« Reply #1681 on: 28 / March / 2013, 06:28:09 »
I finally got hook in function which seems like updates GUI. But overlay still flickers. I think it has something to do with "GUIBlinkTimer".
int UpdateGUI (int r0, int r1, int r2, int r3, int a, int b, int c, int d)
{ int aa = sub_FF92D950 (r0, r1, r2, r3, a, b, c, d); // looks like this function get called everytime GUI updates
UnSuspendTask(hVramModTask);
return aa;
}
(*(int*)0x51C0)= (int)&UpdateGUI; // goes in main.c at initialization
........
Looks interesting, when looking around the address of this CallBackRoutine (CBR), it looks like it is related to WindowInstance stuff... may be this means that it is called only when there are "windows" on the screen...
Another interesting thing is that on the next few addresses, there are stuff related to:
eventproc_TransferNormalScreen()
I think this eventproc is the one that transfers the FrameBuffer to the real LCD screen.
Everything is drawn in a framebuffer and i guess it's double buffered (i.e. there are 2 frame buffers)
then when the frame buffer is changed this routine will draw the original lcd.
IIRC all eventproc routines are registered in table, and there were register_eventproc() or something...
this way, we can replace the original eventproc with ours... and if I'm right on this, this routine should be used to refresh the screen, hence we can use this to stop flickering...
I'm only guessing here, I have no chance to test it ATM.
this is what i see in RAM, right next after some VRAM buffer (frame buffer)
RAM:0023D008 off_23D008: .long off_227DFC @ DATA XREF: RAM:00227E00o
RAM:0023D008 @ RAM:off_23D01Co
RAM:0023D00C .long off_23D01C
RAM:0023D010 .long sub_14
RAM:0023D014 .align 8
RAM:0023D018 .long eventproc_TransferNormalScreen
RAM:0023D01C off_23D01C: .long off_23D008 @ DATA XREF: RAM:0023D00Co
RAM:0023D01C @ RAM:off_23D048o
RAM:0023D020 .long off_23D048
RAM:0023D024 .long dword_2C
RAM:0023D028 .byte 0
RAM:0023D029 .byte 0
RAM:0023D02A .byte 0
RAM:0023D02B .byte 0
RAM:0023D02C .byte 0x14
RAM:0023D02D .byte 0xD0 @ -
RAM:0023D02E .byte 0x23 @ #
RAM:0023D02F .byte 0
RAM:0023D030 aTransferNormalScreen:.ascii "TransferNormalScreen"
and this is the ROM where it gets registered:
FW:FF934EB4 028 LDR R0, =aTransfernormal @ "TransferNormalScreen"
FW:FF934EB8 028 STR R2, [LR] @ Store to Memory
FW:FF934EBC 028 LDR R1, =eventproc_TransferNormalScreen @ Load from Memory
FW:FF934EC0 028 STR R6, [R4] @ Store to Memory
FW:FF934EC4 028 STR R6, [R5] @ Store to Memory
FW:FF934EC8 028 BL RegisterEventProcedure @ Branch with Link
i'm not 100% sure, but i think at 0x00005448 in RAM starts the eventproc table
format is simple:
struct {
int * pointer_to_routine;
char * pointer_to_string;
}
RAM:00005448 .long eventproc_about
RAM:0000544C .long aabout @ "about"
RAM:00005450 .long eventproc_about
RAM:00005454 .long aGetSystemInfo @ "GetSystemInfo"
RAM:00005458 .long eventproc_GetSystemInfo
RAM:0000545C .long aPrintModelName @ "PrintModelName"
Unfortunately i do not find the eventproc_TransferNormalScreen()
it seems this list is only registering the eventproc's available for the shell (console) of the camera, and transfernormalscreen is not one of them. Anyway, it is registered right after one of the VRAM's (see above)
These are just few random thoughts that crossed my mind, hope it helps.