1 #include "lolevel.h"
2 #include "platform.h"
3 #include "core.h"
4
5 // @ FF93B264
6 static long *nrflag = (long*)0x8DCC;
7
8 #include "../../../generic/capt_seq.c"
9
10 // Extracted method: task_CaptSeqTask (FF85DE30)
11 void __attribute__((naked,noinline)) capt_seq_task() // OK
12 {
13 asm volatile (
14 "STMFD SP!, {R3-R9,LR}\n"
15 "LDR R6, =0x19D4C\n"
16 "LDR R5, =0x54B8\n"
17 "MOV R9, #1\n"
18 "MOV R7, #0\n"
19
20 "loc_FF85DE44:\n"
21 "LDR R0, [R5,#0xC]\n"
22 "MOV R2, #0\n"
23 "MOV R1, SP\n"
24 "BL sub_FF827D8C\n" // LOCATION: KerQueue.c:0
25 "TST R0, #1\n"
26 "BEQ loc_FF85DE70\n"
27 "LDR R1, =0x48E\n"
28 "LDR R0, =0xFF85DB08\n" // "SsShootTask.c"
29 "BL _DebugAssert\n"
30 "BL sub_FF81BAA8\n" // ExitTask\n"
31 "LDMFD SP!, {R3-R9,PC}\n"
32
33 "loc_FF85DE70:\n"
34 "LDR R0, [SP,#0x20-0x20]\n"
35 "LDR R1, [R0]\n"
36 "CMP R1, #0x1B\n"
37 "ADDLS PC, PC, R1,LSL#2\n"
38 "B loc_FF85E090\n"
39
40 "loc_FF85DE84:\n"
41 "B loc_FF85DEF4\n"
42
43 "loc_FF85DE88:\n"
44 "B loc_FF85DF5C\n"
45
46 "loc_FF85DE8C:\n"
47 "B loc_FF85DF64\n"
48
49 "loc_FF85DE90:\n"
50 "B loc_FF85DF7C\n"
51
52 "loc_FF85DE94:\n"
53 "B loc_FF85DF70\n"
54
55 "loc_FF85DE98:\n"
56 "B loc_FF85DF84\n"
57
58 "loc_FF85DE9C:\n"
59 "B loc_FF85DF8C\n"
60
61 "loc_FF85DEA0:\n"
62 "B loc_FF85DF94\n"
63
64 "loc_FF85DEA4:\n"
65 "B loc_FF85DFEC\n"
66
67 "loc_FF85DEA8:\n"
68 "B loc_FF85DFF8\n"
69
70 "loc_FF85DEAC:\n"
71 "B loc_FF85E000\n"
72
73 "loc_FF85DEB0:\n"
74 "B loc_FF85E008\n"
75
76 "loc_FF85DEB4:\n"
77 "B loc_FF85E010\n"
78
79 "loc_FF85DEB8:\n"
80 "B loc_FF85E018\n"
81
82 "loc_FF85DEBC:\n"
83 "B loc_FF85E020\n"
84
85 "loc_FF85DEC0:\n"
86 "B loc_FF85E028\n"
87
88 "loc_FF85DEC4:\n"
89 "B loc_FF85E030\n"
90
91 "loc_FF85DEC8:\n"
92 "B loc_FF85E03C\n"
93
94 "loc_FF85DECC:\n"
95 "B loc_FF85E044\n"
96
97 "loc_FF85DED0:\n"
98 "B loc_FF85E04C\n"
99
100 "loc_FF85DED4:\n"
101 "B loc_FF85E054\n"
102
103 "loc_FF85DED8:\n"
104 "B loc_FF85E060\n"
105
106 "loc_FF85DEDC:\n"
107 "B loc_FF85E068\n"
108
109 "loc_FF85DEE0:\n"
110 "B loc_FF85E070\n"
111
112 "loc_FF85DEE4:\n"
113 "B loc_FF85E078\n"
114
115 "loc_FF85DEE8:\n"
116 "B loc_FF85E080\n"
117
118 "loc_FF85DEEC:\n"
119 "B loc_FF85E088\n"
120
121 "loc_FF85DEF0:\n"
122 "B loc_FF85E09C\n"
123
124 "loc_FF85DEF4:\n"
125 // jumptable FF85DE7C entry 0
126 "BL sub_FF939B34\n" // LOCATION: SsPrepareSeq.c:0
127 // only do quick press hack if overrides are active
128 "BL captseq_hack_override_active\n" // returns 1 if tv or sv override in effect
129 "STR R0,[SP,#-4]!\n" // push return value
130 "BL shooting_expo_param_override\n" // +
131 "BL sub_FF85BFB8\n"
132 "LDR R0,[SP],#4\n" // pop override hack
133 "CMP R0, #1\n" // +
134 "MOVEQ R0, #0\n" // +
135 "STREQ R0, [R6,#0x24]\n" // fixes overrides behavior at short shutter press
136 "LDRNE R0, [R6,#0x24]\n" // modified NE
137 "CMPNE R0, #0\n" // modified NE
138 // "LDR R0, [R6,#0x24]\n" // above patch makes these lines redundant
139 // "CMP R0, #0\n"
140 "BEQ loc_FF85E09C\n"
141 "BL sub_FF85D7D8\n"
142 "MOV R4, R0\n"
143 "LDR R0, [R6,#0x24]\n"
144 "CMP R0, #0\n"
145 "BEQ loc_FF85DF3C\n"
146 "MOV R0, #0xC\n"
147 "BL sub_FF860E80\n"
148 "TST R0, #1\n"
149 "STRNE R9, [R5,#4]\n"
150 "LDRNE R0, [R4,#8]\n"
151 "ORRNE R0, R0, #0x40000000\n"
152 "STRNE R0, [R4,#8]\n"
153 "BNE loc_FF85E09C\n"
154
155 "loc_FF85DF3C:\n"
156 "BL sub_FF95CD34\n"
157 "BL sub_FF86CF6C\n" // LOCATION: PropertyCase.c:0
158 "STR R0, [R4,#0x14]\n"
159 "MOV R0, R4\n"
160 //"BL sub_FF93B1EC\n" // LOCATION: SsCaptureSeq.c:536
161 "BL sub_FF93B1EC_my\n" // +
162 "BL capt_seq_hook_raw_here\n" // +
163 "TST R0, #1\n"
164 "STRNE R9, [R5,#4]\n"
165 "B loc_FF85E09C\n"
166
167 "loc_FF85DF5C:\n"
168 // jumptable FF85DE7C entry 1
169 //"BL sub_FF85E1B4\n"
170 "BL sub_FF85E1B4_my\n" // +
171 "B loc_FF85DF74\n"
172
173 "loc_FF85DF64:\n"
174 // jumptable FF85DE7C entry 2
175 "MOV R0, #1\n"
176 "BL sub_FF939CDC\n" // LOCATION: SsPrepareSeq.c:0
177 "B loc_FF85E09C\n"
178
179 "loc_FF85DF70:\n"
180 // jumptable FF85DE7C entry 4
181 "BL sub_FF9397CC\n"
182
183 "loc_FF85DF74:\n"
184 "STR R7, [R6,#0x24]\n"
185 "B loc_FF85E09C\n"
186
187 "loc_FF85DF7C:\n"
188 // jumptable FF85DE7C entry 3
189 "BL sub_FF939B00\n"
190 "B loc_FF85DF74\n"
191
192 "loc_FF85DF84:\n"
193 // jumptable FF85DE7C entry 5
194 "BL sub_FF939B08\n"
195 "B loc_FF85E09C\n"
196
197 "loc_FF85DF8C:\n"
198 // jumptable FF85DE7C entry 6
199 "BL sub_FF939BFC\n" // LOCATION: SsPrepareSeq.c:0
200 "B loc_FF85DFF0\n"
201
202 "loc_FF85DF94:\n"
203 // jumptable FF85DE7C entry 7
204 "LDR R4, [R0,#0xC]\n"
205 "BL sub_FF939B10\n"
206 "MOV R0, R4\n"
207 "BL sub_FF93A324\n" // LOCATION: SsPrePreSeq.c:2097152
208 "TST R0, #1\n"
209 "MOV R8, R0\n"
210 "BNE loc_FF85DFD4\n"
211 "BL sub_FF86CF6C\n" // LOCATION: PropertyCase.c:0
212 "STR R0, [R4,#0x14]\n"
213 "MOV R0, R4\n"
214 "BL sub_FF93B104\n" // LOCATION: SsCaptureSeq.c:1
215 "MOV R0, R4\n"
216 "BL sub_FF93B654\n" // LOCATION: SsCaptureSeq.c:4
217 "MOV R8, R0\n"
218 "LDR R0, [R4,#0x14]\n"
219 "BL sub_FF86D178\n" // LOCATION: PropertyCase.c:0
220
221 "loc_FF85DFD4:\n"
222 "BL sub_FF939B00\n"
223 "MOV R2, R4\n"
224 "MOV R1, #9\n"
225 "MOV R0, R8\n"
226 "BL sub_FF85C50C\n" // LOCATION: SsShootCtrl.c:0
227 "B loc_FF85E09C\n" // Corrigido aqui!
228
229 "loc_FF85DFEC:\n"
230 // jumptable FF85DE7C entry 8
231 "BL sub_FF939C5C\n" // LOCATION: SsPrepareSeq.c:960
232
233 "loc_FF85DFF0:\n"
234 "BL sub_FF85BFB8\n"
235 "B loc_FF85E09C\n"
236
237 "loc_FF85DFF8:\n"
238 // jumptable FF85DE7C entry 9
239 "BL sub_FF939B00\n"
240 "B loc_FF85E09C\n"
241
242 "loc_FF85E000:\n"
243 // jumptable FF85DE7C entry 10
244 "BL sub_FF93A590\n"
245 "B loc_FF85E09C\n"
246
247 "loc_FF85E008:\n"
248 // jumptable FF85DE7C entry 11
249 "BL sub_FF93A778\n"
250 "B loc_FF85E09C\n"
251
252 "loc_FF85E010:\n"
253 // jumptable FF85DE7C entry 12
254 "BL sub_FF93A808\n" // LOCATION: SsExpCompSeq.c:94
255 "B loc_FF85E09C\n"
256
257 "loc_FF85E018:\n"
258 // jumptable FF85DE7C entry 13
259 "BL sub_FF93A8BC\n"
260 "B loc_FF85E09C\n"
261
262 "loc_FF85E020:\n"
263 // jumptable FF85DE7C entry 14
264 "BL sub_FF93AAB4\n" // LOCATION: SsChgExpSeq.c:32
265 "B loc_FF85E09C\n"
266
267 "loc_FF85E028:\n"
268 // jumptable FF85DE7C entry 15
269 "BL sub_FF93AB04\n" // LOCATION: SsChgExpSeq.c:32
270 "B loc_FF85E09C\n"
271
272 "loc_FF85E030:\n"
273 // jumptable FF85DE7C entry 16
274 "MOV R0, #0\n"
275 "BL sub_FF93AB88\n"
276 "B loc_FF85E09C\n"
277
278 "loc_FF85E03C:\n"
279 // jumptable FF85DE7C entry 17
280 "BL sub_FF93ACD8\n"
281 "B loc_FF85E09C\n"
282
283 "loc_FF85E044:\n"
284 // jumptable FF85DE7C entry 18
285 "BL sub_FF93AD6C\n" // LOCATION: SsMFSeq.c:109
286 "B loc_FF85E09C\n"
287
288 "loc_FF85E04C:\n"
289 // jumptable FF85DE7C entry 19
290 "BL sub_FF93AE34\n" // LOCATION: SsMFSeq.c:181
291 "B loc_FF85E09C\n"
292
293 "loc_FF85E054:\n"
294 // jumptable FF85DE7C entry 20
295 "BL sub_FF939E00\n"
296 "BL sub_FF824C34\n"
297 "B loc_FF85E09C\n"
298
299 "loc_FF85E060:\n"
300 // jumptable FF85DE7C entry 21
301 "BL sub_FF93A978\n"
302 "B loc_FF85E09C\n"
303
304 "loc_FF85E068:\n"
305 // jumptable FF85DE7C entry 22
306 "BL sub_FF93A9E4\n" // LOCATION: SsChgExpSeq.c:0
307 "B loc_FF85E09C\n"
308
309 "loc_FF85E070:\n"
310 // jumptable FF85DE7C entry 23
311 "BL sub_FF93CC18\n"
312 "B loc_FF85E09C\n"
313
314 "loc_FF85E078:\n"
315 // jumptable FF85DE7C entry 24
316 "BL sub_FF93CC34\n"
317 "B loc_FF85E09C\n"
318
319 "loc_FF85E080:\n"
320 // jumptable FF85DE7C entry 25
321 "BL sub_FF93CC44\n"
322 "B loc_FF85E09C\n"
323
324 "loc_FF85E088:\n"
325 // jumptable FF85DE7C entry 26
326 "BL sub_FF93CC70\n"
327 "B loc_FF85E09C\n"
328
329 "loc_FF85E090:\n"
330 // jumptable FF85DE7C default entry
331 "LDR R1, =0x58E\n"
332 "LDR R0, =0xFF85DB08\n" // aSsshoottask_c
333 "BL _DebugAssert\n"
334
335 "loc_FF85E09C:\n"
336 // jumptable FF85DE7C entry 27
337 "LDR R0, [SP,#0x20-0x20]\n"
338 "LDR R1, [R0,#4]\n"
339 "LDR R0, [R5,#8]\n"
340 "BL sub_FF827B08\n"
341 "LDR R4, [SP,#0x20-0x20]\n"
342 "LDR R0, [R4,#8]\n"
343 "CMP R0, #0\n"
344 "LDREQ R1, =0x10D\n"
345 "LDREQ R0, =0xFF85DB08\n" // aSsshoottask_c
346 "BLEQ _DebugAssert\n"
347 "STR R7, [R4,#8]\n"
348 "B loc_FF85DE44\n"
349 );
350 }
351
352 void __attribute__((naked,noinline)) sub_FF85E1B4_my() // OK
353 {
354 asm volatile (
355 "STMFD SP!, {R4-R6,LR}\n"
356 "LDR R4, [R0,#0xC]\n"
357 "LDR R6, =0x19D4C\n"
358 "LDR R0, [R4,#8]\n"
359 "MOV R5, #0\n"
360 "ORR R0, R0, #1\n"
361 "STR R0, [R4,#8]\n"
362 "LDR R0, [R6,#0x24]\n"
363 "CMP R0, #0\n"
364 "MOVEQ R0, #2\n"
365 "BLEQ sub_FF858190\n"
366 "BL sub_FF939B10\n"
367 "LDR R0, [R6,#0x24]\n"
368 "CMP R0, #0\n"
369 "BNE loc_FF85E234\n"
370 "MOV R0, R4\n"
371 "BL sub_FF939FA4\n" // LOCATION: SsPrePreSeq.c:242
372 "TST R0, #1\n"
373 "MOVNE R2, R4\n"
374 "LDMNEFD SP!, {R4-R6,LR}\n"
375 "MOVNE R1, #1\n"
376 "BNE sub_FF85C50C\n" // LOCATION: SsShootCtrl.c:0
377 "BL sub_FF95CD34\n"
378 "BL sub_FF86CF6C\n" // LOCATION: PropertyCase.c:0
379 "STR R0, [R4,#0x14]\n"
380 "MOV R0, R4\n"
381 "BL sub_FF93B104\n" // LOCATION: SsCaptureSeq.c:1
382 "BL sub_FF93BBE0\n" // LOCATION: SsShootLib.c:32768
383 "MOV R0, R4\n"
384 //"BL sub_FF93B1EC\n" // LOCATION: SsCaptureSeq.c:536
385 "BL sub_FF93B1EC_my\n" // +
386 "MOV R5, R0\n"
387 "BL capt_seq_hook_raw_here\n" // +
388 "B loc_FF85E244\n"
389
390 "loc_FF85E234:\n"
391 "LDR R0, =0x54B8\n"
392 "LDR R0, [R0,#4]\n"
393 "CMP R0, #0\n"
394 "MOVNE R5, #0x1D\n"
395
396 "loc_FF85E244:\n"
397 "BL sub_FF93CC34\n"
398 "BL sub_FF93CC70\n"
399 "MOV R2, R4\n"
400 "MOV R1, #1\n"
401 "MOV R0, R5\n"
402 "BL sub_FF85C50C\n" // LOCATION: SsShootCtrl.c:0
403 "BL sub_FF93B5F4\n"
404 "CMP R0, #0\n"
405 "LDRNE R0, [R4,#8]\n"
406 "ORRNE R0, R0, #0x2000\n"
407 "STRNE R0, [R4,#8]\n"
408 "LDMFD SP!, {R4-R6,PC}\n"
409 );
410 }
411
412 void __attribute__((naked,noinline)) sub_FF93B1EC_my() // OK
413 {
414 asm volatile (
415 "STMFD SP!, {R0-R10,LR}\n"
416 "MOV R6, #0\n"
417 "MOV R4, R0\n"
418 "BL sub_FF93BD58\n" // LOCATION: SsShootEvent.c:60
419 "MVN R1, #0\n"
420 "BL sub_FF827B3C\n"
421 "MOV R2, #4\n"
422 "ADD R1, SP, #0x30-0x28\n"
423 "MOV R0, #0x8A\n"
424 "BL sub_FF86CDDC\n" // PT_GetPropertyCaseString_0
425 "TST R0, #1\n"
426 "MOVNE R1, #0x218\n"
427 "LDRNE R0, =0xFF93B3BC\n" // "SsCaptureSeq.c"
428 "BLNE _DebugAssert\n"
429 "LDR R8, =0x19E00\n"
430 "LDR R5, =0x19D4C\n"
431 "LDRSH R1, [R8,#0xE]\n"
432 "LDR R0, [R5,#0x7C]\n"
433 "BL sub_FF8F17B8\n"
434 "BL sub_FF8450F0\n" // GetCCDTemperature
435 "LDR R2, =0x8DD0\n"
436 "ADD R3, R4, #0x8C\n"
437 "STRH R0, [R4,#0x88]\n"
438 "STRD R2, [SP,#0x30-0x30]\n"
439 "MOV R1, R0\n"
440 "LDRH R0, [R5,#0x54]\n"
441 "LDRSH R2, [R8,#0xC]\n"
442 "LDR R3, =0x8DCC\n"
443 "BL sub_FF93C24C\n" // LOCATION: NRTable.c:202
444 //PPL NO in 1100 "BL wait_until_remote_button_is_released\n" // +
445 "BL wait_until_remote_button_is_released\n" // +
446
447
448
449
450
451 "BL capt_seq_hook_set_nr\n" // +
452 "BL sub_FF93B260\n" // Continue in the original FW
453 );
454 }
455
456 // Extracted method: task_ExpDrvTask (FF8B478C)
457 void __attribute__((naked,noinline)) exp_drv_task()
458 {
459 asm volatile (
460 "STMFD SP!, {R4-R8,LR}\n"
461 "SUB SP, SP, #0x20\n"
462 "LDR R8, =0xBB8\n"
463 "LDR R7, =0x6A50\n"
464 "LDR R5, =0x3DEE0\n"
465 "MOV R0, #0\n"
466 "ADD R6, SP, #0x38-0x28\n"
467 "STR R0, [SP,#0x38-0x2C]\n"
468
469 "loc_FF8B47AC:\n"
470 "LDR R0, [R7,#0x20]\n"
471 "MOV R2, #0\n"
472 "ADD R1, SP, #0x38-0x1C\n"
473 "BL sub_FF827D8C\n" // LOCATION: KerQueue.c:0
474 "LDR R0, [SP,#0x38-0x2C]\n"
475 "CMP R0, #1\n"
476 "BNE loc_FF8B47F4\n"
477 "LDR R0, [SP,#0x38-0x1C]\n"
478 "LDR R0, [R0]\n"
479 "CMP R0, #0x13\n"
480 "CMPNE R0, #0x14\n"
481 "CMPNE R0, #0x15\n"
482 "BEQ loc_FF8B4910\n"
483 "CMP R0, #0x27\n"
484 "BEQ loc_FF8B48E8\n"
485 "ADD R1, SP, #0x38-0x2C\n"
486 "MOV R0, #0\n"
487 "BL sub_FF8B473C\n" // LOCATION: ExpDrv.c:512
488
489 "loc_FF8B47F4:\n"
490 "LDR R0, [SP,#0x38-0x1C]\n"
491 "LDR R1, [R0]\n"
492 "CMP R1, #0x2C\n"
493 "BNE loc_FF8B4824\n"
494 "LDR R0, [SP,#0x38-0x1C]\n"
495 "BL sub_FF8B59F8\n" // LOCATION: ExpDrv.c:268
496 "LDR R0, [R7,#0x1C]\n"
497 "MOV R1, #1\n"
498 "BL sub_FF827B08\n"
499 "BL sub_FF81BAA8\n" // eventproc_export_ExitTask
500 "ADD SP, SP, #0x20\n"
501 "LDMFD SP!, {R4-R8,PC}\n"
502
503 "loc_FF8B4824:\n"
504 "CMP R1, #0x2B\n"
505 "BNE loc_FF8B4840\n"
506 "LDR R2, [R0,#0x88]!\n"
507 "LDR R1, [R0,#4]\n"
508 "MOV R0, R1\n"
509 "BLX R2\n"
510 "B loc_FF8B4D78\n"
511
512 "loc_FF8B4840:\n"
513 "CMP R1, #0x25\n"
514 "BNE loc_FF8B4890\n"
515 "LDR R0, [R7,#0x1C]\n"
516 "MOV R1, #0x80\n"
517 "BL sub_FF827B3C\n"
518 "LDR R0, =0xFF8B11C4\n"
519 "MOV R1, #0x80\n"
520 "BL sub_FF92D4BC\n" // LOCATION: IrisController.c:74
521 "LDR R0, [R7,#0x1C]\n"
522 "MOV R2, R8\n"
523 "MOV R1, #0x80\n"
524 "BL sub_FF827A40\n" // LOCATION: KerFlag.c:0
525 "TST R0, #1\n"
526 "LDRNE R1, =0xD1B\n"
527 "BNE loc_FF8B48D4\n"
528
529 "loc_FF8B487C:\n"
530 "LDR R1, [SP,#0x38-0x1C]\n"
531 "LDR R0, [R1,#0x8C]\n"
532 "LDR R1, [R1,#0x88]\n"
533 "BLX R1\n"
534 "B loc_FF8B4D78\n"
535
536 "loc_FF8B4890:\n"
537 "CMP R1, #0x26\n"
538 "BNE loc_FF8B48E0\n"
539 "ADD R1, SP, #0x38-0x2C\n"
540 "BL sub_FF8B473C\n" // LOCATION: ExpDrv.c:512
541 "LDR R0, [R7,#0x1C]\n"
542 "MOV R1, #0x100\n"
543 "BL sub_FF827B3C\n"
544 "LDR R0, =0xFF8B11D4\n"
545 "MOV R1, #0x100\n"
546 "BL sub_FF92D744\n" // LOCATION: IrisController.c:160
547 "LDR R0, [R7,#0x1C]\n"
548 "MOV R2, R8\n"
549 "MOV R1, #0x100\n"
550 "BL sub_FF827A40\n" // LOCATION: KerFlag.c:0
551 "TST R0, #1\n"
552 "BEQ loc_FF8B487C\n"
553 "LDR R1, =0xD25\n"
554
555 "loc_FF8B48D4:\n"
556 "LDR R0, =0xFF8B18C4\n" // "ExpDrv.c"
557 "BL _DebugAssert\n"
558 "B loc_FF8B487C\n"
559
560 "loc_FF8B48E0:\n"
561 "CMP R1, #0x27\n"
562 "BNE loc_FF8B48F8\n"
563
564 "loc_FF8B48E8:\n"
565 "LDR R0, [SP,#0x38-0x1C]\n"
566 "ADD R1, SP, #0x38-0x2C\n"
567 "BL sub_FF8B473C\n" // LOCATION: ExpDrv.c:512
568 "B loc_FF8B487C\n"
569
570 "loc_FF8B48F8:\n"
571 "CMP R1, #0x2A\n"
572 "BNE loc_FF8B4910\n"
573 "BL sub_FF893B08\n" // LOCATION: Shutter.c:2
574 "BL sub_FF8948D4\n" // LOCATION: ImgPixel.c:0
575 "BL sub_FF894358\n" // LOCATION: ImgGain.c:0
576 "B loc_FF8B487C\n"
577
578 "loc_FF8B4910:\n"
579 "LDR R0, [SP,#0x38-0x1C]\n"
580 "MOV R4, #1\n"
581 "LDR R1, [R0]\n"
582 "CMP R1, #0x11\n"
583 "CMPNE R1, #0x12\n"
584 "BNE loc_FF8B4980\n"
585 "LDR R1, [R0,#0x7C]\n"
586 "ADD R1, R1, R1,LSL#1\n"
587 "ADD R1, R0, R1,LSL#2\n"
588 "SUB R1, R1, #8\n"
589 "LDMIA R1, {R2-R4}\n"
590 "STMIA R6, {R2-R4}\n"
591 "BL sub_FF8B3250\n" // LOCATION: ExpDrv.c:2
592 "LDR R0, [SP,#0x38-0x1C]\n"
593 "LDR R1, [R0,#0x7C]\n"
594 "LDR R3, [R0,#0x88]\n"
595 "LDR R2, [R0,#0x8C]\n"
596 "ADD R0, R0, #4\n"
597 "BLX R3\n"
598 "LDR R0, [SP,#0x38-0x1C]\n"
599 "BL sub_FF8B5DCC\n" // LOCATION: ExpDrv.c:0
600 "LDR R0, [SP,#0x38-0x1C]\n"
601 "LDR R1, [R0,#0x7C]\n"
602 "LDR R3, [R0,#0x90]\n"
603 "LDR R2, [R0,#0x94]\n"
604 "ADD R0, R0, #4\n"
605 "BLX R3\n"
606 "B loc_FF8B4CB8\n"
607
608 "loc_FF8B4980:\n"
609 "CMP R1, #0x13\n"
610 "CMPNE R1, #0x14\n"
611 "CMPNE R1, #0x15\n"
612 "BNE loc_FF8B4A34\n"
613 "ADD R3, SP, #0x38-0x2C\n"
614 "MOV R2, SP\n"
615 "ADD R1, SP, #0x38-0x28\n"
616 "BL sub_FF8B3498\n" // LOCATION: ExpDrv.c:0
617 "CMP R0, #1\n"
618 "MOV R4, R0\n"
619 "CMPNE R4, #5\n"
620 "BNE loc_FF8B49D0\n"
621 "LDR R0, [SP,#0x38-0x1C]\n"
622 "MOV R2, R4\n"
623 "LDR R1, [R0,#0x7C]!\n"
624 "LDR R12, [R0,#0xC]!\n"
625 "LDR R3, [R0,#4]\n"
626 "MOV R0, SP\n"
627 "BLX R12\n"
628 "B loc_FF8B4A08\n"
629
630 "loc_FF8B49D0:\n"
631 "LDR R0, [SP,#0x38-0x1C]\n"
632 "CMP R4, #2\n"
633 "LDR R3, [R0,#0x8C]\n"
634 "CMPNE R4, #6\n"
635 "BNE loc_FF8B4A1C\n"
636 "LDR R12, [R0,#0x88]\n"
637 "MOV R0, SP\n"
638 "MOV R2, R4\n"
639 "MOV R1, #1\n"
640 "BLX R12\n"
641 "LDR R0, [SP,#0x38-0x1C]\n"
642 "MOV R2, SP\n"
643 "ADD R1, SP, #0x38-0x28\n"
644 "BL sub_FF8B4450\n" // LOCATION: ExpDrv.c:0
645
646 "loc_FF8B4A08:\n"
647 "LDR R0, [SP,#0x38-0x1C]\n"
648 "LDR R2, [SP,#0x38-0x2C]\n"
649 "MOV R1, R4\n"
650 "BL sub_FF8B46DC\n" // LOCATION: ExpDrv.c:2
651 "B loc_FF8B4CB8\n"
652
653 "loc_FF8B4A1C:\n"
654 "LDR R1, [R0,#0x7C]\n"
655 "LDR R12, [R0,#0x88]\n"
656 "ADD R0, R0, #4\n"
657 "MOV R2, R4\n"
658 "BLX R12\n"
659 "B loc_FF8B4CB8\n"
660
661 "loc_FF8B4A34:\n"
662 "CMP R1, #0x21\n"
663 "CMPNE R1, #0x22\n"
664 "BNE loc_FF8B4A80\n"
665 "LDR R1, [R0,#0x7C]\n"
666 "ADD R1, R1, R1,LSL#1\n"
667 "ADD R1, R0, R1,LSL#2\n"
668 "SUB R1, R1, #8\n"
669 "LDMIA R1, {R2-R4}\n"
670 "STMIA R6, {R2-R4}\n"
671 "BL sub_FF8B27DC\n" // LOCATION: ExpDrv.c:0
672 "LDR R0, [SP,#0x38-0x1C]\n"
673 "LDR R1, [R0,#0x7C]\n"
674 "LDR R3, [R0,#0x88]\n"
675 "LDR R2, [R0,#0x8C]\n"
676 "ADD R0, R0, #4\n"
677 "BLX R3\n"
678 "LDR R0, [SP,#0x38-0x1C]\n"
679 "BL sub_FF8B2ACC\n" // LOCATION: ExpDrv.c:0
680 "B loc_FF8B4CB8\n"
681
682 "loc_FF8B4A80:\n"
683 "ADD R1, R0, #4\n"
684 "LDMIA R1, {R2,R3,R12}\n"
685 "STMIA R6, {R2,R3,R12}\n"
686 "LDR R1, [R0]\n"
687 "CMP R1, #0x24\n"
688 "ADDLS PC, PC, R1,LSL#2\n"
689 "B loc_FF8B4C98\n"
690
691 "loc_FF8B4A9C:\n"
692 "B loc_FF8B4B30\n"
693
694 "loc_FF8B4AA0:\n"
695 "B loc_FF8B4B30\n"
696
697 "loc_FF8B4AA4:\n"
698 "B loc_FF8B4B80\n"
699
700 "loc_FF8B4AA8:\n"
701 "B loc_FF8B4B88\n"
702
703 "loc_FF8B4AAC:\n"
704 "B loc_FF8B4B88\n"
705
706 "loc_FF8B4AB0:\n"
707 "B loc_FF8B4B88\n"
708
709 "loc_FF8B4AB4:\n"
710 "B loc_FF8B4B30\n"
711
712 "loc_FF8B4AB8:\n"
713 "B loc_FF8B4B80\n"
714
715 "loc_FF8B4ABC:\n"
716 "B loc_FF8B4B88\n"
717
718 "loc_FF8B4AC0:\n"
719 "B loc_FF8B4B88\n"
720
721 "loc_FF8B4AC4:\n"
722 "B loc_FF8B4BA0\n"
723
724 "loc_FF8B4AC8:\n"
725 "B loc_FF8B4BA0\n"
726
727 "loc_FF8B4ACC:\n"
728 "B loc_FF8B4C8C\n"
729
730 "loc_FF8B4AD0:\n"
731 "B loc_FF8B4C94\n"
732
733 "loc_FF8B4AD4:\n"
734 "B loc_FF8B4C94\n"
735
736 "loc_FF8B4AD8:\n"
737 "B loc_FF8B4C94\n"
738
739 "loc_FF8B4ADC:\n"
740 "B loc_FF8B4C94\n"
741
742 "loc_FF8B4AE0:\n"
743 "B loc_FF8B4C98\n"
744
745 "loc_FF8B4AE4:\n"
746 "B loc_FF8B4C98\n"
747
748 "loc_FF8B4AE8:\n"
749 "B loc_FF8B4C98\n"
750
751 "loc_FF8B4AEC:\n"
752 "B loc_FF8B4C98\n"
753
754 "loc_FF8B4AF0:\n"
755 "B loc_FF8B4C98\n"
756
757 "loc_FF8B4AF4:\n"
758 "B loc_FF8B4B90\n"
759
760 "loc_FF8B4AF8:\n"
761 "B loc_FF8B4B98\n"
762
763 "loc_FF8B4AFC:\n"
764 "B loc_FF8B4B98\n"
765
766 "loc_FF8B4B00:\n"
767 "B loc_FF8B4BAC\n"
768
769 "loc_FF8B4B04:\n"
770 "B loc_FF8B4BAC\n"
771
772 "loc_FF8B4B08:\n"
773 "B loc_FF8B4BB4\n"
774
775 "loc_FF8B4B0C:\n"
776 "B loc_FF8B4BE4\n"
777
778 "loc_FF8B4B10:\n"
779 "B loc_FF8B4C14\n"
780
781 "loc_FF8B4B14:\n"
782 "B loc_FF8B4C44\n"
783
784 "loc_FF8B4B18:\n"
785 "B loc_FF8B4C74\n"
786
787 "loc_FF8B4B1C:\n"
788 "B loc_FF8B4C74\n"
789
790 "loc_FF8B4B20:\n"
791 "B loc_FF8B4C98\n"
792
793 "loc_FF8B4B24:\n"
794 "B loc_FF8B4C98\n"
795
796 "loc_FF8B4B28:\n"
797 "B loc_FF8B4C7C\n"
798
799 "loc_FF8B4B2C:\n"
800 "B loc_FF8B4C84\n"
801
802 "loc_FF8B4B30:\n"
803 // jumptable FF8B4A94 entries 0,1,6
804 "BL sub_FF8B16AC\n" // LOCATION: ExpDrv.c:800
805 "B loc_FF8B4C98\n"
806
807 "loc_FF8B4B80:\n"
808 // jumptable FF8B4A94 entries 2,7
809 "BL sub_FF8B193C\n" // LOCATION: ExpDrv.c:0
810 "B loc_FF8B4C98\n"
811
812 "loc_FF8B4B88:\n"
813 // jumptable FF8B4A94 entries 3-5,8,9
814 "BL sub_FF8B1B40\n" // LOCATION: ExpDrv.c:0
815 "B loc_FF8B4C98\n"
816
817 "loc_FF8B4B90:\n"
818 // jumptable FF8B4A94 entry 22
819 "BL sub_FF8B1DA8\n" // LOCATION: ExpDrv.c:2
820 "B loc_FF8B4C98\n"
821
822 "loc_FF8B4B98:\n"
823 // jumptable FF8B4A94 entries 23,24
824 "BL sub_FF8B1F9C\n" // LOCATION: ExpDrv.c:11
825 "B loc_FF8B4C98\n"
826
827 "loc_FF8B4BA0:\n"
828 // jumptable FF8B4A94 entries 10,11
829 //"BL sub_FF8B2204\n" // LOCATION: ExpDrv.c:2
830 "BL sub_FF8B2204_my\n" //------------>
831 "MOV R4, #0\n"
832 "B loc_FF8B4C98\n"
833
834 "loc_FF8B4BAC:\n"
835 // jumptable FF8B4A94 entries 25,26
836 "BL sub_FF8B2340\n"
837 "B loc_FF8B4C98\n"
838
839 "loc_FF8B4BB4:\n"
840 // jumptable FF8B4A94 entry 27
841 "LDRH R1, [R0,#4]\n"
842 "STRH R1, [SP,#0x38-0x28]\n"
843 "LDRH R1, [R5,#2]\n"
844 "STRH R1, [SP,#0x38-0x26]\n"
845 "LDRH R1, [R5,#4]\n"
846 "STRH R1, [SP,#0x38-0x24]\n"
847 "LDRH R1, [R5,#6]\n"
848 "STRH R1, [SP,#0x38-0x22]\n"
849 "LDRH R1, [R0,#0xC]\n"
850 "STRH R1, [SP,#0x38-0x20]\n"
851 "BL sub_FF8B5A6C\n" // LOCATION: ExpDrv.c:2
852 "B loc_FF8B4C98\n"
853
854 "loc_FF8B4BE4:\n"
855 // jumptable FF8B4A94 entry 28
856 "LDRH R1, [R0,#4]\n"
857 "STRH R1, [SP,#0x38-0x28]\n"
858 "LDRH R1, [R5,#2]\n"
859 "STRH R1, [SP,#0x38-0x26]\n"
860 "LDRH R1, [R5,#4]\n"
861 "STRH R1, [SP,#0x38-0x24]\n"
862 "LDRH R1, [R5,#6]\n"
863 "STRH R1, [SP,#0x38-0x22]\n"
864 "LDRH R1, [R5,#8]\n"
865 "STRH R1, [SP,#0x38-0x20]\n"
866 "BL sub_FF8B5BE8\n" // LOCATION: ExpDrv.c:2
867 "B loc_FF8B4C98\n"
868
869 "loc_FF8B4C14:\n"
870 // jumptable FF8B4A94 entry 29
871 "LDRH R1, [R5]\n"
872 "STRH R1, [SP,#0x38-0x28]\n"
873 "LDRH R1, [R0,#6]\n"
874 "STRH R1, [SP,#0x38-0x26]\n"
875 "LDRH R1, [R5,#4]\n"
876 "STRH R1, [SP,#0x38-0x24]\n"
877 "LDRH R1, [R5,#6]\n"
878 "STRH R1, [SP,#0x38-0x22]\n"
879 "LDRH R1, [R5,#8]\n"
880 "STRH R1, [SP,#0x38-0x20]\n"
881 "BL sub_FF8B5C94\n" // LOCATION: ExpDrv.c:0
882 "B loc_FF8B4C98\n"
883
884 "loc_FF8B4C44:\n"
885 // jumptable FF8B4A94 entry 30
886 "LDRH R1, [R5]\n"
887 "STRH R1, [SP,#0x38-0x28]\n"
888 "LDRH R1, [R5,#2]\n"
889 "STRH R1, [SP,#0x38-0x26]\n"
890 "LDRH R1, [R5,#4]\n"
891 "STRH R1, [SP,#0x38-0x24]\n"
892 "LDRH R1, [R5,#6]\n"
893 "STRH R1, [SP,#0x38-0x22]\n"
894 "LDRH R1, [R0,#0xC]\n"
895 "STRH R1, [SP,#0x38-0x20]\n"
896 "BL sub_FF8B5D34\n" // LOCATION: ExpDrv.c:32
897 "B loc_FF8B4C98\n"
898
899 "loc_FF8B4C74:\n"
900 // jumptable FF8B4A94 entries 31,32
901 "BL sub_FF8B25B4\n" // LOCATION: ExpDrv.c:0
902 "B loc_FF8B4C98\n"
903
904 "loc_FF8B4C7C:\n"
905 // jumptable FF8B4A94 entry 35
906 "BL sub_FF8B2BD0\n" // LOCATION: ExpDrv.c:10
907 "B loc_FF8B4C98\n"
908
909 "loc_FF8B4C84:\n"
910 // jumptable FF8B4A94 entry 36
911 "BL sub_FF8B2E08\n" // LOCATION: ExpDrv.c:0
912 "B loc_FF8B4C98\n"
913
914 "loc_FF8B4C8C:\n"
915 // jumptable FF8B4A94 entry 12
916 "BL sub_FF8B2F80\n" // LOCATION: ExpDrv.c:2
917 "B loc_FF8B4C98\n"
918
919 "loc_FF8B4C94:\n"
920 // jumptable FF8B4A94 entries 13-16
921 "BL sub_FF8B3118\n" // LOCATION: ExpDrv.c:128
922
923 "loc_FF8B4C98:\n"
924 // jumptable FF8B4A94 default entry
925 // jumptable FF8B4A94 entries 17-21,33,34
926 "LDR R0, [SP,#0x38-0x1C]\n"
927 "LDR R1, [R0,#0x7C]\n"
928 "LDR R3, [R0,#0x88]\n"
929 "LDR R2, [R0,#0x8C]\n"
930 "ADD R0, R0, #4\n"
931 "BLX R3\n"
932 "CMP R4, #1\n"
933 "BNE loc_FF8B4D00\n"
934
935 "loc_FF8B4CB8:\n"
936 "LDR R0, [SP,#0x38-0x1C]\n"
937 "MOV R2, #0xC\n"
938 "LDR R1, [R0,#0x7C]\n"
939 "ADD R1, R1, R1,LSL#1\n"
940 "ADD R0, R0, R1,LSL#2\n"
941 "SUB R4, R0, #8\n"
942 "LDR R0, =0x3DEE0\n"
943 "ADD R1, SP, #0x38-0x28\n"
944 "BL sub_FFAA6D50\n"
945 "LDR R0, =0x3DEEC\n"
946 "MOV R2, #0xC\n"
947 "ADD R1, SP, #0x38-0x28\n"
948 "BL sub_FFAA6D50\n"
949 "LDR R0, =0x3DEF8\n"
950 "MOV R2, #0xC\n"
951 "MOV R1, R4\n"
952 "BL sub_FFAA6D50\n"
953 "B loc_FF8B4D78\n"
954
955 "loc_FF8B4D00:\n"
956 "LDR R0, [SP,#0x38-0x1C]\n"
957 "LDR R0, [R0]\n"
958 "CMP R0, #0xB\n"
959 "BNE loc_FF8B4D48\n"
960 "MOV R3, #0\n"
961 "STR R3, [SP,#0x38-0x38]\n"
962 "MOV R3, #1\n"
963 "MOV R2, #1\n"
964 "MOV R1, #1\n"
965 "MOV R0, #0\n"
966 "BL sub_FF8B14B4\n"
967 "MOV R3, #0\n"
968 "STR R3, [SP,#0x38-0x38]\n"
969 "MOV R3, #1\n"
970 "MOV R2, #1\n"
971 "MOV R1, #1\n"
972 "MOV R0, #0\n"
973 "B loc_FF8B4D74\n"
974
975 "loc_FF8B4D48:\n"
976 "MOV R3, #1\n"
977 "MOV R2, #1\n"
978 "MOV R1, #1\n"
979 "MOV R0, #1\n"
980 "STR R3, [SP,#0x38-0x38]\n"
981 "BL sub_FF8B14B4\n"
982 "MOV R3, #1\n"
983 "MOV R2, #1\n"
984 "MOV R1, #1\n"
985 "MOV R0, #1\n"
986 "STR R3, [SP,#0x38-0x38]\n"
987
988 "loc_FF8B4D74:\n"
989 "BL sub_FF8B15F4\n"
990
991 "loc_FF8B4D78:\n"
992 "LDR R0, [SP,#0x38-0x1C]\n"
993 "BL sub_FF8B59F8\n" // LOCATION: ExpDrv.c:268
994 "B loc_FF8B47AC\n"
995 );
996 }
997
998 void __attribute__((naked,noinline)) sub_FF8B2204_my()
999 {
1000 asm volatile (
1001 "STMFD SP!, {R4-R8,LR}\n"
1002 "LDR R7, =0x6A50\n"
1003 "MOV R4, R0\n"
1004 "LDR R0, [R7,#0x1C]\n"
1005 "MOV R1, #0x3E\n"
1006 "BL sub_FF827B3C\n"
1007 "LDRSH R0, [R4,#4]\n"
1008 "MOV R2, #0\n"
1009 "MOV R1, #0\n"
1010 "BL sub_FF8B1248\n"
1011 "MOV R6, R0\n"
1012 "LDRSH R0, [R4,#6]\n"
1013 "BL sub_FF8B1354\n"
1014 "LDRSH R0, [R4,#8]\n"
1015 "BL sub_FF8B13AC\n"
1016 "LDRSH R0, [R4,#0xA]\n"
1017 "BL sub_FF8B1404\n"
1018 "LDRSH R0, [R4,#0xC]\n"
1019 "BL sub_FF8B145C\n"
1020 "MOV R5, R0\n"
1021 "LDR R0, [R4]\n"
1022 "LDR R8, =0x3DEF8\n"
1023 "CMP R0, #0xB\n"
1024 "MOVEQ R6, #0\n"
1025 "MOVEQ R5, #0\n"
1026 "BEQ loc_FF8B2294\n"
1027 "CMP R6, #1\n"
1028 "BNE loc_FF8B2294\n"
1029 "LDRSH R0, [R4,#4]\n"
1030 "LDR R1, =0xFF8B11B4\n"
1031 "MOV R2, #2\n"
1032 "BL sub_FF92D610\n" // LOCATION: IrisController.c:117
1033 "STRH R0, [R4,#4]\n"
1034 "MOV R0, #0\n"
1035 "STR R0, [R7,#0x28]\n"
1036 "B loc_FF8B229C\n"
1037
1038 "loc_FF8B2294:\n"
1039 "LDRH R0, [R8]\n"
1040 "STRH R0, [R4,#4]\n"
1041
1042 "loc_FF8B229C:\n"
1043 "CMP R5, #1\n"
1044 "LDRNEH R0, [R8,#8]\n"
1045 "BNE loc_FF8B22B8\n"
1046 "LDRSH R0, [R4,#0xC]\n"
1047 "MOV R2, #0x20\n"
1048 "LDR R1, =0xFF8B1238\n"
1049 "BL sub_FF8B5A28\n"
1050
1051 "loc_FF8B22B8:\n"
1052 "STRH R0, [R4,#0xC]\n"
1053 "LDRSH R0, [R4,#6]\n"
1054 //"BL sub_FF893854\n" // LOCATION: Shutter.c:0
1055 "BL sub_FF893854_my\n" //------------>
1056 "LDRSH R0, [R4,#8]\n"
1057 "MOV R1, #1\n"
1058 "BL sub_FF894050\n" // LOCATION: ImgGain.c:0
1059 "MOV R1, #0\n"
1060 "ADD R0, R4, #8\n"
1061 "BL sub_FF8940D8\n" // LOCATION: ImgGain.c:0
1062 "LDRSH R0, [R4,#0xE]\n"
1063 "BL sub_FF8A8170\n" // LOCATION: BrtCrct.c:552
1064 "LDR R4, =0xBB8\n"
1065 "CMP R6, #1\n"
1066 "BNE loc_FF8B2310\n"
1067 "LDR R0, [R7,#0x1C]\n"
1068 "MOV R2, R4\n"
1069 "MOV R1, #2\n"
1070 "BL sub_FF827A40\n" // LOCATION: KerFlag.c:0
1071 "TST R0, #1\n"
1072 "LDRNE R1, =0x532\n"
1073 "LDRNE R0, =0xFF8B18C4\n" // "ExpDrv.c"
1074 "BLNE _DebugAssert\n"
1075
1076 "loc_FF8B2310:\n"
1077 "CMP R5, #1\n"
1078 "LDMNEFD SP!, {R4-R8,PC}\n"
1079 "LDR R0, [R7,#0x1C]\n"
1080 "MOV R2, R4\n"
1081 "MOV R1, #0x20\n"
1082 "BL sub_FF827A40\n" // LOCATION: KerFlag.c:0
1083 "TST R0, #1\n"
1084 "LDRNE R1, =0x537\n"
1085 "LDRNE R0, =0xFF8B18C4\n" // "ExpDrv.c"
1086 "LDMNEFD SP!, {R4-R8,LR}\n"
1087 "BNE _DebugAssert\n"
1088 "LDMFD SP!, {R4-R8,PC}\n"
1089 );
1090 }
1091
1092 void __attribute__((naked,noinline)) sub_FF893854_my()
1093 {
1094 asm volatile (
1095 "STMFD SP!, {R4-R6,LR}\n"
1096 "LDR R5, =0x650C\n"
1097 "MOV R4, R0\n"
1098 "LDR R0, [R5,#4]\n"
1099 "CMP R0, #1\n"
1100 "LDRNE R1, =0x16D\n"
1101 "LDRNE R0, =0xFF8935EC\n" // "Shutter.c"
1102 "BLNE _DebugAssert\n"
1103 "CMN R4, #0xC00\n"
1104 "LDREQSH R4, [R5,#2]\n"
1105 "CMN R4, #0xC00\n"
1106 "LDREQ R1, =0x173\n"
1107 "LDREQ R0, =0xFF8935EC\n" // "Shutter.c"
1108 "STRH R4, [R5,#2]\n"
1109 "BLEQ _DebugAssert\n"
1110 "MOV R0, R4\n"
1111 //"BL sub_FF9AD5A8\n"
1112 "BL apex2us\n" // +
1113 "MOV R4, R0\n"
1114 "BL sub_FF8C32F4\n" // nullsub_67
1115 "MOV R0, R4\n"
1116 "BL sub_FF8C77E4\n"
1117 "TST R0, #1\n"
1118 "LDMNEFD SP!, {R4-R6,LR}\n"
1119 "MOVNE R1, #0x178\n"
1120 "LDRNE R0, =0xFF8935EC\n" // "Shutter.c"
1121 "BNE _DebugAssert\n"
1122 "LDMFD SP!, {R4-R6,PC}\n"
1123 );
1124 }
1125
1126
1127 /* exemplo debug
1128 "STMFD SP!, {R0-R11,LR}\n"
1129 );
1130 debug_led(1);
1131 int c = 500000;
1132 while (c--) {asm("nop\n nop\n");};
1133 debug_led(0);
1134 asm volatile (
1135 "LDMFD SP!, {R0-R11,LR}\n"
1136 */
1137