全被你说中了```
楼主去买彩票小心中个3.55亿哦

恩，最其实开始没想那么多，有网友说我发帖子的目的就是为了出售相机和固件让我很郁闷。
冲动了一下。
不该谈钱，不该谈钱，淡定，淡定。
谢谢兄弟提醒，兄弟有维修经验，对程序这块有见解吗？
佳能的每个电子配件换了之后都需要程序配对测试。

楼主给了一个wikia的链接，找到一点关于40d的东西。简单翻译一下与大家共享。水平有限，欢迎拍砖。
Possible extra functionality
额外的可用功能
Movie mode
摄影模式
Already somewhat working, see this movie. If it's not clear enough, this one or this one (both are the same) should convince you.
已经有一些可用，如这段影片(http://chdk.wikia.com/index.php?titl....com%2F40D.avi)。若嫌不够清晰，可以看这段影片(http://chdk.wikia.com/index.php?titl...%3DOlKywUVFJW4)或这段影片(http://chdk.wikia.com/index.php?titl...40D-movie2.avi)。二者皆可。
Live view contrast AF
实时取景自动对焦
Might already be present in the firmware but that's just a guess based on some strings.
或许已经在现有的固件中，但仅是根据某些代码的猜测。
AF microadjustment
自动对焦微调
Some strings present but functionality likely not implemented.
某些代码存在，但似乎功能没有实现。
Total shot counter
快门计数
Scripts

motion detection
运动/动态侦测
.....hhhhhhh?

支持破解
但个个都像LZ这么想
就不会有之前400D 350D的破解了
何况LZ的破解就只一个工程模式
调焦 录像什么的无PP无真相
和400D 350D的破解差远了

我有一点看懂搂主的意思了
好像难度还挺大，.bin没太懂，是写入机器中的意思吗？
作为40d用户，能看到40d还有这么多潜力还是挺欣慰的，之前已近准备转移到5d阵营，但是发觉还是40d好用，不管开发的出来开发不出来吧，就目前功能来说40d已经是很不错了，也谢谢楼主了
发组我的40d片子

这个功能我早就发过帖子说明了。
是俄罗斯的开发团队开发的。需要安装软件，必须靠电脑端录制。http://bbs.fengniao.com/forum/showthread.php?p=23722092

恩 无图无真相，400D 350D 是由chdk.wikia的团队开发的，也是新的团队，他们是拿工资的专业图像程序工程师。我也得拜读他们的文章，自愧不如啊。
通过朋友帮助拿到一台拆机VxWorks OS编码的机器，现在有硬件资料了。
我没事还是在张罗这个事情。慢慢来吧。
40D完工后 | 450D (Rebel XSi) | 1000D (Rebel XS)
的破解应该也会出来了。
大家等吧。
下图是取景模块，其他的晚放上来。
今天我生日。
祝自己生日快乐！加油！

这里还告诉5D2的朋友。
chdk.wikia 已经开放了他们有的内存代码
想自己破解的朋友可以自己动手了。
http://chdk.wikia.com/wiki/5D_Mark_II

[edit] Tasks and contexts
struct context
{
uint32_t cpsr;
uint32_t r[13];
uint32_t lr;
uint32_t pc;
};


struct task
{
uint32_t off_0x00; // always 0?
uint32_t off_0x04; // stack maybe?
uint32_t off_0x08; // flags?
void * entry; // off 0x0c
uint32_t off_0x10;
uint32_t off_0x14;
uint32_t off_0x18;
uint32_t off_0x1c;
uint32_t off_0x20;
char * name; // off_0x24;
uint32_t off_0x28;
uint32_t off_0x2c;
uint32_t off_0x30;
uint32_t off_0x34;
uint32_t off_0x38;
uint32_t off_0x3c;
uint32_t off_0x40;
uint32_t off_0x44;
uint32_t off_0x48;
struct context * context; // off 0x4C
uint32_t pad_1[12];
};

[edit] VRAM The VRAM can be read as sequence of 8-bit pixels:

uint32_t * const vram_config_ptr = (void*) 0x2580;
uint32_t width = vram_config_ptr[ 0x28 / 4 ];

uint32_t * const bmp_vram_ptr = (void*) 0x240cc;
uint8_t * const bmp_vram = (void*) bmp_vram_ptr[ 2 ];
The width config will be 1080 if the output device is HDMI or 720 if it on the internal screen. The bmp_vram pointer might be NULL and always has a pitch of 960 pixels, even in 720 mode.

[edit] State objects Structures like the movie recorder use state objects to track their state. It appears to work like a finite-state-machine, with a set of transitions. The actual mechanism of how they work has not yet been determined, but the structure has been mapped based on the state_object_create() function.


typedef void (*state_function_t)( void * arg );
struct state_object
{
const char * type; // off 0x00, "StateObject"
const char * name; // off 0x04, arg 0
uint32_t id; // off 0x08, arg 1
// off 0x0c, always 0xff99a228 ?
void (*callback)(
struct state_object * obj,
void * unknown1,
void * unknown2
);
state_function_t * callbacks; // off 0x10
uint32_t max_transitions; // off 0x14, arg 2
uint32_t max_states; // off 0x18, arg 3
uint32_t state; // off 0x1c, initially 0
};
extern struct state_object *
state_object_create(
const char * name,
int initial,
state_function_t * callbacks,
int max_states,
int max_transitions
);

[edit] GUI edit GUI Event types 0x6 == IDC_DBN_OK
0x7 == IDC_DBN_CANCEL
0x800 == GOT_TOP_OF_CONTROL
0x801 == LOST_TOP_OF_CONTROL
0x802 == INITIALIZE_CONTROLLER
0x804 == TERMINATE_WINSYS
0x805 == DELETE_DIALOG_REQUEST
0x807 == PRESS_RIGHT_BUTTON
0x809 == PRESS_LEFT_BUTTON
0x80B == PRESS_UP_BUTTON
0x80D == PRSES_DOWN_BUTTON
0x80F == PRESS_MENU_BUTTON
0x812 == PRESS_SET_BUTTON (maybe)
0x81B == PRESS_UP_BUTTON
0x820 == SUB_DIAL (spin left)
0x823 == PRESS_MLT_CENTER_BUTTON
0x829 == PRESS_INFO_BUTTON
0x82B == ELECTRONIC_SUB_DIAL_RIGHT
0x82C == ELECTRONIC_SUB_DIAL_LEFT
? == SUB_DIAL (spin right)
0x10000000 == PRESS_DISP_BUTTON
0x10000005 == PRESS_DIRECT_PRINT_BUTTON
0x10000007 == PRESS_FUNC_BUTTON
0x10000009 == PRESS_PICTURE_STYLE_BUTTON
0x1000000B == OPEN_SLOT_COVER
0x1000000C == CLOSE_SLOT_COVER
0x1000008A == START_SHOOT_MOVIE
edit Property list Properties look like events, I think. They have a unique numeric ID in the 0x80000000 space.

PROP_ABORT
PROP_ACCESS_REMAIN
PROP_ACTIVE_SWEEP_ACTIVATE_CONDITION
PROP_ACTIVE_SWEEP_MODE
PROP_ACTIVE_SWEEP_STATUS
PROP_AEB
PROP_AE_MODE
PROP_AE_MODE_DIAL
PROP_AF_MODE
PROP_AFPOINT
PROP_ARTIST
PROP_AUTO_POWEROFF_TIME
PROP_AUTO_ROTATE
PROP_AVAIL_SHOT
PROP_BATTERY_CHECK
PROP_BATTERY_HISTORY
PROP_BATTERY_POWER
PROP_BATTERY_REPORT
PROP_BEEP
PROP_BODY_ID
PROP_CARD
PROP_CARD1_CLUSTER_SIZE
PROP_CARD1_EXIST
PROP_CARD1_FILE_NUMBER
PROP_CARD1_FOLDER_NUMBER
PROP_CARD1_FREE_SIZE
PROP_CARD1_IMAGE_COMPOSITION
PROP_CARD1_NEXT_FOLDER_NUMBER
PROP_CARD1_RECORD
PROP_CARD1_STATUS
PROP_CARD2_CLUSTER_SIZE
PROP_CARD2_EXIST
PROP_CARD2_FILE_NUMBER
PROP_CARD2_FOLDER_NUMBER
PROP_CARD2_FREE_SIZE
PROP_CARD2_IMAGE_COMPOSITION
PROP_CARD2_NEXT_FOLDER_NUMBER
PROP_CARD2_RECORD
PROP_CARD2_STATUS
PROP_CARD3_CLUSTER_SIZE
PROP_CARD3_EXIST
PROP_CARD3_FILE_NUMBER
PROP_CARD3_FOLDER_NUMBER
PROP_CARD3_FREE_SIZE
PROP_CARD3_IMAGE_COMPOSITION
PROP_CARD3_NEXT_FOLDER_NUMBER
PROP_CARD3_RECORD
PROP_CARD3_STATUS
PROP_CARD_COVER
PROP_CARD_EXTENSION
PROP_CARD_IMAGE_QUALITY
PROP_CFN_TAB1
PROP_CFN_TAB2
PROP_CFN_TAB3
PROP_CFN_TAB4
PROP_COLOR_SPACE
PROP_COLOR_TEMP
PROP_COMP
PROP_CONNECT_TARGET
PROP_CONNECT_TARGET_WFT
PROP_COPYRIGHT
PROP_CURRENT_LENS_NAME
PROP_CURRENT_MEDIA
PROP_CUSTOM_WB
PROP_DATA_INPUT_TRANSMISSION
PROP_DATE_DISPLAY_FORMAT
PROP_DEFAULT_OBWBREG
PROP_DIR_SUFFIX
PROP_DISABLE_PLAY_IMAGE
PROP_DISPLAY_AF_POINTS
PROP_DISPLAY_OFF_SENSOR
PROP_DISPSENSOR_CTRL
PROP_DL_ACTION
PROP_DL_SYMPATHETIC_VIBRATION
PROP_DP_DPOF_PARAM
PROP_DP_EXT_OPTION_PARAM
PROP_DP_STANDARD_PARAM
PROP_DRIVE_MODE
PROP_DSDEFINE
PROP_DUST_DELETE_DATA
PROP_EFIC_TEMP
PROP_ELECTRIC_SHUTTER_MODE
PROP_ERROR_FOR_DISPLAY
PROP_EVF_RECODE_STATUS
PROP_FILE_NUMBERING_MODE
PROP_FILE_PREFIX
PROP_FIRM_VERSION
PROP_FIXED_VERSION
PROP_FLAVOR_BW
PROP_FLAVOR_FAITHFUL
PROP_FLAVOR_LANDSCAPE
PROP_FLAVOR_MODE
PROP_FLAVOR_NEUTRAL
PROP_FLAVOR_PORTRAIT
PROP_FLAVOR_STANDARD
PROP_FLAVOR_USER1
PROP_FLAVOR_USER2
PROP_FLAVOR_USER3
PROP_FOCUS_INFO_EX
PROP_GetCameraSettingProperty
PROP_GPS_STATUS
PROP_GUIGROUND_STATE
PROP_GUI_STATE
PROP_HDD_DCIM_PATH
PROP_HDMI_PHYSICAL_CONNECT
PROP_HDMI_PHYSICAL_DISCONNECT
PROP_HIGHLIGHT_ALERT
PROP_HISTOGRAM
PROP_ICU_AUTO_POWEROFF
PROP_ICU_UILOCK
PROP_INFO_BUTTON_SHOOT
PROP_Initialize
PROP_JUMP_FUNCTION
PROP_LANGUAGE
PROP_LAST_JOBID
PROP_LAST_JOB_STATE
PROP_LCD_BRIGHTNESS
PROP_LCD_BRIGHTNESS_ADJ
PROP_LCD_STATE
PROP_LENS
PROP_LIGHT_FALLOFF_COMP
PROP_LIVE_VIEW_AF_SYSTEM
PROP_LIVE_VIEW_FACE_AF
PROP_LIVE_VIEW_GRID
PROP_LIVE_VIEW_MOVIE_SELECT
PROP_LIVE_VIEW_VIEWTYPE_SELECT
PROP_LOGICAL_CONNECT
PROP_LOGICAL_CONNECT_WFT
PROP_LV_ACTION
PROP_LV_AF_RESULT
PROP_LV_AVAILABLE_AREA
PROP_LV_DISPBUSY
PROP_LV_DISPSIZE
PROP_LV_EMD_DRIVE_RESULT
PROP_LV_EXPOSURE_MODE 0x80050038
PROP_LV_HISTOGRAM 0x80050013
PROP_LV_IMAGE_MUTE
PROP_LV_LENS
PROP_LV_LOCK
PROP_LV_MANIPULATION
PROP_LV_OUTPUT_DEVICE
PROP_LV_SPDN_BTN_STATUS
PROP_LV_START
PROP_LV_ST_CHARGE_INFO
PROP_LV_STOP
PROP_LV_TEST_REMOTE_RELEASE
PROP_LV_ZOOM_FOCUS_FRAME_AREA
PROP_MAX_DESC_BUFFER
PROP_MAX_ENUM_NUMBER
PROP_MENU_POSITION
PROP_METERING_MODE
PROP_METERING_TIMER_FOR_LV
PROP_MOVIE_SIZE
PROP_MOVIE_SOUND_RECORD
PROP_MPU_INDEPENDENT_SETTING
PROP_MWB
PROP_MWB1
PROP_MYMENU_LIST
PROP_NO_CARD_RELEASE
PROP_NUMBER_OF_CONTINUOUS_MODE
PROP_OPTICAL_CORRECT_PARAM
PROP_OUTPUT_TYPE
PROP_PC_AVAIL_SHOT
PROP_PC_FLAVOR1_PARAM
PROP_PC_FLAVOR2_PARAM
PROP_PC_FLAVOR3_PARAM
PROP_PC_FREE_SIZE
PROP_PC_HDD_STATUS
PROP_PC_WB1
PROP_PC_WB2
PROP_PC_WB3
PROP_PC_WB4
PROP_PC_WB5
PROP_PERMIT_ICU_EVENT
PROP_PHOTO_STUDIO_ENABLE_ISOCOMP
PROP_PHOTO_STUDIO_ISOCOMP
PROP_PHOTO_STUDIO_MODE
PROP_PHOTO_STUDIO_MODE_CHANGE_AUTO_PASSWORD_KEY
PROP_PHOTO_STUDIO_MODE_CHANGE_MANUAL_PASSWORD
PROP_PHOTO_STUDIO_SETUP_PASSWORD
PROP_PHYSICAL_CONNECT
PROP_PROGRAM_SHIFT
PROP_QUICKREVIEW
PROP_QUICKREVIEW_MODE
PROP_REGISTER_HEAD
PROP_REMOTE_AFSTART_BUTTON
PROP_REMOTE_BULB_RELEASE_END
PROP_REMOTE_BULB_RELEASE_START
PROP_REMOTE_RELEASE
PROP_REMOTE_SW1
PROP_REMOTE_SW2
PROP_Request
PROP_RequestChange
PROP_SAVE_MODE
PROP_SaveMpuDebugData
PROP_SCREEN_SAVER
PROP_SDIO_PHYSICAL_CONNECT
PROP_SDIO_PHYSICAL_CONNECT_START
PROP_SELECTED_FILE_PREFIX
PROP_SetCameraSettingProperty
PROP_SHOOTING_TYPE
PROP_SHUTTER_COUNTER
PROP_SLIDESHOW
PROP_SPECIAL_OPTION
PROP_STARTUP_CONDITION
PROP_STROBO_CFN
PROP_STROBO_FIRING
PROP_STROBO_SETTING
PROP_STROBO_WIRELESS_SETTING
PROP_TEMP_STATUS
PROP_TFT_SETTING_PARAM
PROP_TFT_STATUS
PROP_TRANS_METHOD_WFT
PROP_TUNING_FLAG
PROP_U**DEVICE_CONNECT
PROP_USER_FILE_PREFIX
PROP_USER_FILE_PREFIX2
PROP_VIDEO_PHYSICAL_CONNECT
PROP_VIDEO_SYSTEM
PROP_WBB_BA
PROP_WBB_GM
PROP_WB_MODE
PROP_WBS_BA
PROP_WBS_GM
PROP_WFT_ADAPTERINFO
PROP_WFT_CAPTION
PROP_WFT_DELIMITER_STATUS
PROP_WFT_DONGLE
PROP_WFT_FTP
PROP_WFT_HOSTINFO
PROP_WFT_HTTP
PROP_WFT_IMAGE_TRANS
PROP_WFT_LOCK
PROP_WFT_SYSTEM
PROP_WFT_TCPIP
PROP_WFT_TRANSMISSION
PROP_WFT_WIRED
PROP_WFT_WIRELESS
PROP_WIZARD_WFT
Retrieved from "http://chdk.wikia.com/wiki/DryOS_structures"

欣赏你的片。

小三角 195楼ailice83

我有一点看懂搂主的意思了
好像难度还挺大，.bin没太懂，是写入机器中的意思吗？
作为40d用户，能看到40d还有这么多潜力还是挺欣慰的，之前已近准备转移到5d阵营，但是发觉还是40d好用，不管开发的出来开发不出来吧，就目前功能来说40d已经是很不错了，也谢谢楼主了
发组我的40d片子

虽然楼主不能继续 研究下去 了。但是还是顶你。。。希望以后有机会开发出来啊