Sounds like two issues, picking the right raw buffer and putting the call to capt_seq_hook_raw_here in the right place.
Comparing
S95 firmware 1.00H to
G12 1.00C I would suggest the following.
In lib.c:
char *hook_raw_image_addr()
{
if (*((int*)0x2ECC) != 0)
return (char*) 0x46000000;
else
return (char*) 0x41269150;
}
In capt_seq.c try adding the call to capt_seq_hook_raw_here at the location below:
"loc_FFAF9A20: \n"
" ADD R1, SP, #0x14 \n"
" MOV R0, R5 \n"
" BL sub_FFAF97F4 \n"
" BL capt_seq_hook_raw_here\n" // added
" B loc_FFAF9A5C \n"
The lib.c changes should work for 1.00e firmware; but the address of the code for capt_seq.c will probably be different.
Hope this helps,
Phil.