Well I need some help with reverse engineering.
I want to find brightness sensors in viewfinder.
If we found it we can implement ETTR in shooting mode or "auto exposure compensation" as I call it. I will describe it later.
There is a few ways how to find it. I choose debug flag.
After some research with nanomad I found that AE_VALUE is probably set in function copyOlcDataToStorage.
Nanomad says that function copies computed AE_VALUE from Toshiba MCU.
So my first step is find the address from is the data copied. I tried to set debug flag here, but it doest work, my flag wasn't triggered. There is some reasons why:
I spy wrong address (maybe I have ROM image wrong loaded)
AE_VALUE is set somewhere else
g3gg0 iirc some cameras permanently cleared the ICACHE in PwrMgr task, not sure if this is the case on 5D2
So please could anybody spy this?
use this https://bitbucket.org/hudson/magic-lantern/pull-request/193/debugger-module
I want to find brightness sensors in viewfinder.
If we found it we can implement ETTR in shooting mode or "auto exposure compensation" as I call it. I will describe it later.
There is a few ways how to find it. I choose debug flag.
After some research with nanomad I found that AE_VALUE is probably set in function copyOlcDataToStorage.
Nanomad says that function copies computed AE_VALUE from Toshiba MCU.
So my first step is find the address from is the data copied. I tried to set debug flag here, but it doest work, my flag wasn't triggered. There is some reasons why:
I spy wrong address (maybe I have ROM image wrong loaded)
AE_VALUE is set somewhere else
g3gg0 iirc some cameras permanently cleared the ICACHE in PwrMgr task, not sure if this is the case on 5D2
So please could anybody spy this?
Code Select
LDRB R0, [R8,#2] ; R8 is what we need
STRB R0, [R9,#0x1D] ; 0x1D is struct offset of AE_VALUE
use this https://bitbucket.org/hudson/magic-lantern/pull-request/193/debugger-module