Linux

USB protocol used by Canon cameras have been reverse engineered by folks at [http://www.gphoto.org∞ gphoto] to enable using them with Linux. Additionaly, a simple application s10sh has been developed that uses this protocol to send "arbitrary" USB commands to the camera. Using s10sh, it is clear that in addition to CF picture storage drive (C: or D:), two other drives A: and B: are present in the cameras. Drives contains DOS executables that controls many functions of the camera.

After mucking around for a few hours with my 300D, KnoppixLinux-on-CD, and making a few trivial changes to s10sh to support 300D here's what I found on my 300D (v1.1.1 firmware):

Drive	Filename	Filesize	Description
A:\	CAMERA.EXE	391k	DataLight RXE (relocatable executable) containg RXE interrupt handler 0x90, RXE header and jump to 8d00:0000 address (in ROM?). Large data segment with many readable strings.
B:\	CAMERA.EXE	117k	100% 16-bit DOS code
	LOGSAVE.EXE	34k	utility to copy debug log to ?
B:\DATA	NOTHM.JPG	5k	160x120 image of yellow question mark on white-to-black gradient background image. Displayed when thumbnail is not available ?
B:\BOOTDISK	COMMAND.COM	27k	Datalight DOS
	VSSVER.SCC	48 bytes	Source Safe version control file ?
	RESTOOL.EXE	56k	M114 Resource configuration tool
	CAMERA.EXE	6k	Failsafe camera firmware ?
	AUTOEXEC.BAT	10 bytes	adds C:\ (CF card) to the search path

• Contents of S40∞

Windows

CanonSDK is available from Canon that may allow writing applications to access drives A: and B: