Hi,
Here are my function names. I focussed mainly on the menu structures and loading and storing of camera properties.
Some interesting addresses are
FF9A34E4 Create_DialogBox; as it already explains this is where all Dialog boxes are created.
FF931B08 Start_submenu. This function is called when a submenu has to be displayed an executed. The switch statement inside will accept 46 values.
0 Quality
1 Red Eye
2 Beep
3 NoCF = Shoot without card
4 Review Time
5 ---------------------------------- what happens here ?? ----------------------
6 AEB
7 WB
8 Custom WB
9 WB BKT
A Colorspace
B Picture Style
C Dust Removal data
D Protect
E Rotate
F Erase All
10 Print Order
11 Transfer Order
12 External Media Backup
13 Highlight Alert
14 AF Points Display
15 Histogram
16 Autoplay
17 Auto PowerOff
18 File Numbering
19 Auto Rotate
1A Info Button
1B Format
1C LAN / WFT settings
1D Card Extension ?? Recording function + Media Select ??
1E Press SET button ?? / LCD brightness
1F Date /Time
20 Language
21 Video
22 Sensor Cleaning
23 Live View
24 Flash Control
25 CamSetupSave
26 Clear Settings
27 FirmVersion
28 ---------------------------------- what happens here ?? ----------------------
29 C.Fn 1 menu
2A C.Fn 2 menu
2B C.Fn 3 menu
2C C.Fn 4 menu
2D Clear Custom Functions
The menu's are build and destroyed at
FF930BEC Build_all_menu_tabs
When the menu's are build I also found memory location where camera properties where stored.
One interesting location 0x3F48. This is where the mode of the camera is stored (P, TV, AV, Landscape etc).
This is used in the sub FF866DBC GetModeZoneData_FF866DBC_0_Adv_1_Basic.
The result of this function
0=Basic Zone (landscape, sports etc)
1=Creative Zone (P. TV, AV etc)
So I made some Get_xxx and Set Setxxx subs where camera properties are retrieved/stored. The list is by far not complete.
So far I found the following memory locations
0x2944 Mirror down Status
0x37FC JpegSize Compression
0x3DF8 Quick review
0x3F48 Camera Mode
0x3FBC (JPEG) Compresson L
0x3FC1 (JPEG) Compresson M1
0x3FC4 (JPEG) Compresson M2
0x3FC8 JPEG Size Compression
0x3FCC Red-Eye reduction
0x3FD0 Beep
0x3FD4 No Card Release
0x3FE0 AEB value
0x3FE4 COMP
0x3FE8 something with WB
0x3FEC something with WB Gui WB PC Valid ?
0x3FF0 WBS GM
0x3FF4 WBS BA
0x3FF8 WBB GM
0x3FFC WBB BA
0x4000 Color Space
0x4004 WB Mode
0x4008 Flavor Mode
0x4108 Display AF Points
0x410C Histogram
0x4110 Highlight Alert
0x4114 Auto Power Off
0x4118 Language
0x411C Auto Rotate
0x4120 File Numbering Mode
0x4124 Video System
0x4128 PTP
0x412C LCD brightness
0x4130 DateStyle
0x4194 Custom WB number
0x4198 Set PC WB number
0x419C Active Sweep mode
0x41A4 Active Sweep status
0x41A8 Electric Shutter
0x41B4 LiveView
0x41B8 LiveView Grid
0x41BC LiveView Timer
0x41C4 LiveView Output device State
0x41D4 Studio ISO COMP
0x13218 AsDoneRecord
0x13220 InfoButtonShoot
0x13278 Param Cfn-1 menu
0x13280 Param Cfn-2 menu
0x13288 Param Cfn-3 menu
0x13290 Param Cfn-4 menu
I am now trying to find out how the strings are loaded into the dialog boxes so I can determine whet the AF Micro adjustment is located. At the end if the BIN File there are reference to many lenses (FFF60164 "EF14mm f/2.8L USM",0)
I located some strings with a substrings "afshift" which might be related.
I think that the location "FF86F6DC DPU_DirectPrinting_FF86F6DC" is executed when the useless direct print button is pressed. Maybe we can reprogram that and make it useful.
so far so good