Difference between revisions of "Canon PowerShot G9"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
VisualWikitext
m
(moved description of JTAG/UART connector to Hacking section)
 
(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
Teardown of the Canon PowerShot G9 point-and-shoot camera.
 
Teardown of the Canon PowerShot G9 point-and-shoot camera.
  
−
12.1 MP CMOS with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].
+
12.1 MP, 1/1.7" CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007[[File:Canon-powershot-g9.jpg|none|thumb|Canon PowerShot G9|alt=]]A service manual with assembly diagram, but no schematic, can be found [https://elektrotanya.com/canon_powershot_g9.pdf/download.html on the internet].
 +
 
 +
Technical details, including firmware dumps, on the [https://chdk.fandom.com/wiki/G9 CHDK Wiki].
  
 
==Teardown Pictures==
 
==Teardown Pictures==
Line 65: Line 67:
 
CN1002 flat flex to jog dial unit, TOP_M FPC
 
CN1002 flat flex to jog dial unit, TOP_M FPC
  
−
CN1003 unpopulated/undocumented -> JTAG/Serial?
+
CN1003 unpopulated/undocumented -> JTAG/Serial? (see below)
−
 
 
−
*Located near to SD card holder
 
−
*Multiple pads connected to test points
 
  
 
CN1004 USB/digital
 
CN1004 USB/digital
Line 190: Line 189:
  
 
Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET
 
Q582 ROHM '''2SK2715''' 10V drive N-Ch MOSFET
 +
[[File:Canon PowerShot G9 debug header.jpg|thumb|Unpopulated connector CN1003, probably for JTAG and UART]]
 +
 +
== Hacking ==
 +
Unpopulated connector CN1003 located on back of main board
  
−
<br />
+
* Candidate for JTAG and/or UART
 +
* Located near to SD card holder
 +
* Multiple pads connected to test points
 +
* Pin-out likely same as documented [https://web.archive.org/web/20200302085303/https://nada-labs.net/2014/finding-jtag-on-a-canon-elph100hs-ixus115/ here].
 +
<syntaxhighlight lang="c">
 +
      TX  -  _  RX
 +
    GND  -  _  3.3V
 +
    SHDN  -  _  N/C
 +
    N/C  -  _  HALF_BAUD
 +
      PD  -  _  ALT_BOOT
 +
      PD  -  _  /TRST
 +
    TDI  -  _  TMS
 +
    TCK  -  _  TDO
 +
    /OFF  -
 +
</syntaxhighlight>

Latest revision as of 00:02, 9 October 2023

Teardown of the Canon PowerShot G9 point-and-shoot camera.

12.1 MP, 1/1.7" CCD image sensor with 6x IS optical zoom. Released in Oct 2007, PCB date code 29th week of 2007

Canon PowerShot G9

A service manual with assembly diagram, but no schematic, can be found on the internet.

Technical details, including firmware dumps, on the CHDK Wiki.

Teardown Pictures

Main PCB, top view
Main PCB, bottom view
Power PCB, top view
Power PCB, bottom view
Top camera control PCB (mode selection, shutter button, power button, flash control)
Back camera control PCB (jog-wheel, various buttons)
12.1 MP CMOS image sensor

Parts Identification

Assembly diagram of main PCB with component designators

The following parts list references the component designators found in the assembly diagram from the service manual. The list is grouped based on the numbering scheme, with a guess on the function of each group.

Main PCB

CPU/DSP

IC1001 Canon Digic III, and Elpida HB0010A17E-E DDR mobile RAM + NOR flash memory (package on package)

IC1002, IC1003 JRC NJM2877 LDO

  • Marking 7 14 71, 5-pin package

IC1004 marking FA, 5-pin package, LDO?

IC1005 Seiko S-817 series LDO?

  • Marking G8X, 4-pin package

IC1006 Seiko S-817 series LDO?

  • Marking B9O, 4-pin package

IC1007 Seiko Epson RX-4571LC real time clock

  • Marking E4571

SR1001 Landscape/portrait orientation sensor?

Q1003, Q1010, Q1011 Toshiba RN4982FE NPN PNP Transistors with 10K Bias Resistors

  • Marking 6B, 6-pin package

Q1005, Q1007, Q1008 Toshiba RN1902FE Dual NPN Transistors with 10K Bias Resistors

  • Marking XB, 6-pin package

Q1012 Toshiba RN4984FE NPN PNP Transistors with 47K Bias Resistors

  • Marking 6D, 6-pin package

D1001 Panasonic MA2S111 Switching Diode

  • Marking A, 2-pin package (silver)

D1002 Panasonic MA3S132E Dual Switching diodes

  • Marking MU, 3-pin package

CN1001 flat flex to DC/DC PCB

CN1002 flat flex to jog dial unit, TOP_M FPC

CN1003 unpopulated/undocumented -> JTAG/Serial? (see below)

CN1004 USB/digital

CN1005 SD card holder

SW1001 switch, battery cover open detect

CCD Interface

IC2002, IC2003 JRC NJM2877 LDO

  • 5-bin package

IC2004 marking 11 77 41, 6-pin package

IC2005 Sony D4807GA analog frontend

IC2006 marking AED3, 5-pin package

IC2008 JRC NJM2877 LDO

  • 5-pin package

IC2009 not populated

  • 5-pin package

CN2001 connector for image sensor assembly

Lens Motor Driver

IC3001 Toshiba TB6609FL motor driver?

IC3002 Toshiba TB6552FNG Dual-Bridge Driver for DC Motors

CN3001 flat flex to lens assembly (zoom, focus, aperture, etc.)

Image Stabilization

IC3201 Renesas(?) R2J30504 725104

  • CK4-1105: Canon part number?
  • Similar IC with part number R2J3050x was found in Sony W120, Canon PowerShot A3100 IS

SR3201, SR3202 Murata ENC-03 series, angular rate sensors

  • 1x ENC-03RC-R and 1x ENC-03RD-R

LCD Driver

IC4001 15019GB 7CR0G 070 LCD power? Driver?

CN4001 LCD panel

CN4002 LCD backlight

Audio/Video

IC4501 Wolfson WM1400G Audio driver/Codec

IC4502 JRC NJM2571 Low Voltage Video Amplifier with LPF

  • Marking A51, 6-pin package

IC4503 unpopulated

CN4501 Microphone

CN4502 A/V out

Mystery

Low resolution die image of mystery IC502

The function of this section, and its main chip IC502 is unclear.

IC501 JRC NJM2877 LDO

  • marking 7 12 62, 5-pin package

IC502 the Mystery IC

  • Transparent package
  • The big black area of this IC looks like a light sensor. However, in the assembled camera, the chip is facing inwards towards the battery compartment.

Q501 SOT23-6 marking FM

ZD501 marking R, reverse biased

Power PCB

IC601 FE 7761R multi-output DC-DC power management controller

IC691 Seiko S-817 series LDO?

  • Marking CUW, 4-pin package

BAT691 Seiko Instruments MS614S 3V rechargeable Li-Ion battery

CN601 battery connector

CN651 flat flex to main PCB

Top Camera Control FPC

Button controls

CN251 to TOP_I FPC

D251, D252, 254, D255 Panasonic MA4Z159 Dual Switching Diodes

  • Marking M1B, 4-pin package

D253 Panasonic MA3S132E Dual Switching diodes

  • Also 4x on rotary dial FPC
  • Marking MU, 3-pin package (silver)

D? Panasonic MA2S111 Switching Diode

  • 1x rotary dial FPC
  • Marking A, 2-pin package (silver)

Power? Flash?

Q581 Toshiba RN4984FE NPN PNP Transistors with 47K Bias Resistors

  • Marking 6D, 6-pin package

Q582 ROHM 2SK2715 10V drive N-Ch MOSFET

Unpopulated connector CN1003, probably for JTAG and UART

Hacking

Unpopulated connector CN1003 located on back of main board

  • Candidate for JTAG and/or UART
  • Located near to SD card holder
  • Multiple pads connected to test points
  • Pin-out likely same as documented here.
      TX  -  _  RX
     GND  -  _  3.3V
    SHDN  -  _  N/C
     N/C  -  _  HALF_BAUD
      PD  -  _  ALT_BOOT
      PD  -  _  /TRST
     TDI  -  _  TMS
     TCK  -  _  TDO
    /OFF  -
Retrieved from "https://wiki.recessim.com/w/index.php?title=Canon_PowerShot_G9&oldid=2034"