Re: concerns about filewrite 'skip-dir' and 'skip-flush' code sections.. I believe I can now insert logging statements and compile with success.
This is really more of a reverse engineering problem, so I won't be able to give you a cookbook answer.
If I were working on this port, I'd start by trying to figure out what the code related to sub_FF02D9F0 / R7 does, and how this section of this ports filewrite differs from earlier cameras like elph130 (which has an otherwise similar filewrite)
I'd also look at the value from "LDR R1, [R5, #0x14]"
R5 is a global structure at 0x107A8, so + 0x14 = 0x107BC.
The following BLX R1 indicates it's a callback of some sort (the BNE skips the call if it's null), and the first parameter depends on the R7 value. elph130 has similar callback code, it just doesn't have a parameter that depends on the result of the skipped call.
Some questions are:
1) Is callback actually used in normal operation, or is it some Canon development hook that's always 0? If it's always zero, then the rest probably doesn't matter.
2) If it is used, does it need to be called or skipped when writes are skipped? (elph130 would call regardless)
3) Is it the same callback every time?
4) How does the behavior depend on the value controlled by R7
So my first step would probably be logging the value of r7 and *(int *)(0x107BC) while shooting without remote shoot, with and without continuous, with and without a directory needing to be created etc.
Looking at the code a bit more, I think the location of loc_A is incorrect. The code that handles the directory creation (starting at loc_FF3AF300) ends by either jumping to loc_FF3AF220 (the start of the main loop) or loc_FF3AF40C. This depends on the callback in 0x107BC mentioned above.
So to get similar behavior to earlier ports, I would put loc_A before that branch, like
//mod start
" LDR R3, =ignore_current_write\n" // !!
" LDR R3, [R3]\n"
" CMP R3, #0\n"
" BNE loc_A\n" // skip creating directory
//mod end
" BL sub_FF027628 \n"
" MOV R1, #0 \n"
" MOV R0, #0x48 \n"
" BL sub_FF0CA2F0 \n"
" ADD R0, R4, #0x58 \n"
" BL sub_FF030DA4 \n"
" LDR R1, [R5, #0x1C] \n"
" BL sub_FF02EC74 \n"
"loc_A:\n"
" LDR R1, [R5, #0x14] \n"
" CMP R1, #0 \n"
" BEQ loc_FF3AF220 \n"
" LDR R0, [R4, #0x10] \n"
" B loc_FF3AF40C \n"
This separates the directory case from the confusion with R7
Note that the R0 parameter for the callback in that case comes from R4+0x10, which is inside the message structure for that particular filewrite invocation.
