Hi srsa,
I'm really impressed how fast you can work through the assembler.
The function I'd call LEDtable_init is sub_fc075dc4. The suspicious values there are 0x21 and 4.
I was so close.. I also found these values but was irritated because this function seemed to write random values into the members [0,1,5,6,7] of the array I identified.
Yes, I also found 0xd20b0000 + 0x800 as well as the On/Off values 0x4d0002 and 0x4c0003.
I'm assuming you do follow reyalp's work on the D6 sigfinder - it's progressing pretty well.
Haha unfortunately no. I basically tried to work *offline* through the assembly since my last post in december.
I printed out the objdump disassembly of "task_LEDCon" and "taskcreate_LEDCon" and all referenced functions.
Then I took the ARM assembler documentation and tried to find breadcrumbs in this mess of instructions:D
I just read through reyalp's thread... Cool
So I guess I could use his software to confirm the findings I already made? This sounds really good.
I'll try it out when I find the time as I am curious if it can identify the missing handful of functions I didn't find yet.
How do I use and dereference pointers in Canon Basic?
I just got it!

There was a syntax error in my script.
'Based on the Dumper Script
startaddr = 0x9BAC
startptr = *startaddr
romsize = 504
sprintf(msgstr,"Adr %0X",startaddr)
PutMsg(msgstr)
sprintf(msgstr,"Ptr %0X",startptr)
PutMsg(msgstr)
dumpfile = Fopen_Fut("A/PRIMARY.BIN","w")
Fwrite_Fut(startaddr,romsize,1,dumpfile)
Fclose_Fut(dumpfile)
I got the following output as well as a dump of the memory:
Adr 9BAC
Ptr 36AE10
Unfortunately, the dump didn't contain anything useful.
(Hmm, I found a lot of instructions that jump into some weird memory range "0xBFE158A8" or so.
Maybe I can dump that too.....)
So I continued with your addresses and it worked!! Thanks!!
led1addr = 0xd20b0884
led2addr = 0xd20b0810
Poke32(led2addr, 0x4d0002) 'It is ON now!!
*led2addr = 0x4d0002 'Works, too!
Poke32(led1addr, 0x4c0003) 'It is OFF now!!
Interestingly, each time I try to read the value of the addresses (using dereferencing or Peek32), I just get "5C" as value.
So, Poke32, Peek32 is equal to pointer-usage in Canon Basic.
0xd20b0884 'Status light - Back facing green LED
0xd20b0810 'Focus helper - Front facing white LED
There is a lot of knowledge hidden here.
Each time I crawl through the forum, the wiki pages or the Repository, I find something new.
If I knew a way to glue this all together, I'd try to help. :')
Next step is to collect more information about running self-compiled programs.
And try the same thing in C.
Thank you all for your patience!