I've ported (what I believe are) the core improvements from 0dan0's Type C firmware to Type D hardware. The device now runs
1600x1200 @ 18fps with improved auto exposure, stable with no motor issues.
The following summary was created by Claude.ai with some notes of my own.
What's Working
- Resolution: 1600x1200 (changed from 640x480 upscaled to 1728x1296, better quality than stock)
- Frame Rate: 18fps
- Auto Exposure: Improved algorithm from custom code
- Stability: Completely stable, motor operates correctly
- All core quality improvements from 0dan0's mod
What's Not Working
- OSD Display: No on-screen histogram, frame counter, or exposure stats
- White balance GUI/control
- Frame rate GUI/control
- Likely due to Type D display hardware differences (frame buffer addresses)
- Custom code executes but output not visible
The Challenge
Type D hardware proved to be significantly different from Type C:
- Memory Layout: Custom code offset +0x1164 from Type C locations
- Function Locations: Preview/capture functions at different addresses
- Motor Timing Sensitivity: Function entry hooks break motor control completely
- Display Hardware: Different frame buffer or overlay addresses
The Solution
After two failed attempts that caused motor issues, I discovered 0dan0 hooks
INSIDE functions, not at entry points:
Key Discovery

Function Entry Hooks (Phase 8 v1 & v2):
- Replace stack setup instruction
- Break function flow
- Destroy motor timing

Internal Function Hooks (Phase 8 v3):
- Leave function entry intact
- Preserve motor timing
- Add hooks at safe points within functions
Applied Hooks
Auto Exposure Hook (Type D: 0x2b688c)
- Calls custom auto exposure code
- Improves exposure algorithm
- Working perfectly
Preview Internal Hook (Type D: 0x2bfeb0)
- Inside preview function at offset +0x170
- Calls OSD drawing code (0x8033aec4)
- Executes successfully but OSD not visible
Technical Details
Memory Offsets
Custom Code Region:
Type C: 0x338f28 - 0x340008
Type D: 0x33a08c - 0x34116c
Offset: +0x1164
Resolution Values:
Type D Width: 0xddc718 (1728 → 1600)
Type D Height: 0xddc71c (1296 → 1200)
18fps Value:
Type D: 0x1f20c8 (60000 → 54000)
Methodology
- Pattern Matching: Found functions by searching for byte signatures
- Custom Code Insertion: Ported 0dan0's custom code with updated addresses
- Hook Analysis: Compared stock vs modded C byte-by-byte to find ALL hooks
- Internal Hooking: Applied hooks inside functions, not at entry points
- Incremental Testing: Phase 1-8, keeping backups at each stage
Results
Video Quality:
- Significant improvement over stock Type D
- 1600x1200 resolution
- Proper 18fps speed
- Better exposure control
Stability:
- No crashes or hangs
- Motor operates correctly
- All menus responsive
- Recording/playback works, not extensively tested
Questions for the Community
For 0dan0:
- Are there known display hardware differences between Type C and Type D? (Pretty sure this is a bona fide "YES!")
- What are the frame buffer addresses you use for OSD drawing?
- Any Type D-specific display register addresses?
For Type D Owners:
Would anyone be interested in testing this firmware? I believe it's a solid improvement even without the OSD.
Files and Tools
I can share:
- Modified firmware (Phase 8 v3)
- Python scripts for analysis and porting
- Documentation of the process
- Ghidra analysis notes
Acknowledgments
Huge thanks to:
- 0dan0 for the original Type C firmware and detailed change notes
- The TinkerDifferent community for the knowledge base
- Everyone who documented the Reels hardware
Next Steps
I'm happy with Phase 8 v3 as-is - the quality improvements are significant and it's completely stable. But if anyone has insights into Type D display hardware or wants to help investigate the OSD issue, I'd be interested in pursuing that.
For now, I'm just enjoying filming with better resolution and the correct frame rate!
Technical Appendix
Hook Locations (Type D)
Auto Exposure:
- Location: 0x2b688c
- Target: 0x8033b7f4 (custom auto exposure)
- Status:
Working
Preview Internal Hook:
- Location: 0x2bfeb0 (inside preview function)
- Target: 0x8033aec4 (OSD drawing)
- Status:
Executes,
Not visible
Phase Progression
- Phase 1-3: Device type changes and NVM address updates
- Phase 4: Custom code insertion (28KB)
- Phase 5: Resolution and 18fps changes
- Phase 6: White balance (skipped - not essential)
- Phase 7: Auto exposure hook (stable baseline)
- Phase 8 v1-v2: Failed - function entry hooks broke motor
- Phase 8 v3: Success - internal hooks preserve motor timing