Pel and others already found the fonts format, and I made previous descriptions about menu and strings IDs, but how the firmware is locating fonts and matching strings in several langages to strings_number ?

in 550d 108, in startupPreparePlayback()

ROM:FF0135AC                 LDR     R0, =dword_FF5B0000
ROM:FF0135B0                 BL      sub_FF05C03C

we got a pointer to an updatable record which contains Gui resources.


first is a directory of tables, here with 6 entries, and the length of "gui_resources" part, see update record #8 here

nb_records=6, filesize= 0x001c648c

then, offset from the start, and lenght

0x00000008: 0x00000038 0x000b1a30 // compressed bitmaps
0x00000010: 0x000b1a68 0x00068ea0 // FONTS
0x00000018: 0x0011a908 0x0006ed6c // Strings in several langages
0x00000020: 0x00189674 0x00039b5c // dialog data
0x00000028: 0x001c31d0 0x00002a20 // ??
0x00000030: 0x001c5bf0 0x0000089c // ??

GUI_resources is located at f85b0000/ff5b0000 on 550d/t2i.

Compressed bitmaps

first table at 0x38 is containing compressed bitmap

0x00000038: 0x00000594

first the number of bitmaps here 0x594, then bitmaps data...

between 0x3c and 02cdc are IDs + offsets to each bitmap data. Below the first column is the offset, then bitmap number, then offset. Delta is just difference between offsets

0x0000003c: 0x10000001 0x00002cdc delta=0x0000, 26 60 3 004f57015603550354095503
0x00000044: 0x10000002 0x00002e28 delta=0x014c, 24 52 5 f500000918196360a02e888d 1248
0x0000004c: 0x10000003 0x00002f2c delta=0x0104, 24 52 5 f500000918196360a02e686d 1248
0x00000054: 0x10000004 0x00003030 delta=0x0104, 24 52 5 2e01000918196360a02e080e 1248
0x0000005c: 0x10000005 0x0000316c delta=0x013c, 26 60 3 00c55601003a550154015501
0x00000064: 0x10000006 0x000031f4 delta=0x0088, 24 52 3 00a95d015c0100315d015c01
0x0000006c: 0x10000007 0x0000326c delta=0x0078, 24 52 3 00a985018401003185018401
0x00000074: 0x10000008 0x000032e4 delta=0x0078, 24 52 3 00a953015201003153015101
0x0000007c: 0x10000009 0x0000335c delta=0x0078, 26 60 5 02010009181963601824203c 1560
0x00000084: 0x1000000a 0x0000346c delta=0x0110, 24 52 5 de00000918196360a02a8889 1248
0x0000008c: 0x1000000b 0x00003558 delta=0x00ec, 24 52 5 de00000918196360a02a6869 1248
0x00000094: 0x1000000c 0x00003644 delta=0x00ec, 24 52 5 ef00000918196360a02a080a 1248
0x0000009c: 0x1000000d 0x00003740 delta=0x00fc, 26 60 5 5b01000918196360181c203c 1560
0x000000a4: 0x1000000e 0x000038a8 delta=0x0168, 24 52 5 2101000918196360a026888d 1248
0x000000ac: 0x1000000f 0x000039d8 delta=0x0130, 24 52 5 2101000918196360a026686d 1248
0x000000b4: 0x10000010 0x00003b08 delta=0x0130, 24 52 5 3201000918196360a026080e 1248
0x000000bc: 0x10000011 0x00003c48 delta=0x0140, 26 60 3 005d570156015409002f5701
0x000000c4: 0x10000012 0x00003d1c delta=0x00d4, 24 52 3 00515d015c025b0700285d01
0x000000cc: 0x10000013 0x00003dcc delta=0x00b0, 24 52 3 005185018402830700288501
0x000000d4: 0x10000014 0x00003e7c delta=0x00b0, 24 52 3 005153015201510150070028
0x000000dc: 0x10000015 0x00003f3c delta=0x00c0, 26 60 5 f80000091819636018d42004 1560
0x000000e4: 0x10000016 0x00004040 delta=0x0104, 24 52 5 ca00000918196360a03988c6 1248
0x000000ec: 0x10000017 0x00004118 delta=0x00d8, 24 52 5 ca00000918196360a03968c6 1248
0x000000f4: 0x10000018 0x000041f0 delta=0x00d8, 24 52 5 d900000918196360a03908c0 1248
0x000000fc: 0x10000019 0x000042d8 delta=0x00e8, 26 60 5 9d010009181963601844203c 1560
0x00000104: 0x1000001a 0x00004484 delta=0x01ac, 24 52 5 5101000918196360a0368889 1248
0x00002ca4: 0x1000058e 0x000b130c delta=0x0030,  36  72 2 00ff00ff00ff00ff00860120 2592
0x00002cac: 0x0000058f 0x000b1348 delta=0x003c, 160 160 7 400200091819636018050c74 3200
0x00002cb4: 0x00000590 0x000b1594 delta=0x024c,  40  40 7 7500000918196360c007180f 200
0x00002cbc: 0x00000591 0x000b1618 delta=0x0084, 160 160 7 810200091819636018050c78 3200
0x00002cc4: 0x00000592 0x000b18a8 delta=0x0290,  40  40 7 6f00000918196360c006fe03 200
0x00002ccc: 0x00000593 0x000b1924 delta=0x007c,  40  40 7 95000009181963608003e63f 200
0x00002cd4: 0x00000594 0x000b19c8 delta=0x00a4,  40  40 7 91000009181963604000e6ff 200

Bitmap 000003f8 40x40.png

bitmap data are structured this way:

0 short width
4 short height
8 long compression_method
12 ... (depending on method)

See columns #5 to #7.

Compression_methods are:

  • 0: no compression, 1bit. data at +8
  • 2: RLE, 8 bits. data at +8
  • 3: RLE, 8 bits. data at +8 (height x width instead of width x height), mirrored
  • 4: color gradient ?
  • 5: zlib, 8 bits. data at +12
  • 7: zlib, 1 bit. data at +12

With zlib, compressed data start at offset+12 (181963...) and RLE data at offset+8 (in bold below). Last column is decompressed size after successfull decompression. Dimensions of bitmap #2 are 24x52 and decompressed data length is 24*52=1248, which means each pixel is 8bits=256 colors (for compression #5). For bitmap #58f (and compression method #7), dimensions are 160x160=25600 pixels, whereas decompression size is 25600/8=3200: this is a monochrome bitmap.

RLE algorithm stream is <Value, T> each on one byte and means "repeat Value T times". For bitmap #33 below, repeat 0xfa 7 times, repeat 0xf9 21 times, etc...

0x000001bc: 0x10000031 0x0000600c delta=0x0188,  84  60 5 d70100091819636018050c08 5040
0x000001c4: 0x10000032 0x000061f0 delta=0x01e4,   2 308 5 b70000091819fbf58b6ee027 616
0x000001cc: 0x10000033 0x000062b4 delta=0x00c4,   2  48 2 fa07f902fa02f902fa01f902 96
0x000001d4: 0x10000034 0x00006304 delta=0x0050,   2 184 5 870000091819fbf58b0cf013 368
0x0000031c: 0x1000005d 0x00007a30 delta=0x0064,  24  52 3 0038502c0008502c0008502c
0x00000324: 0x1000005e 0x00007a94 delta=0x0064,   1  92 4 020000ff
0x0000032c: 0x1000005f 0x00007aa0 delta=0x000c,   1  24 4 020000ff
0x00000334: 0x10000060 0x00007aac delta=0x000c,   1  52 2 020128320201000000010200 52

we can see that compression method #4 for bitmaps #5e and #5f is very efficient, 92 and 24 bytes are encoded in 12 bytes (delta values), minus 8 bytes for H, W and compression_method = 4 bytes.

See this script to extract bitmaps update 2Jan2012:

550d 109/108:

ROM:FF2D85A8 decompress_gui_bitmap                   
ROM:FF2D85A8 var_2EC         = -0x2EC
ROM:FF2D85A8                 STMFD   SP!, {R4-R9,LR}
ROM:FF2D85AC                 MOV     R6, R3          ; heigth
ROM:FF2D85B0                 MOV     R5, R2          ; width
ROM:FF2D85B4                 LDR     R3, [R1]        ; pointer on bitmap data, on compression value
ROM:FF2D85B8                 MOV     R4, R0          ; dest
ROM:FF2D85BC                 CMP     R3, #7          ; switch 8 cases
ROM:FF2D85C0                 ADD     R2, R1, #4      ; r2=bitmap data, zlib src
ROM:FF2D85C4                 SUB     SP, SP, #0x2D4
ROM:FF2D85C8                 MUL     R0, R6, R5
ROM:FF2D85CC                 ADDLS   PC, PC, R3,LSL#2 ; jumptable FF2D85DC case 2
ROM:FF2D8708                 MOV     R1, R0          ; jumptable FF2D85DC case 5
ROM:FF2D870C                 B       loc_FF2D871C
ROM:FF2D8710 ; ---------------------------------------------------------------------------
ROM:FF2D8710 loc_FF2D8710                            
ROM:FF2D8710                 ADD     R0, R5, #7      ; jumptable FF2D85DC case 7
ROM:FF2D8714                 MOV     R0, R0,LSR#3
ROM:FF2D8718                 MUL     R1, R6, R0     ;dest size
ROM:FF2D871C loc_FF2D871C                            
ROM:FF2D871C                 MOV     R0, R4         ;dest
ROM:FF2D8720                 BL      zlib_bitm_decompress
ROM:FF2D8724                 B       loc_FF2D862C

Fonts data

Second part of GUI resources is font data

0x00000010: 0x000b1a68 0x00068ea0

and already described in Fonts.

Strings data

then Strings data

0x18 offset strings table + strings
offset = 0x0011a908, length= 0x0006ed6c

again, you've got

000 long (=0)
004 long lang_number
008 long strings_number
0xc offset table

then strings, null terminated. first message in in several language, then 2nd message in several langage, etc... Below are english versions of strings ids 0xff to 0x109. the first colum is offset to ff5b0000.

0x0011ad10: 0x00ff 0x0001b599 (delta=0x0000020f) 0x135ea1 "Movie rec. size"
0x0011ad14: 0x0100 0x0001b7d4 (delta=0x0000023b) 0x1360dc "1920x1080 30fps"
0x0011ad18: 0x0101 0x0001ba14 (delta=0x00000240) 0x13631c "1920x1080 25fps"
0x0011ad1c: 0x0102 0x0001bc54 (delta=0x00000240) 0x13655c "1920x1080 24fps"
0x0011ad20: 0x0103 0x0001be94 (delta=0x00000240) 0x13679c "1280x720 60fps"
0x0011ad24: 0x0104 0x0001c0bb (delta=0x00000227) 0x1369c3 "1280x720 50fps"
0x0011ad28: 0x0105 0x0001c2e2 (delta=0x00000227) 0x136bea "640x480 60fps"
0x0011ad2c: 0x0106 0x0001c4f0 (delta=0x0000020e) 0x136df8 "640x480 50fps"
0x0011ad30: 0x0107 0x0001c6fe (delta=0x0000020e) 0x137006 "Sound recording"
0x0011ad34: 0x0108 0x0001c885 (delta=0x00000187) 0x13718d "On"
0x0011ad38: 0x0109 0x0001c924 (delta=0x0000009f) 0x13722c "Off"

which must be compared to

ROM:FF521DEC MovieSizeFrameRateMessage_table
                             DCD    0,0x18,   0,0x102         ; 0x18=24 fps
ROM:FF521DEC             DATA XREF: guiGetUnaviMovieSizeFrameRateMessage+4
ROM:FF521DEC                 DCD    0,0x19,   0,0x101         ; 0x19=25 fps
ROM:FF521DEC                 DCD    0,0x1E,   0,0x100         ; 30, 0=1920x1080
ROM:FF521DEC                 DCD    1,0x32,   0,0x104         ; 50
ROM:FF521DEC                 DCD    1,0x3C,   0,0x103         ; 60, 1=1280x720
ROM:FF521DEC                 DCD    2,0x32,   0,0x106         ; 50
ROM:FF521DEC                 DCD    2,0x3C,   0,0x105         ; 60, 2=640x480
ROM:FF521DEC                 DCD    2,0x32,   8,0x3C0         ; 50
ROM:FF521DEC                 DCD    2,0x3C,   8,0x3BF         ; 60, 2=640x480, 8=crop

Dialogs data

for 500d 108 (offset from 0xff5b0000):

0x00000020: dialogs_data at 0x00189674

header is:

0 long 0
4 nb_dialog (0xa1)
8 offsets_tables

it looks like this. I did not analysed how dialogs are stored.

0x00189678: nb_dialogs = 0x000000a1
0x0018967c: 0x00000001 0x0000050c delta=0x050c 0x189b80 70990300010000000100010002000000434f4d4d4f4e0000000000000200
0x00189684: 0x00000002 0x0000057c delta=0x0070 0x189bf0 0100004001000000010006000c000000434f4d4d4f4e0000000000000000
0x0018968c: 0x00000003 0x0000068c delta=0x0110 0x189d00 010000400100000001000c008b000000434f4d4d4f4e0000000000000200
0x00189694: 0x00000004 0x00000c34 delta=0x05a8 0x18a2a8 01000040010000000100190084000000434f4d4d4f4e0000000000000200
0x0018969c: 0x00000005 0x0000124c delta=0x0618 0x18a8c0 010000400100000001000c0081000000434f4d4d4f4e0000000000000200
0x001896a4: 0x00000006 0x000017a4 delta=0x0558 0x18ae18 01000040010000000100040011000000434f4d4d4f4e0000000000000200
0x001896ac: 0x00000007 0x000018bc delta=0x0118 0x18af30 01000040010000000100020006000000434f4d4d4f4e0000000000000200
0x001896b4: 0x00000008 0x0000195c delta=0x00a0 0x18afd0 0100004001000000010011001e000000434f4d4d4f4e0000000000000200
0x001896bc: 0x00000009 0x00001bac delta=0x0250 0x18b220 010000400100000001000f0044000000434f4d4d4f4e0000000000000200
0x001896c4: 0x0000000a 0x00001f18 delta=0x036c 0x18b58c 00000000010000000100140087000000434f4d4d4f4e0000000000000200
0x001896cc: 0x0000000b 0x000024f8 delta=0x05e0 0x18bb6c 010000400100000001001300ab000000434f4d4d4f4e0000000000000200
0x001896d4: 0x0000000c 0x00002c04 delta=0x070c 0x18c278 01000040010000000100030027000000434f4d4d4f4e0000000000000200
0x001896dc: 0x0000000d 0x00002dbc delta=0x01b8 0x18c430 0200004001000000010004000e000000434f4d4d4f4e0000000000000200
0x001896e4: 0x0000000e 0x00002ebc delta=0x0100 0x18c530 01000040010000000100100045000000434f4d4d4f4e0000000000000200
0x001896ec: 0x0000000f 0x00003234 delta=0x0378 0x18c8a8 0100004001000000010004001d000000434f4d4d4f4e0000000000000200
0x001896f4: 0x00000010 0x000033ac delta=0x0178 0x18ca20 0200004001000000010009002c000000434f4d4d4f4e0000000000000200
0x001896fc: 0x00000011 0x000035ec delta=0x0240 0x18cc60 0000000001000000010008001f000000434f4d4d4f4e0000000000000200
0x00189704: 0x00000012 0x000037b4 delta=0x01c8 0x18ce28 0200004001000000010007001d000000434f4d4d4f4e0000000000000200
0x0018970c: 0x00000013 0x0000395c delta=0x01a8 0x18cfd0 01000040010000000100090023000000434f4d4d4f4e0000000000000200
0x00189714: 0x00000014 0x00003b58 delta=0x01fc 0x18d1cc 570000100100000001000a001b000000434f4d4d4f4e0000000000000200
0x0018971c: 0x00000015 0x00003d20 delta=0x01c8 0x18d394 02000040010000000100040016000000434f4d4d4f4e0000000000000200
0x00189724: 0x00000016 0x00003e60 delta=0x0140 0x18d4d4 02000040010000000100060014000000434f4d4d4f4e0000000000000200
0x0018972c: 0x00000017 0x00003fb0 delta=0x0150 0x18d624 871300000100000001002d00d8000000434f4d4d4f4e0000000000000200
0x00189734: 0x00000018 0x000049a8 delta=0x09f8 0x18e01c 0100004001000000010042018e070000434f4d4d4f4e0000000000000400
0x0018973c: 0x00000019 0x00009a9c delta=0x50f4 0x193110 01000040010000000100020008000000434f4d4d4f4e0000000000000400
0x00189744: 0x0000001a 0x00009b4c delta=0x00b0 0x1931c0 01000040010000000100080026000000434f4d4d4f4e0000000000000200
0x0018974c: 0x0000001b 0x00009d4c delta=0x0200 0x1933c0 02000040010000000100080024000000434f4d4d4f4e0000000000000200
0x00189754: 0x0000001c 0x00009f3c delta=0x01f0 0x1935b0 0200004001000000010002000d000000434f4d4d4f4e0000000000000200
0x0018975c: 0x0000001d 0x0000a014 delta=0x00d8 0x193688 01000040010000000100090015000000434f4d4d4f4e0000000000000200


0x00189b7c: 0x000000a1 0x00039970 delta=0x0120 0x1c2fe4 010000000100000001000b0019000000434f4d4d4f4e000000000000010

you can notice strings "COMMON" and "DLG_RC"


camera base address nb_strings nb_bitmap nb_dialogs
550D/T2i 0xFF5B0000 0x3E8 0x594 0xA1
500D/T1i 0xFF5B0000 0x69D 0x5A4 0xF6
60D 0xFF710000 0x4A4 0x6d3 0xDF
600D/T3i 0xFF7E0000 0x6AD 0x846 0xD7
7D 0xFF5B0000 0x69E 0x5A4 0xF6
1100D/T3 0xFF750000
5D Mrk II 0xFF010000 0x674 0x47D 0xF0* main firmware at 0xFF810000
5Dm3 0xF02C0000 0xb9a 0x92b 0x17e main firmware at 0xFF0C0000
  • 5D Mark II has nb_dialogs at offset 0 instead of 4.

Examples (550D 1.0.8)

icons 0x4ab, 0x4ba Bitmap 000004ab 20x40.png , Bitmap 000004ba 20x40.png

icons 0x576, 0x57f, 0x578, 0x580,0x579,

0x57a, 0x57d, 0x57e,0x57b

Bitmap 00000576 60x40.png , Bitmap 0000057f 60x40.png , Bitmap 00000578 60x40.png , Bitmap 00000580 60x40.png , Bitmap 00000579 60x40.png

, Bitmap 0000057a 60x40.png , Bitmap 0000057d 60x40.png , Bitmap 0000057e 60x40.png , Bitmap 0000057b 60x40.png

ROM:FF4E6D48 QualityIconID_table DCD    2,0x4BA      ; DATA XREF: GetQualityIconID
ROM:FF4E6D48                                         ; ROM:off_FF2FC734
ROM:FF4E6D48                 DCD    3,0x4AB
ROM:FF4E6D48                 DCD    6,   0
ROM:FF4E6CB8 WbModeIconID_table DCD    0,0x576       ; DATA XREF: GetWbModeIconID+4
ROM:FF4E6CB8                                         ; ROM:off_FF2FC6F4
ROM:FF4E6CB8                 DCD    1,0x57F
ROM:FF4E6CB8                 DCD    2,0x578
ROM:FF4E6CB8                 DCD    3,0x580
ROM:FF4E6CB8                 DCD    4,0x579
ROM:FF4E6CB8                 DCD    5,0x57A
ROM:FF4E6CB8                 DCD    6,0x57D
ROM:FF4E6CB8                 DCD  0xF,0x57D
ROM:FF4E6CB8                 DCD 0x10,0x57D
ROM:FF4E6CB8                 DCD 0x12,0x57D
ROM:FF4E6CB8                 DCD 0x13,0x57D
ROM:FF4E6CB8                 DCD    8,0x57E
ROM:FF4E6CB8                 DCD    9,0x57B
ROM:FF4E6CB8                 DCD 0x16,   0

See also

See DialogTemplates

Community content is available under CC-BY-SA unless otherwise noted.