Some of the information in this thread also applies to the HP Photosmart M525 since the OEM or chip manufacturer is the same. I'm not sure of the exact connection.
Here is something I figured out we already knew about FOREIGN and SYSTEM function calls but there is a third type: "direct" (no keyword) function calls. If you get anything wrong you will have to take the batteries out. This makes testing very slow. It would be nice if there were a way to figure out how many parameters each function takes and what the type should be (Ex: int, string, bool).
For example here is a script that should in theory disable de-noising (runs but not sure what effect it has)
10 IRP_SetDenoiseTH(0)
20 IRP_NoDenoiseFun()
30 IRP_NoCbCrAverageFun()
RUN
10 IRP_SetSaveCFARaw()
RUN
If I run this it saves a 10-bit raw. Sadly it's already somewhat processed and it's not the 12-bit RAWs that I want.
10 SYSTEM ScreenString(10, 10, "Test")
RUN
This displays the string "Test" on the screen but when I ran it I saw garbage characters after it.
10 FOREIGN DownloadAllCaliData()
RUN
It created a file called "DownloadCali.txt" on the root directory.
10 FOREIGN KeyFlash(1)
Works, it opens the normal flash settings just as if I had pressed the button
10 IRP_SaveNocompressImg()
RUN
Displays Save YCC444 before JPEG. It saved an image just like expected.
10 KeyScan()
RUN
Works, press all keys and it will tell you that the test was a success. S1 = half press shutter, S2 = full press I believe.
I have not been able to get into any hidden menus yet.
