I have a 700D.114 and there the address of capture_err_time_addr is different to the value from @josepvm:
capture_err_time_addr = 0xff1e1dd8
The address of
bulb_end_addr is the same as @josepvm posted = 0x24960
In a first short test I implemented only the capture_err_time_addr
and it works. Now up to 32s are possible.
Bulb mode I have not yet tested.
The code of my ROM1 is:
For BulbEnd: (only the code addresses are different, all other is equal)
capture_err_time_addr = 0xff1e1dd8
The address of
bulb_end_addr is the same as @josepvm posted = 0x24960
In a first short test I implemented only the capture_err_time_addr
and it works. Now up to 32s are possible.
Bulb mode I have not yet tested.
The code of my ROM1 is:
Code Select
"FA_CaptureTestImage(hJob:%#lx)":
ff1e1d90: 435f4146 cmpmi pc, #-2147483631 ; 0x80000011
ff1e1d94: 75747061 ldrbvc r7, [r4, #-97]! ; 0x61
ff1e1d98: 65546572 ldrbvs r6, [r4, #-1394] ; 0x572
ff1e1d9c: 6d497473 cfstrdvs mvd7, [r9, #-460] ; 0xfffffe34
ff1e1da0: 28656761 stmdacs r5!, {r0, r5, r6, r8, r9, sl, sp, lr}^
ff1e1da4: 626f4a68 rsbvs r4, pc, #104, 20 ; 0x68000
ff1e1da8: 6c23253a cfstr32vs mvfx2, [r3], #-232 ; 0xffffff18
ff1e1dac: 00002978 andeq r2, r0, r8, ror r9
"sht_FA_ReleaseStart":
ff1e1db0: 5f746873 svcpl 0x00746873
ff1e1db4: 525f4146 subspl r4, pc, #-2147483631 ; 17f1e1dab: (???)
ff1e1db8: 61656c65 cmnvs r5, r5, ror #24
ff1e1dbc: 74536573 ldrbvc r6, [r3], #-1395 ; 0x573
ff1e1dc0: 00747261 rsbseq r7, r4, r1, ror #4
"sht_FA_ReleaseData":
ff1e1dc4: 5f746873 svcpl 0x00746873
ff1e1dc8: 525f4146 subspl r4, pc, #-2147483631 ; 17f1e1dbf: (???)
ff1e1dcc: 61656c65 cmnvs r5, r5, ror #24
ff1e1dd0: 61446573 hvcvs 18003 ; 0x4653
ff1e1dd4: 00006174 andeq r6, r0, r4, ror r1
ff1e1dd8: 00004e20 andeq r4, r0, r0, lsr #28
ff1e1ddc: 0000017b andeq r0, r0, fp, ror r1
ff1e1de0: ff1e183c ; <UNDEFINED> instruction: 0xff1e183c
"FA_CaptureTestImage Fin":
For BulbEnd: (only the code addresses are different, all other is equal)
Code Select
ff14b0cc: e28f2f81 add r2, pc, #516 ; ff14b2d8: (42736373) *"scsBulbEnd"
ff14b0d0: e20000ff and r0, r0, #255 ; 0xff
ff14b0d4: e3a01003 mov r1, #3
ff14b0d8: eb3ae21f bl loc_395c
ff14b0dc: e51f0b30 ldr r0, [pc, #-2864] ; ff14a5b4: (00024950)
ff14b0e0: e3a01001 mov r1, #1
ff14b0e4: e5801010 str r1, [r0, #16]
ff14b0e8: e5900004 ldr r0, [r0, #4]
ff14b0ec: e8bd8010 pop {r4, pc}