Magic Lantern Firmware Wiki

Menus are created in

ROM:FF305254 sub_FF305254                            ; CODE XREF: StartMenuMode+4�p

depending on the ModeZone (stored at offset 0x98 in struct at 0x14c48).

if ModeZone are 0-5, all Menu are created (A-Dep, M, Av, Tv, P)

ROM:FF305268                 BL      StartMnMainTabHeaderApp

if ModeZone are 9-15 and 19, (CA, Portrait, Landscape ...)

ROM:FF305280                 BL      StartMnMainTabHeaderImageZoneApp

If ModeZone is 20 (Movie)

ROM:FF3052A0                 BL      StartMnMainTabHeaderMovieZoneApp

Let's see extract of StartMnMainTabHeaderApp (0xFF3B15D8)

ROM:FF3B15FC                 BL      StartMnMainRec1App
ROM:FF3B1600                 BL      StartMnMainRec2App
ROM:FF3B1604                 BL      StartMnMainRecord3App
ROM:FF3B1608                 BL      StartMnMainPlay1App
ROM:FF3B160C                 BL      StartMnMainPlay2App
ROM:FF3B1610                 BL      StartMnMainSetup1App
ROM:FF3B1614                 BL      StartMnMainSetup2App
ROM:FF3B1618                 BL      StartMnMainSetup3App
ROM:FF3B161C                 BL      StartMnMainMyMenuApp
ROM:FF3B1620                 MOV     R3, #0
ROM:FF3B1624                 STR     R3, [SP,#0x10+var_10]

and StartMnMainTabHeaderImageZoneApp (FF3C8A90) :

ROM:FF3C8AB4                 BL      StartMnMainRec1App
ROM:FF3C8AB8                 BL      StartMnMainPlay1App
ROM:FF3C8ABC                 BL      StartMnMainPlay2App
ROM:FF3C8AC0                 BL      StartMnMainSetup1App
ROM:FF3C8AC4                 BL      StartMnMainSetup2App

A dialog box is created like this

ROM:FF3B1620                 MOV     R3, #0
ROM:FF3B1624                 STR     R3, [SP]                          ;level?
ROM:FF3B1628                 MOV     R3, #0x46 ; 'F'                   ;id (seems unique)
ROM:FF3B162C                 ADR     R2, MnMainTabHeaderApp_handler    ;handler
ROM:FF3B1630                 MOV     R1, #0                            ;arg2?
ROM:FF3B1634                 MOV     R0, #0                            ;arg1? 
ROM:FF3B1638                 BL      CreateDialogBox          // use 'fastcall' calling convention with IDA 'set function type'
                                                              // (Y key on function name) to assign correctly args to regs
ROM:FF3B163C                 TST     R0, #1                            ;dialog address
ROM:FF3B1640                 STR     R0, [R4]

the handler function is given in R2. R3 is supposed to be a unique identifier (to be checked)

and yes, Trammel already found this, see dialog_create() in dialog.h

The following table describes all menus but custom functions:

ROM:FF53CE64 MenuTable_FuncNo DCD    0,0xFFFFFFFF, 0xB, 0xB,   9	;movie_rec_size, list_popup#6
ROM:FF53CE64                 DCD    1,0xFFFFFFFF, 0xB, 0xB, 0xA		;movie_af_mode
ROM:FF53CE64                 DCD    2,0xFFFFFFFF, 0xB, 0xB, 0xB		;movie_af_during
ROM:FF53CE64                 DCD    3,0xFFFFFFFF, 0xB, 0xB, 0xC
ROM:FF53CE64                 DCD    4,0xFFFFFFFF, 0xB, 0xB, 0xD		;movie_remote_ctrl

ROM:FF53CE64                 DCD    5,0xFFFFFFFF, 0xB, 0xC,   9		;movie_exposure_mode
ROM:FF53CE64                 DCD    6,0xFFFFFFFF, 0xB, 0xC, 0xA		;SetLvGridToWinSystem
ROM:FF53CE64                 DCD    7,0xFFFFFFFF, 0xB, 0xC, 0xB		;SetLvTimerToWinSystem
ROM:FF53CE64                 DCD    8,0xFFFFFFFF, 0xB, 0xC, 0xC		;movie_sound_recording
ROM:FF53CE64                 DCD    9,0xFFFFFFFF, 0xB, 0xC, 0xD		

ROM:FF53CE64                 DCD  0xA, 0xB, 0xB,   0,   9		;red1 / quality
ROM:FF53CE64                 DCD  0xB,   8, 0xB,   0, 0xA		;beep
ROM:FF53CE64                 DCD  0xC,   9, 0xB,   0, 0xB
ROM:FF53CE64                 DCD  0xD,0x22, 0xB,   0, 0xC		;image review, list_popup#1
ROM:FF53CE64                 DCD  0xE,0x12, 0xB,   0, 0xD
ROM:FF53CE64                 DCD  0xF,0x23, 0xB,   0, 0xE		;red eye
ROM:FF53CE64                 DCD 0x10,0x14, 0xB,   0, 0xF

ROM:FF53CE64                 DCD 0x11,0x11, 0xA,   1,   9	;red2 / expo comp. AEB
ROM:FF53CE64                 DCD 0x12,0x16, 0xB,   1, 0xA
ROM:FF53CE64                 DCD 0x13,0x13, 0xB,   1, 0xB	;metring mode
ROM:FF53CE64                 DCD 0x14, 0xF, 0xB,   1, 0xC
ROM:FF53CE64                 DCD 0x15,   2, 0xB,   1, 0xD	;WB shift / studio_mode iso_comp
ROM:FF53CE64                 DCD 0x16,   3, 0xB,   1, 0xE	;color_space
ROM:FF53CE64                 DCD 0x17,   4, 0xB,   1, 0xF	;picture_style (flavor_mode)

ROM:FF53CE64                 DCD 0x18, 0xA, 0xB,   2,   9	;red3 ?
ROM:FF53CE64                 DCD 0x19,0x21, 0xB,   2, 0xA	;auto_iso_max

ROM:FF53CE64                 DCD 0x1A,0x10000, 0xB,   4,   9	;blue1
ROM:FF53CE64                 DCD 0x1B,0x10001, 0xB,   4, 0xA
ROM:FF53CE64                 DCD 0x1C,0x10002, 0xB,   4, 0xB
ROM:FF53CE64                 DCD 0x1D,0x10003, 0xB,   4, 0xC
ROM:FF53CE64                 DCD 0x1E,0x1000D, 0xB,   4, 0xD

ROM:FF53CE64                 DCD 0x1F,0x10009, 0xB,   5,   9	;blue2 / histogram
ROM:FF53CE64                 DCD 0x20,0x1000B, 0xB,   5, 0xA	;image_jump
ROM:FF53CE64                 DCD 0x21,0x1000E, 0xB,   5, 0xB	;hdmi_control

ROM:FF53CE64                 DCD 0x22,0x20000, 0xB,   6,   9	;yellow1 / auto_power_off_time, list_popup#2
ROM:FF53CE64                 DCD 0x23,0x20004, 0xB,   6, 0xA	;auto_rotate, list_popup#3
ROM:FF53CE64                 DCD 0x24,0x20005, 0xB,   6, 0xB
ROM:FF53CE64                 DCD 0x25,0x20002, 0xB,   6, 0xC	;file_numbering_mode
ROM:FF53CE64                 DCD 0x26,0x20018, 0xB,   6, 0xD	;lcd_auto_off (face_sensor)
ROM:FF53CE64                 DCD 0x27,0x20019, 0xB,   6, 0xE	;screen_color
ROM:FF53CE64                 DCD 0x28,0x20022, 0xB,   6, 0xF	;eyefi

ROM:FF53CE64                 DCD 0x29,0x20006,0x14,   7,   9	;yellow2 / lcd_brightness
ROM:FF53CE64                 DCD 0x2A,0x20007, 0xB,   7, 0xA	;date_time
ROM:FF53CE64                 DCD 0x2B,0x20008, 0xB,   7, 0xB	;language
ROM:FF53CE64                 DCD 0x2C,0x20009, 0xB,   7, 0xC	;video_system, list_popup#6
ROM:FF53CE64                 DCD 0x2D,0x20010, 0xB,   7, 0xD
ROM:FF53CE64                 DCD 0x2E,0x2000B, 0xB,   7, 0xE
ROM:FF53CE64                 DCD 0x2F,0xFFFFFFFF, 0xB,   6, 0xF		;factory

ROM:FF53CE64                 DCD 0x30,0x2001A, 0xB,   8,   9	;yellow3?
ROM:FF53CE64                 DCD 0x31,0x2001F, 0xB,   8, 0xA
ROM:FF53CE64                 DCD 0x32,0x2001B, 0xB,   8, 0xB
ROM:FF53CE64                 DCD 0x33,0x20011, 0xB,   8, 0xC	;firmware_update
ROM:FF53CE64                 DCD 0x34,0xFFFFFFFF, 0xB,   8, 0xD		;hidden ?

Column1 is function number
Column2 is the MenuTab number (0 to 0xc)
Last column is the line inside the MenuTab (9 means first line)

Table for custom functions is simpler:

ROM:FF53D288 CFnMenuTable_TableNo DCD 0x35,0x40000   ; DATA XREF: sub_FF4044D4+48�o
ROM:FF53D288                                         ; GetMyMenuItemIdFromFuncNo+6C�o ...
ROM:FF53D288                 DCD 0x36,0x4000F
ROM:FF53D288                 DCD 0x37,0x4000E
ROM:FF53D288                 DCD 0x38,0x50000
ROM:FF53D288                 DCD 0x39,0x50001
ROM:FF53D288                 DCD 0x3A,0x50002
ROM:FF53D288                 DCD 0x3B,0x6000D
ROM:FF53D288                 DCD 0x3C,0x6000E
ROM:FF53D288                 DCD 0x3D,0x70010
ROM:FF53D288                 DCD 0x3E,0x70013
ROM:FF53D288                 DCD 0x3F,0x70011
ROM:FF53D288                 DCD 0x40,0x7000E

the FunctionNumber is used for SubMenu, like here for DustData Creation

ROM:FF3AE948                 MOV     R0, #0x18
ROM:FF3AE94C                 BL      MnStartApp_StartSubMenu


ROM:FF3A88F0 StartMnDustOffDataApp                   ; DATA XREF: MnStartApp_StartSubMenu+18C�o


ROM:FF3A8548 DlgMnDustOffData_handler

If someone knows how to link StringIDs and the offset to the related text in several language. For example, in ROM:FF3A8C08 DustOffData_wizard_maybe, it seems 0xd0, 0xd1, 0xd2 and 0xd3 are StringIDs for

ROM:FF6DFF75 aDustDeleteData DCB "Dust Delete Data",0
ROM:FF6E0230 aObtainDataForRemoving DCB "Obtain data for removing ",0
ROM:FF6E0581 aDustUsingSoftware_ DCB "dust using software.",0
ROM:FF6E0895 aReferToManualForDetails_ DCB "Refer to manual for details.",0

=> see some progress at GUI_StringIDs

Struct 0x14c48 stores a lot of settings like here at offset 0x174 for Histogram (type I believe):

ROM:FF202E64 set_histogram                           ; CODE XREF: SetHistogramToStorage:loc_FF3B22D4�j
ROM:FF202E64                 LDR     R1, =struct_14c48
ROM:FF202E68                 MOV     R2, #4
ROM:FF202E6C                 STR     R0, [R1,#0x174]
ROM:FF202E70                 LDR     R0, =0x2030005
ROM:FF202E74                 ADD     R1, R1, #0x174
ROM:FF202E78                 B       prop_request_change
ROM:FF202E78 ; END OF FUNCTION CHUNK FOR SetHistogramToStorage

the 0x02030005 property is also updated to propagate this change to tasks which are subscribers of this property.

another one (self explaining):

ROM:FF20C438 set_studiomode_maybe
ROM:FF20C438                 LDR     R1, =struct_14c48
ROM:FF20C43C                 MOV     R2, #4
ROM:FF20C440                 STR     R0, [R1,#0x244]
ROM:FF20C444                 LDR     R0, =0x8004001B
ROM:FF20C448                 ADD     R1, R1, #0x244
ROM:FF20C44C                 B       prop_request_change
ROM:FF20C44C ; End of function set_studiomode_maybe

I just found this, about Menus in 40D: 40D 1.0.8 Dump Available (June 2008)