Jump to content

Canon EOS R5 so-called overheat timer defeated by a single screw in battery door


Recommended Posts

  • Administrators

magic-screw.jpg

On Friday, I received a message from the lead developer at Magic Lantern. An interesting theory was being put forward by one of their open source contributors, which he believed could defeat the so-called overheat timer on the Canon EOS R5.

Initially I was skeptical as to whether it would work! Mainly because the initial real-world tests on my own EOS R5 did not reset the timer.

But then, a break-through.

Magic Lantern just became Magic Screw!

Read the full blog post here:

https://www.eoshd.com/news/canon-eos-r5-so-called-overheat-timer-defeated-by-a-single-screw-in-battery-door/

Link to post
Share on other sites
  • Replies 109
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

Canon engineers reading this thread.

On Friday, I received a message from the lead developer at Magic Lantern. An interesting theory was being put forward by one of their open source contributors, which he believed could defeat the so-ca

A1ex is a legend I swear. That guy should replace the current CEO at canon

Posted Images

Being able to save the clip is the critical next step but definitely looks/sounds more like a timer than true communication and limitations from a thermometer. Since we know the internals do heat up to 65C/150F, it'll be interesting to see who pushes this to the limit and the resulting damage (if there is any) after prolonged use. Perhaps with a timer exploit + proper thermal management via hardware mod, you'd actually have the functional camera Canon should have delivered in the first place.

Link to post
Share on other sites

Would love to know what happens if you stop recording at 14 mins, pull the battery and swap the card.  Writing cripple info to the card ties in with people getting longer record times when using external recorders doesn't it?

The other possibility is that after every 8k clip is finished it's writing to nvram. If you can only record a handful of 8k clips per day, it never likely to ware out the nvram.  

Yep its totally insane that you're having to do this to a $4000 camera. On the other hand I can't think of a better way to flip canon the bird than finding a hack for it 😆

 

Link to post
Share on other sites

Hey just had an idea:

If pulling the button battery resets the cripple clock is it possible that canon are using the user-set time as their reference. In other words what happens if you record 14 mins 8k, then set the clock back 14 mins. Do you get your 14 mins back? Wouldn't that be hilarious (unlikely but) 🙂

Link to post
Share on other sites
  • Super Members
2 hours ago, Andrew Reid said:

If you have two cards, it might be worth testing recording clips on the first one until you get close to the limit then inserting the second and doing the battery pull while its recording to that one.

If it resets the clock if its shut down in a disorderly way while recording as has been observed then you'll only have lost that recording and not your real ones from the first card.

Ifit turns out that this sacrficial recording on the second card only needs to be for 30 seconds or whatever then that might be a viable practical workaround.

On a £4K camera.

Link to post
Share on other sites

Andrew, the video that won't play-back in the camera after removing the battery (without stopping the recording first) is likely recoverable by reconstructing the missing tail data of the MP4 container. I've never had to do this myself but in checking online there are a few open-source solutions, some of which require a dummy "good file" taken anytime from the same camera that they then craft the tail data onto the truncated file.

If that solution works then a shooter using the battery hack could just shoot an extra 10-20 seconds of unneeded outro footage that would be tossed from the battery pull. 

Link to post
Share on other sites

Som years ago it came out that a famous car company has manipulated the control system of their cars, so when measuring how pollutive the exhaust is, the software adjusted the engine management, so very low values were registered. The company did advertise the cars with these impossible to archive values, so actually were misleading, cheating the customers. Investigations showed that also other car manufacturers made use of this ingenious trick… 

Since these firms have paid billions as penalty, have “reengineered” the control software, have recalled millions of cars, the responsible ones have faced serious sanctions and most of the CEO-s are not seeeous anymore. Most people find all this rightful. 

I really hope that in some of the most important countries, markets for Canon, where customers are not willing to be defrauded and the legal system is grown up to such situations, Canon is going to be punished for this absurd dishonesty. It will also be an important message for the whole high-tech/IT industry, where shiny marketing brochures often promise values, never archivable in real world.

Link to post
Share on other sites
  • Administrators
2 hours ago, horshack said:

Andrew, the video that won't play-back in the camera after removing the battery (without stopping the recording first) is likely recoverable by reconstructing the missing tail data of the MP4 container.

Yes that's true. Lot's to try next. I'll see what state the clip is in and see if I can still transcode it in EditReady. The 8K HEVC is a bitch to edit! So I'll be doing this anyway with 8K material to ProRes.

The main goal for me is not so much the workable workaround but rather the truth gets out, and to force Canon's hand in removing any artificial limitations. Your contributions here have become invaluable, so thank you.

Quote

I've never had to do this myself but in checking online there are a few open-source solutions, some of which require a dummy "good file" taken anytime from the same camera that they then craft the tail data onto the truncated file.

If that solution works then a shooter using the battery hack could just shoot an extra 10-20 seconds of unneeded outro footage that would be tossed from the battery pull. 

Yes this could indeed work but it'll be beyond the patience of most filmmakers I think. I'll try @BTM_Pix's suggestion first and see if there is a simple way to get around it and produce a usable last recording...

3 hours ago, BTM_Pix said:

If you have two cards, it might be worth testing recording clips on the first one until you get close to the limit then inserting the second and doing the battery pull while its recording to that one.

If it resets the clock if its shut down in a disorderly way while recording as has been observed then you'll only have lost that recording and not your real ones from the first card.

Ifit turns out that this sacrficial recording on the second card only needs to be for 30 seconds or whatever then that might be a viable practical workaround.

On a £4K camera.

 

Link to post
Share on other sites
  • Super Members
8 minutes ago, Andrew Reid said:

 

Yes this could indeed work but it'll be beyond the patience of most filmmakers I think. I'll try @BTM_Pix's suggestion first and see if there is a simple way to get around it and produce a usable last recording...

You could likely do it on the one card and it would just lose the last recording on that one but if you try it with two first to just make sure it doesn't fuck the entire file table on the card.

 

Link to post
Share on other sites

Let's say you have 15 min to record. You record for 13 min. Then press record again and pull the battery (battery door sensor disengaged.) The last file is corrupted but that was just a dummy file.

After reinserting the battery do you have a fresh 15 min. or does it remember the 13 min recording and you only have 2 min?

Link to post
Share on other sites
  • Administrators

Updated article with more clarifications.

It is battery backed RAM not NVRAM EEPROM (that's why the Baidu internal battery pull worked) but the basic workings are the same

https://www.eoshd.com/news/canon-eos-r5-so-called-overheat-timer-defeated-by-a-single-screw-in-battery-door/

A lot to get our heads around, so please if you are commenting on this topic, make sure to read the full article first.

Link to post
Share on other sites

Is there a way to actually do the same trick with the card sensor door?

Try to recording with the door open and remove the card during recording?

Is the same overheat behavior exist? As the camera did not see a stop record order; maybe it will not update the NVRAM flag as well.

Another test is to trigger the clip record with the HDMI input. Maybe these "engineer" in Canon forgot to implement the timer there?
I mean start and stop recording internally, using HDMI command with external display.
I also would like to try this start stop recording with their external recording device RC-6 or BR-E1

This will solve the clip reading issue. If it's working that will be easy fix.

 

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...