Accessing Canon Firmware
Linux
USB protocol used by Canon cameras have been reverse engineered by folks at gPhoto to enable using them with Linux. Additionally, a simple application s10sh has been developed that uses this protocol to send “arbitrary” USB commands to the camera. Using s10sh, it is clear that in addition to CF picture storage drive (C: or D:), two other drives A: and B: are present in the cameras. Drives contains DOS executables that controls many functions of the camera.
After mucking around for a few hours with my 300D and Knoppix Live CD, and making a few trivial changes to s10sh utility to support 300D here’s what I found on my 300D (v1.1.1 firmware):
| Drive | Filename | Filesize | Description |
|---|---|---|---|
| A:\ | CAMERA.EXE | 391k | DataLight RXE (relocatable executable) containing RXE interrupt handler 0×90, RXE header and jump to 8d00:0000 address (in ROM?). Large data segment with many readable strings. |
| B:\ | CAMERA.EXE | 117k | 100% 16-bit DOS code |
| LOGSAVE.EXE | 34k | utility to copy debug log to ? | |
| B:\DATA | NOTHM.JPG | 5k | 160×120 image of yellow question mark on white-to-black gradient background image. Displayed when thumbnail is not available ? |
| B:\BOOTDISK | COMMAND.COM | 27k | Datalight DOS |
| VSSVER.SCC | 48 bytes | Source Safe version control file ? | |
| RESTOOL.EXE | 56k | M114 Resource configuration tool | |
| CAMERA.EXE | 6k | Failsafe camera firmware ? | |
| AUTOEXEC.BAT | 10 bytes | adds C:\ (CF card) to the search path |
Windows
CanonSDK is available from Canon that may allow writing applications to access drives A: and B: