I've got some time to help, so :
// consts-500d.110.h
#define HIJACK_INSTR_BL_CSTART 0xFF012AE8
#define HIJACK_INSTR_BSS_END 0xFF01093C
#define HIJACK_FIXBR_BZERO32 0xFF0108A4
#define HIJACK_FIXBR_CREATE_ITASK 0xFF01092C
#define HIJACK_INSTR_MY_ITASK 0xFF010948
#define HIJACK_TASK_ADDR 0x1a74
// RESTARTSTART at 0x4D000
where to find 0x1a74
ROM:FF015DA4 sub_FF015DA4 ; CODE XREF: sub_FF072738+4p
ROM:FF015DA4 STMFD SP!, {R4,LR}
ROM:FF015DA8 BL sub_FF075320
ROM:FF015DAC LDR R12, =0x1A74 <------
ROM:FF015DB0 LDR R1, [R0]
ROM:FF015DB4 LDR R3, =0x31D8
ROM:FF015DB8 MOV R0, #0
ROM:FF015DBC MOV R2, #0
ROM:FF015DC0 STR R1, [R12,#8]
ROM:FF015DC4
ROM:FF015DC4 loc_FF015DC4 ; CODE XREF: sub_FF015DA4+38j
ROM:FF015DC4 LDR LR, [R3]
ROM:FF015DC8 CMP R0, LR
ROM:FF015DCC ADDLT LR, R1, R0,LSL#3
ROM:FF015DD0 STRLT R2, [LR,#4]
ROM:FF015DD4 STRLT R2, [R1,R0,LSL#3]
ROM:FF015DD8 ADDLT R0, R0, #1
ROM:FF015DDC BLT loc_FF015DC4
ROM:FF015DE0 LDR R0, [R3]
ROM:FF015DE4 ADD R0, R1, R0,LSL#3
ROM:FF015DE8 STR R0, [R12,#0x10]
ROM:FF015DEC SUB R0, R0, #8
ROM:FF015DF0 STR R0, [R12,#0xC]
ROM:FF015DF4 MOV R0, #0
ROM:FF015DF8 STR R2, [R12]
ROM:FF015DFC LDMFD SP!, {R4,PC}
ROM:FF015DFC ; End of function sub_FF015DA4
I can not test it, so I hope already is OK
Indy
