Been busy for a bit with other projects, but back onto the StereoSync project again recently.
Some findings so far (g7x2 110b):
sub_e0470642 will set it to transmit mode, where the output pullup impedance is lower (or maybe driven high) and transmission is possible (any signal sent from the battery will not pull it down all the way to zero volts in this state).
sub_e04f1076 will set it to receive mode, where the output pullup impedance is lower and receiving signals from the battery is possible.
sub_e04f0fe8 will force the signal low with r0=0, not forced low with r0=1. This is used for long sync pulses from the camera to the battery.
sub_e04f0ffa will transmit a byte (value of r0), with 20us per bit and a delay of 1200us afterwards (likely for syncing each the start of each byte). There is 1 low bit for sync then 8 bits MSB-first, 1 is high, 0 is low.
Modifying this function to skip the 1200us delay is possible (it's just a call to UTimer function) and does not seem to cause any issues. Not sure yet how it actually transmits the byte, it looks like it writes it to an MMIO address DAT_c0800000 (plus maybe an offset). Edit: it writes the inverted byte to 0xc0810000 (measured), and makes some other MMIO writes probably to configure the transmission
sub_e04f1076 starts before the battery transmits its return message, and finishes once that message is done. How it receives the transmision is not clear yet. One of its sub functions mentions "NRTable.c" any ideas what that may be?
Another thing I found was a postman_mm function, that seems to run once from the InitExDrivers function, I'm thinking that this may have some relevance as well. Perhaps a postman_mm function runs in the background (maybe on the Omar core) and collects received data then passes it back to the BA_ function.
It would probably be useful for me to look at the code running on the Omar core that is initialized from the InitExDrivers function, however the Omar core isn't mentioned in in stubs_entry.S, and in a strings search it is only mentioned once in the firmware at "e0cb62c4 GIC_OmarIntc" so I'm not sure where the DryOS for that is, any idea of how to find it? If the Omar core still exists for Digic7?
Thanks