My assumption (quite possibly incorrect) was that the normal canon UI now uses OpenGL to draw.
I don't think it's an incorrect assumption. They surely don't want to low level program the GPU, and the presence of OpenGL strings suggests OpenGL libraries.
If that is the case, it may be possible to call regular GL drawing functions to set pixels, draw lines, rectangles etc, in the same context the Canon UI uses, without worrying about frame buffers. Since OpenGL is quite well documented, getting the whole API could be relatively easy once you identified a few functions.
We'll see. Unfortunately, I haven't yet been able to find references to those strings (the disassembly is not 100% correct and there are many more ways of addressing things in thumb-2...).
I think that the firmware uses pieces of "textures" to assemble the overlay (I have found a standalone histogram image in one of the RAM dumps).
It also looks like the "big" RGBA overlay isn't going to be usable for us - my changes do not necessarily end up on screen... So it currently looks like we'll have to draw on YUV
Attached is a small program that will display the battery voltage - in millivolts - on the sx280 102b. It's very basic and not configurable. Display is refreshed twice in every second. I'm using the non-eventproc versions of the LCDMsg event procedures.
@ compile with:
@ arm-none-eabi-gcc -Wl,-N,-Ttext,0x5ce000 -nostdlib -march=armv7 -mthumb vbatt.s -o vbatt.bin
@ and extract the needed bytes from the binary :/
@ toolchain: [url]https://launchpad.net/gcc-arm-embedded[/url]
@ 0x5ce000 is the start of AdditionAgent RAM
@ this macro is for thumb mode
.macro NHSTUB name addr
.globl _\name
.weak _\name
_\name:
ldr.w pc, [pc, #0]
.long \addr
.endm
.globl _start
.org 0
_start:
.text
@ first byte has to be non-zero (otherwise blob might be treated as encoded)
@ force thumb
.code 16
@ allow new instructions (ldr.w)
.syntax unified
push {r4,r5,lr}
sub sp, sp, #20
@ fw version check first
ldr r0, =0xfc142898
ldr r0, [r0]
ldr r1, =0x4232302e
cmp r0, r1
bne quit
mov r0, #100 @ x coordinate of the string
mov r1, #10 @ y coordinate of the string
mov r2, #0 @ start with NULL string
bl _LCDMsg_Create
mov r5, r0
again:
ldr r0, =500 @ 500msec
bl _SleepTask
bl _VBattGet
adr r1, batfrm
mov r2, r0
mov r0, sp
bl _sprintf
mov r0, r5
mov r1, sp
bic r1, #0x40000000
bl _LCDMsg_SetStr
b again
quit:
add sp, sp, #20
pop {r4,r5,pc}
batfrm:
.asciz "%d mV"
.ltorg
@ sx280 102b
@ ".02b" aka 0x4232302e, significant part of version string, 0xfc142898
NHSTUB SleepTask 0xfc251cb4
NHSTUB ExitTask 0xfc2512b0
NHSTUB sprintf 0xfc2b7f81
NHSTUB LCDMsg_Create 0xfc42ef6d
NHSTUB LCDMsg_Delete 0xfc42ee09
NHSTUB LCDMsg_SwDisp 0xfc42f065
NHSTUB LCDMsg_Move 0xfc42ed93
NHSTUB LCDMsg_SetStr 0xfc42f0af
NHSTUB LCDMsg_ChangeColor 0xfc42f20d
NHSTUB VBattGet 0xfc12ec71
To use it,
set up the card to run scripts, copy the 2 files from the zip to the root of the card. Start the cam in play mode and press SET.
