home

Canon SD300 camera analysis 


(or how to use the hardware the way it was meant to be)

Finally, after a week of trying, I was able to dump the SD300 firmware..

Normally, the most preferred method is to create a tiny program that blinks the memory contents to one of the camera's LEDs (see http://chdk.wikia.com/wiki/Porting_the_CHDK for details) and using a photodiode or phototransistor to read on a computer (via the audio card or the RS232 port).

 I've tried hard to blink an LED or the AF-lamp and dump it that way, but after days of trying with the sound card and a IR sensor I had (I 'm too lazy to go buy a photodiode...) I took a deep breath, opened the camera's case and located the yellow LED connections...

 So being extremely careful (given the size of the mentioned LED and the fact that the board is just plastic film that melts with excessive heat) I quickly soldered two very thin wires: one to the LED and one to GROUND (located near the play/record/shoot switch, you can find some other spot using a ohmmeter).

 I then found that I got 0v/2v pulses every time I lighted the LED... I needed a level shifter...

Then I closed the case again, connected the wires to a BC547 NPN transistor to level-shift the output to RS232 levels and connected to the serial.

DO NOT CONNECT THE GROUND OF THE RS-232 (PIN 5) TO ANYTHING AT ALL... JUST LEAVE IT FLOATING.

I needed to modify the blinker firmware a bit, as the level shifter also inverts the signal. Serial.rar

 Then I used both Realterm and/or loader.exe to dump the firmware (just for comparison, and because Realterm allows you to manually set DTR, RTS and change the port speed)...

The good news is that I was able to download at 56kbps!! (and no need for error checking algorithms).

The bad news is, of course, you can blow your camera if not careful enough... So do this at your own risk!

 Overall, big success! Is now time to port the CHDK to this camera (and its cousins the SD400 and SD500)...

 

 The HackingHood

Comments