Memory Addresses

Lots of interesting stuff can be found at certain addresses in camera RAM. The 350D/450D hacks use this approach much more than ML.

550D

I've found the following interesting addresses on the 550D:

0x41d0: focus confirmation status (boolean)
0x2dec: display sensor (face sensor on top on the LCD)
0x40D07800: start of a 720x480 YUV 4-2-2 VRAM buffer (live view image buffer maybe). Odd pixels are luma (Y).

To find relevant memory addresses, use the mem-spy tool (Debug -> Toggle mem-spy). It display the values in memory which change, but not too often (so it filters out most irrelevant results).

Config options:

CONFIG_INT( "debug.mem-spy",		mem_spy, 0 );
CONFIG_INT( "debug.mem-spy.start",	mem_spy_start,	0x0 );      // start from here
CONFIG_INT( "debug.mem-spy.len",	mem_spy_len,	0x1000 );   // look at ### int32's
CONFIG_INT( "debug.mem-spy.bool",	mem_spy_bool,	0 );        // only display booleans (0,1,-1)
CONFIG_INT( "debug.mem-spy.small",	mem_spy_small,	1 );        // only display small numbers (less than 10)