Canon EF lens hackery

Half the info you need is in the blog post, the other half is in the comments below. The only trouble I had was iris control, which I couldn’t get to work on the cheapest Canon kit lenses (though my better lenses all responded fine):


Electronics and hackery, Uncategorized


  1. Hi , i downloaded firmware of EF-S 55-250mm f/4-5.6 IS STM from Canon
    site , i’m planning to reverse it to understand more of Canon Lens protocol ,
    however i have no idea about what MCU is inside EF-S 55-250mm f/4-5.6 IS STM ,
    any help ?

    1. No idea, I’m afraid. You may have more luck following the same route as me: google for as much info as you can, and then just start sending commands to the lens and see what happens. I’ll write up an article with as much of the protocol as I know once I get a chance

  2. Ok , thanks for your reply .
    I just reverse lots of parts of Sigma MC-11 firmware , according to
    code behavior of MC-11 :
    MC-11 send command 0x82 to Canon Lens ,
    Canon Lens then sends lens name text to MC-11 .

    1. Wow, cool, that one’s new to me – I’ll have to add it to my list 🙂 Sounds like you’re more advanced on this sort of thing than me – once I’ve got my breakdown of the protocol (as I understand it) up, I’d appreciate any comments / additions. I’ve got around 10 main commands sussed at the mo, enough to query lens ID, do focus and iris, and get various lens statuses (eg ready for command, motor in motion, at endstop etc).

      Tamron and Sigma had to reverse engineer the protocol, meaning some of their lenses do have difficulties. I wonder how well the Black Magic micro cameras fare, given you can supposedly stick an EF lens on and have full iris and focus control through the camera. Maybe they’ve got the Canon blessing (though they’re in competition, you’d think)

    1. No time to write a proper thing now, but you can see my (really bad) code here:

      Things like 05 and 06 to focus near and far (handy to reset to a known position), 44 nn nn to move focus; 0A to check if lens is ready for a command; 90 B9 to find out if lens is currently moving (if so it’ll accept but ignore any further 44 commands until it’s finished)… and C0 to get the current lens position (which is only a best guess unless you have a 17-55 IS USM in which case it’s pretty damn accurate, as long as you haven’t touched the manual focus ring)

  3. Here is an example of CMD 0x82 response :
    45 46 31 36 2D 33 35 6D 6D 20 66 2F 32 2E 38 4C 20 49 49 55 53 4D 00
    which is string :
    EF16-35mm f/2.8L II USM

Leave a Reply

Your email address will not be published.