I'm not aware of any research about the various adjustment tables found in ROM.
A person with a new (under warranty) camera could help us by doing this:
- if there's any visible hot or dead pixel in live view/recorded video/stills
- make a full ROM dump
- make uncorrected CHDK raw files with various ISO and Tv settings
- dump live image frames with chdkptp
- let the official Canon service repair the cam
- make another ROM dump afterwards
The service may choose to replace the whole camera or replace the sensor, so success is not guaranteed...
There are event procedures with suspicious names in the firmware (see
funcs_by_address.csv):
0xff2d4dcc,PointDefDetect_FW
0xff2d502c,MergeAndConvertDefect_FW
0xff2d533c,PointKizuCheck_FW
0xff2d53a8,SensDefCrowdCheck_FW
0xff2d53dc,ChangeGradeTable_FW
0xff2d53e4,CrossDefDetect_FW
0xff2d5594,ChangeCrossThresholdTable_FW
0xff2d55a8,MixPixDetect_FW
0xff2d5810,GetDefectCrawInfo_FW
0xff2d5874,SetDefectDebugInfo_FW
0xff2d58a0,GetDefectHistgramInfo_FW
0xff2d58d8,GetDefectTvAdj_FW
0xff2d5a04,SetDefectRecParam_FW
0xff2d5bcc,ChangeDefectRecParam_FW
0xff2d5bdc,ExecuteDefectRec_FW
0xff2d5c08,ExecuteDefectRecAndSaveImage_FW
0xff2d5c70,ExecuteDefectRecWithGrade_FW
0xff2d5cac,ExecuteDefectRecAndSaveImageWithGrade_FW
0xff2d5d1c,j_InitializeDefectRec_FW
0xff2d5d20,j_TerminateDefectRec_FW
The actual event procedures have neither "j_" nor "_FW" in their names. "Kizu" (Japanese) likely means something close to "defect", the word is also used as "magic" in some ROM tables. Some functions may require special operating conditions (like special lighting).
A physical
UART connection or
camera console redirection might be the easiest way to mess with
event procedures.
Since it's very easy to screw up the adjustment tables, be sure to make a ROM backup before...