Main Builds » 1200D / Rebel T5 1.0.2

Latest Build (2018-08-21 06:48)

Change Log

19b5e5e: Merged qemu into 1200D

4474a4e: 1200D: removed old minimal target to fix "make zip"

4cc498d: Minimal targets: only compile subdirectories with a valid Makefile

77f1f07: QEMU tests: FA_CaptureTestImage works on 1300D
(prints "Image Power Failure", but the fix is not straightforward)

9c5411f: Merged qemu into 1200D

608c5df: Merged lua_fix into 1200D

c423c00: fw-signature.h: fix bad merge

92f5067: Makefile: when running "make install", copy ML-SETUP.FIR only for the generic profile
(not for minimal or other targets)

0e27b6b: Makefile: always check all minimal targets when running "make zip"
(only check whether they compile without errors, just like with the installer)

e8c2e35: Minimal target: moved the Hello World example into its own directory and removed old platform folders

d6f322b: Minimal targets: 5D3 1.1.3 hacks no longer needed

e4d2c76: GDB scripts: fix IDC names containing spaces

219bdfa: QEMU: fix timeout in ImgPowDet emulation
(there were nondeterministic errors in the FRSP test)

c5fef89: QEMU: emulate ADTGDMA interrupt (used on 100D and EOS M2)
- fixes FA_CaptureTestImage on 100D
- some LiveView screenshots changed on 100D
- color palette in LiveView changed on M2; can be worked around by pressing L (updated menu tests)

93e1c3a: QEMU tests: ignore nondeterministic screenshot on 6D
(may appear with or without free space)

af1b0dc: GDB scripts: moved try_expand_ram_struct at the top

2627562: GDB scripts: minor whitespace fix

f34fbd4: QEMU: ensure valid RAM address before executing EDMAC transfers
(EOS M fails here when running FA_CaptureTestImage)

1558689: QEMU: image sensor power emulation
(fixes FA_CaptureTestImage on 5D2; tested on all other models able to run the FRSP test)

51ea8e0: QEMU: output dummy data (zeros) on read EDMAC connections
Fixes FA_CaptureTestImage on 700D and 650D.

c5dfbe4: qemu-frsp: fix compiling for 70D

241f75f: QEMU: allow reads to EDMAC CHSW registers
(required for FA_CaptureTestImage emulation on 6D and others)

fcc92f6: qemu-frsp: ensure valid exposure settings before the test
(exposure time not too long, ISO other than Auto; required on 600D and others)

2056815: QEMU: fix YUV vertical scaling for 1100D
(only the FRSP test uses it for now)

5131e72: qemu-frsp: allocate a YUV buffer if there isn't one already set up (only with CONFIG_QEMU)
Fixes preview on 5D3 and 1100D, where Canon firmware does not allocate one at startup.

029fecb: QEMU tests: all models able to navigate Canon menu should pass the FRSP (FA_CaptureTestImage) test
Most of them will fail; to be fixed.

e2f648f: QEMU tests: handle models not yet in mainline
(FRSP and HPTimer tests are using this for now)

5c3e459: QEMU: updated gcc 7/8 patch for systems using virtio-9p

8c7217a: QEMU: updated gcc 7.x patch to also work with gcc 8.x

70cfcb4: eos.c: fix gcc8 warnings

d256390: Makefile: allow "make install*" without a FIR file
(for minimal targets and new platforms)

bdab902: QEMU logging: attempt to identify tail calls by default
(-d calls,notail to disable)

f9802bf: QEMU tests: updated for 200D 1.0.1

6edfe05: QEMU logging: moved IDC files into model subdirectories
(for consistency with romcpy shell files)

5a933e7: QEMU logging: fix typo when using -d romcpy
(output file path was not printed correctly)

0ffb5ef: QEMU tests: initial support for 800D
(fixme: call trace not deterministic, same as 77D)

bebea6b: 800D: minor stub fixes in GDB script

59e4e3c: qemu: add 800D to model_list.c, and add 800D/debugmsg.gdb

1939f0c: Config options: fix issue #2892
(custom presets not appearing in menu)

61c6a87: Merged config_var_refactor into lua_fix

8cd3f78: Merged unified into lua_fix

79cd0c5: Menu: fix config var incorrectly changed during fast toggles
(e.g. 36 -> 35 without calling the CBR)

51f2c7d: Config variables: declare all internal structures static
(minor refactor)

5cf9d77: Config variables: include the forward declaration in the CONFIG_INT_EX definition
(no longer needed to declare CONFIG_VAR_CHANGE_FUNC's twice)

7ce54e4: Config variables: use CONFIG_VAR_CHANGE_FUNC (similar to MENU_SELECT_FUNC); minor renames

9abd360: Merged unified into config_var_refactor

74d41e2: audio-ak: fix compiling for 500D

cecef93: menu: short joystick clicks should not be interpreted as SET outside ML menu
(fixes incorrect trigger of Auto ETTR from joystick, for example)

2a7265d: rename xxx_update functions for config_vars to xxx_on_change

9817bac: rename CONFIG_INT_UPDATE to CONFIG_INT_EX and .update to .on_change to avoid confusion and name conflicts with MENU_UPDATE_FUNCs

41c6a31: Merge

1057609: config var: refactor audio-lapis to use new config var CBR (not tested -> I have none of these cameras)

5a01dae: config var: refactor audio-ak and audio-common to use new config var CBR (TODO: audio-lapis)

7a3b5fa: Ghost image: further cleanups and fixes

4702ca0: Ghost image: fix crash (issues #2796, #2783, #2878, #2885)

94442d9: features.tmpl edited online with Bitbucket: use id in th section heading to allow for direct linking via anchor

5e40987: Merged in edmac (pull request #886)
EDMAC module: fixes for DIGIC 4, connection map

b54a0c6: Merged in adv_int (pull request #907)
Advanced intervalometer updates

58e11ee: Merged in memory-backend (pull request #906)
Memory backend improvements

87dfe3c: Makefile: fix "make install_qemu CONFIG_QEMU=y" for minimal targets

cc13316: QEMU: experimental support for gdb-multiarch
(latest Ubuntu no longer has gdb-arm-none-eabi...)

13a1fe1: QEMU install: minor fixes

03cb41d: QEMU install: on some systems, building GDB requires makeinfo; skip it
Also show the last few lines from the compilation logs if there's an error.

36a89bd: QEMU install: on older Ubuntu, gcc/gdb installation without package manager may be required

03f2c82: QEMU install: minor fix for 32-bit Ubuntu
(option 3: no 64-bit gcc available)

ede4b4c: QEMU installer: removed option to allow old 64-bit GDB
(hopefully no longer needed)

c57b71d: QEMU installer: minor fix regarding GDB installation
(force compiling from source if a valid 64-bit gdb is already installed)

ec4df76: QEMU installer: attempt to compile gdb 8.1 from source if a 32-bit version is not available (in particular, Mac and WSL) (thanks t3r4n)

459d709: QEMU install: there's no DISPLAY variable on Mac

04f441f: QEMU: better emulation for cache patches
(uninstalling works, at least for dm-spy-experiments)

4cc0ac8: QEMU: fix CPU0 labels incorrectly appearing in DIGIC 6 logs
(only DIGIC 7 should display these)

0f1447d: QEMU: moved ARM946EOS-specific functions (cache lockdown and WFI) from cpu.c to helper.c

c2ee480: Minimal targets: CONFIG_QEMU no longer hardcoded in Makefile
(should be specified on the command line if desired)

2c36494: Makefile: allow CONFIG_QEMU to work on all ML profiles, including minimal and installer
By default, CONFIG options are only used for the generic profile.
This enables qprintf for debugging DIGIC 6/7 ports using the minimal profile.

afa843c: QEMU: fix printing callstack from GDB scripts
(broken in 1834cd8)

7f8871f: GDB scripts: workaround for a crash occuring with 5D
(possibly GDB bug; can't explain why it works)

600343c: qemu-frsp: fix compiling on lua_fix codebase
(1200D and soon all others)

b3914b9: QEMU: updated expected test results for 1200D 1.0.2
(no stubs changed in debugmsg.gdb)

2b709cf: QEMU: removed bogus/unused BGMT_ISO

697fa63: QEMU: fix Q button code for 1200D
- assuming the same applies to 1300D; unsure about 600D/1100D

30f46a0: QEMU: fix compiling on 32-bit x86 hosts
Caveat: -d romcpy not working on x86 (requires int128_t)

8b9b81b: QEMU README: initial notes on DIGIC 7

a20c79b: QEMU: initial support for DIGIC 7 EOS (200D, 77D, 6D2)
- added ROMID; updated MemDiv, XDMAC, SDIO
- emulation starts many tasks, talks to MPU, initializes SD, creates the DCIM directory on the virtual card
- fails with ERROR WaitPU1 TimeOut
- dumpf does not save any logs (figure out why)
- note: M5 ROM should now be loaded as ROM0

39c9a47: QEMU logging: initial support for DIGIC 7
(CPU0 only; exception vectors at nonzero address)

2fb4f6b: QEMU tests: ROM dumper needs larger timeout on slower computers; undo unwanted changes from cb93334

d0c4830: QEMU tests: fix expected results for restore after format after updating SD image

cb93334: QEMU tests: reworked ROM dump test to wait as much or as little as each camera needs
(fixme: 70D waits for some CFDMA messages that are for some other device)

f300d36: QEMU: usleep patching no longer required on M3

b3d7b70: QEMU: updated ROM dump tests to check SFDATA.BIN too
(currently only applies to DIGIC 6)

daa3003: QEMU: updated SD image with latest display test
(changeset 9b37638)

9416cfa: QEMU: experimental UTimer emulation
- these look pretty much like regular timers (same offsets), but behave like HPTimers!
- UTimer patches from DIGIC 6 no longer needed!
- fine-tuned HPTimer messages

9e082f6: QEMU: fix logging of MMIO registers from the same range as MREQ
(eos_handle_mreq also receives a few other registers, unknown yet)

a4de619: QEMU: specify actual RAM size for each model, rather than using generic values
(emulating with larger size usually works, but doesn't catch some edge cases)

2590edf: QEMU: reordered model definitions in model_list.c
(grouped by DIGIC version and similarity)

394eee0: QEMU: renamed IO_MEM_START/SIZE to MMIO_ADDR/SIZE for consistency;
added MMIO_ADDR to model_list.c (possibly needed for future models)

1834cd8: QEMU: removed unused entries; moved ML helpers to a different GPIO range.
Old range was not accessible on certain models, such as PowerShots and DIGIC 7.
Old GPIOs are still accepted (debugging existing code from experimental branches is still possible without merging latest qemu).

59a663e: QEMU logging: -d romcpy now output a shell script for extracting the copied blocks

5d7146a: QEMU: memfd patch to fix compilation with glibc 2.27

d5e6fbf: QEMU installer: minor updates
- option to "make clean" before renaming the old folder (to save disk space)
- exit if QEMU fails to compile
- check for a valid DISPLAY (important for WSL)
- updated help links

43b5d42: QEMU: updated CPU definition for DIGIC 7; renamed for older models and reverted the HIVECS property back to false

180a4dd: QEMU tests: updated checksums for EOS M/M2 screenshots displaying date/time
(fix commit 8c575ef99b7f)

e7c7ce2: QEMU tests: updated checksum for a screenshot affected by transparency - commit 5b274e3
(Canon quirk - it's not even a LiveView screenshot)

a35f489: allow incomplete mpu_send/recv lines
(such as the ones from 80D logs)

5519e42: MPU spells: documented some AF-related properties

09ca7ba: GDB scripts: also identify and name PTP handlers

7e752d6: GDB scripts: identify named functions during execution and export as IDC
Named functions identified from: task_create, register_func, register_interrupt, CreateStateObject
Tested on 5D3 1.1.3, EOSM2 1.0.3 and 80D 1.0.2 (missing stubs added).

1a45866: QEMU: check whether the ROM contents are mirrored (whether dumped size is larger than actual ROM size)
[EOS] loading './50D/ROM0.BIN' to 0xF0000000-0xF0FFFFFF
[EOS] mirrored data; unique 0x400000 bytes repeated 0x4 times
[EOS] loading './50D/ROM1.BIN' to 0xF8000000-0xF8FFFFFF
[EOS] mirrored data; unique 0x800000 bytes repeated 0x2 times

289c074: QEMU: SRM_SetBusy/ClearBusy emulation for 5D3/6D/70D

248458f: mark unknown MPU messages with ???
(this ensures all MPU messages are displayed to the terminal, including unknown ones)

7dd027a: Menu: QEMU hack 90f702c no longer needed for EOS M/M2
(keeping changes to gui.h and button_codes.h)

13b79a0: fix printing GDB command line on systems where process name is limited to 15 chars;
only look at processes started by the same parent as this script (to avoid false positives)
to be tested on Mac and WSL

ea8b17d: QEMU: EOS M and M2 appear to handle the Q/SET button just like 100D

0fc9e8e: QEMU: enabled MPU properties for EOS M (no more issues after LiveView emulation)

e39699a: QEMU: allow any argument for PROP_LEO_LENSID (EOSM); documented PROP_LEO_LENS*
Should fix emulation with ROMs saved with a different lens (apparently lens ID goes into ROM - property 0xC000004)

0b485e3: QEMU: send PROP_LV_LENS message at initialization (5D3 1.1.3; 1.2.3 commented; the message is model-specific)
Useful for LiveView emulation (display focal length, focus distance etc)
Message sent in a different place (not as in the logs), as it interferes with our (broken) LiveView emulation

5b274e3: QEMU: experimental bitmap transparency support
(doesn't match the hardware exactly, but it's better than nothing)

7df1daf: QEMU: experimental movie mode switch (V key)
Some cameras have dedicated movie mode on the dial, others use a switch and can record video in any mode dial position.

d69ab7e: QEMU: key mapping for Zoom In / Zoom Out (they don't do anything interesing yet);
allow defining different keybindings on the same physical key (5D3/6D: only one zoom button, unlike most others)
cleaned up zoom button handling on 5D3 and 6D (unpress zoom out should not be sent from keyboard, for example)

bf6a9c0: QEMU: fix copy/paste error in HPTimer emulation
(no side effects)

28f8d92: QEMU tests: large timeouts appear to help in some tricky cases
(such as mode switches, which may be slower than usual)

8c575ef: QEMU: updated GUI tests for LiveView.
EOS M/M2: no more reason to start with the date/time dialog.
Still some color palette issues; usually can be worked around by switching to other video mode and back.
Minor call trace differences for 650D and 700D (missed from previous commit)

d2116b6: QEMU: LiveView works!!! (GUI elements only, no image)
Credits go to Greg for the first PoC
Tests not yet updated, just to check whether the implementation is really without side effects outside LV.
Only one screenshot changed - on EOS M (that screenshot was already in LiveView).
Note: 70D uses more EDMAC connections; increased number from 48 to 64.

bc69e69: MPU spells: identified some more properties while looking into the EOSM shutter bug

3b9af67: QEMU: validate calls to eos_trigger_int
allow missing UART RX/TX interrupt and just print a warning
(affected: Eeko and EOS M5; fix not obvious)

2090c2f: QEMU: removed unnecessary assertion in interrupt controller
(triggered very rarely under "normal" conditions, but happens very often with io_trace)

97db8e1: QEMU tests: run the GDB test for 10 seconds
(these logs will be used for building the interrupt map)

0901cba: QEMU: fix alignment of MMIO messages before starting tasks (-d io)

a7821fd: QEMU: fix HPTimer handling of periodic triggers
(VxWorks models use a HPTimer as heartbeat, unlike DryOS)
No visible differences on the UI, but heartbeat is now triggering on all VxWorks models.
Minor emulation differences on 60D, 600D, 650D, 700D, 100D, EOSM, 6D (besides VxWorks models).

29e9550: GDB scripts: EOSM.202 stubs for logging properties
(related: af43d85)

cf62d68: fix handling logs with Windows newlines

b442627: QEMU: delay EDMAC reads by one timer step (apparently reads are supposed to finish after writes)
Change required to pass the memory benchmark on 5D3 and 6D.
700D gives the same error if writes are delayed.
Minor changes to call/return trace on 60D, 600D, 1200D and 1300D (no visible effects).

ccfb0ae: QEMU tests: updated EOSM2 call/return trace for latest SFDATA.BIN from dfort
(previously, SFDATA.BIN for 100D was assumed; no visible changes)

c6dfebd: QEMU: declared silent control events for 5D3
(not used; only for annotations)


0c858dd: QEMU: declared internal zoom in/out events for 5D3
(they are sent by the MPU during GUI mode switches)

d756b74: QEMU: fix LV button code for 5D3

1404ae8: more output options (to stdout, to file, auto rename)

e1735d5: MPU spells: script to annotate logs with mpu_send/recv events
(known MPU messages moved to

f3ad52f: Makefile: fix "make install_qemu CONFIG_QEMU=y" for minimal targets

287c785: adv_int: ignore empty lines when loading keyframes

6239bc6: adv_int: use strstr instead of my_strstr (fixes slow load)

284656a: Include strstr in ML core

ef21d82: adv_int: refactor keyframe time formatting

5ca412b: adv_int: auto-load the saved sequence at startup

a4869c8: adv_int: renamed menu entry to "Ramping options"

e4fd44e: QEMU: workaround to emulate io_trace
(without it, many MMIO events are missed, apparently because of QEMU's TLB cache)

958a876: NotifyBox: log messages to QEMU console

d2bb805: GDB scripts: replaced *(int*)(x) with MEM(x)
(for consistency with other ML code, and maybe slightly easier to read)

34b5de3: QEMU: experimental Q button emulation for 100D
(not 100% sure about it, but seems to emulate the long Q/SET press correctly)



  1. Make sure you are running Canon firmware 1.0.2.
  2. Format the card from the camera.
  3. Unzip the archive and copy ML files to the memory card.
  4. Run the Firmware Update process from Canon menu.

    This procedure will enable the BOOTDISK flag in your camera's Flash ROM, allowing it to load and execute custom code from the memory card. A copy of the original (unmodified) ROM contents will be saved to the card.

    Magic Lantern will run from this card; it won't replace your original firmware.

  5. After installation, please copy your ROM backup files (ML/LOGS/ROM*.BIN on the card) to a safe place.
Detailed instructions on the wiki. Please don't forget to check the FAQ and the user guide.


From camera:
  1. Run Firmware Update from your ML card.
  2. Follow the on-screen instructions, including the fine print.

    This procedure disables the BOOTDISK flag. You will no longer be able to run Magic Lantern, unless you reinstall it.

    Some settings changed by Magic Lantern might be persistent; this procedure will not reset them. To restore the camera to factory state, you may also want to clear all camera settings and custom functions from Canon menu.

From one card:
  • Canon menu: Format card, remove Magic Lantern.
  • This procedure does not disable the BOOTDISK flag. With this method, you will still be able to run Magic Lantern from other cards.
  • Never delete the Magic Lantern files from the card! Format the card instead.

Camera doesn't boot?

  1. Remove battery, remove card.
  2. Put battery back, close card and battery covers.
  3. Start the camera without card.
    • » Did it work? Format the card, reinstall Magic Lantern.
    • » Still not working? Double-check battery and card doors, run the diagnostic tools and get in touch with us.

Troubleshooting tips

  • If your camera locks up, remove the battery and reboot.
  • Make sure you have a backup card without Magic Lantern on it (just in case).
  • To restore ML defaults: Prefs → Config files.
  • To see what settings you have changed from ML defaults: Modified (Δ) menu.
  • To disable Magic Lantern temporarily: press and hold SET at startup.

Older Builds

Magic Lantern is not approved nor endorsed by Canon in any way, and using it will probably void your warranty.
We are not responsible for any damages to your camera.

Copyright (C) 2009-2018 Magic Lantern Development Team

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.