And about "power consumption" method:
The current which consumes the processor, depends on an executed command (because different processor blocks will be involved). Change of a current can be measured and used as a output signal of dumper (if LED addresses are unknown). Of course, this current is integrated in the power supply capacitors, and this method is not too fast...
Technical details: small (5-15 Ohms) resistor inserted between power source (external power supply or battery) and camera. Microphone input of sound card connected to resistor (amplitude of signal is 5-10 mV). Sound record parameters is 8000 Hz, 8 bit, mono
. Transfer speed is 15-20 bytes/sec
. After record is finished, in sound editor is necessary to cut off the beginning and the end of record, save it in RAW (not WAV) format and use dec.exe (sorry, Pascal source) to decode record to binary file (no start-stop bits, blocks, CRCs used - after several hours or record I did not have any error).
Because this method is slow, it can be used with blinker (see file search.c). This dumper finds address of string "LEDDrv" in ROM. After this, we can dump 2-4 kBytes near this string, disassemble it and find all LED addresses. Then we can make dump with usual blinker (this method was used to dump first G7 camera (1.00I)).
