Magic Lantern firmware
Magic Lantern firmware
In 2008 Vincent Laforet released a promo for the Canon 5D Mark 2's video features titled "Reverie"1. The 1080p full frame sensor was unbelievable in the age of 480p MiniDV cameras with tiny sensors, and the 5Dm2 seemed like the start of a new era of film making. I was so impressed by the demo video that I ordered one of the cameras, sight unseen.
When it arrived I signed up for a team in the 48 Hour Film Project and we shot some short films on the camera. Unfortunately the first version of the firmware lacked many features that we wanted for film making, with the two biggest being manual controls for the audio levels and manual control of the lens aperature. The dvinfo.net forum and new sites like cinema5d were full of other users complaining about these missing features, and we found work arounds like "set the lens aperature, then partially remove the lens from the camera to disconnect the controls" (and hope it doesn't fall off the body!), or "inject constant volume 20KHz audio to confuse the AGC" (and hope it can be removed in post).
Based on the success of CHDK (Canon Hack Development Kit) for point-and-shoot cameras,
I was confident that we could build a similar function for the DSLR devices.
When a firmware update was released by Canon, I was able to analyze it based on the knowledge
from CHDK's earlier experiement, which allowed me to gain code execution on the camera in May 2009.
With most of these sort of things, a first step is "change a string visible somewhere" so
that it is clear that the modified firmware is running. The version string was the easiest,
so I modified it to add -hud in the custom firmware image shown above.
Once the audio chip was identified and the framebuffer memory map was located, it was fairly straightforward to turn off the AGC, draw onscreen audio meters, and 16:9 crop marks. Fairly quickly other device interfaces and Canon DryOS functions were mapped out, enabling even more features like focus controls, audio monitoring, reading config from files, etc.
I released the source under the GPL, packaged up my firmware builds and offered it to interested and brave testers with the caveat that "if it breaks your camera, you get to keep both pieces". Despite that lack of guarantee, the firmware started to be used by real film makers, who started sending in new feature requests and trying out the code as I hacked on it. A few other developers like arm.indy started hacking as well, although it was a fairly small crew.
In mid-2010, I ported Magic Lantern to the t2i / 550D, which started a major change for the project. The Canon 5D Mark II was an amazing camera, but it was also a very expensive camera, so the owners tended to be professional photographers or film makers, not reverse engineers and software developers. The Canon t2i / 550D, however, was a budget crop-sensor design that was within reach for far more people. The number of users, and more importantly, the number of developers exploded and suddenly we had a real community of hackers.
Around this time I also moved to NYC and didn't have as much time to hack on it anymore, so I handed the credentials to Alex, who has been the lead dev ever since. They setup the greatly improved magiclantern.fm site in 2012 to replace my magiclantern wiki, and under their leadership the firmware has expanded to support an enormous range of cameras. It even has a wikipedia page.
The Magic Lantern forums are still active aften more than ten years and people are still hacking on the firmware. They've unlocked capabilities like "Raw video mode" in low-end cameras that weren't intended to have it, "Windowed Sensor Reads" for higher frame rates, and functions like onboard scripting language support.
They've also added numerous innovative new features, like
"Dual ISO" mode,
which came out of an observation that the ISO register was always written
with duplicate nibbles, like 0x113 for ISO100, 0x223 for ISO200
or 0xFF3 for ISO12800. acoutts asked, "what if we write 0x1F3
instead?" and found that it exposed the even lines at ISO100 and the
odd lines at ISO12800, allowing realtime HDR photographs and video!
As I wrote in the first anniversary "State of the Lantern" post back when the project was only one year old, it is wonderful to see my code being used and developed by so many people, for so varied applications, in so many different locations2. Releasing it as open source and encouraging other people to hack on the devices that they own was one of my best decisions and I'm excited to see what comes next.
Software Photography Reverse engineering 2010 Video