1 #include "lolevel.h"
2 #include "platform.h"
3 #include "core.h"
4
5 #define NR_ON (2)
6 #define NR_OFF (1)
7 #define NR_AUTO (0)
8
9 static long *nrflag = (long*)0x5c5c;
10
11 #include "../../../generic/capt_seq.c"
12
13 /*
14 from debug strings:
15 [0x5c58]: defect correct setting (0=according to table, 1=off, 2=normal, 3=long)
16 [0x5c5c]: darksub setting (0=according to table, 1=off, 2=on)
17 */
18
19 /*
20 void __attribute__((naked,noinline)) sub_FF9460CC_my()
21 {
22 asm volatile (
23 " STMFD SP!, {R4,R5,LR}\n"
24 " MOV R0, R0,LSL#16\n"
25 " MOV R4, R1,LSL#16\n"
26 " MOV R4, R4,ASR#16\n"
27 " MOV R0, R0,LSR#16\n"
28 " MOV R5, R2,LSL#16\n"
29 " BL sub_FF945FD8\n"
30 " MOV R1, R4\n"
31 " BL sub_FF946024\n"
32 " MOV R5, R5,ASR#16\n"
33 " MOV R4, R0\n"
34 " MOV R0, R5\n"
35 " BL sub_FF946078\n"
36 " LDR R3, =0x5C5C\n"
37 " LDR R2, =0x5C18\n"
38 " LDR R3, [R3]\n" // dark frame sub setting
39 " ADD R0, R0, R4,LSL#2\n"
40 " LDR R0, [R2,R0,LSL#2]\n"
41 " CMP R3, #0\n"
42 " BIC R2, R0, #1\n"
43 " BEQ loc_FF946130\n"
44 " CMP R3, #1\n"
45 " MOVEQ R0, R2\n"
46 " CMP R3, #2\n"
47 " ORREQ R0, R0, #1\n"
48 "loc_FF946130:\n"
49 " LDR R3, =0x5C58\n"
50 " LDR R1, [R3]\n" // defect correct setting
51 " CMP R1, #0\n"
52 " BIC R2, R0, #6\n"
53 " LDEQMFD SP!, {R4,R5,PC}\n"
54 " CMP R1, #1\n"
55 " MOVEQ R0, R2\n"
56 " ORR R3, R0, #2\n"
57 " CMP R1, #2\n"
58 " BIC R3, R3, #4\n"
59 " MOVEQ R0, R3\n"
60 " ORR R2, R0, #6\n"
61 " CMP R1, #3\n"
62 " MOVEQ R0, R2\n"
63 " LDMFD SP!, {R4,R5,PC}\n"
64 );
65 }
66 */
67
68 /*
69 void __attribute__((naked,noinline)) sub_FF942DB8_my()
70 {
71 asm volatile (
72 " STMFD SP!, {R4-R8,LR}\n"
73 " LDR R6, =0xFF941E68\n"
74 " SUB SP, SP, #4\n"
75 " MOV R8, #0\n"
76 " LDR R3, =0x5AF4\n"
77 " LDR R2, [R3]\n"
78 " LDRH R1, [R2,#2]\n"
79 " CMP R1, #1\n"
80 " BNE loc_FF942DF0\n"
81 " LDR R3, =0x5B30\n"
82 " LDR R2, [R3]\n"
83 " LDR R1, [R2,#8]\n"
84 " CMP R1, #1\n"
85 " BHI loc_FF942E24\n"
86 "loc_FF942DF0:\n"
87 " LDR R3, =0x5AF0\n"
88 " LDR R2, [R3]\n"
89 " LDRH R1, [R2]\n"
90 " CMP R1, #9\n"
91 " LDR R5, =0xFF941E18\n"
92 " BNE loc_FF942E28\n"
93 " LDR R3, =0x5B30\n"
94 " LDR R2, [R3]\n"
95 " LDR R1, [R2,#8]\n"
96 " LDR R3, =0xFF941E40\n"
97 " CMP R1, #1\n"
98 " MOVHI R5, R3\n"
99 " B loc_FF942E28\n"
100 "loc_FF942E24:\n"
101 " MOV R5, R6\n"
102 "loc_FF942E28:\n"
103 " LDR R7, =0x5B0C\n"
104 " LDR R3, [R7]\n"
105 " MOV R12, #0\n"
106 " TST R3, #1\n"
107 " MOV R0, R12\n"
108 " MOVNE R3, R6\n"
109 " MOVEQ R3, R5\n"
110 " LDR R1, =0xFF941D60\n"
111 " MOV R2, R0\n"
112 " STR R12, [SP]\n"
113 " BL sub_FF8B525C\n"
114 " ANDS R4, R0, #1\n"
115 " BEQ loc_FF942E70\n"
116 " LDR R2, =0x5AFC\n"
117 " MOV R3, #1\n"
118 " STR R3, [R2]\n"
119 " MOV R8, #0x1D\n"
120 " B loc_FF942F54\n"
121 "loc_FF942E70:\n"
122 " LDR R3, [R7]\n"
123 " TST R3, #1\n"
124 " BEQ loc_FF942EB0\n"
125 " MOV R0, #0x24\n"
126 " MOV R1, R4\n"
127 " MOV R6, R5\n"
128 " BL sub_FF999528\n"
129 " BL sub_FF8B5218\n"
130 " MOV R1, R4\n"
131 " MOV R0, R6\n"
132 " BL sub_FF8B53FC\n"
133 " ANDS R1, R0, #1\n"
134 " MOVNE R8, #1\n"
135 " BNE loc_FF942F54\n"
136 " MOV R0, #0x25\n"
137 " BL sub_FF999528\n"
138 "loc_FF942EB0:\n"
139 " MOV R1, #0\n"
140 " LDR R0, =0xFF941DFC\n"
141 " BL sub_FFA59594\n"
142 " LDR R3, =0x5AF4\n"
143 " LDR R2, [R3]\n"
144 " LDRH R1, [R2,#2]\n"
145 " CMP R1, #1\n"
146 " BNE loc_FF942EE4\n"
147 " LDR R3, =0x5B30\n"
148 " LDR R2, [R3]\n"
149 " LDR R1, [R2,#8]\n"
150 " CMP R1, #1\n"
151 " BHI loc_FF942F18\n"
152 "loc_FF942EE4:\n"
153 " LDR R3, =0x675C0\n"
154 " MOV R1, #8\n"
155 " MOV R2, #0x1380\n"
156 " LDR R0, [R3]\n"
157 " ADD R2, R2, R1\n"
158 " BL sub_FF94E4B8\n"
159 " CMP R0, #0\n"
160 " BEQ loc_FF942F18\n"
161 " MOV R2, #0x4F0\n"
162 " LDR R0, =0xFF942D60\n"
163 " LDR R1, =0xFF941950\n"
164 " ADD R2, R2, #5\n"
165 " BL sub_FF814C10\n"
166 "loc_FF942F18:\n"
167 " LDR R3, =0x5B0C\n"
168 " LDR R3, [R3]\n"
169 " TST R3, #4\n"
170 " BEQ loc_FF942F3C\n"
171 " LDR R3, =0x5B30\n"
172 " LDR R2, [R3]\n"
173 " LDR R0, [R2,#0x10]\n"
174 " BL sub_FF91FCF8\n"
175 " B loc_FF942F54\n"
176 "loc_FF942F3C:\n"
177 " TST R3, #2\n"
178 " BEQ loc_FF942F54\n"
179 " LDR R3, =0x5B30\n"
180 " LDR R2, [R3]\n"
181 " LDR R0, [R2,#0x10]\n"
182 " BL sub_FF91FCC4\n"
183 "loc_FF942F54:\n"
184 " MOV R0, R8\n"
185 " ADD SP, SP, #4\n"
186 " LDMFD SP!, {R4-R8,PC}\n"
187 );
188 }
189 */
190
191 void __attribute__((naked,noinline)) sub_FF94195C_my()
192 {
193 asm volatile (
194 " STMFD SP!, {R4,R5,LR}\n"
195 " BL sub_FF98A60C\n"
196 " LDR R5, =0x5B14\n"
197 " LDR R3, =0x5B10\n"
198 " MOV R2, #0x1C\n"
199 " LDR R1, [R3]\n"
200 " MOV R0, R5\n"
201 " BL sub_FFABC0A0\n" // memcpy
202 " BL sub_FF82CF00\n"
203 " LDR R4, =0x5B30\n"
204 " MOV R3, R0\n"
205 " LDR R12, [R4]\n"
206 " MOV R2, #0x154\n"
207 " TST R3, #1\n"
208 " LDR R1, =0xFF941950\n" // CaptSeq.c
209 " ADD R2, R2, #3\n"
210 " LDR R0, =0xFF941918\n" // !( (((ERROR_T)( m_pCaptInfo->hPropertyCase ))&1) == 1 )
211 " STR R3, [R12,#4]\n"
212 " BEQ loc_FF9419AC\n"
213 " BL sub_FF814C10\n" // debugassert
214 "loc_FF9419AC:\n"
215 " BL sub_FFA484D8\n"
216 " LDR R2, [R4]\n"
217 " LDR R3, =0x5AF4\n"
218 " STRH R0, [R2,#0x14]\n"
219 " LDR R1, [R3]\n"
220 " LDRH R0, [R1,#0x10]\n"
221 " LDRSH R1, [R2,#0x14]\n"
222 " LDRSH R2, [R5,#8]\n"
223 "BL capt_seq_hook_set_nr\n" // +
224 " BL sub_FF9460CC\n" // nr and defect correct settings read
225 " LDR R3, =0x5AF0\n"
226 " LDR R2, [R3]\n"
227 " LDR R1, [R2,#4]\n"
228 " LDR R2, =0x5B0C\n"
229 " CMP R1, #2\n"
230 " STR R0, [R2]\n" // evaluated nr & defect correct setting stored here [5b0c]
231 " MOVEQ R3, #0\n"
232 " STREQ R3, [R2]\n"
233 " LDMFD SP!, {R4,R5,PC}\n"
234 );
235 }
236
237 void __attribute__((naked,noinline)) sub_ff943074_my()
238 {
239 asm volatile (
240 " STMFD SP!, {R4-R6,LR}\n"
241 " LDR R3, =0x5AF0\n"
242 " LDR R2, [R3]\n"
243 " CMP R2, #0\n"
244 " BEQ loc_FF9430B8\n"
245 " LDR R3, =0x5B10\n"
246 " LDR R2, [R3]\n"
247 " CMP R2, #0\n"
248 " BEQ loc_FF9430B8\n"
249 " LDR R3, =0x5AF4\n"
250 " LDR R2, [R3]\n"
251 " CMP R2, #0\n"
252 " BEQ loc_FF9430B8\n"
253 " LDR R3, =0x5B30\n"
254 " LDR R2, [R3]\n"
255 " CMP R2, #0\n"
256 " BNE loc_FF9430CC\n"
257 "loc_FF9430B8:\n"
258 " MOV R2, #0x520\n"
259 " LDR R0, =0xff942f98\n" // "m_pSettingForPrepare != ((VOID*)0) &&..."
260 " LDR R1, =0xff941950\n" // "CaptSeq.c"
261 " ADD R2, R2, #2\n"
262 " BL sub_FF814C10\n"
263 "loc_FF9430CC:\n"
264 " BL sub_FF9417D0\n"
265 " CMP R0, #0\n"
266 " BNE loc_FF943108\n"
267 " LDR R3, =0x5B10\n"
268 " LDR R2, [R3]\n"
269 " LDR R1, [R2,#4]\n"
270 " CMP R1, #0\n"
271 " BEQ loc_FF943108\n"
272 " LDR R0, =0xff943020\n" //"\r\nCaptSeq::ChargeNotCompleted!!"
273 " BL sub_FFAC016C\n"
274 " LDR R0, =0xff943040\n" //"\r\nCaptSeq::WaitingStrobeCharge..."
275 " BL sub_FFAC016C\n"
276 " BL sub_FF941804\n"
277 " LDR R0, =0xff943064\n" //"Completed!!\r\n"
278 " BL sub_FFAC016C\n"
279 "loc_FF943108:\n"
280 " LDR R3, =0x675BC\n"
281 " MVN R4, #0\n"
282 " LDR R0, [R3]\n"
283 " MOV R1, R4\n"
284 " BL sub_FF821CB4\n"
285 " LDR R3, =0x675C0\n"
286 " MOV R1, R4\n"
287 " LDR R0, [R3]\n"
288 " BL sub_FF821CB4\n"
289 //before take
290 "BL shooting_expo_param_override\n" // +
291
292 " LDR R3, =0x5B00\n"
293 " LDR R3, [R3]\n"
294 " CMP R3, #1\n"
295 " CMPNE R3, #3\n"
296 " BEQ loc_FF94317C\n"
297 " CMP R3, #4\n"
298 " BEQ loc_FF94317C\n"
299 " LDR R3, =0x5AF4\n"
300 " LDR R2, [R3]\n"
301 " LDRH R1, [R2,#2]\n"
302 " CMP R1, #1\n"
303 " BNE loc_FF943178\n"
304 " LDR R3, =0x5B30\n"
305 " LDR R2, [R3]\n"
306 " LDR R1, [R2,#8]\n"
307 " CMP R1, #1\n"
308 " BLS loc_FF943178\n"
309 " BL sub_FF942110\n"
310 " B loc_FF94317C\n"
311 "loc_FF943178:\n"
312 " BL sub_FF942740\n"
313 "loc_FF94317C:\n"
314 " BL sub_FF942A28\n"
315 " MOV R4, R0\n"
316 " TST R4, #1\n"
317 " BEQ loc_FF9431C0\n"
318 " LDR R6, =0x5B44\n"
319 " LDR R2, [R6]\n"
320 " CMP R2, #0\n"
321 " BEQ loc_FF9431AC\n"
322 " LDR R3, =0x5B48\n"
323 " LDR R1, [R3]\n"
324 " MOV LR, PC\n"
325 " MOV PC, R2\n"
326 "loc_FF9431AC:\n"
327 " LDR R5, =0x675B8\n"
328 " MOV R1, #2\n"
329 " LDR R0, [R5]\n"
330 " BL sub_FF821B20\n"
331 " B loc_FF9431C8\n"
332 "loc_FF9431C0:\n"
333 " LDR R6, =0x5B44\n"
334 " LDR R5, =0x675B8\n"
335 "loc_FF9431C8:\n"
336 " BL sub_FF94195C_my\n" //-> some NR-related stuff inside (read)
337 " LDR R3, =0x5B34\n"
338 " LDR R2, [R3]\n" // seems to be 0xff940914 so far
339 " CMP R2, #0\n"
340 " BEQ loc_FF9431F0\n"
341 " LDR R3, =0x5B38\n"
342 " MOV R0, R4\n"
343 " LDR R1, [R3]\n"
344 " MOV LR, PC\n"
345 " MOV PC, R2\n" //R0 is 0xff945214 after this (so far)
346 "loc_FF9431F0:\n"
347 " BL sub_FF942C24\n"
348 " BL sub_FF942D10\n"
349 " BL sub_FF942DB8\n" // expo, apply nr and defect correct stuff (takes most time)
350 /*
351 execution times for the untouched routine (sub_FF942DB8):
352 4s expo w/NR takes 8480ms (if ticks are 1ms)
353 2s expo w/NR 4480ms
354 short expo 470ms
355 */
356 "BL capt_seq_hook_raw_here\n" // + seems to be a better place, no dng/jpg corruption so far
357 " LDR R2, [R6]\n" // 0xff94089c so far (launches resize/jpeg compression process, at least i guess so)
358 " CMP R2, #0\n"
359 " BEQ loc_FF943218\n"
360 " LDR R3, =0x5B48\n"
361 " LDR R1, [R3]\n"
362 " MOV LR, PC\n"
363 " MOV PC, R2\n" // R0 is 0xff945800 after this so far
364 "loc_FF943218:\n"
365 // "BL capt_seq_hook_raw_here\n" //bad place for this, dng routine clashes with the camera's resize/jpegcompress process which reuses the only raw buffer
366 " LDR R0, [R5]\n"
367 " MOV R1, #2\n"
368 " LDMFD SP!, {R4-R6,LR}\n"
369 " B sub_FF821B20\n"
370 );
371 }
372
373
374 void __attribute__((naked,noinline)) capt_seq_task() //@ff944904 in ixus30
375 {//THE CODE USES STRANGE JUMP TABLE! (starts at 0x5b50)
376 /* the table in ROM:
377 ffadb6f0: ff9425a4
378 ffadb6f4: ff943074
379 ffadb6f8: ff9427fc
380 ffadb6fc: ff942498
381 ffadb700: ff943604
382 ffadb704: ff94394c
383 ffadb708: ff943be8
384 ffadb70c: ff943d8c
385 ffadb710: ff943fcc
386 ffadb714: ff94419c
387 ffadb718: ff94429c
388 ffadb71c: ff944320
389 ffadb720: ff944588
390 ffadb724: ff94463c*/
391 asm volatile (
392 " STMFD SP!, {R4,R5,LR}\n"
393 " SUB SP, SP, #4\n"
394 //patching the jumptable
395 " LDR R4, =0x5b50\n" //+
396 " LDR R5, =sub_ff943074_my\n" //+
397 " STR R5, [R4, #4]\n" //+
398 //patching finished
399 " MOV R5, SP\n"
400 " B loc_FF944934\n"
401 "loc_FF944914:\n"
402 " LDR R12, [SP]\n"
403 " CMP R12, #0xD\n"
404 " BLS loc_FF944928\n"
405 " BL sub_FF814C10\n"
406 " LDR R12, [SP]\n"
407 " loc_FF944928:\n"
408 " STMFD SP!, {R0}\n" //+
409 " MOV R0, R12\n" //+
410 " BL set_shooting_status\n" //+ (shooting status hack)
411 " LDMFD SP!, {R0}\n" //+
412 " LDR R3, =0x5B50\n"
413 " MOV LR, PC\n"
414 " LDR PC, [R3,R12,LSL#2]\n"
415 "loc_FF944934:\n"
416 " LDR R3, =0x675C4\n"
417 " MOV R12, #0\n"
418 " LDR R4, =0x5AFC\n"
419 " MOV R2, R12\n"
420 " MOV R1, R5\n"
421 " LDR R0, [R3]\n"
422 " STR R12, [R4]\n"
423 " BL sub_FF822320\n"
424 " MOV R2, #0x7B0\n"
425 " TST R0, #1\n"
426 " LDR R1, =0xff941950\n" // "CaptSeq.c"
427 " ADD R2, R2, #5\n"
428 " LDR R0, =0xff9448ec\n" // "ReqID < CAPTSEQ_REQ_MAX"
429 " BEQ loc_FF944914\n"
430 " BL sub_FF823B44\n"
431 " ADD SP, SP, #4\n"
432 " LDMFD SP!, {R4,R5,PC}\n"
433 );
434 }
435
436
437 /*************************************************************/
438 //** exp_drv_task @ 0xFF8F5A80 - 0xFF8F5CAC, length=140
439 void __attribute__((naked,noinline)) exp_drv_task() {
440 asm volatile (
441 " STMFD SP!, {R4-R6,LR} \n"
442 " SUB SP, SP, #0xC \n"
443 " MOV R5, SP \n"
444 " B loc_FF8F5C68 \n"
445
446 "loc_FF8F5A90:\n"
447 " CMP R3, #0x11 \n"
448 " BNE loc_FF8F5AA8 \n"
449 " LDR R0, [R2, #0x2C] \n"
450 " MOV LR, PC \n"
451 " LDR PC, [R2, #0x28] \n"
452 " B loc_FF8F5AD8 \n"
453
454 "loc_FF8F5AA8:\n"
455 " CMP R3, #0xF \n"
456 " BNE loc_FF8F5AB8 \n"
457 " BL sub_FFA58810 \n"
458 " B loc_FF8F5AC8 \n"
459
460 "loc_FF8F5AB8:\n"
461 " CMP R3, #0x10 \n"
462 " BNE loc_FF8F5AE4 \n"
463 " BL sub_FF8A9150 \n"
464 " BL sub_FF8AB474 \n"
465
466 "loc_FF8F5AC8:\n"
467 " LDR R3, [SP] \n"
468 " LDR R0, [R3, #0x2C] \n"
469 " MOV LR, PC \n"
470 " LDR PC, [R3, #0x28] \n"
471
472 "loc_FF8F5AD8:\n"
473 " LDR R0, [SP] \n"
474 " BL sub_FF8F4944 \n"
475 " B loc_FF8F5C68 \n"
476
477 "loc_FF8F5AE4:\n"
478 " CMP R3, #0xB \n"
479 " MOV R6, #1 \n"
480 " BNE loc_FF8F5B54 \n"
481 " LDR R1, [R2, #0x24] \n"
482 " ADD R1, R1, R1, LSL#1 \n"
483 " ADD R4, SP, #4 \n"
484 " ADD R1, R2, R1, LSL#1 \n"
485 " SUB R1, R1, #2 \n"
486 " MOV R2, #6 \n"
487 " MOV R0, R4 \n"
488 " BL _memcpy \n"
489 " LDR R0, [SP] \n"
490 " BL sub_FF8F5478 \n"
491 " LDR R3, [SP] \n"
492 " LDR R1, [R3, #0x24] \n"
493 " LDR R2, [R3, #0x2C] \n"
494 " ADD R0, R3, #4 \n"
495 " MOV LR, PC \n"
496 " LDR PC, [R3, #0x28] \n"
497 " LDR R0, [SP] \n"
498 " BL sub_FF8F55F8 \n"
499 " LDR R3, [SP] \n"
500 " ADD R0, R3, #4 \n"
501 " LDR R1, [R3, #0x24] \n"
502 " LDR R2, [R3, #0x34] \n"
503 " MOV LR, PC \n"
504 " LDR PC, [R3, #0x30] \n"
505 " B loc_FF8F5C18 \n"
506
507 "loc_FF8F5B54:\n"
508 " ADD R4, SP, #4 \n"
509 " ADD R1, R2, #4 \n"
510 " MOV R0, R4 \n"
511 " MOV R2, #6 \n"
512 " BL _memcpy \n"
513 " LDR R12, [SP] \n"
514 " LDR R3, [R12] \n"
515 " MOV R1, R4 \n"
516 " MOV R0, R12 \n"
517 " CMP R3, #0xE \n"
518 " LDRLS PC, [PC, R3, LSL#2] \n"
519 " B loc_FF8F5C04 \n"
520 " .long loc_FF8F5BC0 \n"
521 " .long loc_FF8F5BC8 \n"
522 " .long loc_FF8F5BD0 \n"
523 " .long loc_FF8F5BD0 \n"
524 " .long loc_FF8F5BC0 \n"
525 " .long loc_FF8F5BC8 \n"
526 " .long loc_FF8F5BD0 \n"
527 " .long loc_FF8F5BD0 \n"
528 " .long loc_FF8F5BE8 \n"
529 " .long loc_FF8F5BF4 \n"
530 " .long loc_FF8F5BFC \n"
531 " .long loc_FF8F5C04 \n"
532 " .long loc_FF8F5BD8 \n"
533 " .long loc_FF8F5BD8 \n"
534 " .long loc_FF8F5BE0 \n"
535
536 "loc_FF8F5BC0:\n"
537 " BL sub_FF8F4D28 \n"
538 " B loc_FF8F5C00 \n"
539
540 "loc_FF8F5BC8:\n"
541 " BL sub_FF8F4E60 \n"
542 " B loc_FF8F5C00 \n"
543
544 "loc_FF8F5BD0:\n"
545 " BL sub_FF8F4F8C \n"
546 " B loc_FF8F5C00 \n"
547
548 "loc_FF8F5BD8:\n"
549 " BL sub_FF8F5674 \n"
550 " B loc_FF8F5C00 \n"
551
552 "loc_FF8F5BE0:\n"
553 " BL sub_FF8F515C \n"
554 " B loc_FF8F5C00 \n"
555
556 "loc_FF8F5BE8:\n"
557 " BL sub_FF8F5260_my \n" // --> Patched. Old value = 0xFF8F5260.
558 " MOV R6, #0 \n"
559 " B loc_FF8F5C00 \n"
560
561 "loc_FF8F5BF4:\n"
562 " BL sub_FF8F5310 \n"
563 " B loc_FF8F5C00 \n"
564
565 "loc_FF8F5BFC:\n"
566 " BL sub_FF8F53F8 \n"
567
568 "loc_FF8F5C00:\n"
569 " LDR R12, [SP] \n"
570
571 "loc_FF8F5C04:\n"
572 " ADD R0, R12, #4 \n"
573 " LDR R1, [R12, #0x24] \n"
574 " LDR R2, [R12, #0x2C] \n"
575 " MOV LR, PC \n"
576 " LDR PC, [R12, #0x28] \n"
577
578 "loc_FF8F5C18:\n"
579 " CMP R6, #1 \n"
580 " BNE loc_FF8F5C40 \n"
581 " LDR R1, [SP] \n"
582 " LDR R3, [R1, #0x24] \n"
583 " ADD R3, R3, R3, LSL#1 \n"
584 " ADD R1, R1, R3, LSL#1 \n"
585 " MOV R0, R4 \n"
586 " SUB R1, R1, #2 \n"
587 " BL sub_FF8F4C78 \n"
588 " B loc_FF8F5C60 \n"
589
590 "loc_FF8F5C40:\n"
591 " MOV R0, #1 \n"
592 " MOV R1, R0 \n"
593 " MOV R2, R0 \n"
594 " BL sub_FF8F4C1C \n"
595 " MOV R0, #1 \n"
596 " MOV R1, R0 \n"
597 " MOV R2, R0 \n"
598 " BL sub_FF8F4CAC \n"
599
600 "loc_FF8F5C60:\n"
601 " LDR R0, [SP] \n"
602 " BL sub_FF8F4944 \n"
603
604 "loc_FF8F5C68:\n"
605 " LDR R3, =0x4BC90 \n"
606 " MOV R2, #0 \n"
607 " LDR R0, [R3] \n"
608 " MOV R1, R5 \n"
609 " BL sub_FF822320 /*_ReceiveMessageQueue*/ \n"
610 " LDR R2, [SP] \n"
611 " LDR R3, [R2] \n"
612 " CMP R3, #0x12 \n"
613 " BNE loc_FF8F5A90 \n"
614 " MOV R0, R2 \n"
615 " BL sub_FF8F4944 \n"
616 " LDR R3, =0x4BC8C \n"
617 " MOV R1, #1 \n"
618 " LDR R0, [R3] \n"
619 " BL sub_FF821B20 /*_SetEventFlag*/ \n"
620 " BL _ExitTask \n"
621 " ADD SP, SP, #0xC \n"
622 " LDMFD SP!, {R4-R6,PC} \n"
623 );
624 }
625
626 /*************************************************************/
627 //** sub_FF8F5260_my @ 0xFF8F5260 - 0xFF8F5300, length=41
628 void __attribute__((naked,noinline)) sub_FF8F5260_my() {
629 asm volatile (
630 " STMFD SP!, {R4,R5,LR} \n"
631 " LDR R3, =0x4BC8C \n"
632 " MOV R4, R0 \n"
633 " MOV R1, #0xE \n"
634 " LDR R0, [R3] \n"
635 " BL sub_FF821CB4 /*_ClearEventFlag*/ \n"
636 " MOV R1, #0 \n"
637 " LDRSH R0, [R4, #4] \n"
638 " BL sub_FF8F49C8 \n"
639 " MOV R5, R0 \n"
640 " LDRSH R0, [R4, #6] \n"
641 " BL sub_FF8F4AF8 \n"
642 " LDRSH R0, [R4, #8] \n"
643 " BL sub_FF8F4B94 \n"
644 " CMP R5, #1 \n"
645 " LDR R1, =0xFF8F4974 \n"
646 " MOV R2, #2 \n"
647 " BNE loc_FF8F52C0 \n"
648 " LDRSH R0, [R4, #4] \n"
649 " BL sub_FFA584F4 \n"
650 " LDR R2, =0x4BCB4 \n"
651 " MOV R3, #0 \n"
652 " STR R3, [R2] \n"
653 " B loc_FF8F52C4 \n"
654
655 "loc_FF8F52C0:\n"
656 " BL sub_FF8F4BEC \n"
657
658 "loc_FF8F52C4:\n"
659 " STRH R0, [R4, #4] \n"
660 " LDRSH R0, [R4, #6] \n"
661 " BL sub_FF8A8E44_my \n" // --> Patched. Old value = 0xFF8A8E44.
662 " LDRSH R0, [R4, #8] \n"
663 " BL sub_FF8AAE18 \n"
664 " MOV R1, #0 \n"
665 " ADD R0, R4, #8 \n"
666 " BL sub_FF8AAF64 \n"
667 " CMP R5, #1 \n"
668 " MOV R1, #2 \n"
669 " MOV R2, #0 \n"
670 " LDMNEFD SP!, {R4,R5,PC} \n"
671 " LDR R3, =0x4BC8C \n"
672 " LDR R0, [R3] \n"
673 " LDMFD SP!, {R4,R5,LR} \n"
674 " B sub_FF821B10 /*_WaitForAllEventFlag*/ \n"
675 );
676 }
677
678 /*************************************************************/
679 //** sub_FF8A8E44_my @ 0xFF8A8E44 - 0xFF8A8EA0, length=24
680 void __attribute__((naked,noinline)) sub_FF8A8E44_my() {
681 asm volatile (
682 " STMFD SP!, {R4,LR} \n"
683 " LDR R3, =0x3274 \n"
684 " LDR R12, [R3] \n"
685 " MOV R3, R0, LSL#16 \n"
686 " CMP R12, #1 \n"
687 " LDR R1, =0xFF8A8830 \n"
688 " MOV R2, #0xF5 \n"
689 " LDR R0, =0xFF8A8A54 \n"
690 " MOV R4, R3, ASR#16 \n"
691 " BEQ loc_FF8A8E70 \n"
692 " BL _DebugAssert \n"
693
694 "loc_FF8A8E70:\n"
695 " CMN R4, #0xC00 \n"
696 " LDR R3, =0x2F1D6 \n"
697 " LDR R0, =0xFF8A8A60 \n"
698 " LDR R1, =0xFF8A8830 \n"
699 " MOV R2, #0xFB \n"
700 " LDREQSH R4, [R3] \n"
701 " LDRNE R3, =0x2F1D6 \n"
702 " CMN R4, #0xC00 \n"
703 " STRH R4, [R3] \n"
704 " BNE loc_FF8A8E9C \n"
705 " BL _DebugAssert \n"
706
707 "loc_FF8A8E9C:\n"
708 " MOV R0, R4 \n"
709 " BL apex2us \n" // --> Patched. Old value = _apex2us.
710 " LDR PC, =0xFF8A8EA4 \n" // Continue in firmware
711 );
712 }