Canon EOS R5 so-called overheat timer defeated by a single screw in battery door

[Andrew Reid]

1 minute ago, visionrouge said:

Is there a way to actually do the same trick with the card sensor door?

Try to recording with the door open and remove the card during recording?

Is the same overheat behavior exist? As the camera did not see a stop record order; maybe it will not update the NVRAM flag as well.

Another test is to trigger the clip record with the HDMI input. Maybe these "engineer" in Canon forgot to implement the timer there?
I mean start and stop recording internally, using HDMI command with external display.
This will solve the clip reading issue. If it's working that will be easy fix.

 

Interesting point.

I'll see if I can give it a go.

First I need to work on a YouTube video showing it going for 1 hour in 8K.

That should shut some people up.

[visionrouge]

1 minute ago, Andrew Reid said:

Interesting point.

I'll see if I can give it a go.

First I need to work on a YouTube video showing it going for 1 hour in 8K.

That should shut some people up.

I have updated my post with 3 tests to do. One is pretty simple with the help of a external recorder, just to start stop with HDMI command

[visionrouge]

Apparently,, according to the manual, when you simply unplug the HDMI connector, it will stop recording. Is this write the infamous timer flag?
Another test to do with such... Press record on the camera with a HDMI screen, and stop the recording by unplugging the HDMI, not by using the record button...

[horshack]

1 hour ago, Andrew Reid said:

Updated article with more clarifications.

It is battery backed RAM not NVRAM EEPROM (that's why the Baidu internal battery pull worked) but the basic workings are the same

https://www.eoshd.com/news/canon-eos-r5-so-called-overheat-timer-defeated-by-a-single-screw-in-battery-door/

A lot to get our heads around, so please if you are commenting on this topic, make sure to read the full article first.

Good update. FYI, NVRAM refers to any memory that doesn't require the embedded device's primary power source. This can include actual non-volatile memory like EEPROM but is more typically the battery-backed variety, like the Dallas parts that also include an RTC (real-time clock). Here's a sample Dallas datasheet for the latter variety and excerpt:

"The DS14285/DS14287 Real Time Clock with NVRAM Control provides the industry standard DS1287 clock function with the additional feature of providing nonvolatile control for an external SRAM. "

"The DS14285/DS14287 uses its backup energy source and battery-backup controller to make a standard CMOS static RAM nonvolatile during power-fail conditions. During power fail, the DS14285/DS14287 automatically write-protects the external SRAM and provides a VCC output sourced from its internal battery. "

[Cliff Totten]

Look....Cannot has worked hard to cripple the R5 and limit it's ability to be used as a replacement for their Pro Cine models. I'll say it again, Cine EOS managers were in the R5 technical planning and devopment meetings from the beginning. Nobody wants the R5 to take $1 away from the Cine EOS model sales.

Cannot is not afraid of bad press on the R5. What DOES terrify them are customers circumventing the R5 marketing control measures and making it go beyond Cannot's intentions. It's vital for the R5 to live in the carefully calculated market "box" that Cannot made it for.

We can all bet our lives that Cannot will work as hard they can to thwart any user hacks that crop up. They will likely reduce some of their original cripples in future firmware but never enough to match what "WE" want the R5 to actually be.

What Cannot want's the R5 to be and what "we" want the R5 to be.....are two RADICALLY different ideas.....

[Oliver Daniel]

8 hours ago, Stronz said:

The thought of spending $4,000 on a camera and having to deal with all this nonsense, just to get the features Canon markets on the box...it's appalling. What's even more tragic is the people still making excuses. Canon could have delivered the goods and made everyone happy but they botched it.  

Yep, absolutely ridiculous the “workarounds” people are considering to record video properly on a $4000 camera, and the excuses being made. If this was on a Panasonic nobody would bother. 

Andrews intentions are correct. The marketing sold this as a revolutionary pro video tool yet Canon have decided it “overheats”. Good work! 

[Davos]

Canon engineers reading this thread.

[Video Hummus]

Honestly all magic lantern has to do is implement a proper temperature timer and be done with it. Once the camera reaches the temperature reported after 20 mins of 8K RAW it shuts down. After 3 minutes the camera naturally cools down to cold start temperatures and is ready for another 20 mins of 8K. This would be a safe implementation because its based entirely off the supposed temperatures Canon wanted the camera to max out at. We have seen the internal temperature is barely effected by the outside conditions.

Now, depending how the temperature is reported the firmware hack would be relatively small actual code changes.

Or even simpler, just change the code that writes the cripple clock to RAM to always be 25 mins.

[Andrew Reid]

Yes certainly possible but it is one heck of a reverse engineering project with many complexities and arduous effort, and would likely take a long time even for somebody as skilful and experienced as a1ex.

I think after being mislead we deserve Canon to come out with an official fix, and a public apology.

It would also be smart of Canon to make a development kit so that Magic Lantern didn't have to reverse engineer in order to add modules and code.

Can you imagine if developers had to do this to make Android apps?!

[docmoore]

5 hours ago, Andrew Reid said:

Yes that's true. Lot's to try next. I'll see what state the clip is in and see if I can still transcode it in EditReady. The 8K HEVC is a bitch to edit! So I'll be doing this anyway with 8K material to ProRes.

The main goal for me is not so much the workable workaround but rather the truth gets out, and to force Canon's hand in removing any artificial limitations. Your contributions here have become invaluable, so thank you.

Yes this could indeed work but it'll be beyond the patience of most filmmakers I think. I'll try @BTM_Pix's suggestion first and see if there is a simple way to get around it and produce a usable last recording...

 

I guess the question is how short of a recording will work ... IOW film for 14 minutes. Stop record so the clip is saved. Start a sham record and reset the timer ... lose the sham recording but have another 15 minutes on the timer. Not sure how long the sham recording needs to be for this to work.

[docmoore]

3 hours ago, visionrouge said:

Apparently,, according to the manual, when you simply unplug the HDMI connector, it will stop recording. Is this write the infamous timer flag?
Another test to do with such... Press record on the camera with a HDMI screen, and stop the recording by unplugging the HDMI, not by using the record button...

Why use the record button at all? I routinely record to my external recorder via HDMI without pushing record on the camera ... the signal gets recorded externally

and the camera is just idling in liveview. I started this with the original Leica SL as it was suggested that one could bypass internal noise reduction which kicked in

when the camera was recording.

Since the camera seems to heat up while idling you would need to reset the timer as mentioned in Andrew's article ... but could stop the external recorder to save

the clip prior to shutdown of the camera.

[Cliff Totten]

At this point, now that we know what Cannot has done with the R5, why "exactly" are we all pissed off?

1.) Are we pissed because Cannot crippled the R5 to such ridiculas levels? Are we pissed because we think that protecting EOS Cine camcorders is a stupid idea? Are we pissed that Cannot just didnt let the R5 do everything it was truly capable of?

2.) Are we pissed that Cannot LIED to its customers by trying to make us believe that the cripples were not avoidable because of heat limitations? 

In other words....If Cannot just came out and said from day one; "Yes,...we have placed software blocks that limit the R5's ability to negatively impact our pro camcorder sales"....would that have made the cripples OK?

If Cannot was just blunt and honest about the R5 cannibalizing camcorder sales...would we all have understood and given Cannot a cripple pass?

[horshack]

I looked into what it might take to recover the lost/missing video file after a battery pull. I reproduced the R5 hack scenario on my Canon RP by recording a minute of video on a freshly-formatted SD card and then pulling the battery while the door-sensor was inhibited. Like what Andrew discovered on his R5 the file is not corrupt but actually completely missing, both when attempting to play the video on the camera and when mounting the card on a computer. I then tried running SanDisk's RescuePro Deluxe and after scanning the entire card it didn't find the video.

Here's what I think is happening. Obviously Canon has to write the video data to the card while recording, since it has no other place to retain it beyond the internal SDRAM buffer capacity. You can see easy evidence of this by watching the card access light continuously flicker. The strategy Canon is likely employing is to defer the writing of the official FAT metadata until the recording is orderly stopped. This would include elements such as the FAT directory entry, which anchors the file, and possibly also the linked FAT allocation tables. This would explain why RescuePro couldn't find the file, since there isn't enough or any recognizable metadata to reconstruct the orphaned data sectors associated with the video. Canon is either caching that information in memory until the file is closed or is writing it somewhere on the card that isn't linked to the official FAT structures. The benefit of this strategy, assuming they're using it, is that it prevents any potential filesystem-level corruption from incomplete metadata updates, since none of the official metadata structures are updated to link to the file until it's closed. The downside of this strategy is that it orphans all the data from the file and makes recovery more complicated.

There are a few strategies in devising a recovery app for this situation. The first would be to reverse-engineer exactly what if any metadata Canon is writing during the recording and to where. If that orphaned metadata is in the same format as actual FAT structures then it should be relatively straightforward to create a placeholder directory entry and link to it. If the format of that metadata is proprietary to Canon then the process of reverse-engineering its structure would be much more complex. This would all be done by using a sector editor and block-based search tools to compare a freshly-formatted card to one which has a missing video after recording. And lots of effort.

I was actually an embedded firmware storage engineer for most of my professional career so this would be in my wheelhouse. I'll see how much demand there might be for this before I spent any serious amount of time on it.

In the meantime I'll also try some other recovery apps to see if they have better luck...in case SanDisk's utility is not doing the job it's supposed to. I recommend others try the same so we don't unnecessarily reinvent the wheel 🙂

[Emanuel]

  

9 minutes ago, Cliff Totten said:

At this point, now that we know what Cannot has done with the R5, why "exactly" are we all pissed off?

1.) Are we pissed because Cannot crippled the R5 to such ridiculas levels? Are we pissed because we think that protecting EOS Cine camcorders is a stupid idea? Are we pissed that Cannot just didnt let the R5 do everything it was truly capable of?

2.) Are we pissed that Cannot LIED to its customers by trying to make us believe that the cripples were not avoidable because of heat limitations? 

In other words....If Cannot just came out and said from day one; "Yes,...we have placed software blocks that limit the R5's ability to negatively impact our pro camcorder sales"....would that have made the cripples OK?

If Cannot was just blunt and honest about the R5 cannibalizing camcorder sales...would we all have understood and given Cannot a cripple pass?

Truth. Technology, knowledge. Resources. Who pays don't give a damn for their reasons. We have ours our money pays. We pay for an equipment, not for their reasoning if any.

[docmoore]

Might give IsoBuster a try ... I have recovered a ton of stuff when the FAT was completely corrupted ... mainly from DVD/CDs

It will dump any information it finds and is usually able to tell the type of file from the structure.

[horshack]

21 minutes ago, docmoore said:

Might give IsoBuster a try ... I have recovered a ton of stuff when the FAT was completely corrupted ... mainly from DVD/CDs

It will dump any information it finds and is usually able to tell the type of file from the structure.

Good call @docmoore. Just downloaded IsoBuster and it found the .mp4. It wont let me attempt to extract it without buying a license.  I'll search out a few other free/open-source solutions first before biting the bullet on the purchase.

Here's a screenshot of the recovery:

[docmoore]

It is really a good program ... I have had it for close to 15 years ... easily justified the cost in my case.

And it is great to see that the files are on the card 🙂

[AitorElorga]

Canon is not responsible.

Who can certify that the camera is not oberhrat after say 20 minutes ?

As camera has probably no tenperature sensor, and as 8k requires a lot of power processing, which translates to heat. 

FOR ME is totally normal that canon decide to not allow more than N number of minutes of recording. And yoy cannot say that Canon is dishonest in this way.

Canon eos C models are bigger with bigger cooling solutions and indded dont have 8 recording.

SO STOP complaining to Canon for that, and enjoy more than 15 minutes of full 8k recording in a dslr camera, coño

[newfoundmass]

This is fucking ridiculous. Seriously: fuck Canon. 

[horshack]

5 minutes ago, docmoore said:

It is really a good program ... I have had it for close to 15 years ... easily justified the cost in my case.

And it is great to see that the files are on the card 🙂

It's definitely a start. The file sizes are off though - it shows only 96K for the MP4 and put the remainder of the card's capacity in bucket labeled .mhk. Not sure if the extraction would successfully reconstruct the file.