I'm moving this to a separate thread as it turned out that more models have support for scripting.
So far confirmed to exist on:
PowerShot SX740
EOS M50
EOS R, RP, R5, R6
EOS 250D
About the language.
Card setup.
Note that some people have problems making a usable script card. If that happens, try again. If in doubt, a card prepared for scripting can be verified on any older PowerShot from ~2005 on. The card probably needs to be formatted FAT16/32.
Any script error will crash the camera and require a battery pull.
The language used on DIGIC 8 models is the same as described on the above links, but CHDK-related scripts will not work. The reason for this is that the so-called
event procedures (named firmware functions) are mostly different.
Unlike on older PowerShots, most of the available event procedures are pre-registered - can be used without running registration procedures.
Also unlike on older cameras, it is possible to try executing an eventproc that may not exist. This can be achieved by using ExecuteEventProcedure.
ExecuteEventProcedure("Peek32",0x1000)is equivalent to
Peek32(0x1000)and will return the word read from address 0x1000
ExecuteEventProcedure("arbitrary_invalid_function")will return -1
Native code can be executed by using ExportToEventProcedure
ExportToEventProcedure("my_func",0xe1234567)will make the firmware function at 0xe1234566 (with thumb bit) available for script as eventproc my_func
All variables of the script are 32-bit signed integers, interpreted as integer, pointer, pointer to string, as required.
It's worth to note that operator precedence is different from other languages. Negative numbers (that includes pointers to ROM) can have
funny effects in expressions involving more than two numbers.
File handling capabilities are quite limited when using only available event procedures - native code must be found and used for
reading anything from file,
writing a binary file, erasing a file, etc.
String constants are limited to 127 bytes. sprintf() only allows up to 8 substitutions (probably a language limit).
The available event procedures can be harvested from ROM, by looking up the registration functions in the disassembly.
Some example scripts
ROM dumper (main image from 0xe0040000, without bootloader)
private sub Initialize()
SaveBootableToFile()
end sub
ROM dumper, not working on M50 due to missing eventproc
private sub Initialize()
SaveAllRomImageToFile()
end sub
Enable bootflag
private sub Initialize()
EnableBootDisk()
end sub
Disable bootflag
private sub Initialize()
DisableBootDisk()
end sub
Dumping camera log (current session)
private sub Initialize()
dumpf()
end sub
I posted a slow dumper script in
this older post.
Finally, the usual warning: do not post your ROM dumps publicly.
