Hi,
@matteopd : is europe precise enough
@all :
I would like to summarise the information I researched from various sources and garnish them with some questions:
- so my 750D has a processor called digic6 which is in fact 2(3?) processors in one chip the main one being an arm7 cortex
- being an arm7 cortex it understands two dialects of opcodes: arm and thumb2. To switch between the two a ldx or blx instruction is used. Our disassemblers have a problem in deciding when to use which dialect (still true or old information?)
- there is a co processor handling much of the io stuff the main processor talks to it via e.g. cdp mcr
- there is a tool enabling the boot flag on the camera. is there a source for that (could be that I'm missing the obvious)?
- qemu enters the firmware at 0x7c000008 why this odd (even though it is even

) address and not 0x7e02000 which is the firmware start? The first eight bytes at 0x7c000000 are no legal opcodes I understand.
- in the qemu code it says under digic6 .rom0 not yet dumped. is that something we are missing? haven't found anything in the forum on the topic
- I have been casually stepping through the startup code and noticed several loop doing nothing else but counting down r0 from e.g.. 0x20a or 0xf there are other loop copying stuff (e.g. from rom at 0xfe020000..40 to 0x0 in tcm.code) I assume these are to sync stuff and wait for some things to settle or is there any "magic" arm stuff I'm missing out?
At the moment I'm experimenting with radare2 as a replacement for gdb. It has some nice analysis features (if I had the money for IDA I would have bought a different camera instead

) it is even possible to dry simulate an arm system without qemu attached.
The camera itself seems to have an interface in the battery compartment (JTAG? serial? ) Does anyone have information on that? I could 3D print a battery dummy an put connectors as they're used on testbeds for PCBs on it to get an interface but I'm a bit reluctant to do this to my camera.
Well so far, more questions as they arise.