andrew_sj
Ok, thanks for the reply. Could someone either point me to a resource or explain to me how the hack works. I understand that the hack sits on the CF and doesn't modify the firmware but I don't know what it contains or how it works. I'm pretty good at reverse engineering so I'll start work on the mirror control by decrypting the canon firmware and decompiling it the best I can.
Does anyone know the extent to which the symbol table is populated in the canon firmware? thanks
I am probably not the best person to explain this, but I will try (0xAF will surely correct my mistakes): Basically, when the camera starts up, it executes "start" at "entry.S", which passes the control to "my_romStart" at "init.c"; from there, we replicate all the initialization stuff from the original firmware, but with some subtle changes to plug-in our code.