1 #include "lolevel.h"
2 #include "platform.h"
3 #include "core.h"
4 #include "conf.h"
5
6 //IXUS 1000 102B
7 // mwvent82: taken from reference sub 100D and adjusted what needs to be adjusted
8 // most location labels are left as 100D with the 'real' 102B locations commented in some cases
9
10 static long *nrflag = (long*)0xDDA8; // -> ASM1989 11.06.2010 found at FFAE3478 in s95:FFAF9528 in sx210: FF972F10
11
12 #include "../../../generic/capt_seq.c"
13
14 //ASM1989 Started :FF883630 in sx210: FF87EB90
15 void __attribute__((naked,noinline)) capt_seq_task() {
16 // _sub_FF88365C__SsShootTask.c__13 ROM FF88365C 00000274 R . . . . . .
17 asm volatile (
18 "STMFD SP!, {R3-R7,LR}\n"
19 "LDR R7, =0x3474\n" // In sx200 was: 0x2B78
20 "LDR R4, =0x3C5E4\n" // In sx200 was: 0x15448
21 "MOV R6, #0\n"
22 "loc_FF883640:\n" // loc_FF88366C in 102B
23 "LDR R0, [R7,#4]\n"
24 "MOV R2, #0\n"
25 "MOV R1, SP\n"
26 "BL sub_FF83AE20\n" // same as 100D
27 "TST R0, #1\n"
28 "BEQ loc_FF88366C\n" // loc_FF883698 in 102B
29 "LDR R1, =0x43F\n"
30 "LDR R0, =0xFF8831C8\n" //aSsshoottask_c // changed from 0xFF88319C in 100D
31 "BL sub_FF81EB78\n" //DebugAssert // unchanged from 100D
32 "BL sub_FF81EB30\n" //eventproc_export_ExitTask // unchanged from 100D
33 "LDMFD SP!, {R3-R7,PC}\n"
34
35 "loc_FF88366C:\n" // loc_FF883698 in 102B
36 "LDR R0, [SP]\n"
37 "LDR R1, [R0]\n"
38 "CMP R1, #0x1F\n"
39 "ADDLS PC, PC, R1,LSL#2\n"
40 "B loc_FF883868\n" // loc_FF883894 in 102B
41
42 "loc_FF883680:\n" // loc_FF8836AC
43 "B loc_FF883700\n" // loc_FF88372C
44 "loc_FF883684:\n" // loc_FF8836B0
45 "B loc_FF883718\n" // loc_FF883744
46 "loc_FF883688:\n" // loc_FF8836B4
47 "B loc_FF883730\n" // loc_FF88375C
48 "loc_FF88368C:\n" // loc_FF8836B8
49 "B loc_FF883744\n" // loc_FF883770
50 "loc_FF883690:\n" // loc_FF8836BC
51 "B loc_FF88373C\n" // loc_FF883768
52 "loc_FF883694:\n" // loc_FF8836C0
53 "B loc_FF883750\n" // loc_FF88377C
54 "loc_FF883698:\n" // loc_FF8836C4
55 "B loc_FF883758\n" // loc_FF883784
56 "loc_FF88369C:\n" // loc_FF8836C8
57 "B loc_FF883760\n" // loc_FF88378C
58 "loc_FF8836A0:\n" // loc_FF8836CC
59 "B loc_FF88376C\n" // loc_FF883798
60 "loc_FF8836A4:\n" // loc_FF8836D0
61 "B loc_FF883794\n" // loc_FF8837C0
62 "loc_FF8836A8:\n" // loc_FF8836D4
63 "B loc_FF883778\n" // loc_FF8837A4
64 "loc_FF8836AC:\n" // loc_FF8836D8
65 "B loc_FF883784\n" // loc_FF8837B0
66 "loc_FF8836B0:\n" // loc_FF8836DC
67 "B loc_FF88378C\n" // loc_FF8837B8
68 "loc_FF8836B4:\n" // loc_FF8836E0
69 "B loc_FF88379C\n" // loc_FF8837C8
70 "loc_FF8836B8:\n" // loc_FF8836E4
71 "B loc_FF8837A4\n" // loc_FF8837D0
72 "loc_FF8836BC:\n" // loc_FF8836E8
73 "B loc_FF8837AC\n" // loc_FF8837D8
74 "loc_FF8836C0:\n" // loc_FF8836EC
75 "B loc_FF8837B4\n" // loc_FF8837E0
76 "loc_FF8836C4:\n" // loc_FF8836F0
77 "B loc_FF8837BC\n" // loc_FF8837E8
78 "loc_FF8836C8:\n" // loc_FF8836F4
79 "B loc_FF8837C8\n" // loc_FF8837F4
80 "loc_FF8836CC:\n" // loc_FF8836F8
81 "B loc_FF8837D0\n" // loc_FF8837FC
82 "loc_FF8836D0:\n" // loc_FF8836FC
83 "B loc_FF8837D8\n" // loc_FF883804
84 "loc_FF8836D4:\n" // loc_FF883700
85 "B loc_FF8837E0\n" // loc_FF88380C
86 "loc_FF8836D8:\n" // loc_FF883704
87 "B loc_FF8837E8\n" // loc_FF883814
88 "loc_FF8836DC:\n" // loc_FF883708
89 "B loc_FF8837F4\n" // loc_FF883820
90 "loc_FF8836E0:\n" // loc_FF88370C
91 "B loc_FF8837FC\n" // loc_FF883828
92 "loc_FF8836E4:\n" // loc_FF883710
93 "B loc_FF883804\n" // loc_FF883830
94 "loc_FF8836E8:\n" // loc_FF883714
95 "B loc_FF88380C\n" // loc_FF883838
96 "loc_FF8836EC:\n" // loc_FF883718
97 "B loc_FF883814\n" // loc_FF883840
98 "loc_FF8836F0:\n" // loc_FF88371C
99 "B loc_FF88381C\n" // loc_FF883848
100 "loc_FF8836F4:\n" // loc_FF883720
101 "B loc_FF883824\n" // loc_FF883850
102 "loc_FF8836F8:\n" // loc_FF883724
103 "B loc_FF883830\n" // loc_FF88385C
104 "loc_FF8836FC:\n" // loc_FF883728
105 "B loc_FF883874\n" // loc_FF8838A0
106 "loc_FF883700:\n" // loc_FF88372C
107 "BL shooting_expo_param_override\n" // +
108 "BL sub_FF883DB4\n" // changed from FF883D88 in 100D
109 "BL shooting_expo_param_override\n" // +
110 "BL sub_FF880F50\n" // changed from FF880F24 in 100D
111
112 // copied over from SX10 don't know if we need it yet
113 // this code added to avoid some incorrect behavior if overrides are used.
114 // but it can cause some unexpected side effects. In this case, remove this code!
115
116 "MOV R0, #0\n"
117 "STR R0, [R4,#0x24]\n" // fixes overrides behavior at short shutter press
118 // end of my code
119 "LDR R0, [R4,#0x24]\n"
120 "CMP R0, #0\n"
121
122 //TIL HERE ixus1000 then changes a lot !!!
123
124 //all this should not be here:
125
126 //"BLNE sub_FF98ADD4\n" // This is a potential my sub like the FF972EFC but starting some line earlier
127
128 "BLNE sub_FF98ADD4_my\n" // This is a potential my sub like the FF972EFC but starting some line earlier // sub_FF883DB4 in 102B
129 //---------------->
130 // "BL capt_seq_hook_raw_here\n" // +
131
132 "B loc_FF883874\n" // loc_FF8838A0 in 102B
133 "loc_FF883718:\n" // loc_FF883744 in 102B
134 "LDRH R1, [R4]\n"
135 "SUB R12, R1, #0x8200\n"
136 "SUBS R12, R12, #0x2E\n"
137 "LDRNE R0, [R0,#0xC]\n"
138 // "BLNE sub_FF98AB68\n"
139 "BLNE sub_FF98AB68_my\n" // 100 D was 68 // _sub_FF98AC1C__SsCaptureSeq.c__195 in 102b
140 //---------------->
141 // "BL capt_seq_hook_raw_here\n" // +
142
143
144 "B loc_FF883874\n" // loc_FF8838A0 in 102B
145 "loc_FF883730:\n" // loc_FF88375C in 102B
146 "MOV R0, #1\n"
147 "BL sub_FF884070\n" // changed from FF884044 in 100D
148 "B loc_FF883874\n" // loc_FF8838A0 in 102B
149 "loc_FF88373C:\n" // loc_FF883768
150 "BL sub_FF883A54\n" // changed from FF883A28 in 100D
151 "B loc_FF883748\n" // loc_FF883774 in 102B
152 "loc_FF883744:\n" // loc_FF883770
153 "BL sub_FF883D94\n" // chnaged from sub_FF883D68 in 100D
154 "loc_FF883748:\n" // loc_FF883774 in 102B
155 "STR R6, [R4,#0x24]\n"
156 "B loc_FF883874\n" // loc_FF8838A0 in 100D
157 "loc_FF883750:\n" // loc_FF88377C in 102B
158 "BL sub_FF883D9C\n" // changed from sub_FF883D70 in 100D
159 "B loc_FF883874\n" // loc_FF8838A0 in 102B
160
161 "loc_FF883758:\n" // loc_FF883784 in 102B
162 "BL sub_FF883F74\n" // changed from sub_FF883F48 in 100D
163 "B loc_FF883770\n" // loc_FF88379C in 102B
164 "loc_FF883760:\n" // loc_FF88378C
165 "LDR R0, [R0,#0xC]\n"
166 "BL sub_FF98AEE8\n" // changed from sub_FF98AE34 in 100D
167 "B loc_FF883874\n" // loc_FF8838A0
168 "loc_FF88376C:\n" // loc_FF883798
169 "BL sub_FF883FE0\n" // chnaged from sub_FF883FB4 in 100D
170 "loc_FF883770:\n" // loc_FF88379C
171 "BL sub_FF880F50\n" // changed from sub_FF880F24 in 100D
172 "B loc_FF883874\n" // loc_FF8838A0
173 "loc_FF883778:\n" // loc_FF8837A4
174 "LDR R0, [R4,#0x54]\n"
175 "BL sub_FF8846DC\n" // changed from sub_FF8846B0 in 100D
176 "B loc_FF883874\n" // loc_FF8838A0
177 "loc_FF883784:\n" // loc_FF8837B0
178 "BL sub_FF884A78\n" // changed from sub_FF884A4C in 100D
179 "B loc_FF883874\n" // loc_FF8838A0
180 "loc_FF88378C:\n" // loc_FF8837B8
181 "BL sub_FF884ADC\n" // changed from sub_FF884AB0 in 100D
182 "B loc_FF883874\n" // loc_FF8838A0
183 "loc_FF883794:\n" // loc_FF8837C0
184 "BL sub_FF883D94\n" // changed from sub_FF883D68 in 100D
185 "B loc_FF883874\n" // loc_FF8838A0
186 "loc_FF88379C:\n" // loc_FF8837C8
187 "BL sub_FF98A268\n" // changed from sub_FF98A1B4 in 100D
188 "B loc_FF883874\n" // loc_FF8838A0
189 "loc_FF8837A4:\n" // loc_FF8837D0
190 "BL sub_FF98A474\n" // sub_FF98A3C0
191 "B loc_FF883874\n" // loc_FF8838A0
192 "loc_FF8837AC:\n" // loc_FF8837D8
193 "BL sub_FF98A518\n" // changed from sub_FF98A464 in 100D
194 "B loc_FF883874\n" // loc_FF8838A0
195 "loc_FF8837B4:\n" // loc_FF8837E0
196 "BL sub_FF98A5E8\n" // changed from sub_FF98A534 in 100D
197 "B loc_FF883874\n" // loc_FF8838A0
198 "loc_FF8837BC:\n" // loc_FF8837E8
199 "MOV R0, #0\n"
200 "BL sub_FF98A848\n" // changed from sub_FF98A794 in 100D
201 "B loc_FF883874\n" // loc_FF8838A0
202 "loc_FF8837C8:\n" // loc_FF8837F4
203 "BL sub_FF98A9A4\n" // changed from sub_FF98A8F0 in 100D
204 "B loc_FF883874\n" // loc_FF8838A0
205 "loc_FF8837D0:\n" // loc_FF8837FC
206 "BL sub_FF98AA48\n" // changed from sub_FF98A994 in 100D
207 "B loc_FF883874\n" // loc_FF8838A0
208 "loc_FF8837D8:\n" // loc_FF883804
209 "BL sub_FF98AB28\n" // changed from sub_FF98AA74 in 100D
210 "B loc_FF883874\n" // loc_FF8838A0
211 "loc_FF8837E0:\n" // loc_FF88380C
212 "BL sub_FF884258\n" // sub_FF88422C
213 "B loc_FF883874\n" // loc_FF8838A0
214 "loc_FF8837E8:\n" // loc_FF883814
215 "BL sub_FF884304\n" // sub_FF8842D8
216 "BL sub_FF98BBA8\n" // sub_FF98BAF4
217 "B loc_FF883874\n" // loc_FF8838A0
218 "loc_FF8837F4:\n" // loc_FF883820
219 "BL sub_FF98A6B4\n" // sub_FF98A600
220 "B loc_FF883874\n" // loc_FF8838A0
221 "loc_FF8837FC:\n" // loc_FF883828
222 "BL sub_FF98A71C\n" // sub_FF98A668
223 "B loc_FF883874\n" // loc_FF8838A0
224 "loc_FF883804:\n" // loc_FF883830
225 "BL sub_FF98BC78\n" // sub_FF98BBC4
226 "B loc_FF883874\n" // loc_FF8838A0
227 "loc_FF88380C:\n" // loc_FF883838
228 "BL sub_FF838C50\n" // unchanged from 100D
229 "B loc_FF883874\n" // loc_FF8838A0
230 "loc_FF883814:\n" // loc_FF883840
231 "BL sub_FF886E18\n" // sub_FF886DEC
232 "B loc_FF883874\n" // loc_FF8838A0
233 "loc_FF88381C:\n" // loc_FF883848
234 "BL sub_FF886EA0\n" // sub_FF886E74
235 "B loc_FF883874\n" // loc_FF8838A0
236 "loc_FF883824:\n" // loc_FF883850
237 "BL sub_FF886EFC\n" // sub_FF886ED0
238 "BL sub_FF886EBC\n" // sub_FF886E90
239 "B loc_FF883874\n" // loc_FF8838A0
240 "loc_FF883830:\n" // loc_FF88385C
241 "MOV R0, #1\n"
242 "BL sub_FF98B6E4\n" // sub_FF98B630
243 "MOV R0, #1\n"
244 "BL sub_FF98B814\n" // sub_FF98B760
245 "LDRH R0, [R4,#0x94]\n"
246 "CMP R0, #4\n"
247 "LDRNEH R0, [R4]\n"
248 "SUBNE R12, R0, #0x8200\n"
249 "SUBNES R12, R12, #0x2A\n"
250 "BNE loc_FF883874\n" // loc_FF8838A0 in 102B
251 "BL sub_FF886EA0\n" // changed from sub_FF886E74 in 100D
252 "BL sub_FF88740C\n" // changed from sub_FF8873E0 in 100D
253 "BL sub_FF88731C\n" // changed from sub_FF8872F0 in 100D
254 "B loc_FF883874\n" // loc_FF8838A0
255 "loc_FF883868:\n" // loc_FF883894
256 "LDR R1, =0x591\n"
257 "LDR R0, =0xFF8831C8\n" //aSsshoottask_c // changed from 0xFF88319C in 100D
258 "BL sub_FF81EB78\n" //DebugAssert
259 "loc_FF883874:\n" // loc_FF8838A0
260 "LDR R0, [SP]\n"
261 "LDR R1, [R0,#4]\n"
262 "LDR R0, [R7]\n"
263 "BL sub_FF88DBB8\n" // changed from sub_FF88DB8C in 100D
264 "LDR R5, [SP]\n"
265 "LDR R0, [R5,#8]\n"
266 "CMP R0, #0\n"
267 "LDREQ R1, =0x115\n"
268 "LDREQ R0, =0xFF8831C8\n" //aSsshoottask_c "ADREQ R0, aSsshoottask_c ; "SsShootTask.c // changed from 0xFF88319C in 100D
269 "BLEQ sub_FF81EB78\n" //DebugAssert
270 "STR R6, [R5,#8]\n"
271 "B loc_FF883640\n" // loc_FF88366C in 102B
272
273
274
275
276
277
278 // looks like the nr stuff is sub_FFAE3304
279
280
281
282 );
283 } // ASM 1989 Done 11.11.10
284
285 //100F needs check
286
287
288 // For the 1st raw stuff
289 void __attribute__((naked,noinline)) sub_FF98ADD4_my() {
290 // sub_FF98AE88 in 102B
291 asm volatile (
292 "STMFD SP!, {R4-R6,LR}\n"
293 "BL sub_FF882E98\n" // changed from sub_FF882E6C in 100D
294 "MOV R4, R0\n"
295 "LDR R0, =0x3C5E4\n"
296 "LDR R5, =0x7C94\n" //F: 0x7C94 // changed from 0x7C8C in 100D
297 "LDR R0, [R0,#0x24]\n"
298 "MOV R6, #1\n"
299 "CMP R0, #0\n"
300 "BEQ loc_FF98AE18\n" //F: 1C // loc_FF98AECC in 102B
301 "MOV R0, #0xC\n"
302 "BL sub_FF888998\n" // changed from sub_FF88896C in 100D
303 "TST R0, #1\n"
304 "STRNE R6, [R5]\n"
305 "LDRNE R0, [R4,#8]\n"
306 "ORRNE R0, R0, #0x40000000\n"
307 "STRNE R0, [R4,#8]\n"
308 "LDMNEFD SP!, {R4-R6,PC}\n"
309 "loc_FF98AE18:\n" // loc_FF98AECC in 102B
310 "MOV R0, R4\n"
311 "BL sub_FFAE2DF8\n" //F: 0C // changed from sub_FFAE2D08 in 100D
312 "MOV R0, R4\n"
313 //"BL sub_FFAE37CC\n" //F: D0
314 "BL sub_FFAE37CC_my\n" // sub_FFAE38BC in 102B
315 //---------------->
316
317 // "BL capt_seq_hook_raw_here\n" // added
318 "TST R0, #1\n"
319 "TST R0, #1\n"
320 "STRNE R6, [R5]\n"
321 "LDMFD SP!, {R4-R6,PC}\n"
322 );
323 }
324
325 //First BL for the nr stuff
326 void __attribute__((naked,noinline)) sub_FFAE37CC_my() {
327 asm volatile (
328 "STMFD SP!, {R2-R8,LR}\n"
329 "MOV R6, R0\n"
330 "BL sub_FF98B9D8\n" //f: 28 // 100D : sub_FF98B924
331 //"MOVL R1, 0xFFFFFFFF\n"
332 "MVN R1, #0 \n" // mwvent82: TODO NOT in 102B firware should I remove this?
333 "BL sub_FF88DBEC\n" // 100D: sub_FF88DBC0
334 "LDR R0, =0xFFAE3034\n" //F: 48 100D: 0xFFAE2F44
335 "MOV R1, R6\n"
336 "BL sub_FF8C25D0\n" // 100D: sub_FF8C25A4
337 "MOV R0, R6\n"
338 "BL sub_FFAE2EFC\n" //F: 10 // 100D: sub_FFAE2E0C
339 "MOV R0, R6\n"
340 // "BL sub_FFAE3304\n" //F: 08
341 "BL sub_FFAE3304_my\n" // 102B : sub_FFAE33F4
342 "B sub_FFAE38EC\n" // continue func in firmware needs to be tested // 100D: sub_FFAE37FC
343 );
344 }
345
346
347 //NR stuff goes here needs to be tested
348 void __attribute__((naked,noinline)) sub_FFAE3304_my() {
349 // sub_FFAE33F4 in 102B
350 asm volatile (
351 "STMFD SP!, {R0-R8,LR}\n"
352 "MOV R4, R0\n"
353 "MOV R0, #0\n"
354 "MOV R7, #1\n"
355 "LDR R5, =0x3C6B4\n"
356 "STR R7, [SP,#0x8]\n"
357 "STR R0, [SP,#0xC]\n"
358 "LDR R6, =0x3C5E4\n"
359 "LDR R3, [R5]\n"
360 "LDRSH R2, [R5,#0xC]\n"
361 "LDRSH R1, [R5,#0xE]\n"
362 "LDR R0, [R6,#0x88]\n"
363 "BL sub_FF945014\n" // 100D: sub_FF944FC8
364 "BL sub_FF868328\n" //GetCCDTemperature 100D: sub_FF8682FC
365 "LDR R2, =0xDDA8\n" //F: DDB0
366 "ADD R3, SP, #0xC\n"
367 "STRH R0, [R4,#0xAC]\n"
368 "STRD R2, [SP]\n"
369 "MOV R1, R0\n"
370 "LDRH R0, [R6,#0x5C]\n"
371 "LDRSH R2, [R5,#0xC]\n"
372 "ADD R3, SP, #0x8\n"
373 "BL sub_FF98D61C\n" //NRTable.c F: 6C 100D: sub_FF98D568
374 //TESTing enable latter!
375 // "BL wait_until_remote_button_is_released\n"
376 "BL capt_seq_hook_set_nr\n"
377 "B sub_FFAE3450\n" // continue function in firmware 100D: sub_FFAE3360
378 );
379 }
380
381 // For the 2nd raw stuff
382 void __attribute__((naked,noinline)) sub_FF98AB68_my() {
383 // sub_FF98AC1C__SsCaptureSeq.c__195 in 102b
384 asm volatile (
385 "STMFD SP!, {R3-R7,LR}\n"
386 "LDR R5, =0x3C5E4\n"
387 "MOV R4, R0\n"
388 "LDR R0, [R5,#0x24]\n"
389 "LDR R6, =0x820C\n"
390 "CMP R0, #0\n"
391 "MOV R7, #0\n"
392 "BNE loc_FF98AC14\n" //F: 18 102B: loc_FF98ACC8
393 "LDR R0, [R5,#0xB8]\n"
394 "CMP R0, #1\n"
395 "BNE loc_FF98ABF0\n" //F: F4 102B: loc_FF98ACA4
396 "LDRH R0, [R5]\n"
397 "CMP R0, R6\n"
398 "LDRNEH R0, [R5,#0x92]\n"
399 "CMPNE R0, #3\n"
400 "LDRNE R0, [R4,#0xC]\n"
401 "CMPNE R0, #1\n"
402 "BLS loc_FF98ABC4\n" //F:C8 102B: loc_FF98AC78
403 "BL sub_FF833020\n" // unchanged from 100D
404 "TST R0, #1\n"
405 "BEQ loc_FF98AC14\n" //F: 18 102B: loc_FF98ACC8
406 "BL sub_FF8889F8\n" // 100D: sub_FF8889CC
407 "B loc_FF98AC00\n" //F: 04 ..... 102B: loc_FF98ACB4
408 "loc_FF98ABC4:\n" // loc_FF98AC78
409 "MOV R0, #0xC\n"
410 "BL sub_FF888998\n" // 100D: sub_FF88896C
411 "TST R0, #1\n"
412 "BEQ loc_FF98AC14\n" // 102B: loc_FF98ACC8
413 "MOV R2, R4\n"
414 "MOV R1, #1\n"
415 "MOV R0, #1\n"
416 "BL sub_FF881914\n" // 100D: sub_FF8818E8
417 "BL sub_FF98B56C\n" // 100D: sub_FF98B4B8
418 "BL sub_FF88163C\n" // 100D: sub_FF881610
419 "LDMFD SP!, {R3-R7,PC}\n"
420 "loc_FF98ABF0:\n" // loc_FF98ACA4
421 "MOV R0, #0xC\n"
422 "BL sub_FF888998\n" // 100D: sub_FF88896C
423 "TST R0, #1\n"
424 "BEQ loc_FF98AC14\n" // 102B: loc_FF98ACC8
425 "loc_FF98AC00:\n" // loc_FF98ACB4
426 "MOV R2, R4\n"
427 "MOV R1, #1\n"
428 "MOV R0, #1\n"
429 "BL sub_FF881914\n" // 100D: sub_FF8818E8
430 "LDMFD SP!, {R3-R7,PC}\n"
431 "loc_FF98AC14:\n" // 102B: loc_FF98ACC8
432 "LDR R0, [R4,#8]\n"
433 "ORR R0, R0, #1\n"
434 "STR R0, [R4,#8]\n"
435 "LDRH R0, [R5]\n"
436 "CMP R0, R6\n"
437 "BEQ loc_FF98ACA0\n" // 102B: loc_FF98AD54
438 "LDRH R0, [R5,#0x92]\n"
439 "CMP R0, #3\n"
440 "BEQ loc_FF98ACE8\n" // 102B: loc_FF98AD9C
441 "LDR R0, [R4,#0xC]\n"
442 "CMP R0, #1\n"
443 "BLS loc_FF98ACAC\n" // 102B: loc_FF98AD60
444 "LDRH R0, [R5,#0x90]\n"
445 "CMP R0, #0\n"
446 "BNE loc_FF98ACE8\n" // 102B: loc_FF98AD9C
447 "LDRH R0, [R5,#0x8C]\n"
448 "CMP R0, #2\n"
449 "BNE loc_FF98ACB8\n" // 102B: loc_FF98AD6C
450 "BL sub_FF8843C8\n" // 100D: sub_FF88439C
451 "LDRH R0, [R5]\n"
452 "CMP R0, R6\n"
453 "BEQ loc_FF98ACA0\n" // 102B: loc_FF98AD54
454 "LDRH R0, [R5,#0x92]\n"
455 "CMP R0, #3\n"
456 "BEQ loc_FF98ACE8\n" // 102B: loc_FF98AD9C
457 "LDR R0, [R4,#0xC]\n"
458 "CMP R0, #1\n"
459 "BLS loc_FF98ACAC\n" // 102B: loc_FF98AD60
460 "LDRH R0, [R5,#0x90]\n"
461 "CMP R0, #0\n"
462 "BNE loc_FF98ACE8\n" // 102B: loc_FF98AD9C
463 "LDRH R0, [R5,#0x8C]\n"
464 "CMP R0, #2\n"
465 "BEQ loc_FF98ACE4\n" // 102B: loc_FF98AD98
466 "B loc_FF98ACB8\n" // 102B: loc_FF98AD6C
467 "loc_FF98ACA0:\n" // 102B: loc_FF98AD54
468 "LDRH R0, [R5,#0x92]\n"
469 "CMP R0, #3\n"
470 "BEQ loc_FF98ACE8\n" // loc_FF98AD9C
471 "loc_FF98ACAC:\n" // loc_FF98AD60
472 "LDRH R0, [R5,#0x90]\n"
473 "CMP R0, #0\n"
474 "BNE loc_FF98ACE8\n" // loc_FF98AD9C
475 "loc_FF98ACB8:\n" // loc_FF98AD6C
476 "LDRH R0, [R5,#0x8C]\n"
477 "CMP R0, #1\n"
478 "BNE loc_FF98ACE8\n" // loc_FF98AD9C
479 "LDRH R0, [R5]\n"
480 "CMP R0, R6\n"
481 "LDRNE R0, [R4,#0xC]\n"
482 "CMPNE R0, #1\n"
483 "BLS loc_FF98ACE8\n" // loc_FF98AD9C
484 "LDR R0, [R4,#0x10]\n"
485 "CMP R0, #1\n"
486 "BNE loc_FF98ACE8\n" // loc_FF98AD9C
487 "loc_FF98ACE4:\n" // loc_FF98AD98
488 "BL sub_FF98BCB0\n" // 100D: sub_FF98BBFC
489 "loc_FF98ACE8:\n" // loc_FF98AD9C
490 "BL sub_FF98BC78\n" // 100D: sub_FF98BBC4
491 "BL sub_FF883DA4\n" // 100D: sub_FF883D78
492 "LDR R0, [R5,#0x24]\n"
493 "CMP R0, #0\n"
494 "BNE loc_FF98ADB4\n" // 102B: loc_FF98AE68
495 "MOV R0, R4\n"
496 "BL sub_FFAE2E70\n" // 100D: sub_FFAE2D80
497 "TST R0, #1\n"
498 "LDMNEFD SP!, {R3-R7,PC}\n"
499 "MOV R0, R4\n"
500 "BL sub_FFAE330C\n" // 100D: sub_FFAE321C
501 "BL sub_FF98B4AC\n" // 100D: sub_FF98B3F8
502 "LDR R0, [R5,#0xB8]\n"
503 "CMP R0, #1\n"
504 "BNE loc_FF98AD40\n" // 102B: loc_FF98ADF4
505 "LDRH R0, [R5]\n"
506 "CMP R0, R6\n"
507 "LDRNEH R0, [R5,#0x92]\n"
508 "CMPNE R0, #3\n"
509 "LDRNE R0, [R4,#0xC]\n"
510 "CMPNE R0, #1\n"
511 "BHI loc_FF98AD48\n" // 102B: loc_FF98ADFC
512 "loc_FF98AD40:\n" // loc_FF98ADF4
513 "MOV R0, #2\n"
514 "BL sub_FF87F4D0\n" // 100D: sub_FF87F4A4
515 "loc_FF98AD48:\n" // loc_FF98ADFC
516 "LDRH R0, [R5]\n"
517 "SUB R12, R0, #0x8200\n"
518 "SUBS R12, R12, #0x2D\n"
519 "BNE loc_FF98ADA4\n" // 102B: loc_FF98AE58
520 "MOV R5, #1\n"
521 "MOV R2, #2\n"
522 "ADD R0, R2, #0x15C\n"
523 "MOV R1, SP\n"
524 "STR R5, [SP]\n"
525 "BL sub_FF895DE8\n" //GetPropertyCase 100D: sub_FF895DBC
526 "TST R0, #1\n"
527 "MOVNE R1, #0xC3\n"
528 "LDRNE R0, =0xFF98AFAC \n" //ADRNE R0, aSscaptureseq_c ; // 100D: 0xFF98AEF8
529 "BLNE sub_FF81EB78\n" //DebugAssert
530 "LDRH R0, [SP]\n"
531 "CMP R0, #1\n"
532 "BLS loc_FF98AD9C\n" // 102B: loc_FF98AE50
533 "MOV R0, R4\n"
534 "STR R5, [R4,#0xE4]\n"
535 "BL sub_FFAE3DCC\n" //_SsGISCaptureSeq.c // 100D: sub_FFAE3CDC
536 "B loc_FF98ADAC\n" // 100D: loc_FF98AE60
537 "loc_FF98AD9C:\n" // loc_FF98AE50
538 "MOV R0, #0\n"
539 "STR R0, [R4,#0xE4]\n"
540 "loc_FF98ADA4:\n" // loc_FF98AE58
541 "MOV R0, R4\n"
542 //"BL sub_FFAE37CC\n"
543 "BL sub_FFAE37CC_my\n" // sub_FFAE38BC in 102B
544 //---------------->
545 "BL capt_seq_hook_raw_here\n" // added
546 "loc_FF98ADAC:\n" // loc_FF98AE60
547 "MOV R7, R0\n"
548 "B loc_FF98ADC4\n" // loc_FF98AE78
549 "loc_FF98ADB4:\n" // loc_FF98AE68
550 "LDR R0, =0x7C94\n" // 100D: 0x7C8C
551 "LDR R0, [R0]\n"
552 "CMP R0, #0\n"
553 "MOVNE R7, #0x1D\n"
554 "loc_FF98ADC4:\n" // loc_FF98AE78
555 "MOV R1, R7\n"
556 "MOV R0, R4\n"
557 "BL sub_FFAE2FC4\n" // 100D: sub_FFAE2ED4
558 "LDMFD SP!, {R3-R7,PC}\n"
559 );
560 }
561
562
563 //--------------------------- apexus stuff-------------------
564 //100D: FF8CCA88 102B: FF8CCAB4
565 void __attribute__((naked,noinline)) exp_drv_task() {
566 asm volatile(
567 " STMFD SP!, {R4-R8,LR}\n"
568 " SUB SP, SP, #0x20\n"
569 " LDR R8, =0xBB8\n"
570 " LDR R7, =0x4C6C\n"
571 " LDR R5, =0x58054\n"
572 " MOV R0, #0\n"
573 " ADD R6, SP, #0x10\n"
574 " STR R0, [SP,#0xC]\n"
575 "loc_FF8CCAA8:\n"
576 " LDR R0, [R7,#0x20]\n"
577 " MOV R2, #0\n"
578 " ADD R1, SP, #0x1C\n"
579 " BL sub_FF83AE20\n" //__KerQueue.c__0 ; LOCATION: KerQueue.c:0 // unchanged in 102B
580 " LDR R0, [SP,#0xC]\n"
581 " CMP R0, #1\n"
582 " BNE loc_FF8CCAF4\n" // 102B: loc_FF8CCB20
583 " LDR R0, [SP,#0x1C]\n"
584 " LDR R0, [R0]\n"
585 " CMP R0, #0x14\n"
586 " CMPNE R0, #0x15\n"
587 " CMPNE R0, #0x16\n"
588 " CMPNE R0, #0x17\n"
589 " BEQ loc_FF8CCC58\n" // 102B: loc_FF8CCC84
590 " CMP R0, #0x29\n"
591 " BEQ loc_FF8CCBE0\n" // 102B: loc_FF8CCC0C
592 " ADD R1, SP, #0xC\n"
593 " MOV R0, #0\n"
594 " BL sub_FF8CCA64\n" //__ExpDrv.c__512 ; LOCATION: ExpDrv.c:512 100D: sub_FF8CCA38
595 "loc_FF8CCAF4:\n" // loc_FF8CCB20
596 " LDR R0, [SP,#0x1C]\n"
597 " LDR R1, [R0]\n"
598 " CMP R1, #0x2F\n"
599 " BNE loc_FF8CCB24\n" // loc_FF8CCB50
600 " LDR R0, [SP,#0x1C]\n"
601 " BL sub_FF8CDE64\n" //__ExpDrv.c__0 ; LOCATION: ExpDrv.c:0 100D: sub_FF8CDE38
602 " LDR R0, [R7,#0x1C]\n"
603 " MOV R1, #1\n"
604 " BL sub_FF88DBB8\n" // 100D: sub_FF88DB8C
605 " BL sub_FF81EB30\n" //ExitTask ; LOCATION: KerTask.c:0 // unchanged from 100D
606 " ADD SP, SP, #0x20\n"
607 " LDMFD SP!, {R4-R8,PC}\n"
608 "loc_FF8CCB24:\n" // loc_FF8CCB50
609 " CMP R1, #0x2E\n"
610 " BNE loc_FF8CCB40\n" // loc_FF8CCB6C
611 " LDR R2, [R0,#0x8C]!\n"
612 " LDR R1, [R0,#4]\n"
613 " MOV R0, R1\n"
614 " BLX R2\n"
615 " B loc_FF8CD120\n" // loc_FF8CD14C
616 "loc_FF8CCB40:\n" // loc_FF8CCB6C
617 " CMP R1, #0x27\n"
618 " BNE loc_FF8CCB90\n" // loc_FF8CCBBC
619 " LDR R0, [R7,#0x1C]\n"
620 " MOV R1, #0x80\n"
621 " BL sub_FF88DBEC\n" // 100D: sub_FF88DBC0
622 " LDR R0, =0xFF8C8874\n" // 100D: 0xFF8C8848
623 " MOV R1, #0x80\n"
624 " BL sub_FF974480\n" //__IrisController.c__116 ; LOCATION: IrisController.c:116 100D: sub_FF974434
625 " LDR R0, [R7,#0x1C]\n"
626 " MOV R2, R8\n"
627 " MOV R1, #0x80\n"
628 " BL sub_FF88DAF8\n" //__KerFlag.c__0 ; LOCATION: KerFlag.c:0 // 100D: sub_FF88DACC
629 " TST R0, #1\n"
630 " LDRNE R1, =0x1089\n"
631 " BNE loc_FF8CCC4C\n" // loc_FF8CCC78
632 "loc_FF8CCB7C:\n" // loc_FF8CCBA8
633 " LDR R1, [SP,#0x1C]\n"
634 " LDR R0, [R1,#0x90]\n"
635 " LDR R1, [R1,#0x8C]\n"
636 " BLX R1\n"
637 " B loc_FF8CD120\n" // loc_FF8CD14C
638 "loc_FF8CCB90:\n" // loc_FF8CCBBC
639 " CMP R1, #0x28\n"
640 " BNE loc_FF8CCBD8\n" // loc_FF8CCC04
641 " ADD R1, SP, #0xC\n"
642 " BL sub_FF8CCA64\n" //__ExpDrv.c__512 ; LOCATION: ExpDrv.c:512 100D: sub_FF8CCA38
643 " LDR R0, [R7,#0x1C]\n"
644 " MOV R1, #0x100\n"
645 " BL sub_FF88DBEC\n" // 100D: sub_FF88DBC0
646 " LDR R0, =0xFF8C8884\n" // 100D: FF8C8858
647 " MOV R1, #0x100\n"
648 " BL sub_FF974E0C\n" //__IrisController.c__0 ; LOCATION: IrisController.c:0 100D: sub_FF974DC4
649 " LDR R0, [R7,#0x1C]\n"
650 " MOV R2, R8\n"
651 " MOV R1, #0x100\n"
652 " BL sub_FF88DAF8\n" //__KerFlag.c__0 ; LOCATION: KerFlag.c:0 100D: sub_FF88DACC
653 " TST R0, #1\n"
654 " BEQ loc_FF8CCB7C\n" // loc_FF8CCBA8
655 " LDR R1, =0x1093\n"
656 " B loc_FF8CCC4C\n" // loc_FF8CCC78
657 "loc_FF8CCBD8:\n" // loc_FF8CCC04
658 " CMP R1, #0x29\n"
659 " BNE loc_FF8CCBF0\n" // loc_FF8CCC1C
660 "loc_FF8CCBE0:\n" // loc_FF8CCC0C
661 " LDR R0, [SP,#0x1C]\n"
662 " ADD R1, SP, #0xC\n"
663 " BL sub_FF8CCA64\n" //__ExpDrv.c__512 ; LOCATION: ExpDrv.c:512 100D: sub_FF8CCA38
664 " B loc_FF8CCB7C\n" // loc_FF8CCBA8
665 "loc_FF8CCBF0:\n" // loc_FF8CCC1C
666 " CMP R1, #0x2C\n"
667 " BNE loc_FF8CCC08\n" // loc_FF8CCC34
668 " BL sub_FF8BA660\n" //__Shutter.c__2 ; LOCATION: Shutter.c:2 100D: sub_FF8BA634
669 " BL sub_FF8BB27C\n" // __ImgPixel.c__272 ; LOCATION: ImgPixel.c:272 100D: sub_FF8BB250
670 " BL sub_FF8BADE8\n" //__ImgGain.c__0 ; LOCATION: ImgGain.c:0 100D: sub_FF8BADBC
671 " B loc_FF8CCB7C\n" // loc_FF8CCBA8
672 "loc_FF8CCC08:\n" // loc_FF8CCC34
673 " CMP R1, #0x2D\n"
674 " BNE loc_FF8CCC58\n" // loc_FF8CCC84
675 " LDR R0, [R7,#0x1C]\n"
676 " MOV R1, #4\n"
677 " BL sub_FF88DBEC\n" // 100D: sub_FF88DBC0
678 " LDR R1, =0xFF8C88A4\n" // 100D: FF8C8878
679 " LDR R0, =0xFFFFF400\n" // unchanged from 100D
680 " MOV R2, #4\n"
681 " BL sub_FF8BA0DC\n" // 100D: sub_FF8BA0B0
682 " BL sub_FF8BA364\n" //__Shutter.c__0 ; LOCATION: Shutter.c:0 100D: sub_FF8BA338
683 " LDR R0, [R7,#0x1C]\n"
684 " MOV R2, R8\n"
685 " MOV R1, #4\n"
686 " BL sub_FF88DA14\n" // __KerFlag.c__0 ; LOCATION: KerFlag.c:0 100D: sub_FF88D9E8
687 " TST R0, #1\n"
688 " BEQ loc_FF8CCB7C\n" // loc_FF8CCBA8
689 " LDR R1, =0x10BB\n"
690 "loc_FF8CCC4C:\n"
691 " LDR R0, =0xFF8C8F74\n" //aExpdrv_c 100D: FF8C8F48
692 " BL sub_FF81EB78\n" //DebugAssert
693 " B loc_FF8CCB7C\n" // loc_FF8CCBA8
694 "loc_FF8CCC58:\n" // loc_FF8CCC84
695 " LDR R0, [SP,#0x1C]\n"
696 " MOV R4, #1\n"
697 " LDR R1, [R0]\n"
698 " CMP R1, #0x12\n"
699 " CMPNE R1, #0x13\n"
700 " BNE loc_FF8CCCC8\n" // loc_FF8CCCF4
701 " LDR R1, [R0,#0x7C]\n"
702 " ADD R1, R1, R1,LSL#1\n"
703 " ADD R1, R0, R1,LSL#2\n"
704 " SUB R1, R1, #8\n"
705 " LDMIA R1, {R2-R4}\n"
706 " STMIA R6, {R2-R4}\n"
707 " BL sub_FF8CB1EC\n" // __ExpDrv.c__2 ; LOCATION: ExpDrv.c:2 100D: sub_FF8CB1C0
708 " LDR R0, [SP,#0x1C]\n"
709 " LDR R1, [R0,#0x7C]\n"
710 " LDR R3, [R0,#0x8C]\n"
711 " LDR R2, [R0,#0x90]\n"
712 " ADD R0, R0, #4\n"
713 " BLX R3\n"
714 " LDR R0, [SP,#0x1C]\n"
715 " BL sub_FF8CE26C\n" //__ExpDrv.c__0 ; LOCATION: ExpDrv.c:0 100D: sub_FF8CE240
716 " LDR R0, [SP,#0x1C]\n"
717 " LDR R1, [R0,#0x7C]\n"
718 " LDR R3, [R0,#0x94]\n"
719 " LDR R2, [R0,#0x98]\n"
720 " ADD R0, R0, #4\n"
721 " BLX R3\n"
722 " B loc_FF8CD05C\n" // loc_FF8CD088
723 "loc_FF8CCCC8:\n" // loc_FF8CCCF4
724 " CMP R1, #0x14\n"
725 " CMPNE R1, #0x15\n"
726 " CMPNE R1, #0x16\n"
727 " CMPNE R1, #0x17\n"
728 " BNE loc_FF8CCD80\n" // loc_FF8CCDAC
729 " ADD R3, SP, #0xC\n"
730 " MOV R2, SP\n"
731 " ADD R1, SP, #0x10\n"
732 " BL sub_FF8CB458\n" // __ExpDrv.c__3168 ; LOCATION: ExpDrv.c:3168 100D: sub_FF8CB42C
733 " CMP R0, #1\n"
734 " MOV R4, R0\n"
735 " CMPNE R4, #5\n"
736 " BNE loc_FF8CCD1C\n" // loc_FF8CCD48
737 " LDR R0, [SP,#0x1C]\n"
738 " MOV R2, R4\n"
739 " LDR R1, [R0,#0x7C]!\n"
740 " LDR R12, [R0,#0x10]!\n"
741 " LDR R3, [R0,#4]\n"
742 " MOV R0, SP\n"
743 " BLX R12\n"
744 " B loc_FF8CCD54\n" // loc_FF8CCD80
745 "loc_FF8CCD1C:\n" // loc_FF8CCD48
746 " LDR R0, [SP,#0x1C]\n"
747 " CMP R4, #2\n"
748 " LDR R3, [R0,#0x90]\n"
749 " CMPNE R4, #6\n"
750 " BNE loc_FF8CCD68\n" // loc_FF8CCD94
751 " LDR R12, [R0,#0x8C]\n"
752 " MOV R0, SP\n"
753 " MOV R2, R4\n"
754 " MOV R1, #1\n"
755 " BLX R12\n"
756 " LDR R0, [SP,#0x1C]\n"
757 " MOV R2, SP\n"
758 " ADD R1, SP, #0x10\n"
759 " BL sub_FF8CC7B0\n" // __ExpDrv.c__0 ; LOCATION: ExpDrv.c:0 100D: sub_FF8CC784
760 "loc_FF8CCD54:\n"
761 " LDR R0, [SP,#0x1C]\n"
762 " LDR R2, [SP,#0xC]\n"
763 " MOV R1, R4\n"
764 " BL sub_FF8CCA04\n" // __ExpDrv.c__2 ; LOCATION: ExpDrv.c:2 100D: sub_FF8CC9D8
765 " B loc_FF8CD05C\n" // loc_FF8CD088
766 "loc_FF8CCD68:\n" // loc_FF8CCD94
767 " LDR R1, [R0,#0x7C]\n"
768 " LDR R12, [R0,#0x8C]\n"
769 " ADD R0, R0, #4\n"
770 " MOV R2, R4\n"
771 " BLX R12\n"
772 " B loc_FF8CD05C\n" // loc_FF8CD088
773 "loc_FF8CCD80:\n" // loc_FF8CCDAC
774 " CMP R1, #0x23\n"
775 " CMPNE R1, #0x24\n"
776 " BNE loc_FF8CCDCC\n" // loc_FF8CCDF8
777 " LDR R1, [R0,#0x7C]\n"
778 " ADD R1, R1, R1,LSL#1\n"
779 " ADD R1, R0, R1,LSL#2\n"
780 " SUB R1, R1, #8\n"
781 " LDMIA R1, {R2-R4}\n"
782 " STMIA R6, {R2-R4}\n"
783 " BL sub_FF8CA260\n" // __ExpDrv.c__2064 ; LOCATION: ExpDrv.c:2064 // 100D: sub_FF8CA234
784 " LDR R0, [SP,#0x1C]\n"
785 " LDR R1, [R0,#0x7C]\n"
786 " LDR R3, [R0,#0x8C]\n"
787 " LDR R2, [R0,#0x90]\n"
788 " ADD R0, R0, #4\n"
789 " BLX R3\n"
790 " LDR R0, [SP,#0x1C]\n"
791 " BL sub_FF8CA6AC\n" // __ExpDrv.c__0 ; LOCATION: ExpDrv.c:0 // 100D: sub_FF8CA680
792 " B loc_FF8CD05C\n" // loc_FF8CD088
793 "loc_FF8CCDCC:\n" // loc_FF8CCDF8
794 " ADD R1, R0, #4\n"
795 " LDMIA R1, {R2,R3,R12}\n"
796 " STMIA R6, {R2,R3,R12}\n"
797 " LDR R1, [R0]\n"
798 " CMP R1, #0x26\n"
799 " ADDLS PC, PC, R1,LSL#2\n"
800 // mwvent82: TODO comment all these 100D location labels with the real 102B firmware adddress altough its only academic
801 " B loc_FF8CD03C\n"
802 "loc_FF8CCDE8:\n"
803 " B loc_FF8CCE84\n"
804 "loc_FF8CCDEC:\n"
805 " B loc_FF8CCE84\n"
806 "loc_FF8CCDF0:\n"
807 " B loc_FF8CCE8C\n"
808 "loc_FF8CCDF4:\n"
809 " B loc_FF8CCE94\n"
810 "loc_FF8CCDF8:\n"
811 " B loc_FF8CCE94\n"
812 "loc_FF8CCDFC:\n"
813 " B loc_FF8CCE94\n"
814 "loc_FF8CCE00:\n"
815 " B loc_FF8CCE84\n"
816 "loc_FF8CCE04:\n"
817 " B loc_FF8CCE8C\n"
818 "loc_FF8CCE08:\n"
819 " B loc_FF8CCE94\n"
820 "loc_FF8CCE0C:\n"
821 " B loc_FF8CCE94\n"
822 "loc_FF8CCE10:\n"
823 " B loc_FF8CCEAC\n"
824 "loc_FF8CCE14:\n"
825 " B loc_FF8CCEAC\n"
826 "loc_FF8CCE18:\n"
827 " B loc_FF8CD028\n"
828 "loc_FF8CCE1C:\n"
829 " B loc_FF8CD030\n"
830 "loc_FF8CCE20:\n"
831 " B loc_FF8CD030\n"
832 "loc_FF8CCE24:\n"
833 " B loc_FF8CD030\n"
834 "loc_FF8CCE28:\n"
835 " B loc_FF8CD030\n"
836 "loc_FF8CCE2C:\n"
837 " B loc_FF8CD038\n"
838 "loc_FF8CCE30:\n"
839 " B loc_FF8CD03C\n"
840 "loc_FF8CCE34:\n"
841 " B loc_FF8CD03C\n"
842 "loc_FF8CCE38:\n"
843 " B loc_FF8CD03C\n"
844 "loc_FF8CCE3C:\n"
845 " B loc_FF8CD03C\n"
846 "loc_FF8CCE40:\n"
847 " B loc_FF8CD03C\n"
848 "loc_FF8CCE44:\n"
849 " B loc_FF8CD03C\n"
850 "loc_FF8CCE48:\n"
851 " B loc_FF8CCE9C\n"
852 "loc_FF8CCE4C:\n"
853 " B loc_FF8CCEA4\n"
854 "loc_FF8CCE50:\n"
855 " B loc_FF8CCEA4\n"
856 "loc_FF8CCE54:\n"
857 " B loc_FF8CCEB8\n"
858 "loc_FF8CCE58:\n"
859 " B loc_FF8CCEB8\n"
860 "loc_FF8CCE5C:\n"
861 " B loc_FF8CCEC0\n"
862 "loc_FF8CCE60:\n"
863 " B loc_FF8CCEF8\n"
864 "loc_FF8CCE64:\n"
865 " B loc_FF8CCFA0\n"
866 "loc_FF8CCE68:\n"
867 " B loc_FF8CCFD8\n"
868 "loc_FF8CCE6C:\n"
869 " B loc_FF8CD010\n"
870 "loc_FF8CCE70:\n"
871 " B loc_FF8CD010\n"
872 "loc_FF8CCE74:\n"
873 " B loc_FF8CD03C\n"
874 "loc_FF8CCE78:\n"
875 " B loc_FF8CD03C\n"
876 "loc_FF8CCE7C:\n"
877 " B loc_FF8CD018\n"
878 "loc_FF8CCE80:\n"
879 " B loc_FF8CD020\n"
880 "loc_FF8CCE84:\n"
881 " BL sub_FF8C8DB4\n" //__ExpDrv.c__0 100D: sub_FF8C8D88
882 " B loc_FF8CD03C\n"
883 "loc_FF8CCE8C:\n"
884 " BL sub_FF8C90A4\n" //__ExpDrv.c__0 100D: sub_FF8C9078
885 " B loc_FF8CD03C\n"
886 "loc_FF8CCE94:\n"
887 " BL sub_FF8C930C\n" //__ExpDrv.c__9 100D: sub_FF8C92E0
888 " B loc_FF8CD03C\n"
889 "loc_FF8CCE9C:\n"
890 " BL sub_FF8C95C0\n" //__ExpDrv.c__2 100D: sub_FF8C9594
891 " B loc_FF8CD03C\n"
892 "loc_FF8CCEA4:\n"
893 " BL sub_FF8C97D8\n" //__ExpDrv.c__0 100D: sub_FF8C97AC
894 " B loc_FF8CD03C\n"
895 "loc_FF8CCEAC:\n" // loc_FF8CCED8
896 //" BL sub_FF8C9AD0\n" // the one to override------------------------------
897 " BL sub_FF8C9AD0_my\n" // first step for apexus // 102B: sub_FF8C9AFC
898 //----------------------->
899 " MOV R4, #0\n"
900 " B loc_FF8CD03C\n"
901 "loc_FF8CCEB8:\n"
902 " BL sub_FF8C9C44\n" // 100D: sub_FF8C9C18
903 " B loc_FF8CD03C\n"
904 "loc_FF8CCEC0:\n" // loc_FF8CCEEC
905 " LDRH R1, [R0,#4]\n"
906 " STRH R1, [SP,#0x10]\n"
907 " LDRH R1, [R5,#2]\n"
908 " STRH R1, [SP,#0x12]\n"
909 " LDRH R1, [R5,#4]\n"
910 " STRH R1, [SP,#0x14]\n"
911 " LDRH R1, [R5,#6]\n"
912 " STRH R1, [SP,#0x16]\n"
913 " LDRH R1, [R0,#0xC]\n"
914 " STRH R1, [SP,#0x18]\n"
915 " LDRH R1, [R5,#0xA]\n"
916 " STRH R1, [SP,#0x1A]\n"
917 " BL sub_FF8CDF64\n" // 100D: sub_FF8CDF38
918 " B loc_FF8CD03C\n" // loc_FF8CD068
919 "loc_FF8CCEF8:\n" // loc_FF8CCF24
920 " LDRH R1, [R0,#4]\n"
921 " STRH R1, [SP,#0x10]\n"
922 " LDRH R1, [R5,#2]\n"
923 " STRH R1, [SP,#0x12]\n"
924 " LDRH R1, [R5,#4]\n"
925 " STRH R1, [SP,#0x14]\n"
926 " LDRH R1, [R5,#6]\n"
927 " STRH R1, [SP,#0x16]\n"
928 " LDRH R1, [R0,#8]\n"
929 " STRH R1, [SP,#0x18]\n"
930 " LDRH R1, [R5,#0xA]\n"
931 " STRH R1, [SP,#0x1A]\n"
932 " BL sub_FF8CE06C\n" // 100D: sub_FF8CE040
933 " B loc_FF8CD03C\n" // loc_FF8CD068
934
935
936 "loc_FF8CCFA0:\n" // loc_FF8CCFCC
937 " LDRH R1, [R5]\n"
938 " STRH R1, [SP,#0x10]\n"
939 " LDRH R1, [R5,#6]\n"
940 " STRH R1, [SP,#0x12]\n"
941 " LDRH R1, [R5,#4]\n"
942 " STRH R1, [SP,#0x14]\n"
943 " LDRH R1, [R5,#6]\n"
944 " STRH R1, [SP,#0x16]\n"
945 " LDRH R1, [R0,#8]\n"
946 " STRH R1, [SP,#0x18]\n"
947 " LDRH R1, [R5,#0xA]\n"
948 " STRH R1, [SP,#0x1A]\n"
949 " BL sub_FF8CE120\n" // 100D: sub_FF8CE0F4
950 " B loc_FF8CD03C\n" // loc_FF8CD068
951 "loc_FF8CCFD8:\n" // loc_FF8CD004
952 " LDRH R1, [R5]\n"
953 " STRH R1, [SP,#0x10]\n"
954 " LDRH R1, [R5,#2]\n"
955 " STRH R1, [SP,#0x12]\n"
956 " LDRH R1, [R5,#4]\n"
957 " STRH R1, [SP,#0x14]\n"
958 " LDRH R1, [R5,#6]\n"
959 " STRH R1, [SP,#0x16]\n"
960 " LDRH R1, [R0,#0xC]\n"
961 " STRH R1, [SP,#0x18]\n"
962 " LDRH R1, [R5,#0xA]\n"
963 " STRH R1, [SP,#0x1A]\n"
964 " BL sub_FF8CE1C8\n" // 100D: sub_FF8CE19C
965 " B loc_FF8CD03C\n" // loc_FF8CD068
966
967 "loc_FF8CD010:\n"
968 " BL sub_FF8CA038\n" // 100D: sub_FF8CA00C
969 " B loc_FF8CD03C\n"
970 "loc_FF8CD018:\n"
971 " BL sub_FF8CA7B0\n" // 100D: sub_FF8CA784
972 " B loc_FF8CD03C\n"
973 "loc_FF8CD020:\n"
974 " BL sub_FF8CAA4C\n" // 100D: sub_FF8CAA20
975 " B loc_FF8CD03C\n"
976 "loc_FF8CD028:\n"
977 " BL sub_FF8CAC2C\n" // 100D: sub_FF8CAC00
978 " B loc_FF8CD03C\n"
979 "loc_FF8CD030:\n"
980 " BL sub_FF8CADE8\n" // 100D: sub_FF8CADBC
981 " B loc_FF8CD03C\n"
982 "loc_FF8CD038:\n"
983 " BL sub_FF8CAFE4\n" // 100D: sub_FF8CAFB8
984 "loc_FF8CD03C:\n"
985 " LDR R0, [SP,#0x1C]\n"
986 " LDR R1, [R0,#0x7C]\n"
987 " LDR R3, [R0,#0x8C]\n"
988 " LDR R2, [R0,#0x90]\n"
989 " ADD R0, R0, #4\n"
990 " BLX R3\n"
991 " CMP R4, #1\n"
992 " BNE loc_FF8CD0A4\n" // loc_FF8CD0D0
993 "loc_FF8CD05C:\n" // loc_FF8CD088
994 " LDR R0, [SP,#0x1C]\n"
995 " MOV R2, #0xC\n"
996 " LDR R1, [R0,#0x7C]\n"
997 " ADD R1, R1, R1,LSL#1\n"
998 " ADD R0, R0, R1,LSL#2\n"
999 " SUB R4, R0, #8\n"
1000 " LDR R0, =0x58054\n"
1001 " ADD R1, SP, #0x10\n"
1002 " BL sub_FFB873EC\n" // 100D: sub_FFB872F4
1003 " LDR R0, =0x58060\n"
1004 " MOV R2, #0xC\n"
1005 " ADD R1, SP, #0x10\n"
1006 " BL sub_FFB873EC\n" // 100D: sub_FFB872F4
1007 " LDR R0, =0x5806C\n"
1008 " MOV R2, #0xC\n"
1009 " MOV R1, R4\n"
1010 " BL sub_FFB873EC\n" //F4 in 100F 100D: sub_FFB872F0
1011 " B loc_FF8CD120\n" // 102B: loc_FF8CD14C
1012 "loc_FF8CD0A4:\n"
1013 " LDR R0, [SP,#0x1C]\n"
1014 " MOV R3, #1\n"
1015 " LDR R0, [R0]\n"
1016 " CMP R0, #0xB\n"
1017 " BNE loc_FF8CD0EC\n"
1018 " MOV R2, #0\n"
1019 " STRD R2, [SP]\n"
1020 " MOV R2, #1\n"
1021 " MOV R1, #1\n"
1022 " MOV R0, #0\n"
1023 " BL sub_FF8C8B94\n" // 100D: sub_FF8C8B68
1024 " MOV R3, #1\n"
1025 " MOV R2, #0\n"
1026 " STRD R2, [SP]\n"
1027 " MOV R2, #1\n"
1028 " MOV R1, #1\n"
1029 " MOV R0, #0\n"
1030 " B loc_FF8CD11C\n" // loc_FF8CD148
1031 "loc_FF8CD0EC:\n" // loc_FF8CD118
1032 " MOV R2, #1\n"
1033 " STRD R2, [SP]\n"
1034 " MOV R3, #1\n"
1035 " MOV R1, #1\n"
1036 " MOV R0, #1\n"
1037 " BL sub_FF8C8B94\n" // 100D: sub_FF8C8B68
1038 " MOV R3, #1\n"
1039 " MOV R2, #1\n"
1040 " MOV R1, #1\n"
1041 " MOV R0, #1\n"
1042 " STR R3, [SP]\n"
1043 " STR R3, [SP,#4]\n"
1044 "loc_FF8CD11C:\n" // loc_FF8CD148
1045 " BL sub_FF8C8CFC\n" // sub_FF8C8CD0
1046 "loc_FF8CD120:\n" // loc_FF8CD14C
1047 " LDR R0, [SP,#0x1C]\n"
1048 " BL sub_FF8CDE64\n" // 100D: sub_FF8CDE38
1049 " B loc_FF8CCAA8\n" // loc_FF8CCAD4
1050 );
1051 }
1052
1053 void __attribute__((naked,noinline)) sub_FF8C9AD0_my() {
1054 // sub_FF8C9AFC in 102B fw
1055 asm volatile (
1056 " STMFD SP!, {R4-R8,LR}\n"
1057 " LDR R7, =0x4C6C\n"
1058 " MOV R4, R0\n"
1059 " LDR R0, [R7,#0x1C]\n"
1060 " MOV R1, #0x3E\n"
1061 " BL sub_FF88DBEC\n" // 100D: sub_FF88DBC0
1062 " LDRSH R0, [R4,#4]\n"
1063 " MOV R2, #0\n"
1064 " MOV R1, #0\n"
1065 " BL sub_FF8C88F8\n" // 100D: sub_FF8C88CC
1066 " MOV R5, R0\n"
1067 " LDRSH R0, [R4,#6]\n"
1068 " BL sub_FF8C8A08\n" // 100D: sub_FF8C89DC
1069 " LDRSH R0, [R4,#8]\n"
1070 " BL sub_FF8C8A60\n" // 100D: sub_FF8C8A34
1071 " LDRSH R0, [R4,#0xA]\n"
1072 " BL sub_FF8C8AB8\n" // 100D: sub_FF8C8A8C
1073 " LDRSH R0, [R4,#0xC]\n"
1074 " MOV R1, #0\n"
1075 " BL sub_FF8C8B10\n" // 100D: sub_FF8C8AE4
1076 " MOV R6, R0\n"
1077 " LDRSH R0, [R4,#0xE]\n"
1078 " BL sub_FF8CDF04\n" // 100D: sub_FF8CDED8
1079 " LDR R0, [R4]\n"
1080 " LDR R8, =0x5806C\n"
1081 " CMP R0, #0xB\n"
1082 " MOVEQ R5, #0\n"
1083 " MOVEQ R6, #0\n"
1084 " BEQ loc_FF8C9B6C\n" // loc_FF8C9B98
1085 " CMP R5, #1\n"
1086 " BNE loc_FF8C9B6C\n" // loc_FF8C9B98
1087 " LDRSH R0, [R4,#4]\n"
1088 " LDR R1, =0xFF8C8864\n" // 100D: 0xFF8C8838
1089 " MOV R2, #2\n"
1090 " BL sub_FF9747C8\n" //__IrisController.c__190 ; LOCATION: IrisController.c:190 100D: sub_FF974780
1091 " STRH R0, [R4,#4]\n"
1092 " MOV R0, #0\n"
1093 " STR R0, [R7,#0x28]\n"
1094 " B loc_FF8C9B74\n" // loc_FF8C9BA0
1095 "loc_FF8C9B6C:\n"
1096 " LDRH R0, [R8]\n"
1097 " STRH R0, [R4,#4]\n"
1098 "loc_FF8C9B74:\n"
1099 " CMP R6, #1\n"
1100 " LDRNEH R0, [R8,#8]\n"
1101 " BNE loc_FF8C9B90\n" // loc_FF8C9BBC
1102 " LDRSH R0, [R4,#0xC]\n"
1103 " LDR R1, =0xFF8C88E8\n" // 100D: FF8C88BC
1104 " MOV R2, #0x20\n"
1105 " BL sub_FF8CDEF4\n" // sub_FF8CDF20
1106 "loc_FF8C9B90:\n" // loc_FF8C9BBC
1107 " STRH R0, [R4,#0xC]\n"
1108 " LDRSH R0, [R4,#6]\n"
1109 //" BL sub_FF8BA3A4\n" // last step __Shutter.c__0 ; LOCATION: Shutter.c:0
1110 " BL sub_FF8BA3A4_my\n" // sub_FF8BA3D0 in 102B
1111 //------------------------>
1112 "B sub_FF8C9BC8\n" // Continue function in firmware 100D: FF8C9B9C
1113
1114 /*
1115 " LDRSH R0, [R4,#8]\n"
1116 " MOV R1, #1\n"
1117 " BL _sub_FF8BAB04__ImgGain.c__0 ; LOCATION: ImgGain.c:0\n"
1118 " MOV R1, #0\n"
1119 " ADD R0, R4, #8\n"
1120 " BL _sub_FF8BAB8C__ImgGain.c__352 ; LOCATION: ImgGain.c:352\n"
1121 " LDRSH R0, [R4,#0xE]\n"
1122 " BL _sub_FF8C37D0__BrtCrct.c__0 ; LOCATION: BrtCrct.c:0\n"
1123 " LDR R4, =0xBB8\n"
1124 " CMP R5, #1\n"
1125 " BNE loc_FF8C9BE8\n"
1126 " LDR R0, [R7,#0x1C]\n"
1127 " MOV R2, R4\n"
1128 " MOV R1, #2\n"
1129 " BL _sub_FF88DACC__KerFlag.c__0 ; LOCATION: KerFlag.c:0\n"
1130 " TST R0, #1\n"
1131 " LDRNE R1, =0x61E\n"
1132 " ADRNE R0, aExpdrv_c ; "ExpDrv.c"\n"
1133 " BLNE DebugAssert\n"
1134 "\n"
1135 "loc_FF8C9BE8 ; CODE XREF: _sub_FF8C9AD0__ExpDrv.c__2+F4j\n"
1136 " CMP R6, #1\n"
1137 " LDMNEFD SP!, {R4-R8,PC}\n"
1138 " LDR R0, [R7,#0x1C]\n"
1139 " MOV R2, R4\n"
1140 " MOV R1, #0x20\n"
1141 " BL _sub_FF88DACC__KerFlag.c__0 ; LOCATION: KerFlag.c:0\n"
1142 " TST R0, #1\n"
1143 " LDRNE R1, =0x623\n"
1144 " LDRNE R0, =aExpdrv_c\n"
1145 " LDMNEFD SP!, {R4-R8,LR}\n"
1146 " BNE DebugAssert\n"
1147 " LDMFD SP!, {R4-R8,PC}\n"
1148 */
1149
1150 );
1151 }
1152
1153
1154
1155 void __attribute__((naked,noinline)) sub_FF8BA3A4_my() {
1156 // sub_FF8BA3D0 in 102B
1157 asm volatile (
1158 " STMFD SP!, {R4-R6,LR}\n"
1159 " LDR R5, =0x4934\n"
1160 " MOV R4, R0\n"
1161 " LDR R0, [R5,#4]\n"
1162 " CMP R0, #1\n"
1163 " LDRNE R1, =0x146\n"
1164 " LDRNE R0, =0xFF8BA1D4\n" // Shutter.c 100D: 0xFF8BA1A8
1165 " BLNE sub_FF81EB78\n" //DebugAssert
1166 " CMN R4, #0xC00\n"
1167 " LDREQSH R4, [R5,#2]\n"
1168 " CMN R4, #0xC00\n"
1169 " MOVEQ R1, #0x14C\n"
1170 " LDREQ R0, =0xFF8BA1D4\n" // Shutter.c 100D: 0xFF8BA1A8
1171 " STRH R4, [R5,#2]\n"
1172 " BLEQ sub_FF81EB78\n" //DebugAssert
1173 " MOV R0, R4\n"
1174 " BL apex2us\n" //++ was sub_FFA34F70 in 102B fw
1175 " MOV R4, R0\n"
1176 " BL sub_FF9066C8\n" //nullsub_68 100D: FF90667C
1177 " MOV R0, R4\n"
1178 " BL sub_FF910B44\n" // 100D : sub_FF910AF8
1179 " TST R0, #1\n"
1180 " LDRNE R1, =0x151\n"
1181 " LDMNEFD SP!, {R4-R6,LR}\n"
1182 " LDRNE R0, =0xFF8BA1D4\n" // Shutter.c 100D: 0xFF8BA1A8
1183 " BNE sub_FF81EB78\n" //DebugAssert
1184 " LDMFD SP!, {R4-R6,PC}\n"
1185
1186 );
1187 }