say if all of the terms of Canon hack will be met. Perhaps, although changing the frame rate to 24p and PAL are the ones that have the most unknowns.

So, what are the next steps?
* Figuring out how to create additional menus
* Understanding localization and string pointers into ROM1.bin
* Adding custom functions for enabling/disabling new features
* Overriding lvae_*
* AUTOBOOT.BIN to automatically start the new firmware from the CF card
* Adjusting frame rate of video (24p and PAL)
* Figuring out how to write to the frame buffer device
* Onscreen level meters

There are lots of other features that everyone wants. I'm not sure how how long any of these further projects will take. But, the first steps have been taken and hopefully we'll be able to start implementing new features once we have the initial show-stoppers fixed.

William Chung · May 17th, 2009, 08:18 PM

Tramm amazing work you have done there!!! Looking forward to see your progress

Alex Coelho · May 17th, 2009, 08:19 PM

You got to love hackers. Maybe we should email Canon about this so it would light a fire under them to make the changes we want.

Chris Barcellos · May 17th, 2009, 08:50 PM

Tramm:

Are you looking for input from programers on this board. I am not one, but there may be some here.

Chris Hurd · May 17th, 2009, 09:24 PM

Well done -- this opens a world of possibilities. Thanks Tramm,

Jacob Mason · May 17th, 2009, 09:53 PM

Quote:

Originally Posted by Alex Coelho

You got to love hackers. Maybe we should email Canon about this so it would light a fire under them to make the changes we want.

Canon is rumored to have a firmware update for the 5DmkII ready to release in the coming weeks. I have no idea what all it'll address, but it's believed they'll only do minor updates for video. Just enough to ensure that people stop buying Nikon's manual aperture lenses. They kinda don't like how that went down so that's their only real concern. Otherwise, they need to keep it limited due to conflicts this camera poses to dedicated HD video cameras.

Jon Fairhurst · May 17th, 2009, 11:26 PM

Quote:

Originally Posted by Jacob Mason

...but it's believed they'll only do minor updates for video. Just enough to ensure that people stop buying Nikon's manual aperture lenses.

This wouldn't surprise me - and I'll be happy to take it. There's also the problem of stutters when zooming a Canon lens and when the aperture changes when the exposure isn't locked. Those would be good Canon lens fixes too.

Quote:

...they need to keep it limited due to conflicts this camera poses to dedicated HD video cameras.

I've been thinking about this, and am starting to think that this might not be a motivator. Let's say that Canon owns 25% of the prosumer camera market. (I have no idea about their market share. I made the 25% thing up.) If the 5D MkII is able to steal share from the prosumer video camera market, then for every four sold, Canon only loses one sale. The other sales losses are for Sony, Panasonic, JVC and whomever. And for each 5D MkII sold, there's the potential of another few thousand dollars worth of lenses, batteries and accessories.

And even with 24/25p and manual control, there's still the 12 minute limit, the DSLR form factor, the lack of electronic zoom, autofocus limitations, no built-in ND filters, no XLR audio, no timecode, rolling shutter and aliasing. The prosumer camcorder market won't crumble overnight. And big, fast sensors will rejuvenate the prosumer market.

The real loser in all of this is the $30k and over camera. Once big sensors are available for $10k and below, the high roller cameras have got to look elsewhere for differentiation. Note that Canon doesn't compete at the higher price points. If anything, Canon will soon be in a position to take away those high end sales.

So, Canon, bring on the features. You have nothing to fear! :)

William Chung · May 17th, 2009, 11:30 PM

Usually big companies don't like hacked firmwares because of the problems that it causes them. Hacked ones don't go through the QA and there are going to be a ton of inexperienced people trying to mess with it and bricking their cameras. Would you want to deal with that?

If he can get all those functions we want working though it will definitely speed up the process since everyone will know it's 100% possible to do.

Marcus Marchesseault · May 18th, 2009, 12:44 AM

"...enough to ensure that people stop buying Nikon's manual aperture lenses."

Oops! Too late. I'm a baaaaaad customer. Either that or I'm a good Nikon customer. I'm even planning to buy some brand new Nikon lenses down the road.

Nigel Barker · May 18th, 2009, 03:10 AM

Quote:

Originally Posted by Marcus Marchesseault

Oops! Too late. I'm a baaaaaad customer. Either that or I'm a good Nikon customer.

No, you are just a cheap customer:-) There are plenty of used Nikon lenses on the market at cheap prices. They all have an aperture ring even the more modern ones that on a Nikon will have the aperture controlled electronically by the camera. For our purposes though old totally manual lenses are fine.

Adaptor rings for fitting other camera manufacturers lenses to the Canon are also available. Lovely manual lenses from other manufacturers can be found even cheaper than the Nikon lenses. There are great lenses for brands like Practika(r) & Exakta made by Carl Zeiss of Jena which are particularly cheap.

BTW Why would you want to buy new Nikon lenses? None of the modern electronic aids e.g. focus, stabilisation are going to work.

Jon Fairhurst · May 18th, 2009, 12:27 PM

Quote:

Originally Posted by Nigel Barker

...Adaptor rings for fitting other camera manufacturers lenses to the Canon are also available...

Rumor: Harry Potter film crew using 2 Canon 5D mk ii cameras with Panavision lenses

But I digress...

A firmware hack for the 5D MkII is really welcome. I have the feeling that Canon will give us aperture control of their lenses - and will fix the stutter when their lenses change aperture/focal length. (That could be the excuse for the update.)

If that's the case, it's still not enough. Currently the shutter speed is 1/focal_length. Sorry, but I don't want my shutter speed to change within a scene just because I zoomed or used a different prime lens.

If they must go auto, the shutter should default at 180 degrees (1/60) and should increase when the ISO clips at 100, and should decrease when it clips at 3200. But aperture must be controllable. And frankly, I'd really like to push the ISO to 1,000 or so with a fast shutter for special effects.

Unless Canon unleashes this beast, we will still want this firmware mod.

Ryan Mueller · May 18th, 2009, 03:39 PM

Tramm, You are THE MAN! I am very intersted in what you are working on and can't wait to see what else you come up with. Keep up the incredible work!

Marcus Marchesseault · May 18th, 2009, 10:37 PM

"BTW Why would you want to buy new Nikon lenses? None of the modern electronic aids e.g. focus, stabilisation are going to work."

At this point, with half a dozen Nikon lenses, I really only need the AGC control hack. I'll eventually buy some new Nikon lenses to get capabilities not around 20 years ago like 20mm focal length for specialty shots like small rooms or to get that forced perspective effect that seems so popular these days. Things like that may be gimmicky, but they have their place. It is also not easy or possible to find old f2.8 zoom lenses and that is where the real need is when I do events.

Why buy Nikon now? Because it is most logical that Nikon will come out with a full-frame camera with full video controls since Canon won't want to interfere with their video division. With each lens purchase I am making it easier to switch to Nikon. Besides, I think I will put more money into lenses than the camera body so the lenses will eventually determine which body I buy in the future. I love the 5D for many of its qualities, but it has a few important things mysteriously missing.

Peer Landa · May 18th, 2009, 11:16 PM

Quote:

Originally Posted by Marcus Marchesseault

Why buy Nikon now? Because it is most logical that Nikon will come out with a full-frame camera with full video controls since Canon won't want to interfere with their video division.

I kind of agree, but since Canon has a huge leg up when it comes to video, I believe it will take some time before we see such a camera from Nikon.

-- peer

Marcus Marchesseault · May 18th, 2009, 11:30 PM

I agree, Peer, but Nikon lenses last a LOOOOOONG time. I'm fairly certain I have a lens that is older than me. I won't feel I am wasting money getting a few $1000 lenses and waiting a couple of years to get what will probably be an amazing Nikon body. Until then, I'll be very happy to have a 5D with decent audio.

Thanks for all the hard work fixing my almost-perfect camera!

May 17th, 2009, 07:56 PM	#1
Tramm Hudson Wizard Status Join Date: Jun 2005 Location: New York, NY Posts: 239	Homebrew firmware for the 5D Mark 2 I've figured out a way to build a firmware file that will disable the automatic audio gain, leaving the default +36 dB gain in place, and change the firmware version string to read '1.0.7-hudson'. This isn't the final goal, but what is does prove is that we can run our own software on the 5D Mark 2 and make the changes that will make the camera even more suited for our film uses. A file named '5d2.fir' is copied to the CF card and "Update firmware" is selected from the menu. The running firmware shuts down, loads the file into RAM and starts it running. Rather than reflashing the ROMs, this new program: * copies itself above the DryOS BSS * copies part of the DryOS ROM image into the BSS * modifies it to reserve the new regions * adjusts the code flow to return to itself * creates its own task (that doesn't do anything yet) * installs a hook so that task scheduling will call its own routine * hooks the sound_dev_task() so that my version is used instead (which just turns off AGC) * has a periodic timer that writes state information into a logging file for my analysis Nothing is written into the ROMs. When the camera reboots, the RAM image is flushed and the bootloader FROMUTIL at 0xFFFF0000 starts the pristine copy in ROM at 0xff810000. After any reboot (or even powersave), you must select the "Update firmware" menu item. Eventually we want to be able to boot directly from the AUTOBOOT.BIN file on the CF card. I haven't bricked my camera yet, but that is no guarantee. It doesn't write to the ROMs at all, so it should be fairly safe, but anytime software is interacting with hardware there is possibility of significant damage. The FROMUTILITY appears to have a way to reflash even a bricked camera, but I don't know how to access the console. The current code is very tightly integrated with the 1.0.7 firmware image; it modifies specific instructions at hard-coded addresses and uses function addresses that will change in a new firmware. If Canon releases a new firmware version, the reset shim in my code will need to be updated with locations of the functions in the new one before it can be used with it. Since nothing is modified in the camera itself when running the modified firmware, it will be possible to upgrade to Canon's hypothetical new firmware even after running my modified 1.0.7 version. It is hard to predict how much effort will be required to implement new features like 24p and full manual control. Disabling existing features is fairly easy, which is why AGC support was the first target. Disabling auto-exposure should be easy as well, but an accurate estimate is difficult to give since I'm only working on this in my spare time. For these reasons it is hard to say if all of the terms of Canon hack will be met. Perhaps, although changing the frame rate to 24p and PAL are the ones that have the most unknowns. So, what are the next steps? * Figuring out how to create additional menus * Understanding localization and string pointers into ROM1.bin * Adding custom functions for enabling/disabling new features * Overriding lvae_* * AUTOBOOT.BIN to automatically start the new firmware from the CF card * Adjusting frame rate of video (24p and PAL) * Figuring out how to write to the frame buffer device * Onscreen level meters There are lots of other features that everyone wants. I'm not sure how how long any of these further projects will take. But, the first steps have been taken and hopefully we'll be able to start implementing new features once we have the initial show-stoppers fixed. Attached Thumbnails Last edited by Tramm Hudson; May 17th, 2009 at 09:23 PM. Reason: Minor typos

May 17th, 2009, 08:50 PM	#4
Chris Barcellos Inner Circle Join Date: Nov 2005 Location: Elk Grove CA Posts: 6,838	Tramm: Are you looking for input from programers on this board. I am not one, but there may be some here. __________________ Chris J. Barcellos

May 17th, 2009, 09:24 PM	#5
Chris Hurd Obstreperous Rex Join Date: Jan 2001 Location: San Marcos, TX Posts: 27,368 Images: 513	Well done -- this opens a world of possibilities. Thanks Tramm, __________________ CH Search DV Info Net \| 20 years of DVi \| ...Tuesday is Soylent Green Day!

May 17th, 2009, 08:18 PM	#2
William Chung Regular Crew Join Date: Jan 2009 Location: Duluth, GA Posts: 80	Tramm amazing work you have done there!!! Looking forward to see your progress

May 17th, 2009, 08:19 PM	#3
Alex Coelho Tourist Join Date: Jan 2009 Location: Washington DC Posts: 4	You got to love hackers. Maybe we should email Canon about this so it would light a fire under them to make the changes we want.

May 17th, 2009, 11:30 PM	#8
William Chung Regular Crew Join Date: Jan 2009 Location: Duluth, GA Posts: 80	Usually big companies don't like hacked firmwares because of the problems that it causes them. Hacked ones don't go through the QA and there are going to be a ton of inexperienced people trying to mess with it and bricking their cameras. Would you want to deal with that? If he can get all those functions we want working though it will definitely speed up the process since everyone will know it's 100% possible to do.

May 18th, 2009, 12:44 AM	#9
Marcus Marchesseault Trustee Join Date: Nov 2005 Location: Honolulu, HI Posts: 1,961	"...enough to ensure that people stop buying Nikon's manual aperture lenses." Oops! Too late. I'm a baaaaaad customer. Either that or I'm a good Nikon customer. I'm even planning to buy some brand new Nikon lenses down the road.

May 18th, 2009, 03:39 PM	#12
Ryan Mueller Major Player Join Date: Mar 2007 Location: Highlands Ranch, CO Posts: 336	Tramm, You are THE MAN! I am very intersted in what you are working on and can't wait to see what else you come up with. Keep up the incredible work!

May 18th, 2009, 10:37 PM	#13
Marcus Marchesseault Trustee Join Date: Nov 2005 Location: Honolulu, HI Posts: 1,961	"BTW Why would you want to buy new Nikon lenses? None of the modern electronic aids e.g. focus, stabilisation are going to work." At this point, with half a dozen Nikon lenses, I really only need the AGC control hack. I'll eventually buy some new Nikon lenses to get capabilities not around 20 years ago like 20mm focal length for specialty shots like small rooms or to get that forced perspective effect that seems so popular these days. Things like that may be gimmicky, but they have their place. It is also not easy or possible to find old f2.8 zoom lenses and that is where the real need is when I do events. Why buy Nikon now? Because it is most logical that Nikon will come out with a full-frame camera with full video controls since Canon won't want to interfere with their video division. With each lens purchase I am making it easier to switch to Nikon. Besides, I think I will put more money into lenses than the camera body so the lenses will eventually determine which body I buy in the future. I love the 5D for many of its qualities, but it has a few important things mysteriously missing.

May 18th, 2009, 11:30 PM	#15
Marcus Marchesseault Trustee Join Date: Nov 2005 Location: Honolulu, HI Posts: 1,961	I agree, Peer, but Nikon lenses last a LOOOOOONG time. I'm fairly certain I have a lens that is older than me. I won't feel I am wasting money getting a few $1000 lenses and waiting a couple of years to get what will probably be an amazing Nikon body. Until then, I'll be very happy to have a 5D with decent audio. Thanks for all the hard work fixing my almost-perfect camera!