I'm still struggeling to find a way to overwrite physw_status on this camera.
Problem is GetKbdState is totaly different to other (older) cameras...
SD4000
ROM:FF861908 GetKbdState ; CODE XREF: kbd_read_keys+20
ROM:FF861908 STMFD SP!, {R4-R6,LR}
ROM:FF86190C LDR R6, =0x24BC
ROM:FF861910 MOV R4, R0
ROM:FF861914 LDR R0, [R6,#4]
ROM:FF861918 LDR R5, =0xC0220000
ROM:FF86191C CMP R0, #0
ROM:FF861920 LDRNE R0, [R5,#0x114]
ROM:FF861924 BICNE R0, R0, #2
ROM:FF861928 STRNE R0, [R5,#0x114]
ROM:FF86192C MOVNE R0, #3
ROM:FF861930 BLNE _sub_FF8618C4__PhySwGpioMatSw.c__2 ; LOCATION: PhySwGpioMatSw.c:2
ROM:FF861934 LDR R0, [R5,#0x200]
ROM:FF861938 STR R0, [R4]
ROM:FF86193C LDR R0, [R5,#0x204]
ROM:FF861940 STR R0, [R4,#4]
ROM:FF861944 LDR R0, [R5,#0x208]
ROM:FF861948 STR R0, [R4,#8]
ROM:FF86194C MOV R0, R4
ROM:FF861950 BL sub_FF861080
ROM:FF861954 STR R0, [R4]
ROM:FF861958 MOV R0, #0
ROM:FF86195C STR R0, [R4,#4]
ROM:FF861960 STR R0, [R4,#8]
ROM:FF861964 LDR R0, [R6,#4]
ROM:FF861968 CMP R0, #0
ROM:FF86196C LDREQ R0, [R6,#0xC]
ROM:FF861970 STREQ R0, [R4,#4]
ROM:FF861974 BEQ loc_FF861A10
ROM:FF861978 MOV R0, #0
ROM:FF86197C BL sub_FF8610AC
ROM:FF861980 STR R0, [R4,#4]
ROM:FF861984 LDR R0, [R5,#0x114]
ROM:FF861988 ORR R0, R0, #2
ROM:FF86198C STR R0, [R5,#0x114]
ROM:FF861990 MOV R0, #0x1E
ROM:FF861994 BL _sub_FF8618C4__PhySwGpioMatSw.c__2 ; LOCATION: PhySwGpioMatSw.c:2
ROM:FF861998 LDR R0, [R5,#0x118]
ROM:FF86199C BIC R0, R0, #2
ROM:FF8619A0 STR R0, [R5,#0x118]
ROM:FF8619A4 MOV R0, #3
ROM:FF8619A8 BL _sub_FF8618C4__PhySwGpioMatSw.c__2 ; LOCATION: PhySwGpioMatSw.c:2
ROM:FF8619AC MOV R0, #1
ROM:FF8619B0 BL sub_FF8610AC
ROM:FF8619B4 LDR R1, [R4,#4]
ROM:FF8619B8 ORR R0, R0, R1
ROM:FF8619BC STR R0, [R4,#4]
ROM:FF8619C0 LDR R0, [R5,#0x118]
ROM:FF8619C4 ORR R0, R0, #2
ROM:FF8619C8 STR R0, [R5,#0x118]
ROM:FF8619CC MOV R0, #0x1E
ROM:FF8619D0 BL _sub_FF8618C4__PhySwGpioMatSw.c__2 ; LOCATION: PhySwGpioMatSw.c:2
ROM:FF8619D4 LDR R0, [R5,#0x11C]
ROM:FF8619D8 BIC R0, R0, #2
ROM:FF8619DC STR R0, [R5,#0x11C]
ROM:FF8619E0 MOV R0, #3
ROM:FF8619E4 BL _sub_FF8618C4__PhySwGpioMatSw.c__2 ; LOCATION: PhySwGpioMatSw.c:2
ROM:FF8619E8 MOV R0, #2
ROM:FF8619EC BL sub_FF8610AC
ROM:FF8619F0 LDR R1, [R4,#4]
ROM:FF8619F4 ORR R0, R0, R1
ROM:FF8619F8 STR R0, [R4,#4]
ROM:FF8619FC LDR R0, [R5,#0x11C]
ROM:FF861A00 ORR R0, R0, #2
ROM:FF861A04 STR R0, [R5,#0x11C]
ROM:FF861A08 LDR R0, [R4,#4]
ROM:FF861A0C STR R0, [R6,#0xC]
ROM:FF861A10
ROM:FF861A10 loc_FF861A10 ; CODE XREF: GetKbdState+6C
ROM:FF861A10 LDR R0, [R6,#4]
ROM:FF861A14 MOV R1, #1
ROM:FF861A18 BIC R0, R1, R0
ROM:FF861A1C STR R0, [R6,#4]
ROM:FF861A20 LDMFD SP!, {R4-R6,PC}
SD990 (like most other DryOs cameras like A720)
ROM:FF84A390 GetKbdState ; CODE XREF: kbd_read_keys+20
ROM:FF84A390 LDR R1, =0xC0220000
ROM:FF84A394 LDR R2, [R1,#0x200]
ROM:FF84A398 STR R2, [R0]
ROM:FF84A39C LDR R2, [R1,#0x204]
ROM:FF84A3A0 STR R2, [R0,#4]
ROM:FF84A3A4 LDR R1, [R1,#0x208]
ROM:FF84A3A8 MOV R1, R1,LSL#16
ROM:FF84A3AC MOV R1, R1,LSR#16
ROM:FF84A3B0 STR R1, [R0,#8]
ROM:FF84A3B4 BX LR
If i try to overwrite physw_status like SD990 for example, camera just shutdown without assert or else...
SD990 kbd.c
...
physw_status[0] = kbd_new_state[0];
physw_status[1] = kbd_new_state[1];
physw_status[2] = kbd_new_state[2];
...
