reyalp
The + value is just a way of making it easier understand how the value was found, and find the same variable in other dumps. If the firmware does
LDR r0,=0x7B08
LDRB r1,[R0,1]
You would be able to find the code by searching for 0x7B08, but not by searching for 0x7B09
I'm not sure what you mean by "too short". Almost everything in stubs_min.S is a RAM address rather than ROM, so is in RAM address space.
Thanks, it's absolutely clear now. I rechecked every addresses again, and i found one wrong. Corrected:
DEF(enabled_refresh_physical_screen, 0x9D60 + 0x2😎 // in FFA0499C
But this not solved the problem.
However, there are 2 another values about 99 percent sure, not 100%, and the FlashParamsTable is not found yet.
DEF(physw_status, 0x32444) // in FF832B90
DEF(physw_run, 0x1C38 + 0x0C) // in FF832B90
DEF(FlashParamsTable,0xFFB7454C) // ?
DEF(zoom_busy, 0x6E9C + 0x1C) // in FF9568F4
DEF(focus_busy, 0x6D40 + 😎 // 99%
DEF(canon_menu_active, 0x3128 + 4) // in FF8903B4
DEF(canon_shoot_menu_active, 0x8838 + 1) // in FF9A9F7C
DEF(recreview_hold, 0x76F4 + 0x10) // 99%
DEF(zoom_status, 0xC6B😎 // in FFAAEEC4
DEF(movie_status, 0x2BF8 + 0x3😎 // in FF878924
DEF(enabled_refresh_physical_screen, 0x9D60 + 0x2😎 // in FFA0499C
DEF(playrec_mode, 0x2E54 + 0x4) // in FF882228