T3i bricked after using Nightly.2015Jan15.600D102

Issue #2186 closed
Paul Collett created an issue

I have been using Magic Lantern 2011Dec22 for several years on my T3i and decided to try out a nightly. I downloaded the Jan 15th edition and installed it. Cool! new features and all that.

I took the camera out for a shoot and found that the camera was unstable. It would freeze during recording video after a few minutes which required a battery pull to get it to reset. When I got done with the shoot, I put the camera back in its case and headed home. When I got home the red power light on my camera was flashing and camera wouldn't turn on. The camera body was warm. I yanked the battery and copied the footage off of the SD card.

When I put the card and battery back in the red light would repeatedly blink but wouldn't turn on. I tried my other card which has the same version of ML on it. Same issue. I tried a battery pull and then put it in with no card. Nothing at all. No blinking, no turning on at all. I tried with a freshly formatted blank card. Nothing at all. I tried with my ML card again. Nothing at all. I have not seen any sign of life out of my camera for several days of trying different combinations of battery and cards.

Any suggestions on how to bring my camera back from the dead?

Comments (76)

  1. Paul Collett reporter

    I got blinks with the blink test.

    I think I deleted the log files on accident when I first encountered the problem. I was trying to roll back to an earlier ML version.

    Now what?

  2. Paul Collett reporter

    I went right down the list and every one of them did the same thing. The led just blinks continuously.

  3. Paul Collett reporter

    G3gg0, no blinks or any reaction from my camera at all from your file.

    From the diagnostic page linked above, I tried the LED blink test, the Startup log file, and the ROM dump file. All three make the light blink rapidly. No files are output by the camera to the memory card.

    Ideas anyone?

  4. Paul Collett reporter

    G3gg0, after a few more tries I got the camera to blink with your autoexec.bin file in, but no .BIN files were written out.

  5. Alex

    Make sure you format the card as FAT32, and wait until the LED is no longer blinking quickly. Do not remove the battery earlier.

    If in doubt, leave it blinking for several minutes.

  6. Georg Hofstetter

    how fast are they blinking? i tested that on my 600D v1.0.2 and it worked. it didnt make any difference whether the card was formatted in camera or in the computer.

    what's the capacity of your card?

  7. Paul Collett reporter

    I could say slow or fast but that means nothing without some kind of reference. So here is how fast it blinks: http://youtu.be/Q629RjLnl0w

    I'm using a 32GB Sony Class 10 UHS-1 card. I have tried other cards that I have as well.

  8. Paul Collett reporter

    Same results with a 4gb card. The blinktest, Startup Log and ROM dump files from the earlier link all blink fast. Your file, G3gg0 blinks slow.

  9. Paul Collett reporter

    Wow, this is getting a bit difficult here. I'll have to look and see if I can come up with a phototransistor. I'm confused after reading the directions about how to get the LED to blink in code in the first place. I suspect it would be good to find out if I can even do that much before going to the effort of finding a phototransistor.

  10. Alex

    LED code is our job, you just need the hardware side. To test it, just record some existing LED blinks.

  11. Paul Collett reporter

    So just running the blink test would get me code? It looks to me like all the blinks are the same. I'm looking for an old opto-mechanical mouse.

  12. Alex

    The blink test is just to test if your hardware works. I'll create another blinker that sends real data (the contents of your ROM).

  13. Paul Collett reporter

    I found a local store with a NTE3036 PhotoTransistor Dector, but have not yet found a BPW96C. Not being an electronics engineer I don't know if that would work as a substitute. Any idea if it will work?

  14. Paul Collett reporter

    I sure appreciate the help. I'm standing by. Any chance you can got to it over the weekend?

  15. Paul Collett reporter

    Bump. Just keeping this in up near the top so it doesn't get forgotten. I'm currently waiting on a program to dump the ROM with the blinker.

  16. Georg Hofstetter

    uh. ok that was nothing...

    a) its recorded with 44.1 kHz and not with 96 kHz

    b) it seems your optocoupler seems to have a very high capacitance

    for comparison: http://imgur.com/a55su9p.jpg

    the upper signal is from my setup. a standard audio cable, ~1.5m and some random photoresistor/diode i found. http://i.imgur.com/kGja7kt.jpg

    i will prepare a dumper that is much slower for another test

  17. Georg Hofstetter

    slowdown 100: http://upload.g3gg0.de/pub_files/55b316d574dae66d122df9bacee6963d/autoexec.bin

    slowdown 200: http://upload.g3gg0.de/pub_files/352fcfa0df303126a5a335b1a2ac6ed0/autoexec.bin

    slowdown 10: http://upload.g3gg0.de/pub_files/53313695c02e446a08b05d8b39528e84/autoexec.bin

    can you make some recordings with these three dumpers?

    ideal would be if the "slowdown 10" file would deliver good data, but first we need to get at least some data out of the camera :)

  18. Georg Hofstetter

    cannot check it right now, proxy forbids access to share hosters. will check tonight/tomorrow.

  19. Georg Hofstetter

    uuuh i checked it. can you try to get some other diode or photosensor? the current one is totally unusable :( i could try with slowdown 4000 but then we'd struggle with a lot of other issues. (and we would get one byte per second)

  20. Georg Hofstetter

    i just implemented direct register IO access to SD card, allowing me to write raw sectors to the SD card without using canon code. will polish it a bit, so we can use it to dump your ROM to the card.

  21. Georg Hofstetter

    are you able to format a fresh bootable sd card? if you format it under windows, the camera probably wont boot it anymore. i always have to format it in camera. i am asking because my current code will blindly overwrite all contents of the SD card with the ROM content. and i dont want you to delete your only bootable sd card with that dumper.

  22. Georg Hofstetter

    can you try this one? http://upload.g3gg0.de/pub_files/e9c835ed41251b4894e3d359258c937e/autoexec.bin

    it will directly access the SD card via the SDCON registers, as explained above. (and contains the "fullfat" library) when everything ran fine, you will have a ROM.BIN in your card's root folder. before uploading, do a chkdsk on the card. if there was some (repairable) error, delete the file and retry.

    if you did not have any chkdsk error, please upload the file (to prevent any copyright issues, PLEASE SEND THE DL LINK PER MAIL to 'ml_at_g3gg0.de' )

  23. Georg Hofstetter

    i received it. wow, i wonder what happened to your ROM, it looks very odd. it doesnt look like some "accidental" overwrite caused by ML calling a bad function or so. it looks more like a defect flash memory, mixing data lines.

    to exclude write errors with the dumper i made, please try this dumper: http://upload.g3gg0.de/pub_files/befb24980906526cf16d7f140d8202c1/autoexec.bin

    if that causes no LED activity, use this one: http://upload.g3gg0.de/pub_files/660f847e2ac558366b4cf0414a4296ab/autoexec.bin

    please upload both files ROM.BIN and ROM.MD5

  24. Paul Collett reporter

    The first file would cause the led to blink once, and then nothing.

    The second file caused the LED to go on solid and remain that way until I pull the battery.

    No files are written out.

  25. Georg Hofstetter

    oh wait, the second one. how long did you let it bing lit? it should be on with approx. 75% brightness and then after 2 minutes it should blink.

  26. Paul Collett reporter

    This one writes out a 0kb ROM.BIN file.

    I have been trying multiple cards and have been getting inconsistent results. One card will simply lock up with a solid red light, while another blinks once then nothing and yet another does nothing at all. I also find that I have to pull and put the battery in many times to get one time where the camera suddenly responds.

  27. Paul Collett reporter

    With two different SD cards I have managed to get two identical ROM.BIN files like what I sent to you earlier. With the same two SD cards I have managed to get two identical 0 kb ROM.BIN files from the autoexec.bin file from two days ago. One of them is a 32GB class 10 card, the other is a 4gb class 2 card. I get no blinking lights at all from the most recent autoexec file.

  28. Georg Hofstetter

    the next one: http://upload.g3gg0.de/pub_files/6f109814e86a35397ccca374001d428d/autoexec.bin

    the data you sent shows that there is not the data in the ROM.BIN which should be there. there was a transfer failure when writing from ROM to the SD card.

    in detail: the file contains data that repeats after 8 bytes again. it seems that the DMA controller transfers 16 bytes at once, but due to some weird behavior, no idea why, it transfers the first 8 bytes twice. but not always, often there are byte errors too.

    now i am trying to arrange the data in a way that i can reconstruct the original data from it. maybe that helps.

  29. Georg Hofstetter

    okay that worked.

    i tend to say that your digic, power supply or flash is bad.

    i did a binary diff of all the relevant parts in the flash:

    • 0x00000000 flags

    • 0x00002000 device information

    • 0x00002060 tune area

    • 0x00002140 device ID area

    • 0x00010000 main firmware

    • 0x0C000000 bootloader

    • 0x000AE000, 0x00B00000, 0x00B60000, 0x00BE0000, 0x00EC0000 properties

    which is probably everything contained in the flash as of my understanding of the 600D and the results are:

    flags: exactly like my camera

    device information: same here

    tune area: well, differs in some details, thats ok

    device ID area: totally different, which is to expect, sane numbers though

    main firmware: 100% clean

    bootloader: 100% clean

    properties: are dumpable and look totally okay to me. some excerpt you might recognise:

          <Property Id="0E070000" BaseAddress="00B303C4" Length="00000040">
            <String>Paul Collett _paul@xxxxxxxxx.net_______________________________</String>
          <Property Id="0E070001" BaseAddress="00B3040C" Length="00000040">
            <String>2011 If this camera found please call xxxxxxxxxxx______________</String>

    so i can not imagine why it behaves that buggy if it were just something ML could destroy if really everything in the world went wrong (flash content). the behavior of your camera tells me that this is due to some defective chip (probably digic) or - less likely - power supply - or even less likely - a flash chip failure.

    if it were my own camera, i had stopped here, opened it and checked the PCB for traces of water, defective capacitors, diodes, etc. or better, given it to the service center that they replace the PCB.

    i am sorry i could not help further :(

    i hope you see that this seems to be far out of my possibilities.

    maybe alex has some idea though?

    BR, georg

  30. Paul Collett reporter

    Ouch, that's not the news I was hoping for. It may be cheaper to buy a replacement than repair. The camera has not ever been allowed to get wet. Could ML have allowed the camera to overheat and fry an on board chip? It just seems like no coincidence that everything works perfect for years on 2.3 Stable until the very day I switch to a new build of ML and go shooting with it.

  31. Georg Hofstetter

    it is unlikely but within range of possibilities. even if the software caused a total lockup, causing maximum heat dissipation, this is just a bit more heat than you have in live view mode normally. if you kept it running hot in an insulated bag for many hours, i am not sure if it will cause such defects. you would for sure have smell of molten plastic then.

    as you said, ML was very unstable and you had to pull the battery. this is not normal either. maybe this was already a sign of the failure coming up.

  32. Paul Collett reporter

    I took it to a local camera store and he said it needs sent in to Canon for repair. I have done some pricing on that, and there is a minimum $190 plus parts. It looks like the mainboard from Canon is $199, so I'm looking at a $389 repair bill. More than what I could replace it for. I might be able to find a used board for less but I don't have the skills to do a replacement myself.

    I can't really afford to replace my camera body but I'm looking on Craigslist for a deal any way. Maybe I'll luck out.

  33. Paul Collett reporter

    Other batteries, other cards, yes - all that stuff. Anyone want a fried T3i?

    I just bought a used 5D Mk II.

  34. Alex

    I'd like to take a closer look at it as well. Can you sent me the same file you sent to g3gg0 last time?

  35. Carlos Martín Carrasco

    How hot was the camera when you get home? Is it possible that magic lantern was doing some operation. The chamber temperature rose too and some component broke?

  36. Paul Collett reporter

    Alex, I can send you the file. Give me an email and I'll share the link privately.

    I tried the LCD Display file and I got three results depending on which time I stuck in the battery. Some times the LED would go on solid until I eject the battery. Sometimes it would blink once then nothing. And sometimes it would do nothing at all. After about 30 tries, occurrence was about 25%, 15%, and 60% of the time respectively.

    Carlos, I'm open to selling the camera body. Make an offer. I also have a 17-40 L and a 24-105 L that are both in like new condition in the box with everything including warranty card.

    If I connect the camera via USB I get a 'device not recognized' error. Temperature may have been a factor with the camera. I frequently record long videos, and was doing that just before it died. I record at a lower bitrate and use the auto restart feature of Magic Lantern to record often for a couple hours at a time. I had never encountered any issues with doing this on the last ML stable version but there may have been something come up with the newer version.

  37. Alex

    I've got the file from g3gg0 last night, so it's no longer needed. There's nothing wrong with the ROM that I could see, property data structures are valid, and the ROM file can be loaded in QEMU and ML runs with it.

    If the display test doesn't work, and gives inconsistent results, I'm afraid it's a hardware issue. That file does not call anything from main firmware (it only uses bootloader routines), so even if the camera would need reflashing, the display test would still work.


  38. Log in to comment