Administrators Andrew Reid Posted August 23, 2020 Administrators Share Posted August 23, 2020 On Friday, I received a message from the lead developer at Magic Lantern. An interesting theory was being put forward by one of their open source contributors, which he believed could defeat the so-called overheat timer on the Canon EOS R5. Initially I was skeptical as to whether it would work! Mainly because the initial real-world tests on my own EOS R5 did not reset the timer. But then, a break-through. Magic Lantern just became Magic Screw! Read the full blog post here: https://www.eoshd.com/news/canon-eos-r5-so-called-overheat-timer-defeated-by-a-single-screw-in-battery-door/ Cosimo, Hanriverprod, zerocool22 and 1 other 3 1 Quote Link to comment Share on other sites More sharing options...
Stronz Posted August 23, 2020 Share Posted August 23, 2020 Being able to save the clip is the critical next step but definitely looks/sounds more like a timer than true communication and limitations from a thermometer. Since we know the internals do heat up to 65C/150F, it'll be interesting to see who pushes this to the limit and the resulting damage (if there is any) after prolonged use. Perhaps with a timer exploit + proper thermal management via hardware mod, you'd actually have the functional camera Canon should have delivered in the first place. Video Hummus 1 Quote Link to comment Share on other sites More sharing options...
Administrators Andrew Reid Posted August 23, 2020 Author Administrators Share Posted August 23, 2020 Looks like somebody has been right? Quote Link to comment Share on other sites More sharing options...
Stronz Posted August 23, 2020 Share Posted August 23, 2020 The thought of spending $4,000 on a camera and having to deal with all this nonsense, just to get the features Canon markets on the box...it's appalling. What's even more tragic is the people still making excuses. Canon could have delivered the goods and made everyone happy but they botched it. newfoundmass, Xavier Plagaro Mussard and Andrew Reid 3 Quote Link to comment Share on other sites More sharing options...
Lloyd Posted August 23, 2020 Share Posted August 23, 2020 A1ex is a legend I swear. That guy should replace the current CEO at canon andrgl, Batteries, LukeM and 1 other 2 2 Quote Link to comment Share on other sites More sharing options...
gethin Posted August 23, 2020 Share Posted August 23, 2020 Would love to know what happens if you stop recording at 14 mins, pull the battery and swap the card. Writing cripple info to the card ties in with people getting longer record times when using external recorders doesn't it? The other possibility is that after every 8k clip is finished it's writing to nvram. If you can only record a handful of 8k clips per day, it never likely to ware out the nvram. Yep its totally insane that you're having to do this to a $4000 camera. On the other hand I can't think of a better way to flip canon the bird than finding a hack for it 😆 Quote Link to comment Share on other sites More sharing options...
gethin Posted August 23, 2020 Share Posted August 23, 2020 Hey just had an idea: If pulling the button battery resets the cripple clock is it possible that canon are using the user-set time as their reference. In other words what happens if you record 14 mins 8k, then set the clock back 14 mins. Do you get your 14 mins back? Wouldn't that be hilarious (unlikely but) 🙂 Quote Link to comment Share on other sites More sharing options...
Super Members BTM_Pix Posted August 23, 2020 Super Members Share Posted August 23, 2020 2 hours ago, Andrew Reid said: Read the full blog post here: https://www.eoshd.com/news/canon-eos-r5-so-called-overheat-timer-defeated-by-a-single-screw-in-battery-door/ If you have two cards, it might be worth testing recording clips on the first one until you get close to the limit then inserting the second and doing the battery pull while its recording to that one. If it resets the clock if its shut down in a disorderly way while recording as has been observed then you'll only have lost that recording and not your real ones from the first card. Ifit turns out that this sacrficial recording on the second card only needs to be for 30 seconds or whatever then that might be a viable practical workaround. On a £4K camera. Andrew Reid 1 Quote Link to comment Share on other sites More sharing options...
horshack Posted August 23, 2020 Share Posted August 23, 2020 Andrew, the video that won't play-back in the camera after removing the battery (without stopping the recording first) is likely recoverable by reconstructing the missing tail data of the MP4 container. I've never had to do this myself but in checking online there are a few open-source solutions, some of which require a dummy "good file" taken anytime from the same camera that they then craft the tail data onto the truncated file. If that solution works then a shooter using the battery hack could just shoot an extra 10-20 seconds of unneeded outro footage that would be tossed from the battery pull. Quote Link to comment Share on other sites More sharing options...
Joseph Weigert Posted August 23, 2020 Share Posted August 23, 2020 It looks like, hacking is even simpler with a battery grip: https://www.youtube.com/watch?v=b-qeqNY2Nog horshack 1 Quote Link to comment Share on other sites More sharing options...
horshack Posted August 23, 2020 Share Posted August 23, 2020 2 minutes ago, Joseph Weigert said: It looks like, hacking is even simpler with a battery grip: https://www.youtube.com/watch?v=b-qeqNY2Nog Someone else did it with a dummy AC battery as well: Joseph Weigert 1 Quote Link to comment Share on other sites More sharing options...
k-robert Posted August 23, 2020 Share Posted August 23, 2020 Som years ago it came out that a famous car company has manipulated the control system of their cars, so when measuring how pollutive the exhaust is, the software adjusted the engine management, so very low values were registered. The company did advertise the cars with these impossible to archive values, so actually were misleading, cheating the customers. Investigations showed that also other car manufacturers made use of this ingenious trick… Since these firms have paid billions as penalty, have “reengineered” the control software, have recalled millions of cars, the responsible ones have faced serious sanctions and most of the CEO-s are not seeeous anymore. Most people find all this rightful. I really hope that in some of the most important countries, markets for Canon, where customers are not willing to be defrauded and the legal system is grown up to such situations, Canon is going to be punished for this absurd dishonesty. It will also be an important message for the whole high-tech/IT industry, where shiny marketing brochures often promise values, never archivable in real world. zerocool22 and Andrew Reid 2 Quote Link to comment Share on other sites More sharing options...
Davos Posted August 23, 2020 Share Posted August 23, 2020 So there we have it. Proven without doubt Canon lied. Over at Canon fan boy HQ, dpreview, it's thing of beauty to watch the fan boys react to this news. The mental gymnastics required to defend Canon in light of this are really quite something. Andrew Reid 1 Quote Link to comment Share on other sites More sharing options...
John Matthews Posted August 23, 2020 Share Posted August 23, 2020 I can see Foneh Thornrup frantically conjuring up a video where he somehow finds all the solutions and saves the day for all R5 owners, of which there are 126 internationally. andrgl 1 Quote Link to comment Share on other sites More sharing options...
Administrators Andrew Reid Posted August 23, 2020 Author Administrators Share Posted August 23, 2020 2 hours ago, horshack said: Andrew, the video that won't play-back in the camera after removing the battery (without stopping the recording first) is likely recoverable by reconstructing the missing tail data of the MP4 container. Yes that's true. Lot's to try next. I'll see what state the clip is in and see if I can still transcode it in EditReady. The 8K HEVC is a bitch to edit! So I'll be doing this anyway with 8K material to ProRes. The main goal for me is not so much the workable workaround but rather the truth gets out, and to force Canon's hand in removing any artificial limitations. Your contributions here have become invaluable, so thank you. Quote I've never had to do this myself but in checking online there are a few open-source solutions, some of which require a dummy "good file" taken anytime from the same camera that they then craft the tail data onto the truncated file. If that solution works then a shooter using the battery hack could just shoot an extra 10-20 seconds of unneeded outro footage that would be tossed from the battery pull. Yes this could indeed work but it'll be beyond the patience of most filmmakers I think. I'll try @BTM_Pix's suggestion first and see if there is a simple way to get around it and produce a usable last recording... 3 hours ago, BTM_Pix said: If you have two cards, it might be worth testing recording clips on the first one until you get close to the limit then inserting the second and doing the battery pull while its recording to that one. If it resets the clock if its shut down in a disorderly way while recording as has been observed then you'll only have lost that recording and not your real ones from the first card. Ifit turns out that this sacrficial recording on the second card only needs to be for 30 seconds or whatever then that might be a viable practical workaround. On a £4K camera. Quote Link to comment Share on other sites More sharing options...
Super Members BTM_Pix Posted August 23, 2020 Super Members Share Posted August 23, 2020 8 minutes ago, Andrew Reid said: Yes this could indeed work but it'll be beyond the patience of most filmmakers I think. I'll try @BTM_Pix's suggestion first and see if there is a simple way to get around it and produce a usable last recording... You could likely do it on the one card and it would just lose the last recording on that one but if you try it with two first to just make sure it doesn't fuck the entire file table on the card. Quote Link to comment Share on other sites More sharing options...
ajay Posted August 23, 2020 Share Posted August 23, 2020 Let's say you have 15 min to record. You record for 13 min. Then press record again and pull the battery (battery door sensor disengaged.) The last file is corrupted but that was just a dummy file. After reinserting the battery do you have a fresh 15 min. or does it remember the 13 min recording and you only have 2 min? Quote Link to comment Share on other sites More sharing options...
Django Posted August 23, 2020 Share Posted August 23, 2020 I’m curious how many 8K / 4KHQ sessions can you shoot with this hack before the temp reaches unsafe limits. Canon needs now to address all this ASAP with a firmware update! Quote Link to comment Share on other sites More sharing options...
Administrators Andrew Reid Posted August 23, 2020 Author Administrators Share Posted August 23, 2020 Updated article with more clarifications. It is battery backed RAM not NVRAM EEPROM (that's why the Baidu internal battery pull worked) but the basic workings are the same https://www.eoshd.com/news/canon-eos-r5-so-called-overheat-timer-defeated-by-a-single-screw-in-battery-door/ A lot to get our heads around, so please if you are commenting on this topic, make sure to read the full article first. Quote Link to comment Share on other sites More sharing options...
visionrouge Posted August 23, 2020 Share Posted August 23, 2020 Is there a way to actually do the same trick with the card sensor door? Try to recording with the door open and remove the card during recording? Is the same overheat behavior exist? As the camera did not see a stop record order; maybe it will not update the NVRAM flag as well. Another test is to trigger the clip record with the HDMI input. Maybe these "engineer" in Canon forgot to implement the timer there? I mean start and stop recording internally, using HDMI command with external display. I also would like to try this start stop recording with their external recording device RC-6 or BR-E1 This will solve the clip reading issue. If it's working that will be easy fix. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.