1) there is a code in FLASH(ROM) which can load files from SD card without loading of OS (Rescue Loader code)
Funny thing. I went over my A720-Dump yesterday, noticed the Rescue loader and had the same Idea
It seem to me like the rescue loader is started by default by the camera and checks if the original firmware is "ok" (just checks one byte, as far as I understand), jumps to the real firmware if the check is successful or loads DISKBOOT.BIN, ROMWRITE.BIN, UPGRADER.BIN from SD otherwise.
The rescue loader is pretty much at the end of the firmware. The initial function refers to the string
#RomStarter Ver1.02 for EC226\n\r (version and ECxx may differ).
2) it is unknown if Rescue Loader contain code which can write to SD card when OS unitialized ( it is logical there must be no one)
Indeed there's no need for code to write to the card, but the rescue loader is pretty small and should get us an idea about how card access works. It should be possible to get the rest of the pieces from the regular firmware.
3) when diskboot.bin is loaded and executed SD card controller (if it exists) already initialized
Maybe. I made a boot-loop in my A720 by copying the restart function to my own code (as suggested by CHDK). We could also take the main function of the rescue loader, strip it of the firmware-ok-check and have our code rerun by the rescue functions.
I noticed a difference in the rescue loader from regular SD access. The rescue loader refers to the files by their name. The regular functions refer to the files by a device indicator ("A/") plus the filename. It might not mean much, I just mentioned for completeness.
4) Running OS must have some primitive functions to read/write sectors which can work without OS initialized
5) my camera(a630) can work with SD and MMC cards . I don't know how camera operates with any of them and if there is a difference
4) I don't think that works, but analyzing the rescue loader might get useful results.
5) Probably it doesn't make any difference to the software.
lets get to the point:
1) we load .bin file
2) OS is unitialized
3) .bin file code finds SD/MMC sector read/write functions using signatures
4) .bin file writes dump into SD/MMC card
As already stated, there may be no code to write to the card in the rescue loader. I suggest:
3) ...finds functions using signatures, extracts necessary addresses for IO and uses own functions for accessing the card that were derived from the original firmware.
Cheers.
