Skip to main content
Electronics and hackeryUncategorized

Canon EF lens hackery

By May 11, 2015April 12th, 20228 Comments

8 Comments

  • leegong says:

    Hi , i downloaded firmware of EF-S 55-250mm f/4-5.6 IS STM from Canon
    site , i’m planning to reverse it to understand more of Canon Lens protocol ,
    however i have no idea about what MCU is inside EF-S 55-250mm f/4-5.6 IS STM ,
    any help ?

    • h says:

      No idea, I’m afraid. You may have more luck following the same route as me: google for as much info as you can, and then just start sending commands to the lens and see what happens. I’ll write up an article with as much of the protocol as I know once I get a chance

  • leegong says:

    Ok , thanks for your reply .
    I just reverse lots of parts of Sigma MC-11 firmware , according to
    code behavior of MC-11 :
    MC-11 send command 0x82 to Canon Lens ,
    Canon Lens then sends lens name text to MC-11 .

    • h says:

      Wow, cool, that one’s new to me – I’ll have to add it to my list 🙂 Sounds like you’re more advanced on this sort of thing than me – once I’ve got my breakdown of the protocol (as I understand it) up, I’d appreciate any comments / additions. I’ve got around 10 main commands sussed at the mo, enough to query lens ID, do focus and iris, and get various lens statuses (eg ready for command, motor in motion, at endstop etc).

      Tamron and Sigma had to reverse engineer the protocol, meaning some of their lenses do have difficulties. I wonder how well the Black Magic micro cameras fare, given you can supposedly stick an EF lens on and have full iris and focus control through the camera. Maybe they’ve got the Canon blessing (though they’re in competition, you’d think)

  • leegong says:

    My wild guessing , CMD90 probably may turn image stabilization on .

    • h says:

      No time to write a proper thing now, but you can see my (really bad) code here: https://github.com/howiemnet/h-moco-LENS-Arduino/blob/master/ControlCanonLens.cpp

      Things like 05 and 06 to focus near and far (handy to reset to a known position), 44 nn nn to move focus; 0A to check if lens is ready for a command; 90 B9 to find out if lens is currently moving (if so it’ll accept but ignore any further 44 commands until it’s finished)… and C0 to get the current lens position (which is only a best guess unless you have a 17-55 IS USM in which case it’s pretty damn accurate, as long as you haven’t touched the manual focus ring)

  • leegong says:

    Here is an example of CMD 0x82 response :
    45 46 31 36 2D 33 35 6D 6D 20 66 2F 32 2E 38 4C 20 49 49 55 53 4D 00
    which is string :
    EF16-35mm f/2.8L II USM

Leave a Reply to h Cancel Reply