Skip to content

6D2: override the 29:59 MOV/MP4 recording limit - #294

Open
ServerDestroyer wants to merge 1 commit into
reticulatedpines:devfrom
ServerDestroyer:6d2-mov-time-limit
Open

6D2: override the 29:59 MOV/MP4 recording limit#294
ServerDestroyer wants to merge 1 commit into
reticulatedpines:devfrom
ServerDestroyer:6d2-mov-time-limit

Conversation

@ServerDestroyer

Copy link
Copy Markdown

Adds the two MVR_TIME_LIMIT_* constants and enables FEATURE_OVERRIDE_MOVIE_30_MIN_LIMIT for the 6D2 (1.1.1), following the 200D implementation.

How the addresses were found: searched ROM0 for the exact .old_value constants movtweaks.c asserts against — 1799000 (29m59s) and 449000 (7m29s). Each byte pattern occurs exactly once in the whole 32 MiB image, adjacent and in that order, so there is no competing candidate. Both are reached from a two-armed getter at 0xe042fee8 (the beq at 0xe042fef0 selects normal vs high FPS; each arm is an ldr r0, [pc, #128] whose computed T1 literal target resolves to these addresses). Verified by decoding the instructions, not by byte pattern-matching alone.

Tested on a real 6D2 (fw 1.1.1): limit set to 1 min → recording stops on its own at ~60 s. apply_patches() accepted both patches without E_PATCH_OLD_VALUE_MISMATCH, independently confirming the .old_value constants against this body's ROM. Also double-checked by two consecutive ~448 MB MP4s landing within 0.2% of each other at the 180-min setting test.

🤖 Generated with Claude Code

Add MVR_TIME_LIMIT_NORMAL_FPS / MVR_TIME_LIMIT_HIGH_FPS for 6D2 1.1.1
and enable FEATURE_OVERRIDE_MOVIE_30_MIN_LIMIT, wiring up the existing
movtweaks.c implementation.

The addresses are the two recording time limits (in ms) in a ROM0
literal pool. Searching ROM0 for 1799000 (0x1b7358, 29m59s) and 449000
(0x6d9e8, 7m29s) - the exact .old_value fields movtweaks.c asserts
against - finds each byte pattern exactly once in the whole 32 MiB
image, adjacent and in that order, so there is no competing candidate.
Both are read by a two-armed getter at 0xe042fee8: the beq at
0xe042fef0 selects normal vs high FPS, and each arm is an
"ldr r0, [pc, reticulatedpines#128]" whose literal target resolves to 0xe042ff74 and
0xe042ff78 respectively. Verified by decoding the instructions, not by
pattern-matching bytes.

Tested on a real 6D2 (firmware 1.1.1): with the limit set to 1 min,
recordings stopped on their own at ~60 s. apply_patches() validated
.old_value on the body without tripping E_PATCH_OLD_VALUE_MISMATCH,
which independently confirms both addresses against this body's ROM.
A wrong address fails loudly and rolls back atomically rather than
patching anything.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant