Summary of available (known) commands

Table 3.2. Storage Control Commands (cmd2=0x11)

cmd1cmd3Argument(e.g.)Response LengthOperation
0x010x2020x00000000 0x00001400 "DCIM\100CANON\IMG_0100.JPG" <NUL>LGet picture
0x050x201"D:\DCIM" <NUL>0x5Make directory
0x060x201"D:\DCIM" <NUL>0x54Delete directory
0x090x201"D:\" <NUL>0x5cDisk info request
0x0A0x202noneLFlash device identification
0x0B0x2020x01 "D:\DCIM"<NUL> <NUL> <NUL>LGet directory
0x0D0x201"D:\DCIM\100CANON" <NUL> "IMG_0002.JPG" <NUL>0x54Delete file
0x0E0x2010x00000021 "D:\DCIM\100CANON" <NUL> "IMG_0002.JPG" <NUL>0x54Set file attributes
0x0F0x2010x00000021 "D:\DCIM\158CANON\AUT_0001.JPG" <NUL> <NUL>0x54Set file time

Table 3.3. Camera Control Commands (cmd2=0x12)

cmd1cmd3Argument(e.g.)Response LengthOperation
0x010x201none0x9cIdentify camera
0x030x201none0x60Get time
0x040x2010x390873f0 0x000000000x54Set time
0x050x201"Donald Duck" <NUL>0x54Change owner
0x0A0x201none0x58Power supply status
0x130x201variesvariesRemote camera control
0x170x2020, 0x1400, 1, 0x2d011516LDownload Captured Image
0x1A0x20144 bytes0x80Unknown: EOS D30 only
0x1B0x2010x000000060x54EOS (D30/D60) Lock Keys
0x1C0x201none0x54EOS (D30/D60) Unlock Keys
0x1D0x201none0x58Get EOS Body ID
0x1F0x201none0x384Get camera photo abilities
0x200x201none0x54Lock keys, turn off LCD

A length of L corresponds to a cmd3 of 0x202 and means that the program reads 0x40 from bulk in, checks for a word at position 0x06 for the length, and then reads the rest in 0x1400 buffers as described above.