It is late and I cannot access the USB drive that has the disassembled code for SX230HS 101b until tomorrow.
For now, take my word that testing took us to address sub_FF002EEC.
I said this to the tester :-
"Before we go any further please explain exactly what you did with the code at sub_FF002EEC and did the camera shoot or not."
He replied :-
asm volatile(
" STMFD SP!, {R4-R6,LR}\n"
" MOV R6, R1\n"
" BICS R1, R2, #4\n"
" MOV R5, R2\n"
" BEQ loc_FF002F08\n"
//" MOVL R0, 0xFFFFFFFF\n"
" MVN R0, #0\n" //MOVL
" LDMFD SP!, {R4-R6,PC}\n"
"loc_FF002F08:\n"
" MRS R4, CPSR\n"
" ORR R1, R4, #0x80\n"
if i put wait code here, camera doesn't shoot until switch released.
" MSR CPSR_c, R1\n"
if i put wait code here, camera shoots without switch released.
" BL sub_FF007340\n"
" CMP R0, #0\n"
" MSREQ CPSR_c, R4\n"
" BEQ sub_FF002F00\n"
" MOV R2, R5\n"
" MOV R1, R6\n"
" BL sub_FF0074F8\n"
" MSR CPSR_c, R4\n"
" MOV R0, #0\n"
" LDMFD SP!, {R4-R6,PC}\n"
);
}