Nothing useful, only notes. (thx for A1ex for posting this link: http://magiclantern.wikia.com/wiki/Engio_Magic_Spells )

Framerate & exposure controlEdit

The behaviour written on the above mentioned page exists. Writing arbitrary values to 0xc0f06014 followed by writing 1 to 0xc0f06000 causes immediate change in the liveview framerate as well as in exposition (probably exposition time = 1/framerate). The value seems to wrap (at ~10000...20000?). Setting too low (<1) fps causes shutdown (watchdog, I guess). Overexposure causes the camera to adjust the shutterspeed (and fps). Tried and works on the A420, A470.

0xC0F06014

Can be found in DIGIC III and 4 compacts, and probably has the same purpose. It's only used by one function which looks roughly the same (be it VxWorks or DryOS camera). One of its callers is a function which computes something from half- and full words which are part of a structure. The pointer to that structure comes from a function which is in the FldSpec.c source module. The pointer this function supplies comes from a table of pointers in RAM. The base address can be found as a constant here. The pointers point to the above mentioned structures in ROM.

The structuresEdit

Their length is 0xd0 bytes (in most DIGIC II - DIGIC IV cameras I've seen).

They are probably used for what the Magic Lantern wiki currently calls "Path setup" (Register_Map) and / or store timing values.

These are called "field specifications" (hint: Fldspec.c), mostly containing timing values (assumption).

S1ISEdit

This DIGIC (I) model doesn't yet have the ability to adjust liveview frame rate dynamically. Therefore, it only has 6 field spec tables. A table is 0xc0 bytes long, the sensor driving clock frequency is stored separately (it's fixed 24.3MHz). At least the start of these tables is very similar to the later ones.

The cam has 640x480 and 320x240 movie modes at 15 and 30 fps. Maximal exposure time is the same at 15 and 30 fps. Movie modes get 1 of these spec tables, framerate and resolution is dealt with elsewhere. There has to be an AF-mode (partial vertical scan with detailed horizontal lines) and the regular liveview used in all the still image modes. The regular liveview has a vertical resolution of 218 or 240 pixels, depending on whether tv-out is used.

A420Edit

Example from the A420 (DIGIC II, only found that FldSpec.c routine with the base address (0x5224) and used a RAM dump to get the ROM addresses), 4Mpixel

first structure

ffcb4bd0: 	0c300c30
ffcb4bd4: 	0aba0c30
ffcb4bd8: 	00000c30
ffcb4bdc: 	00000319
ffcb4be0: 	00000319
	... (zeros skipped)
ffcb4bec: 	000900c0
ffcb4bf0: 	00000000
ffcb4bf4: 	00000001
	...
ffcb4c48: 	00ce0000
ffcb4c4c: 	03110032
ffcb4c50: 	0003024b
	...
ffcb4c98: 	0001867e
ffcb4c9c: 	0179a7b0

second one

ffcb4ca0: 	13581252
ffcb4ca4: 	12521252
ffcb4ca8: 	00001252
ffcb4cac: 	00000078
ffcb4cb0: 	00000078
	...
ffcb4cbc: 	000900c0
ffcb4cc0: 	00000000
ffcb4cc4: 	00000001
	...
ffcb4cd0: 	00020000
ffcb4cd4: 	00000002
ffcb4cd8: 	00000001
	...
ffcb4d18: 	00030000
ffcb4d1c: 	05fc002c
ffcb4d20: 	00040075
	...
ffcb4d34: 	061b060d
	...
ffcb4d68: 	000058dd
ffcb4d6c: 	0179a7b0 (24,750,000, is the same in every struct, clock in Hz?)

nr. of these structs is 17, there's a table which translates the parameter (?) of the 
"Imager" setup functions to select one of these (@0xffcb2bac)

0xffcb2bac: 0xA, 0xA, 0xC, 0xD, 0, 2, 5, 4, 1, 6, 3, 7, 8, 0xF, 0x10, 2, 0

The "Imager" is in its 5th mode (0) when in still image or low res movie mode,
and in the 4th (2) when in VGA movie mode.

Some elements of the structure are obviously half-words (16bits), the last 
value seems to be a full word.

A570Edit

Late VxWorks model (7.1Mpixel) , structs start at 0xFFD6AFCC (rev. 1.00e).

A470Edit

A470 examples (1.02c, pointers in RAM start at 0x686c), 7.1Mpixel

The sensor resolution and size is exactly the same as in the A570 (and a few other models). The VGA video mode may be deliberately crippled (20fps in the A470, 30fps in the other models), 60fps lo-res mode is not available, unlike in the other models. This is the only 7.1M model with DryOS.

first struct

ffe5ff80: 	119a119a
ffe5ff84: 	1661119a
ffe5ff88: 	0000119a
ffe5ff8c: 	0000018f
ffe5ff90: 	0000018f
	...
ffe5ff9c: 	000900c0
ffe5ffa0: 	00000000
ffe5ffa4: 	00000001
	...
ffe5fff8: 	00840000
ffe5fffc: 	05550003
ffe60000: 	0003010b
	...
ffe60014: 	002c000a
	...
ffe60044: 	00000001
ffe60048: 	0000c315
ffe6004c: 	02255100

second one

ffe60050: 	119a119a
ffe60054: 	119a119a
ffe60058: 	0000119a
ffe6005c: 	0000010f
ffe60060: 	0000010f
	...
ffe6006c: 	000900c0
ffe60070: 	00000000
ffe60074: 	00000001
	...
ffe600c8: 	00040000
ffe600cc: 	05550003
ffe600d0: 	0003010b
	...
ffe600e4: 	002c000a
	...
ffe60118: 	00008480
ffe6011c: 	02255100 (36,000,000; the only one exception is 18,000,000)

Ixus870 / SD880Edit

Ixus870/SD880 1.00e, DIGIC 4, 10Mpixel, pointers to these start at 0x6fcc

first struct

ffae0578: 	085c07e4
ffae057c: 	07e407e4
ffae0580: 	000007e4
ffae0584: 	00000252
ffae0588: 	00000252
	...
ffae0594: 	000900c0
ffae0598: 	00000000
ffae059c: 	00000001
	...
ffae05a8: 	00020000
ffae05ac: 	00000002
ffae05b0: 	00000001
	...
ffae05f0: 	00710001
ffae05f4: 	03090005
ffae05f8: 	000401e1
	...
ffae0640: 	00008235
ffae0644: 	02255100 (36,000,000)

second one

ffae0648: 	07e407e4
ffae064c: 	07e407e4
ffae0650: 	000007e4
ffae0654: 	000001f0
ffae0658: 	000001f0
	...
ffae0664: 	000900c0
ffae0668: 	00000000
ffae066c: 	00000001
	...
ffae06c0: 	000f0001
ffae06c4: 	03090005
ffae06c8: 	000401e1
	...
ffae0710: 	00006cb7
ffae0714: 	02255100

The pointers in RAM are of course copied there from the ROM at startup, as no pointer to the start of these structures can be found elsewhere.