What do you think 'PT' stands for ?
I'd say Product Test, since a540 has a function "RegisterProductTestEvent"
While you are looking at this stuff, do you know if the movie-capture task can be paused anywhere without causing a crash ?
(I can start a new thread about this).
Probably better in a new thread (or the previous one we talked about this in). I don't know myself.
If not, is there anywhere an led can be very briefly flashed at the instant each frame is captured ?
This seems like it ought to be possible, but again, I don't know anything specific.
For capt_seq, we still need all the asm for the raw hook, though?
Yes, unfortunately it seems so.
This makes me wonder if there are more such vacant eventprocs for testing or debug?
Worth looking for. One way to do this is to work backwards from calls to ExecuteEventProcedure. The thing you need to do is find was that are called automatically in operation. I believe a lot of the eventprocs just exist to be called from cbasic or development or service code. In many cases the normal camera code calls the C function directly instead of going through event proc interface. So replacing Fopen_Fut doesn't let you hook everywhere the camera opens a file.
Maybe some that aren't even empty like these PT* functions but contain things like console logging that doesn't really need to be done by a replacement...
Another approach would be to figure out how to find the address of a currently registered eventproc, then you could would truly 'hook' it instead of replacing. I haven't seen an obvious way to do this, but event procs seem to be handled by something called "nameservice". It should be possible to get the proper lookup code from ExecuteEventProcedure, but it looks like it would have to be found manually or done with sigs.
There is also CreateProxyOfEventProcedure and DeleteProxyOfEventProcedure which sound interesting but I don't understand what they do.
edit: these are empty as well:
PT_BatLvChange_PreWeak
PT_BatLvChange_Weak
PT_BatLvChange_Low
PT_BatLvChange_SysLow
Are they called by the camera in normal operation ? From a quick look on a540, it appears they would be called from PT_BatTestTask.
To find ones that can be used in hooks, you need to look find ones that are called automatically. In a570, the function that "dispatches" the PT_ hooks is sub_FFEB5A60, and it only looks at the first 10. Looking for similar functions might be productive.
There is another interesting set of event procs that look like they might do something like this. On a570 100e, sub_FFC04BE0 loads an event proc name from 0xD970 and executes it. There are a bunch of similar ones that use offsets from this address. These functions (sub_FFC04BE0 etc) are themselves in a table in that gets copied to camera RAM, starting at FFF2D72C. On a540, the contents of the corresponding address (0xD310) seems to be null by default.
Edit: these are somehow used by CreateProxyOfEventProcedure and DeleteProxyOfEventProcedure
One thing that should help hunting these is that whenever an eventproc is called, the name is sent to the camera log. Of course, there may be other pre-conditions that need to be present before they are called at all (like the variable set by SS.Create in D10)
edit:
Two more likely candidates on d10, not on older cameras like a570
UIFS_ChangeShootState called by sub_FF9317E4
UIFS_ShootSeqToUI called by sub_FF931808. This one looks interesting, it is called from PostEventShootSeqToUI. Calls to this go into the camera log as "ShootSeqToUI:0x%04x:adr:%p,Para:%ld"
