Each NEX firmware package contains an av-cam.bin, it's ARM code, and powered with t-kernel RTOS ( open sourced in www.t-engine.org ), but is hard to identify whether it is t-kernel v1 or v2.

The init IDC dump of my disassembling to this module can be found here in https://github.com/steelcnn/nex-hack . This IDC is incomplete, if you find sth weired, switching the instruction mode bewteen ARM32/Thumb16 may helps. 

Most parts of code reversed is related to JPEG/Video codec, so it is highly suspected that this code running in the Bionz image processing chip or Sony CDX4113GG chip - Audio/Video codec.

More details will be posted here if I have.


List of source cpp file names found:
{{ av-cam.png?nolink |}}


In different NEX model, av-cam.bin module is relocated in different address, you can adjust it accordingly by referencing the address info in the red circle of the following picture. In NEX-5N FW 1.02, that address is 0xC34210xx, so you can rebase the module to 0xC3421000.


{{ av-cam-rebase.png?nolink |}}