Menus are created in
ROM:FF305254 sub_FF305254 ; CODE XREF: StartMenuMode+4�p
depending on the ModeZone (stored at offset 0x98 in struct at 0x14c48).
if ModeZone are 0-5, all Menu are created (A-Dep, M, Av, Tv, P)
ROM:FF305268 BL StartMnMainTabHeaderApp
if ModeZone are 9-15 and 19, (CA, Portrait, Landscape ...)
ROM:FF305280 BL StartMnMainTabHeaderImageZoneApp
If ModeZone is 20 (Movie)
ROM:FF3052A0 BL StartMnMainTabHeaderMovieZoneApp
Let's see extract of StartMnMainTabHeaderApp (0xFF3B15D8)
ROM:FF3B15FC BL StartMnMainRec1App ROM:FF3B1600 BL StartMnMainRec2App ROM:FF3B1604 BL StartMnMainRecord3App ROM:FF3B1608 BL StartMnMainPlay1App ROM:FF3B160C BL StartMnMainPlay2App ROM:FF3B1610 BL StartMnMainSetup1App ROM:FF3B1614 BL StartMnMainSetup2App ROM:FF3B1618 BL StartMnMainSetup3App ROM:FF3B161C BL StartMnMainMyMenuApp ROM:FF3B1620 MOV R3, #0 ROM:FF3B1624 STR R3, [SP,#0x10+var_10]
and StartMnMainTabHeaderImageZoneApp (FF3C8A90) :
ROM:FF3C8AB4 BL StartMnMainRec1App ROM:FF3C8AB8 BL StartMnMainPlay1App ROM:FF3C8ABC BL StartMnMainPlay2App ROM:FF3C8AC0 BL StartMnMainSetup1App ROM:FF3C8AC4 BL StartMnMainSetup2App
A dialog box is created like this
ROM:FF3B1620 MOV R3, #0
ROM:FF3B1624 STR R3, [SP] ;level?
ROM:FF3B1628 MOV R3, #0x46 ; 'F' ;id (seems unique)
ROM:FF3B162C ADR R2, MnMainTabHeaderApp_handler ;handler
ROM:FF3B1630 MOV R1, #0 ;arg2?
ROM:FF3B1634 MOV R0, #0 ;arg1?
ROM:FF3B1638 BL CreateDialogBox // use 'fastcall' calling convention with IDA 'set function type'
// (Y key on function name) to assign correctly args to regs
ROM:FF3B163C TST R0, #1 ;dialog address
ROM:FF3B1640 STR R0, [R4]
the handler function is given in R2. R3 is supposed to be a unique identifier (to be checked)
and yes, Trammel already found this, see dialog_create() in dialog.h
The following table describes all menus but custom functions:
ROM:FF53CE64 MenuTable_FuncNo DCD 0,0xFFFFFFFF, 0xB, 0xB, 9 ;movie_rec_size, list_popup#6 ROM:FF53CE64 DCD 1,0xFFFFFFFF, 0xB, 0xB, 0xA ;movie_af_mode ROM:FF53CE64 DCD 2,0xFFFFFFFF, 0xB, 0xB, 0xB ;movie_af_during ROM:FF53CE64 DCD 3,0xFFFFFFFF, 0xB, 0xB, 0xC ROM:FF53CE64 DCD 4,0xFFFFFFFF, 0xB, 0xB, 0xD ;movie_remote_ctrl ROM:FF53CE64 DCD 5,0xFFFFFFFF, 0xB, 0xC, 9 ;movie_exposure_mode ROM:FF53CE64 DCD 6,0xFFFFFFFF, 0xB, 0xC, 0xA ;SetLvGridToWinSystem ROM:FF53CE64 DCD 7,0xFFFFFFFF, 0xB, 0xC, 0xB ;SetLvTimerToWinSystem ROM:FF53CE64 DCD 8,0xFFFFFFFF, 0xB, 0xC, 0xC ;movie_sound_recording ROM:FF53CE64 DCD 9,0xFFFFFFFF, 0xB, 0xC, 0xD ROM:FF53CE64 DCD 0xA, 0xB, 0xB, 0, 9 ;red1 / quality ROM:FF53CE64 DCD 0xB, 8, 0xB, 0, 0xA ;beep ROM:FF53CE64 DCD 0xC, 9, 0xB, 0, 0xB ROM:FF53CE64 DCD 0xD,0x22, 0xB, 0, 0xC ;image review, list_popup#1 ROM:FF53CE64 DCD 0xE,0x12, 0xB, 0, 0xD ROM:FF53CE64 DCD 0xF,0x23, 0xB, 0, 0xE ;red eye ROM:FF53CE64 DCD 0x10,0x14, 0xB, 0, 0xF ROM:FF53CE64 DCD 0x11,0x11, 0xA, 1, 9 ;red2 / expo comp. AEB ROM:FF53CE64 DCD 0x12,0x16, 0xB, 1, 0xA ROM:FF53CE64 DCD 0x13,0x13, 0xB, 1, 0xB ;metring mode ROM:FF53CE64 DCD 0x14, 0xF, 0xB, 1, 0xC ROM:FF53CE64 DCD 0x15, 2, 0xB, 1, 0xD ;WB shift / studio_mode iso_comp ROM:FF53CE64 DCD 0x16, 3, 0xB, 1, 0xE ;color_space ROM:FF53CE64 DCD 0x17, 4, 0xB, 1, 0xF ;picture_style (flavor_mode) ROM:FF53CE64 DCD 0x18, 0xA, 0xB, 2, 9 ;red3 ? ROM:FF53CE64 DCD 0x19,0x21, 0xB, 2, 0xA ;auto_iso_max ROM:FF53CE64 DCD 0x1A,0x10000, 0xB, 4, 9 ;blue1 ROM:FF53CE64 DCD 0x1B,0x10001, 0xB, 4, 0xA ROM:FF53CE64 DCD 0x1C,0x10002, 0xB, 4, 0xB ROM:FF53CE64 DCD 0x1D,0x10003, 0xB, 4, 0xC ROM:FF53CE64 DCD 0x1E,0x1000D, 0xB, 4, 0xD ROM:FF53CE64 DCD 0x1F,0x10009, 0xB, 5, 9 ;blue2 / histogram ROM:FF53CE64 DCD 0x20,0x1000B, 0xB, 5, 0xA ;image_jump ROM:FF53CE64 DCD 0x21,0x1000E, 0xB, 5, 0xB ;hdmi_control ROM:FF53CE64 DCD 0x22,0x20000, 0xB, 6, 9 ;yellow1 / auto_power_off_time, list_popup#2 ROM:FF53CE64 DCD 0x23,0x20004, 0xB, 6, 0xA ;auto_rotate, list_popup#3 ROM:FF53CE64 DCD 0x24,0x20005, 0xB, 6, 0xB ROM:FF53CE64 DCD 0x25,0x20002, 0xB, 6, 0xC ;file_numbering_mode ROM:FF53CE64 DCD 0x26,0x20018, 0xB, 6, 0xD ;lcd_auto_off (face_sensor) ROM:FF53CE64 DCD 0x27,0x20019, 0xB, 6, 0xE ;screen_color ROM:FF53CE64 DCD 0x28,0x20022, 0xB, 6, 0xF ;eyefi ROM:FF53CE64 DCD 0x29,0x20006,0x14, 7, 9 ;yellow2 / lcd_brightness ROM:FF53CE64 DCD 0x2A,0x20007, 0xB, 7, 0xA ;date_time ROM:FF53CE64 DCD 0x2B,0x20008, 0xB, 7, 0xB ;language ROM:FF53CE64 DCD 0x2C,0x20009, 0xB, 7, 0xC ;video_system, list_popup#6 ROM:FF53CE64 DCD 0x2D,0x20010, 0xB, 7, 0xD ROM:FF53CE64 DCD 0x2E,0x2000B, 0xB, 7, 0xE ROM:FF53CE64 DCD 0x2F,0xFFFFFFFF, 0xB, 6, 0xF ;factory ROM:FF53CE64 DCD 0x30,0x2001A, 0xB, 8, 9 ;yellow3? ROM:FF53CE64 DCD 0x31,0x2001F, 0xB, 8, 0xA ROM:FF53CE64 DCD 0x32,0x2001B, 0xB, 8, 0xB ROM:FF53CE64 DCD 0x33,0x20011, 0xB, 8, 0xC ;firmware_update ROM:FF53CE64 DCD 0x34,0xFFFFFFFF, 0xB, 8, 0xD ;hidden ?
Column1 is function number
Column2 is the MenuTab number (0 to 0xc)
Last column is the line inside the MenuTab (9 means first line)
Table for custom functions is simpler:
ROM:FF53D288 CFnMenuTable_TableNo DCD 0x35,0x40000 ; DATA XREF: sub_FF4044D4+48�o ROM:FF53D288 ; GetMyMenuItemIdFromFuncNo+6C�o ... ROM:FF53D288 DCD 0x36,0x4000F ROM:FF53D288 DCD 0x37,0x4000E ROM:FF53D288 DCD 0x38,0x50000 ROM:FF53D288 DCD 0x39,0x50001 ROM:FF53D288 DCD 0x3A,0x50002 ROM:FF53D288 DCD 0x3B,0x6000D ROM:FF53D288 DCD 0x3C,0x6000E ROM:FF53D288 DCD 0x3D,0x70010 ROM:FF53D288 DCD 0x3E,0x70013 ROM:FF53D288 DCD 0x3F,0x70011 ROM:FF53D288 DCD 0x40,0x7000E
the FunctionNumber is used for SubMenu, like here for DustData Creation
ROM:FF3AE948 MOV R0, #0x18 ROM:FF3AE94C BL MnStartApp_StartSubMenu
then
ROM:FF3A88F0 StartMnDustOffDataApp ; DATA XREF: MnStartApp_StartSubMenu+18C�o
...
ROM:FF3A8548 DlgMnDustOffData_handler
If someone knows how to link StringIDs and the offset to the related text in several language.
For example, in ROM:FF3A8C08 DustOffData_wizard_maybe, it seems 0xd0, 0xd1, 0xd2 and 0xd3 are StringIDs for
ROM:FF6DFF75 aDustDeleteData DCB "Dust Delete Data",0 ROM:FF6E0230 aObtainDataForRemoving DCB "Obtain data for removing ",0 ROM:FF6E0581 aDustUsingSoftware_ DCB "dust using software.",0 ROM:FF6E0895 aReferToManualForDetails_ DCB "Refer to manual for details.",0
=> see some progress at GUI_StringIDs
Struct 0x14c48 stores a lot of settings like here at offset 0x174 for Histogram (type I believe):
ROM:FF202E64 set_histogram ; CODE XREF: SetHistogramToStorage:loc_FF3B22D4�j ROM:FF202E64 LDR R1, =struct_14c48 ROM:FF202E68 MOV R2, #4 ROM:FF202E6C STR R0, [R1,#0x174] ROM:FF202E70 LDR R0, =0x2030005 ROM:FF202E74 ADD R1, R1, #0x174 ROM:FF202E78 B prop_request_change ROM:FF202E78 ; END OF FUNCTION CHUNK FOR SetHistogramToStorage
the 0x02030005 property is also updated to propagate this change to tasks which are subscribers of this property.
another one (self explaining):
ROM:FF20C438 set_studiomode_maybe ROM:FF20C438 LDR R1, =struct_14c48 ROM:FF20C43C MOV R2, #4 ROM:FF20C440 STR R0, [R1,#0x244] ROM:FF20C444 LDR R0, =0x8004001B ROM:FF20C448 ADD R1, R1, #0x244 ROM:FF20C44C B prop_request_change ROM:FF20C44C ; End of function set_studiomode_maybe
I just found this, about Menus in 40D: 40D 1.0.8 Dump Available (June 2008)