Ah, ok. Yes, those are the same ones I found and IDA identified them as loc_.... so indeed not a function. Anyway, did you also try EdLedOn and EdLedOff or did you only try EdLedBlink? If you tried them all, they probably confirm my theory. Those functions give me a PostLEDMessage (present on compact cameras) feeling, so they probably tell the OS to turn on/off or blink a specific LED. If the OS isn't running anymore... well.. do the math. I guess you'll have to search for the addresses 0xCAF0 and 0xCAD8 (or 0xC0210014 and 0xC0220000, their respective values), as they seem to tell the OS what to do.
Equivalent, abbreviated C:
void EdLedOff() {
*((long *) 0xC0210014) = 0;
*((long *) 0xC0220000) = 0x44;
}
void EdLedOn() {
*((long *) 0xC0220000) = 0x48;
*((long *) 0xC0210014) = 1;
}
void EdLedBlink() {
*((long *) 0xC0220000) = 0x48;
*((long *) 0xC0210014) = 3;
}
