Some additional info to port it to other platforms:
found in subroutine _ShootState.c__225 (there is always some "ShootState.c" around), at the beginning (not always the first instruction), the one which is not 0x02 before the address at the end, 0x2574 and 0x2576 :
ROM:FF82D5B0 EXPORT _sub_FF82D5B0__ShootState.c__225
ROM:FF82D5B0 _sub_FF82D5B0__ShootState.c__225 ; CODE XREF: sub_FF82DA04+30p
ROM:FF82D5B0 ; sub_FF82E078+84p ...
ROM:FF82D5B0 LDR R3, =0x2568
ROM:FF82D5B4 STMFD SP!, {R4,R5,LR}
ROM:FF82D5B8 MOV R4, R0
ROM:FF82D5BC LDR R5, =0x2574
ROM:FF82D5C0 LDR R1, =aShootstate0xX
ROM:FF82D5C4 STR R4, [R3]
ROM:FF82D5C8 MOV R0, #0x20
ROM:FF82D5CC MOV R2, R4
ROM:FF82D5D0 BL _sub_FF8158A4__CameraLog.c__130 ; LOCATION: CameraLog.c:130
ROM:FF82D5D4 LDRH R12, [R5]
ROM:FF82D5D8 CMP R12, #0xA
ROM:FF82D5DC MOV R3, #0
ROM:FF82D5E0 LDR R0, =aShootstate_c
ROM:FF82D5E4 MOV R1, #0xE1
ROM:FF82D5E8 STREQH R3, [R5]
ROM:FF82D5EC MOVEQ R12, R3
ROM:FF82D5F0 CMP R12, #9
ROM:FF82D5F4 BLS loc_FF82D600
ROM:FF82D5F8 BL DebugAssert
ROM:FF82D5FC LDRH R12, [R5]
ROM:FF82D600
ROM:FF82D600 loc_FF82D600 ; CODE XREF: _sub_FF82D5B0__ShootState.c__225+44j
ROM:FF82D600 LDRH R3, [R5]
ROM:FF82D604 LDR R2, =0x2576
ROM:FF82D608 ADD R1, R12, #1
ROM:FF82D60C STRB R4, [R2,R3]
ROM:FF82D610 STRH R1, [R5]
ROM:FF82D614 LDMFD SP!, {R4,R5,PC}
ROM:FF82D614 ; End of function _sub_FF82D5B0__ShootState.c__225
For SD700 101b: 0x72EC (_ShootState.c__201) (or maybe 0x72F8)
For SD800 100e: 0x7CD8 (or maybe 0x7CE4)
For A720IS 100c: 0xAB38 (or maybe 0xABB0)
If someone wants to try, and cannot find the address for his camera, or cannot compile the build to test, ask me, I will do my best to help...