This RAW problem is interesting to say the least, and I've run out of ideas.
The pointer to where the RAW data should be in memory is definitely correct, but there's just nothing there. I even manually edited core/raw.c to check whether there was some kind of linking error but same thing happens so it's not a problem with the raw_savefile() function not using the correct address.
ROM:FFA812AC loc_FFA812AC ; CODE XREF: sub_FFA81264+3Cj
ROM:FFA812AC LDR R2, =0xE88
ROM:FFA812B0 LDR R1, =0x107D68C0
ROM:FFA812B4 SUB R3, R2, #0x3B4
ROM:FFA812B8 ADR R0, aCrwaddressLxCr ; " CrwAddress %lx, CrwSize H %ld V %ld\r"
ROM:FFA812BC STR R3, [SP,#0x38+var_2C]
ROM:FFA812C0 STR R2, [SP,#0x38+var_30]
ROM:FFA812C4 STR R1, [SP,#0x38+var_34]
ROM:FFA812C8 BL sub_FF8FEF54
ROM:FFA812CC LDR R3, [SP,#0x38+var_1C]
ROM:FFA812D0 ADR R0, aIntegposHLdVLd ; " IntegPos H %ld V %ld Size H %ld V %ld\r"...
ROM:FFA812D4 STR R3, [SP,#0x38+var_38]
ROM:FFA812D8 ADD R3, SP, #0x38+var_28
ROM:FFA812DC LDMIA R3, {R1-R3}
ROM:FFA812E0 BL sub_FF8FEF54
ROM:FFA812E4 MOV R2, #0x2C
ROM:FFA812E8 ADD R1, SP, #0x38+var_34
ROM:FFA812EC MOV R0, R4
ROM:FFA812F0 BL sub_FF848604
ROM:FFA812F4 AND R1, R0, #1
ROM:FFA812F8 ADD SP, SP, #0x30
ROM:FFA812FC LDMFD SP!, {R4,PC}
ROM:FFA812FC ; End of function sub_FFA81264
There's actually a string "CrwAddress %lx, CrwSize H %ld V %ld" used at 0xffa812b8 that you can use to work out the RAW address which is of course 0x107D68C0 and you can also see the RAW width and height which are 0xE88 (3720) and the width 0xE88-0x3B4 (2772) which add up to the raw_size of 0xEC04F0 [(0xE88 * (0xE88-0x3B4) * 12 bit) / 8 bit] which you can find elsewhere in the disassembly. These are what I've used in lib.c to no avail.
capt_seq_hook_raw_here() is in the same place as in the ixus860/sd870 code. In fact the only difference in the function to the ixus860 code is lines 129/130. (Commenting these add results in no visible change in function of the camera.)
83 void __attribute__((naked,noinline)) sub_FF85E634_my() //#fs
84 {
85 asm volatile (
86 "STMFD SP!, {R4-R6,LR}\n"
87 "LDR R4, [R0,#0xC]\n"
88 "LDR R6, =0x19E8C\n"
89 "LDR R0, [R4,#8]\n"
90 "MOV R5, #0\n"
91 "ORR R0, R0, #1\n"
92 "STR R0, [R4,#8]\n"
93 "LDR R0, [R6,#0x24]\n"
94 "CMP R0, #0\n"
95 "MOVEQ R0, #2\n"
96 "BLEQ sub_FF858610\n"
97 "BL sub_FF93C144\n"
98 "LDR R0, [R6,#0x24]\n"
99 "CMP R0, #0\n"
100 "BNE loc_FF85E6B4\n"
101 "MOV R0, R4\n"
102 "BL sub_FF93C5D8\n"
103 "TST R0, #1\n"
104 "MOVNE R2, R4\n"
105 "LDMNEFD SP!, {R4-R6,LR}\n"
106 "MOVNE R1, #1\n"
107 "BNE sub_FF85C98C\n"
108 "BL sub_FF95DAFC\n"
109 "BL sub_FF86D3EC\n"
110 "STR R0, [R4,#0x14]\n"
111 "MOV R0, R4\n"
112 "BL sub_FF93D738\n"
113 "BL sub_FF93E214\n"
114 "MOV R0, R4\n"
115 //"BL sub_FF93D820\n"
116 "BL sub_FF93D820_my\n"
117 "BL capt_seq_hook_raw_here\n" // +
118 "MOV R5, R0\n"
119 "B loc_FF85E6C4\n"
120
121
122 "loc_FF85E6B4:\n" // ; CODE XREF: sub_FF85E634+38j
123 "LDR R0, =0x54E0\n"
124 "LDR R0, [R0,#4]\n"
125 "CMP R0, #0\n"
126 "MOVNE R5, #0x1D\n"
127
128 "loc_FF85E6C4:\n" // ; CODE XREF: sub_FF85E634+7Cj
129 "BL sub_FF93F268\n"
130 "BL sub_FF93F2A4\n"
131 "MOV R2, R4\n"
132 "MOV R1, #1\n"
133 "MOV R0, R5\n"
134 "BL sub_FF85C98C\n"
135 "BL sub_FF93DC28\n"
136 "CMP R0, #0\n"
137 "LDRNE R0, [R4,#8]\n"
138 "ORRNE R0, R0, #0x2000\n"
139 "STRNE R0, [R4,#8]\n"
140 "LDMFD SP!, {R4-R6,PC}\n"
141 );
142 }
[edit] 12-bit RAW for both the win and loss. Higher depth, but no converter
