This page serves to document findings about hardware and firmware of Canon Digital Rebel (aka 300d) cameras in an effort to extend and improve their functions.

CanonDigitalRebelHackedFirmware

Several versions of the modified firmware were developed first by Wasia∞ and then further improved by Lex and not_now (UnDutchables∞, login required).

Resources

Firmware

• Canon uses ROM-DOS from Datalight∞ in many of their cameras as was announced in their 1999 BusinessWire press release∞. B:\BOOTDISK\COMMAND.COM contains references to ROM-DOS and Datalight.

• Like with many other Canon cameras part of CanonDigitalRebelFirmware can be accessed via USB port. This allows one to analyze routines responsible for firmware updates and reverse engineer Canon’s encryption.
• CanonDigitalRebelFirmware details.

Hardware

• Analysis of a photo of Digital Rebel Internals to identify components.
• At least one of the camera’s processors is capable of running x86. Analysis of firmware files contained on drives A: and B: of the camera shows that they are valid 16-bit DOS executables. It is possible that x86 processor is NEC V30.
• Evidence that Canon also uses ToshibaTX1942 MIPS processor in Digital Rebel.
• DIGIC
• Motorola 68HC12? There are references to HC12 in the firmware and firmware contains parts in S19 format, which is a file format used by Motorola.

Hacking Resources

• http://www.syeager.org/300d/∞
• http://groups.yahoo.com/group/canondigicamhacking/∞
• http://forum.ixbt.com/0020/011661.html∞
• http://www.volny.cz/rayer/hardware/a70.htm∞
• http://wins10sh.narod.ru/∞