Decoding my way through filewrite.c for ixus160, looking at what code_gen.txt is doing. Dumped the start of filewrite the way code_gen does;
tools/capdis -v -s='0xffab8cf0' -c=42 -stubs=platform/ixus160_elph160/sub/100a/ -d ../ixus160/PRIMARY.BIN 0xff810000then I go thru ARM instructions and operands. Match up ARM instructions to the reference manual. I think I have the PUSH decoded correctly. The next instruction is
ldr r5, =0x0000b584 ; [pc, #448] (0xffab8ebc)
I think, from instruction syntax, that it is
ldr type 3 ldr3 = 32b mem useful for ProgramCounter PC relative data
Paraphrased from the arm v5 ref manual;
# LDR <Rd>, [PC, #<immed_8> * 4]
# Rd is dest register,
# pc is program counter, used to calc mem addr;
# Bit 1 of pc val forced to 0 for this calc,
# such that addr (results?) is word-aligned.
# immed_8 is 8bit val * 4 and added to PC to form mem addr
It must be related, due to Rd = (0xffab8ebc) ... I suspect this, because loc_ffab8eac !!! It's the address written to 7 (jpg) chunk times <from hdr file>. Also suspect this because ldr3 is the only ldr instruction in the ref mentioning PC.
So, what's r5, =blah ? Destination register's position.. we know 0xffab8ebc is dest register's address. The instruction is represented by mix of arm and C syntax;
'#' is GNU arm assm *immediate operand prefix
';' is GNU arm assm *Statement Separator math rules apply? (left hand eval before right)
',' is C *expression to discard previous value
'=' is C *initialization -> assignment expression
'[' is C *punctuators
']' is C *punctuators
'(' C *not sure what form..
')' C *
* are used in the instruction, so it must be.
So,
Before performing [PC, #<immed_8> * 4], we eval r5, =0x0000b584
Meaning, discard what's in r5 and assign 0x0000b584 to it.
Then, discard what's in PC (by comma), and uhh,
0x0000b584 * 4 = 2D610, PC becomes this ?
