Ant
But I can't find analog of sub_fc060338_my function, that is called from sub_fc04f72a_my = fc0634e2@eosm3. There is a loopback on fc083cc4@eosm3.
Correct, the routine we usually call "startupchecks" simply returns 1 here. Therefore, remove the C code from the start of sub_fc062f48().
Waterwingz is right: you need to boot the camera with minimal changes to the
build boot process.
That means:
- remove the CreateTask replacement
- you need the Canon heap related modification, so those lines should stay
- the last modified piece of code should be sub_fc06347d_my, where the only change that should stay is the removal of the startdiskboot routine sub_fc0637b2. Remove the physw modification and don't start spytask.
If the camera boots and doesn't halt and doesn't crash with the above modification, you can continue.
This camera is substantially different from the sx280, because
- it has a "subcpu", most likely a tx19
- there is code copied to and executed from the memory range above 0xbfe10800. For example, CreateTask seems to live there. This comes in addition to the usual DryOS kernel area which starts at 0x10e1000 here.
I still see 3 DryOS images in the ROM, so I suspect the 2 ARM cores still run separate operating systems.
You may want to execute the cpuinfo_get_info() function you can find here:
https://www.assembla.com/spaces/chdk-s1/subversion-11/source/HEAD/trunk/modules/cpuinfo_v7.c from an AdditionAgentTask-based little program, save the returned block of memory to file and evaluate it by hand or by using the other cpuinfo routines. Would be interesting to see the differences to sx280.
