requesttype=0x13
This command actually has 19 subcommands:
Table 3.4. Remote Camera Control Codes
| Subcommand | Sample Parameters | Reply Length | Function |
|---|---|---|---|
| 00 | none | 5C | Camera control initialization |
| 01 | none | 5C | Exit release control |
| 02 | none | 5C | Start viewfinder |
| 03 | none | 5C | Stop viewfinder |
| 04 | none | 5C | Release shutter |
| 07 | buffer of 0x34 bytes | 5C | Set release parameters |
| 09 | 04 00 00 00 09 00 00 00 | 5C | Set transfer mode |
| 0A | none | 8C | Get release parameters |
| 0B | none | 60 | Get zoom position |
| 0C | 04 00 00 00 01 00 00 00 | 5c | Set zoom position |
| 0D | none | 60 | Get available shot |
| 0E | ??? | ?? | Set custom function |
| 0F | 14 bytes | 66 | Get custom function |
| 10 | none | 60 | Get size of extended release parameters |
| 11 | ???? | ???? | Get version of extended release parameters |
| 12 | none | varies | Get extended release parameters |
| 13 | ???? | ?? | Set extended parameters |
| 14 | 01 00 00 00 00 03 | 5C | Select camera output |
| 15 | ???? | ?? | Do auto exposure, focus, and white balance |
The subcommand is stored as a little-endian 4-byte number at the start of the message payload (i.e. starting 0x50 bytes from the start of the buffer). Parameters vary by subcommand, as noted below; they follow the subcommand in the message payload. The minimum is <subcommand> 0, so the minimum length of a command packet is 0x58.
In the reply, the payload will always start with status, <subcommand>. After that, the minimum is one more zero word, or there may be more information. The minimum length is 0x5c.
Takes no parameters. With some models, this command extends the lens to make the camera ready to capture images. With others, there is no visible effect, but Canon software seems to issue it anyway.
Command: 0x58 bytes
0000 18 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 05 7f 00 00 02 00 01 43 61 6e 6f ............Cano
0020 6e 20 45 4f 53 20 44 33 30 00 00 00 00 00 00 00 n.EOS.D30.......
0030 00 00 00 00 00 00 00 00 00 00 00 00 43 6f 72 6e ............Corn
0040 02 00 00 00 13 00 00 12 18 00 00 00 00 c5 12 00 ................
0050 00 00 00 00 00 00 00 00 ........
Response: 0x5c bytes (after ~5 seconds on PowerShot G2)
0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000 02 00 00 00 13 00 00 22 1c 00 00 00 00 c5 12 00 ......."........
0010 00 00 00 00 00 00 00 00 00 00 00 00 ............
If the lens cap is left on a PowerShot G2, the lens cant extend. The response takes about 10 seconds (as apparently the camera tries more than once to extend the lens), and the response block looks like this. Note that bytes 0x50 and 0x53 are non-zero, which is not the case when the lens extends properly.
0000: 1c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010: 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0020: 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0030: 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0040: 02 00 00 00 13 00 00 22 1c 00 00 00 78 56 34 12 ......."....xV4.
0050: 85 00 00 02 00 00 00 00 00 00 00 00 ............
If there is no CF card in an EOS D30, the response will be only 0x40 bytes long, and will look like this:
0000 00 00 00 00 01 03 00 00-00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
The PowerShot G2 returns normally, even if no CF card is present. The error will be signaled later, at set transfer mode and release shutter
Takes no parameters
Command: 0x58 bytes
0000 18 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 00 12 18 00 00 00 18 cd 12 00 ................
0050 01 00 00 00 00 00 00 00 ........
Response: 0x5c bytes
0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000 02 00 00 00 13 00 00 22 1c 00 00 00 18 cd 12 00 ......."........
0010 00 00 00 00 01 00 00 00 00 00 00 00 ............
Takes no parameters; returns minimum message of 0x5c bytes. The camera does, however, signal through the interrupt pipe. The sequence goes:
Issue release shutter command, read reply of 0x5c bytes. From a D60, this reply was
0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000 02 00 00 00 13 00 00 22 1c 00 00 00 28 f6 12 00 ......."....(...
0010 00 00 00 00 04 00 00 00 00 00 00 00 ............
Read 0x10 bytes from interrupt endpoint, using timeout of 50 milliseconds and retrying until success. The camera will normally respond in about 32 milliseconds (EOS D60, G2). Most responses have a length of zero, but the response after the release shutter is complete will be 0x10 bytes in length.
The bytes seem always to be 02 00 00 00 0a 00 00 00 10 00 00 00 1c 00 00 00", whether the shot succeeded or failed.
For the G2, the 0x10 response takes about 3.6 seconds. I believe that this signals that the capture is complete. The time seems relatively independent of image size or compression.
For the D60, it seems to come within about 10ms of the release shutter command.
For the 300D, response takes about 0.35 seconds.
If transfer mode includes THUMB_TO_PC (see Set transfer mode below), read 0x17 bytes from interrupt endpoint as above.
For a D60, these bytes were
0000: 02 00 00 00 08 00 00 00 17 00 00 00 eb 00 b0 17
0010: 01 00 1e 00 00 00 af
For a G2, the bytes were
0000: 02 00 00 00 08 00 00 00 17 00 00 00 01 00 00 00
0010: 01 09 0c 00 00 00 b0
At byte 12 (0x0c) is a 4-byte integer with some sort of image index; you must specify this in a download captured image command to make it work.
Starting at byte 0x11 is a 4-byte integer with the size of the thumbnail image to download.
NOTE: This doesnt arrive if the capture fails. Instead, a reply of 0x10 bytes arrives (for D60):
0000: 02 00 00 00 0a 00 00 00 10 00 00 00 1d 00 00 00
If transfer mode includes FULL_TO_PC, read 0x17 bytes from interrupt endpoint as above.
For a D60, these bytes were
0000: 02 00 00 00 0c 00 00 00 17 00 00 00 eb 00 b0 17
0010: 01 c5 80 06 00 00 af
For a G2, the bytes were
0000: 02 00 00 00 0c 00 00 00 17 00 00 00 01 00 00 00
0010: 01 5a cb 09 00 00 b0
A 4-byte integer at 0x0c has the image index for the download captured image command.
A 4-byte integer at 0x11 has the main image size. I dont know what the other bytes are.
I suspect that byte 4 has some sort of flags for the type of image.
I also guess that the last byte (at 0x16) may encode the camera model somehow.
NOTE: This block doesnt arrive if the capture fails. Instead, a reply of 0x14 bytes arrives (for D60):
0000 02 00 00 00 0a 00 00 00 14 00 00 00 0a 00 00 00
0010 01 00 00 00
Read 0x10 bytes from interrupt endpoint as above.
For EOS cameras, this seems to signify that capture is complete and the image has been written to the storage card. For a D60, this can take from about 1.6 seconds (for small, low-quality JPEG) to about 16.5 seconds (for RAW), plus the shutter open time.
For the G2, this returns immediately.
For the EOS 20D, this message never comes.
This response always seems to be
0000: 02 00 00 00 0a 00 00 00 10 00 00 00 1d 00 00 00
regardless of success or failure.
The sequence of messages 0x0a/0x1c; 0x0a/0x1d may be repeated once or twice if the the image captured is the last one that will fit on the camera's storage device.
For EOS cameras, only after successful write to camera storage, read another 0x10 bytes from interrupt endpoint as above. This returns immediately. The result is
0000: 02 00 00 00 0e 00 00 00 10 00 00 00 00 00 00 00
for success. If the capture failed, or if neither THUMB_TO_DRIVE or FULL_TO_DRIVE is set in the current transfer mode, this message is skipped and we go on to the final message (below).
The code 0e may signify that the thumbnail is ready for download; at any rate, Chris Breezes D30Capture starts to download the thumbnail immediately after this message is received.
For EOS cameras, read the final message:
0000: 02 00 00 00 0f 00 00 00 10 00 00 00 00 00 00 00
NOTE: This message seems never to arrive from an EOS 300D.
Interrupt reads always have a code in byte 0x04 (actually, its probably a 4-byte integer with a small value). This code is
Type codes for interrupt read
Unknown; sometimes seen with PowerShot G2.
Image descriptor for captured thumbnail (only if THUMB_TO_PC bit is set in the current transfer mode); 0x17 bytes including the length of the thumbnail image and a key that must be supplied in the get captured image command.
Image descriptor for full-size captured image (only if FULL_TO_PC bit is set in the current transfer mode); 0x17 bytes including the length of the full image and a key that must be supplied in the get captured image command. The key seems to be identical for thumbnail and full image that correspond to each other.
Capture status: 0x10 bytes. The byte at offset 0x0c contains a code: 0x1c for start of capture, 0x1d for end of capture (completion for PowerShot cameras, still in progress for EOS cameras), and 0x0a (with a length of 0x14 bytes) if there was a photographic failure. There also is a code of 0x1b that seems to tell us to wait for the flash to fire; it has been seen when using the internal flash on EOS D30 and D60.
EOS write to flash storage successful: 0x10 bytes. This will never come if the current transfer mode doesn't include either THUMB_TO_DRIVE or FULL_TO_DRIVE
EOS capture complete: 0x10 bytes.
Response to camera initialization; not seen during capture dialog.
Takes a payload of 0x38 bytes: 0x34 after subcommand code. Offset 14 in these bytes (18 from the start of the payload) controls the flash:
#define FLASH_OFF 0x00
#define FLASH_ON 0x01
#define FLASH_AUTO 0x02
Response: 0x5c bytes (failure):
0000: 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040: 02 00 00 00 13 00 00 22 1c 00 00 00 2f 00 00 00 ......."..../...
0050: 00 00 00 00 07 01 00 ff 00 00 00 00 ............
(success):
0000: 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040: 02 00 00 00 13 00 00 22 1c 00 00 00 2f 00 00 00 ......."..../...
0050: 00 00 00 00 07 00 00 00 00 00 00 00 ............
Takes 2 parameters: 4, <code> where <code> is a combination of the following bits:
#define THUMB_TO_PC 0x0001
#define FULL_TO_PC 0x0002
#define THUMB_TO_DRIVE 0x0004
#define FULL_TO_DRIVE 0x0008
These may be combined in any way.
Command: 0x5c bytes
0000 1c 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 00 12 1c 00 00 00 2c c4 12 00 ............,...
0050 09 00 00 00 04 00 00 00 0d 00 00 00 ............
Error codes:
| 0x00000000 No errors |
| 0x0200002a Camera storage is full |
Response 0x5c bytes:
0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000 02 00 00 00 13 00 00 22 1c 00 00 00 8c c5 12 00 ......."........
0010 00 00 00 00 09 00 00 00 00 00 00 00 ............
This has just set the camera to send the next captured image to the camera's local storage, with the thumbnail image both to storage and to the PC.
Takes no parameters. Returns 0x34 bytes after the echo of the subcommand code. First 4-byte integer is 0x00000030, which is the count of remaining bytes. I assume that the 0x34 bytes are the same as is sent down by code 07, set release parameters.
Command: 0x58 bytes
0000 18 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 00 12 18 00 00 00 14 c4 12 00 ................
0050 0a 00 00 00 00 00 00 00 ........
Response 0x8C bytes:
0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 00 22 4c 00 00 00 14 c4 12 00 ......."L.......
0050 00 00 00 00 0a 00 00 00 30 00 00 00 00 04 02 00 ........0.......
0060 00 00 00 00 04 01 01 ff 03 ff 01 30 00 ff 00 ff ...........0....
0070 00 00 00 7f 10 00 60 00 38 00 7c 00 18 18 18 ff ......`.8.|.....
0000 20 00 50 00 14 00 14 00 14 00 01 00 ..P.........
No parameters
Command: 0x58 bytes
0000 18 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0020 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0030 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0040 02 00 00 00 13 00 00 12 18 00 00 00 a4 f6 12 00 ................
0050 0b 00 00 00 00 00 00 00 ........
Reply: 0x60 bytes
0000 20 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ...............
0010 82 81 80 7f 7f 80 81 83 84 84 83 81 80 7f 7f 80 ................
0020 81 83 83 81 80 7f 7d 7d 7e 7f 80 81 80 7f 7e 7c ......}}~.....~|
0030 7c 7d 7f 80 81 81 81 80 7f 7f 80 81 82 84 84 83 |}..............
0000 02 00 00 00 13 00 00 22 20 00 00 00 a4 f6 12 00 ......." .......
0010 00 00 00 00 0b 00 00 00 04 00 00 00 00 00 3c 00 ..............<.
Response has a 4-byte count (4), and I think two 2-byte integers (0,60). This was for a G2 at full-wide position (7mm).
Two parameters.
Command: 0x5c bytes
0000 1c 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0020 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0030 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
0040 02 00 00 00 13 00 00 12 1c 00 00 00 a8 f6 12 00 ................
0050 0c 00 00 00 04 00 00 00 01 00 00 00 ............
Parameters are (4,1).
Reply: 0x5c bytes
0000 1c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 7f 7f 80 80 80 80 7f 7d 7c 7b 7c 7e 7f 80 80 80 .......}|{|~....
0020 7f 7e 7f 7f 80 82 83 84 83 82 81 80 80 81 82 84 .~..............
0030 84 83 81 80 7f 7f 7f 80 80 80 80 7f 7e 7c 7b 7b ............~|{{
0000 02 00 00 00 13 00 00 22 1c 00 00 00 a8 f6 12 00 ......."........
0010 00 00 00 00 0c 00 00 00 00 00 00 00 ............
No parameters
Command: 0x58 bytes
0000 18 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 00 12 18 00 00 00 ec f4 25 01 ..............%.
0050 0d 00 00 00 00 00 00 00 ........
Reply 0x60 bytes:
0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000 02 00 00 00 13 00 00 22 20 00 00 00 ec f4 25 01 ......."......%.
0010 00 00 00 00 0d 00 00 00 04 00 00 00 02 00 00 00 ................
The last word is the estimated number of shots remaining: i.e. the free storage space divided by the estimated size of an image file in the current mode.
14 bytes of parameters. The first 4 bytes is a 32-bit little-endian count of the number of bytes following. In the example, there are 10 bytes of actual data. But the next 2 bytes seems to be an index for the custom function to read; the value comes back in the reply, which has a payload just as long, but with just the index/value pair repeated and then the setting of that function. A zero value is the default setting for all functions.
Command: 0x62 bytes
0000 22 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 "...............
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 00 12 22 00 00 00 d4 c5 12 00 ........".......
0050 0f 00 00 00 0a 00 00 00 04 00 e8 77 00 00 13 00 ...........w....
0060 08 00 ..
Reply 0x66 bytes:
0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000 02 00 00 00 13 00 00 22 26 00 00 00 d4 c5 12 00 ......."&.......
0010 00 00 00 00 0f 00 00 00 0a 00 00 00 04 00 04 00 ................
0020 00 00 00 00 00 00 ......
Command: 0x62 bytes. In this case, we read custom function 1 ("Long exposure noise reduction"), which was set to 1.
0000 22 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 "...............
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 00 12 22 00 00 00 54 f6 12 00 ........"...T...
0050 0f 00 00 00 0a 00 00 00 01 00 ff ff 00 00 00 00 ................
0060 00 00 ..
Reply 0x66 bytes:
0000 00 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 00 22 26 00 00 00 54 f6 12 00 ......."&...T...
0050 00 00 00 00 0f 00 00 00 0a 00 00 00 01 00 01 00 ................
0060 01 00 00 00 00 00 ......
The value of the given custom function is given starting at byte 0x60. I don't know if this is a 2-byte or 4-byte value, or if it's possible to read more than one custom function at a time; Canon RemoteCapture reads them one at a time, even when it reads all the available functions.
The custom functions (as seen in Canon RemoteCapture and on the camera menu) are as follows:
Table 3.5. EOS Custom Functions
| Code | Function | Values |
|---|---|---|
| 0x01 | Long exposure noise reduction | 0: Off 1: On (not on D60) |
| 0x02 | Shutter button/AE lock button | 0: AF/AE lock 1: AE lock/AF 2: AF/AF lock 3: AE+release/AE+AF |
| 0x03 | Mirror lockup | 0: Disable 1: Enable |
| 0x04 | Tv, Av and exposure steps | 0: stop 1: 1/3 stop |
| 0x05 | AF-assist beam/ Flash firing | 0: Emits/fires 1: Does not emit/Fires 2: Only ext. flash emits/Fires 3: Emits/Does not fire |
| 0x06 | Shutter speed in Av mode | 0: Auto 1: 1/200 (fixed) |
| 0x07 | AEB sequence/auto cancellation | 0: 0 - + /Enable 1: 0 - + /Disable 2: 0 + - /Enable 3: 0 + - /Disable |
| 0x08 | Shutter curtain sync | 0: 1st-curtain sync 1: 2nd-curtain sync |
| 0x09 | Lens AF stop button Fn, switch | 0: AF stop 1: AF start 2: AE lock while metering |
| 0x0a | Auto reduction of fill flash | 0: Enable 1: Disable |
| 0x0b | Menu button return position | 0: Top 1: Previous (top if powered off) 2: Previous |
| 0x0c | SET button func, when shooting | 0: Default (no function) 1: Change quality 2: Change ISO speed 3: Change parameters |
| 0x0d | Sensor cleaning | 0: Disable 1: Enable |
| 0x0e | Superimposed display | 0: On 1: Off (not on D30) |
| 0x0f | Shutter release without CF card | 0: Possible w/o CF card 1: Not possible (not on D30)) |
No parameters
Command: 0x58 bytes
0000 18 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 7f 7f 80 80 80 80 7f 7d 7c 7b 7c 7e 7f 80 80 80 .......}|{|~....
0020 7f 7e 7f 7f 80 82 83 84 83 82 81 80 80 81 82 84 .~..............
0030 84 83 81 80 7f 7f 7f 80 80 80 80 7f 7e 7c 7b 7b ............~|{{
0040 02 00 00 00 13 00 00 12 18 00 00 00 50 f6 12 00 ............P...
0050 10 00 00 00 00 00 00 00 ........
Reply: 0x60 bytes
0000 20 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ...............
0010 87 8b 8d 8a 87 88 89 89 87 88 8b 8b 89 86 87 89 ................
0020 89 86 84 85 85 83 81 82 85 84 80 7e 7e 7f 7f 7e ...........~~..~
0030 7f 82 83 80 7b 7b 7e 80 80 82 85 86 82 7e 7d 80 ....{{~......~}.
0000 02 00 00 00 13 00 00 22 20 00 00 00 50 f6 12 00 ......." ...P...
0010 00 00 00 00 10 00 00 00 04 00 00 00 10 00 00 00 ................
I think this means to expect 16 (0x10) bytes of extended release parameters.
Command: 0x5c bytes
0000 1c 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 7f 7f 80 80 80 80 7f 7d 7c 7b 7c 7e 7f 80 80 80 .......}|{|~....
0020 7f 7e 7f 7f 80 82 83 84 83 82 81 80 80 81 82 84 .~..............
0030 84 83 81 80 7f 7f 7f 80 80 80 80 7f 7e 7c 7b 7b ............~|{{
0040 02 00 00 00 13 00 00 12 1c 00 00 00 50 f6 12 00 ............P...
0050 12 00 00 00 04 00 00 00 10 00 00 00 ............
Reply: 0x6c bytes
0000 2c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00 ,...............
0010 71 72 75 76 79 7e 80 7f 7b 7c 7f 81 82 84 86 87 qruvy~..{|......
0020 85 81 80 81 83 82 80 7f 80 7c 77 76 78 7a 79 77 .........|wvxzyw
0030 75 76 78 79 79 7b 7f 7f 7e 7d 80 84 84 84 87 8b uvxyy{..~}......
0000 02 00 00 00 13 00 00 22 2c 00 00 00 50 f6 12 00 .......",...P...
0010 00 00 00 00 12 00 00 00 10 00 00 00 10 00 00 00 ................
0020 00 00 02 00 00 00 18 00 e0 08 54 aa ..........T.
Sends a 9-byte payload: 0x00000014, 0x00000001, and a single byte with the code LCD (0x1), Video out (0x2), or OFF (0x3).