Greg and Alex: I disassembled the ROM1, found the line:
ff085a50: e28f209c add r2, pc, #156 ; ff085af4: (435f4146) *"FA_CaptureTestImage(hJob:%#lx)"
but I can't find 0x4E20 (or 0x4e20, 0x04e20, 0x004e20) anywhere. Does it mean my camera uses a different timing parameter (not 20000 ms)? What else can I do here?
EDIT: Okay, I think I have to search for 00004e20. Its first instance is found 20 lines below the above line (FA_CaptureTestImage(hJob:%#lx)):
ff085aa0: e59f106c ldr r1, [pc, #108] ; ff085b14: (00004e20)
and then 30 lines below the previous one:
ff085b14: 00004e20 andeq r4, r0, r0, lsr #28
So which of the two addresses (if any) should be used for capture_err_time_addr - ff085aa0 or ff085b14?