Bumble-Bee: libcameraservice.c

File libcameraservice.c, 149.3 KB (added by admin, 13 years ago)
Line 
1/* This file has been generated by the Hex-Rays decompiler.
2   Copyright (c) 2007-2011 Hex-Rays <info@hex-rays.com>
3
4   Detected compiler: GNU C++
5*/
6
7#include <defs.h>
8
9
10//-------------------------------------------------------------------------
11// Data declarations
12
13extern char aAndroid_permis[24]; // weak
14extern char aPermissionDeni[65]; // weak
15extern char aClientDPPidD[25]; // weak
16extern char aNoCameraClient[23]; // weak
17extern char aV[3]; // weak
18extern char aSetLogLevelToD[20]; // weak
19extern char aCameraservice[14]; // weak
20extern char aInvalidSetdisp[41]; // weak
21extern char aAttemptToUseAL[81]; // weak
22extern char aAttemptToUseAC[52]; // weak
23extern char aLockifmessag_0[42]; // weak
24extern char aLockifmessagew[37]; // weak
25extern char aLockifmessag_1[50]; // weak
26extern char aCopyframeandpo[28]; // weak
27extern char aFailedToAlloca[44]; // weak
28extern char aFailedToAllo_0[44]; // weak
29extern char aFrameCallbackI[27]; // weak
30extern char aDisablePreview[25]; // weak
31extern char aFrameIsCopied[16]; // weak
32extern char aFrameIsForward[19]; // weak
33extern char aSendcommandPid[21]; // weak
34extern char aTakepicturePid[21]; // weak
35extern char aCancelautofocu[25]; // weak
36extern char aAutofocusPidD[19]; // weak
37extern char aRecordingenabl[26]; // weak
38extern char aPreviewenabled[24]; // weak
39extern char aStoppreviewPid[21]; // weak
40extern char aSetpreviewcall[36]; // weak
41extern char aConnectEPidD[19]; // weak
42extern char aTriedToConnect[61]; // weak
43extern char aConnectToTheSa[27]; // weak
44extern char aConnectXPidD[19]; // weak
45extern char aUnlockPidD[16]; // weak
46extern char aClearMcameracl[29]; // weak
47extern char aLockPidD[14]; // weak
48extern char aGetparametersP[28]; // weak
49extern char aSetparametersP[28]; // weak
50extern char aRegisterbuffer[38]; // weak
51extern char aCameraserviceR[35]; // weak
52extern char aFailedToLoadCa[40]; // weak
53extern char aSetshuttersoun[57]; // weak
54extern char aSetshutterso_0[48]; // weak
55extern char aSetshutterso_1[31]; // weak
56extern char aCameraserviceL[32]; // weak
57extern char aSystemMediaAud[40]; // weak
58extern char aSystemMediaA_0[39]; // weak
59extern char aPlaysoundD[14]; // weak
60extern char aSnapshotImageW[35]; // weak
61extern char aStoprecordingP[23]; // weak
62extern char aAndroid_perm_0[26]; // weak
63extern char aPermissionDe_0[55]; // weak
64extern char aCameraservic_0[39]; // weak
65extern char aRemoveclientCl[30]; // weak
66extern char aCameraservic_1[39]; // weak
67extern char aCameraDIsStill[41]; // weak
68extern char aCameraserviceS[31]; // weak
69extern char aNumberOfCamera[41]; // weak
70extern char aGetbufferinfoP[23]; // weak
71extern char aMhardwareIsNul[30]; // weak
72extern char aMismatchServic[18]; // weak
73extern char aMhardware0Call[45]; // weak
74extern char aDatacallbackti[26]; // weak
75extern char aNullDataReturn[51]; // weak
76extern char aDatacallbackD[17]; // weak
77extern char aNullDataRetu_0[36]; // weak
78extern char aNotifycallback[19]; // weak
79extern char aClientClientEP[26]; // weak
80extern char aClientClientXP[26]; // weak
81extern char aCameraserviceC[41]; // weak
82extern char aCom_sonyericss[44]; // weak
83extern char aPermissionDe_1[64]; // weak
84extern char aCameraservic_2[66]; // weak
85extern char aCameraservic_3[52]; // weak
86extern char aCameraservic_4[62]; // weak
87extern char aCameraservic_5[70]; // weak
88extern char aFailToOpenCame[37]; // weak
89extern char aCameraservic_6[25]; // weak
90extern char aOverlayCreateF[33]; // weak
91extern char aOverlayCreatio[25]; // weak
92extern char aMhardwareSetov[47]; // weak
93extern char aStartpreviewmo[17]; // weak
94extern char aStartrecording[19]; // weak
95extern char aMhardwareStart[50]; // weak
96extern char aStartcameramod[20]; // weak
97extern char aMsurfaceIsNotS[25]; // weak
98extern char aMsurfaceMustBe[48]; // weak
99extern char aStartrecordi_0[24]; // weak
100extern char aStartpreviewPi[22]; // weak
101extern char aSetpreviewdisp[31]; // weak
102extern char aClearingOldPre[32]; // weak
103extern char aDisconnectEPid[22]; // weak
104extern char aDifferentClien[36]; // weak
105extern char aCameraIsUnlock[63]; // weak
106extern char aHardwareTeardo[18]; // weak
107extern char aDisconnectXPid[22]; // weak
108extern char aClientClient_0[36]; // weak
109extern char aClientClient_1[36]; // weak
110extern char *off_6800C018; // weak
111extern char _vtable_for_android::BnInterface<android::ICamera>[248]; // weak
112extern char _VTT_for_android::BnInterface<android::ICamera>[44]; // weak
113extern char _vtable_for_android::BnInterface<android::ICameraService>[180]; // weak
114extern char _VTT_for_android::BnInterface<android::ICameraService>[44]; // weak
115extern char _vtable_for_android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>[108]; // weak
116extern char _vtable_for_android::CameraService[196]; // weak
117extern char _VTT_for_android::CameraService[68]; // weak
118extern char _vtable_for_android::CameraService::Client[252]; // weak
119extern char _VTT_for_android::CameraService::Client[68]; // weak
120extern _UNKNOWN GLOBAL_OFFSET_TABLE_; // weak
121extern _UNKNOWN unk_6800D370; // weak
122extern _DWORD *dword_6800D374[3]; // idb
123// extern _UNKNOWN _vtable_for_android::BnCamera; weak
124// extern _UNKNOWN _VTT_for_android::BnCamera; weak
125// extern _UNKNOWN _vtable_for_android::BnCameraService; weak
126// extern _UNKNOWN _VTT_for_android::BnCameraService; weak
127// extern _UNKNOWN _stack_chk_guard; weak
128
129//-------------------------------------------------------------------------
130// Function declarations
131
132// int __fastcall android::BBinder::_BBinder(_DWORD, _DWORD); weak
133// int __fastcall android::ICamera::_ICamera(_DWORD, _DWORD); weak
134// int __fastcall android::RefBase::_RefBase(_DWORD); weak
135// void __cdecl operator delete(void *); idb
136// int strzcmp16(void); weak
137// int __fastcall android::RefBase::incStrong(_DWORD, _DWORD); weak
138// int __fastcall android::ICameraService::_ICameraService(_DWORD, _DWORD); weak
139// int __fastcall android::String8::String8(_DWORD); weak
140// int __fastcall android::String8::_String8(_DWORD); weak
141// int __fastcall android::IPCThreadState::self(_DWORD); weak
142// int __fastcall android::IPCThreadState::getCallingPid(_DWORD); weak
143// int __fastcall android::IPCThreadState::getCallingUid(_DWORD); weak
144// int __fastcall android::RefBase::weakref_type::attemptIncStrong(_DWORD, _DWORD); weak
145// int __fastcall android::RefBase::decStrong(_DWORD, _DWORD); weak
146// int pthread_mutex_unlock(pthread_mutex_t *mutex);
147// int __fastcall android::String16::String16(_DWORD, _DWORD); weak
148// int __fastcall android::checkCallingPermission(_DWORD); weak
149// int __fastcall android::String16::_String16(_DWORD); weak
150// int snprintf(char *s, size_t maxlen, const char *format, ...);
151// int __fastcall android::String8::append(_DWORD, _DWORD); weak
152// ssize_t write(int fd, const void *buf, size_t n);
153// int pthread_mutex_trylock(pthread_mutex_t *mutex);
154// int usleep(__useconds_t useconds);
155// int __fastcall android::IInterface::asBinder(_DWORD, _DWORD); weak
156// int sprintf(char *s, const char *format, ...);
157// int __fastcall android::String8::String8(_DWORD, _DWORD); weak
158// int atoi(const char *nptr);
159// int __fastcall android_atomic_release_store(_DWORD, _DWORD); weak
160// int __fastcall android::String8::String8(_DWORD, _DWORD); weak
161// int __fastcall _stack_chk_fail(_DWORD); weak
162// int _android_log_print(_DWORD, _DWORD, const char *, ...); weak
163// int __fastcall operator new(_DWORD); weak
164// int android::MemoryHeapBase::MemoryHeapBase(void); weak
165// void *memcpy(void *dest, const void *src, size_t n);
166// int android::MemoryBase::MemoryBase(void); weak
167// int __fastcall android::IPCThreadState::flushCommands(_DWORD); weak
168// int __fastcall android_atomic_and(_DWORD, _DWORD); weak
169// int __fastcall android_atomic_or(_DWORD, _DWORD); weak
170// int pthread_mutex_lock(pthread_mutex_t *mutex);
171// int __fastcall android::CameraParameters::flatten(_DWORD, _DWORD); weak
172// int __fastcall android::CameraParameters::_CameraParameters(_DWORD); weak
173// int __fastcall android::String8::String8(_DWORD, _DWORD); weak
174// int __fastcall android::SortedVectorImpl::SortedVectorImpl(_DWORD, _DWORD, _DWORD); weak
175// int __fastcall android::CameraParameters::unflatten(_DWORD, _DWORD); weak
176// int strcmp(const char *s1, const char *s2);
177// int android::VectorImpl::finish_vector(void); weak
178// int __fastcall android::SortedVectorImpl::_SortedVectorImpl(_DWORD); weak
179// int __fastcall android::CameraParameters::getPreviewSize(_DWORD, _DWORD, _DWORD); weak
180// int __fastcall android::ISurface::BufferHeap::BufferHeap(_DWORD, _DWORD, _DWORD, _DWORD); weak
181// int __fastcall android::ISurface::BufferHeap::_BufferHeap(_DWORD); weak
182// int android_atomic_dec(void); weak
183// int __fastcall android_atomic_inc(_DWORD); weak
184// int android::ICamera::ICamera(void); weak
185// int __fastcall android::BBinder::BBinder(_DWORD, _DWORD); weak
186// int android::MediaPlayer::disconnect(void); weak
187// int android::MediaPlayer::MediaPlayer(void); weak
188// int __fastcall android::MediaPlayer::setDataSource(_DWORD, _DWORD, _DWORD); weak
189// int __fastcall android::MediaPlayer::setAudioStreamType(_DWORD, _DWORD); weak
190// int __fastcall android::MediaPlayer::prepare(_DWORD); weak
191// int __fastcall android::AudioSystem::getStreamVolumeIndex(_DWORD, _DWORD); weak
192// int __fastcall android::MediaPlayer::seekTo(_DWORD, _DWORD); weak
193// int __fastcall android::MediaPlayer::start(_DWORD); weak
194// int __fastcall android::CameraParameters::getPictureSize(_DWORD, _DWORD, _DWORD); weak
195// __pid_t getpid(void);
196// int __fastcall android::BnCameraService::onTransact(_DWORD, _DWORD, _DWORD, _DWORD); weak
197// int __fastcall android::RefBase::weakref_type::decWeak(_DWORD, _DWORD); weak
198// int pthread_mutex_destroy(pthread_mutex_t *mutex);
199// int __fastcall HAL_getCameraInfo(_DWORD, _DWORD); weak
200// int __fastcall android::RefBase::createWeak(_DWORD, _DWORD); weak
201// int android::ICameraService::ICameraService(void); weak
202// int __fastcall android::RefBase::RefBase(_DWORD); weak
203// int pthread_mutex_init(pthread_mutex_t *mutex, const pthread_mutexattr_t *mutexattr);
204// int __fastcall HAL_getNumberOfCameras(_DWORD); weak
205// int __fastcall HAL_openCameraHardware(_DWORD, _DWORD); weak
206// int __cdecl android::Overlay::Overlay(_DWORD, _DWORD); weak
207// int pthread_create(pthread_t *newthread, const pthread_attr_t *attr, void *(*start_routine)(void *), void *arg);
208// int pthread_join(pthread_t th, void **thread_return);
209int __fastcall android::CameraService::getNumberOfCameras(int a1);
210int __fastcall android::CameraService::connect(int a1, int a2, int a3);
211int __fastcall android::CameraService::isExtension(int a1);
212int __fastcall android::CameraService::Client::releaseRecordingFrameInternal(int a1);
213int __fastcall android::BnInterface<android::ICameraService>::onAsBinder(int a1);
214int __fastcall android::BnInterface<android::ICamera>::onAsBinder(int a1);
215int __fastcall sub_68007808(int a1, int a2);
216int __fastcall sub_68007840(int a1);
217int __fastcall _virtual_thunk_to_android::BnInterface<android::ICamera>::_BnInterface(int a1);
218void *__fastcall sub_680078A8(int a1);
219void *__fastcall _virtual_thunk_to_android::BnInterface<android::ICamera>::_BnInterface(int a1);
220int __fastcall sub_680078D4(int a1);
221int __fastcall _virtual_thunk_to_android::BnCamera::_BnCamera(int a1);
222void *__fastcall sub_68007930(int a1);
223void *__fastcall _virtual_thunk_to_android::BnCamera::_BnCamera(int a1);
224int __fastcall sub_68007954();
225int __fastcall android::sp<android::ICameraClient>::sp(int a1, int a2);
226int __fastcall sub_68007A1C(int a1);
227int __fastcall _virtual_thunk_to_android::BnInterface<android::ICameraService>::_BnInterface(int a1);
228void *__fastcall sub_68007A84(int a1);
229void *__fastcall _virtual_thunk_to_android::BnInterface<android::ICameraService>::_BnInterface(int a1);
230int __fastcall sub_68007AA8(int a1, int a2);
231int __fastcall sub_68007AE0(int a1);
232int __fastcall _virtual_thunk_to_android::BnCameraService::_BnCameraService(int a1);
233void *__fastcall sub_68007B3C(int a1);
234void *__fastcall _virtual_thunk_to_android::BnCameraService::_BnCameraService(int a1);
235int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_construct(int a1, int a2, int a3);
236int __fastcall sub_68007B84(int a1);
237int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_destroy(int a1, int a2, int a3);
238int __fastcall sub_68007BB0(int a1);
239int __fastcall sub_68007BBC(int a1);
240int __fastcall android::wp<android::CameraService::Client>::promote(int a1, int a2);
241int __fastcall android::sp<android::IBinder>::_sp(int a1);
242int __fastcall android::sp<android::CameraService::Client>::_sp(int a1);
243int __fastcall android::sp<android::MemoryHeapBase>::operator_(int a1, int a2);
244int __fastcall android::sp<android::MemoryHeapBase>::operator_(int a1, int a2);
245int __fastcall android::sp<android::IMemoryHeap>::_sp(int a1);
246int __fastcall android::sp<android::MemoryHeapBase>::_sp(int a1);
247int __fastcall android::sp<android::ICameraClient>::_sp(int a1);
248int __fastcall android::sp<android::ICameraClient>::operator_(int a1, int a2);
249int __fastcall android::sp<android::Overlay>::_sp(int a1);
250int __fastcall android::sp<android::ISurface>::operator_(int a1, int a2);
251int __fastcall android::sp<android::CameraService>::operator_(int a1, int a2);
252int __fastcall android::sp<android::CameraHardwareInterface>::operator_(int a1, int a2);
253int __fastcall android::sp<android::MediaPlayer>::clear(int result);
254int __fastcall android::sp<android::MediaPlayer>::operator_(int a1, int a2);
255int __fastcall android::sp<android::MediaPlayer>::operator_(int a1, int a2);
256int __fastcall android::sp<android::MediaPlayer>::_sp(int a1);
257int __fastcall android::sp<android::CameraService::Client>::operator_(int a1, int a2);
258int __fastcall android::sp<android::CameraService::Client>::operator_(int a1, int a2);
259int __fastcall android::CameraService::Client::handleGenericDataTimestamp(int a1, int a2, int _R2);
260int __fastcall android::CameraService::Client::handleGenericData(int a1, int a2);
261int __fastcall android::CameraService::Client::handleGenericNotify(int a1, int a2, int a3);
262int __fastcall android::CameraService::Client::handleSceneDetection(int a1, int a2, int a3);
263int __fastcall android::CameraService::Client::handleFaceDetection(int a1, int a2, int a3);
264int __fastcall _non_virtual_thunk_to_android::CameraService::dump(int a1, int a2, int a3);
265int __fastcall android::CameraService::dump(int a1, int a2, int a3);
266int __fastcall android::CameraService::setCameraFree(int a1, int a2);
267int __fastcall android::CameraService::setCameraBusy(int a1, int a2);
268signed int __fastcall android::CameraService::Client::getOrientation(int a1, signed int a2, int a3);
269signed int __fastcall android::CameraService::Client::checkPid(int a1);
270signed int __fastcall android::CameraService::Client::checkPidAndHardware(int a1);
271signed int __fastcall android::CameraService::Client::lockIfMessageWanted(int a1, int a2);
272__int64 __fastcall android::CameraService::Client::copyFrameAndPostCopiedFrame(__int64 a1, int a2, int a3, size_t a4);
273int __fastcall sub_68008564(int a1);
274int __fastcall android::CameraService::Client::disableMsgType(int a1, int a2);
275int __fastcall android::CameraService::Client::handleCompressedPicture(int a1, int a2, int a3);
276void __fastcall android::CameraService::Client::handleRawPicture(int a1, int a2, int a3, int a4);
277int __fastcall android::CameraService::Client::handlePostview(int a1, int a2, int a3);
278int __fastcall android::CameraService::Client::handlePreviewData(int a1, int a2);
279int __fastcall android::CameraService::Client::enableMsgType(int a1, int a2);
280signed int __fastcall android::CameraService::Client::sendCommand(int a1, signed int a2, signed int a3);
281signed int __fastcall android::CameraService::Client::takePicture(int a1);
282signed int __fastcall android::CameraService::Client::cancelAutoFocus(int a1);
283signed int __fastcall android::CameraService::Client::autoFocus(int a1);
284int __fastcall android::CameraService::Client::recordingEnabled(int a1);
285int __fastcall android::CameraService::Client::previewEnabled(int a1);
286int __fastcall android::CameraService::Client::releaseRecordingFrame(int a1);
287int __fastcall android::CameraService::Client::stopPreview(int a1);
288int __fastcall android::CameraService::Client::setPreviewCallbackFlag(int a1, int a2);
289signed int __fastcall android::CameraService::Client::connect(int a1, int a2);
290signed int __fastcall android::CameraService::Client::unlock(int a1);
291signed int __fastcall android::CameraService::Client::lock(int a1);
292int __fastcall android::CameraService::Client::getParameters(int a1, int a2);
293int __fastcall sub_68008E2C(int a1, int a2);
294int __fastcall android::move_backward_type<android::key_value_pair_t<android::String8_android::String8>>(int a1, int a2, int a3);
295int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_move_backward(int a1, int a2, int a3, int a4);
296int __fastcall android::move_forward_type<android::key_value_pair_t<android::String8_android::String8>>(int result, int a2, int a3);
297int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_move_forward(int a1, int a2, int a3, int a4);
298int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_splat(int a1, int a2, int a3, int a4);
299int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_copy(int a1, int a2, int a3, int a4);
300int __fastcall sub_68008F00(int a1, int a2, int a3);
301signed int __fastcall android::CameraService::Client::setParameters(int a1, int a2);
302unsigned int __fastcall android::compare_type<android::key_value_pair_t<android::String8_android::String8>>(const char **a1, const char **a2);
303unsigned int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_compare(int a1, const char **a2, const char **a3);
304int __fastcall sub_68008FF0(int a1);
305int __fastcall android::CameraService::Client::registerPreviewBuffers(int a1);
306int __fastcall sub_680090C4(int a1);
307int __fastcall android::sp<android::OverlayRef>::operator_(int a1, int a2);
308int __fastcall sub_68009100(int a1, int a2);
309int __fastcall android::CameraService::releaseSound(int a1);
310int __fastcall sub_680091B0(int a1);
311signed int __fastcall android::CameraService::setShutterSound(int a1, int a2, int a3);
312signed int __fastcall android::CameraService::Client::setShutterSound(int a1, int a2, int a3);
313int __fastcall android::CameraService::loadSound(int a1);
314int __fastcall android::CameraService::playSound(int a1, int a2);
315int __fastcall android::CameraService::Client::handleShutter(int a1, int a2);
316int __fastcall android::CameraService::Client::stopRecording(int a1);
317int __fastcall _non_virtual_thunk_to_android::CameraService::onTransact(int a1, int a2, int a3, int a4);
318int __fastcall android::CameraService::onTransact(int a1, int a2, int a3, int a4);
319int __fastcall android::CameraService::removeClient(int a1, int a2);
320int __fastcall _non_virtual_thunk_to_android::CameraService::_CameraService(int a1);
321int __fastcall android::CameraService::_CameraService(_DWORD); // weak
322void *__fastcall _non_virtual_thunk_to_android::CameraService::_CameraService(int a1);
323void *__fastcall android::CameraService::_CameraService(void *a1);
324int __fastcall android::CameraService::_CameraService(int a1, int a2);
325signed int __fastcall android::CameraService::getCameraInfo(int a1, int a2, int a3);
326int __fastcall android::wp<android::CameraService::Client>::operator_(int a1, int *a2);
327int __fastcall sub_680099B8(int a1, int a2);
328int __fastcall android::CameraService::CameraService(int a1);
329int __fastcall android::CameraService::CameraService(int a1, int a2);
330int __fastcall sub_68009BC4(int a1);
331int __fastcall android::CameraService::Client::getBufferInfo(int a1, int a2);
332int __fastcall sub_68009C48(int result);
333int __fastcall sub_68009C50(int result);
334int __fastcall android::CameraService::Client::getClientFromCookie(int a1, int a2, int a3);
335int __fastcall android::CameraService::Client::dataCallbackTimestamp(int _R0, int a2, int a3, int a4, int a5);
336int __fastcall android::CameraService::Client::dataCallback(int a1, int a2, int a3);
337int __fastcall android::CameraService::Client::notifyCallback(int a1, int a2, int a3, int a4);
338int __fastcall android::CameraService::getClientById(int a1, int a2, int a3);
339int __fastcall sub_68009EDC(int a1);
340int __fastcall android::CameraService::Client::Client(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8);
341int __fastcall android::CameraService::Client::Client(int a1, int a2, int a3, int a4, int a5, int a6, int a7);
342int __fastcall android::CameraService::connect(int a1, int a2, int a3, int a4, unsigned __int8 a5);
343int __fastcall sub_6800A4AC(int a1);
344signed int __fastcall android::CameraService::Client::setOverlay(int a1);
345signed int __fastcall android::CameraService::Client::startPreviewMode(int a1);
346signed int __fastcall android::CameraService::Client::startRecordingMode(int a1);
347signed int __fastcall android::CameraService::Client::startCameraMode(int a1, int a2);
348signed int __fastcall android::CameraService::Client::startRecording(int a1);
349signed int __fastcall android::CameraService::Client::startPreview(int a1);
350signed int __fastcall android::CameraService::Client::setPreviewDisplay(int a1, int a2);
351int __fastcall android::CameraService::Client::disconnect(int a1);
352int __fastcall _non_virtual_thunk_to_android::CameraService::Client::_Client(int a1, int a2, int a3, pthread_t a4);
353int __fastcall android::CameraService::Client::_Client(int a1, int a2, int a3, pthread_t a4);
354void *__fastcall _non_virtual_thunk_to_android::CameraService::Client::_Client(int a1, int a2, int a3, pthread_t a4);
355void *__fastcall android::CameraService::Client::_Client(int a1, int a2, int a3, pthread_t a4);
356int __fastcall android::CameraService::Client::_Client(int a1, int a2);
357void *__fastcall _virtual_thunk_to_android::CameraService::Client::_Client(int *a1, int a2, int a3);
358int __fastcall _virtual_thunk_to_android::CameraService::Client::_Client(int *a1, int a2, int a3);
359void *__fastcall _virtual_thunk_to_android::CameraService::_CameraService(int a1);
360int __fastcall _virtual_thunk_to_android::CameraService::_CameraService(int a1);
361
362
363//----- (680077B0) --------------------------------------------------------
364int __fastcall android::CameraService::getNumberOfCameras(int a1)
365{
366  return *(_DWORD *)(a1 + 52);
367}
368
369//----- (680077B4) --------------------------------------------------------
370int __fastcall android::CameraService::connect(int a1, int a2, int a3)
371{
372  int v3; // r4@1
373
374  v3 = a1;
375  (*(void (__cdecl **)(int, int, int))(*(_DWORD *)a2 + 28))(a1, a2, a3);
376  return v3;
377}
378
379//----- (680077C8) --------------------------------------------------------
380int __fastcall android::CameraService::isExtension(int a1)
381{
382  return *(_BYTE *)(a1 + 88);
383}
384
385//----- (680077D0) --------------------------------------------------------
386int __fastcall android::CameraService::Client::releaseRecordingFrameInternal(int a1)
387{
388  int result; // r0@1
389
390  result = *(_DWORD *)(a1 + 40);
391  if ( result )
392    result = (*(int (**)(void))(*(_DWORD *)result + 68))();
393  return result;
394}
395
396//----- (680077E0) --------------------------------------------------------
397int __fastcall android::BnInterface<android::ICameraService>::onAsBinder(int a1)
398{
399  return a1 + 4;
400}
401
402//----- (680077E4) --------------------------------------------------------
403int __fastcall android::BnInterface<android::ICamera>::onAsBinder(int a1)
404{
405  return a1 + 4;
406}
407
408//----- (68007808) --------------------------------------------------------
409int __fastcall sub_68007808(int a1, int a2)
410{
411  int v2; // r5@1
412  int v3; // r1@1
413  int v4; // r4@1
414
415  v2 = a2;
416  v3 = *(_DWORD *)a2;
417  v4 = a1;
418  *(_DWORD *)a1 = v3;
419  *(_DWORD *)(a1 + *(_DWORD *)(v3 - 12)) = *(_DWORD *)(v2 + 36);
420  *(_DWORD *)(a1 + 4) = *(_DWORD *)(v2 + 40);
421  android::BBinder::_BBinder(a1 + 4, v2 + 20);
422  android::ICamera::_ICamera(v4, v2 + 4);
423  return v4;
424}
425// 68007128: using guessed type int __fastcall android__BBinder___BBinder(_DWORD, _DWORD);
426// 68007134: using guessed type int __fastcall android__ICamera___ICamera(_DWORD, _DWORD);
427
428//----- (68007840) --------------------------------------------------------
429int __fastcall sub_68007840(int a1)
430{
431  int v1; // r4@1
432  int v2; // r6@1
433
434  v1 = a1;
435  *(_DWORD *)a1 = &_vtable_for_android::BnInterface<android::ICamera>[12];
436  v2 = a1 + 16;
437  *(_DWORD *)(a1 + 16) = &_vtable_for_android::BnInterface<android::ICamera>[224];
438  *(_DWORD *)(a1 + 4) = &_vtable_for_android::BnInterface<android::ICamera>[128];
439  android::BBinder::_BBinder(a1 + 4, &_VTT_for_android::BnInterface<android::ICamera>[20]);
440  android::ICamera::_ICamera(v1, &_VTT_for_android::BnInterface<android::ICamera>[4]);
441  android::RefBase::_RefBase(v2);
442  return v1;
443}
444// 68007128: using guessed type int __fastcall android__BBinder___BBinder(_DWORD, _DWORD);
445// 68007134: using guessed type int __fastcall android__ICamera___ICamera(_DWORD, _DWORD);
446// 68007140: using guessed type int __fastcall android__RefBase___RefBase(_DWORD);
447
448//----- (68007890) --------------------------------------------------------
449int __fastcall _virtual_thunk_to_android::BnInterface<android::ICamera>::_BnInterface(int a1)
450{
451  return sub_68007840(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
452}
453
454//----- (680078A8) --------------------------------------------------------
455void *__fastcall sub_680078A8(int a1)
456{
457  void *v1; // r4@1
458
459  v1 = (void *)a1;
460  sub_68007840(a1);
461  operator delete(v1);
462  return v1;
463}
464
465//----- (680078BC) --------------------------------------------------------
466void *__fastcall _virtual_thunk_to_android::BnInterface<android::ICamera>::_BnInterface(int a1)
467{
468  return sub_680078A8(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
469}
470
471//----- (680078D4) --------------------------------------------------------
472int __fastcall sub_680078D4(int a1)
473{
474  int v1; // r4@1
475  int v2; // r5@1
476
477  v1 = a1;
478  *(_DWORD *)a1 = (char *)&_vtable_for_android::BnCamera + 12;
479  v2 = a1 + 16;
480  *(_DWORD *)(a1 + 16) = (char *)&_vtable_for_android::BnCamera + 228;
481  *(_DWORD *)(a1 + 4) = (char *)&_vtable_for_android::BnCamera + 132;
482  sub_68007808(a1, (int)((char *)&_VTT_for_android::BnCamera + 4));
483  android::RefBase::_RefBase(v2);
484  return v1;
485}
486// 68007140: using guessed type int __fastcall android__RefBase___RefBase(_DWORD);
487
488//----- (68007918) --------------------------------------------------------
489int __fastcall _virtual_thunk_to_android::BnCamera::_BnCamera(int a1)
490{
491  return sub_680078D4(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
492}
493
494//----- (68007930) --------------------------------------------------------
495void *__fastcall sub_68007930(int a1)
496{
497  void *v1; // r4@1
498
499  v1 = (void *)a1;
500  sub_680078D4(a1);
501  operator delete(v1);
502  return v1;
503}
504
505//----- (68007944) --------------------------------------------------------
506void *__fastcall _virtual_thunk_to_android::BnCamera::_BnCamera(int a1)
507{
508  return sub_68007930(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
509}
510
511//----- (68007954) --------------------------------------------------------
512int __fastcall sub_68007954()
513{
514  int v0; // r0@1
515  char v1; // cf@1
516  int result; // r0@1
517
518  v0 = strzcmp16();
519  v1 = (unsigned int)v0 <= 1;
520  result = 1 - v0;
521  if ( !v1 )
522    result = 0;
523  return result;
524}
525// 68007158: using guessed type int strzcmp16(void);
526
527//----- (680079F8) --------------------------------------------------------
528int __fastcall android::sp<android::ICameraClient>::sp(int a1, int a2)
529{
530  int v2; // r3@1
531  int v3; // r4@1
532
533  v2 = *(_DWORD *)a2;
534  v3 = a1;
535  *(_DWORD *)a1 = *(_DWORD *)a2;
536  if ( v2 )
537    android::RefBase::incStrong(v2 + *(_DWORD *)(*(_DWORD *)v2 - 12), a1);
538  return v3;
539}
540// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
541
542//----- (68007A1C) --------------------------------------------------------
543int __fastcall sub_68007A1C(int a1)
544{
545  int v1; // r4@1
546  int v2; // r6@1
547
548  v1 = a1;
549  *(_DWORD *)a1 = &_vtable_for_android::BnInterface<android::ICameraService>[12];
550  v2 = a1 + 16;
551  *(_DWORD *)(a1 + 16) = &_vtable_for_android::BnInterface<android::ICameraService>[156];
552  *(_DWORD *)(a1 + 4) = &_vtable_for_android::BnInterface<android::ICameraService>[60];
553  android::BBinder::_BBinder(a1 + 4, &_VTT_for_android::BnInterface<android::ICameraService>[20]);
554  android::ICameraService::_ICameraService(v1, &_VTT_for_android::BnInterface<android::ICameraService>[4]);
555  android::RefBase::_RefBase(v2);
556  return v1;
557}
558// 68007128: using guessed type int __fastcall android__BBinder___BBinder(_DWORD, _DWORD);
559// 68007140: using guessed type int __fastcall android__RefBase___RefBase(_DWORD);
560// 68007170: using guessed type int __fastcall android__ICameraService___ICameraService(_DWORD, _DWORD);
561
562//----- (68007A6C) --------------------------------------------------------
563int __fastcall _virtual_thunk_to_android::BnInterface<android::ICameraService>::_BnInterface(int a1)
564{
565  return sub_68007A1C(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
566}
567
568//----- (68007A84) --------------------------------------------------------
569void *__fastcall sub_68007A84(int a1)
570{
571  void *v1; // r4@1
572
573  v1 = (void *)a1;
574  sub_68007A1C(a1);
575  operator delete(v1);
576  return v1;
577}
578
579//----- (68007A98) --------------------------------------------------------
580void *__fastcall _virtual_thunk_to_android::BnInterface<android::ICameraService>::_BnInterface(int a1)
581{
582  return sub_68007A84(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
583}
584
585//----- (68007AA8) --------------------------------------------------------
586int __fastcall sub_68007AA8(int a1, int a2)
587{
588  int v2; // r5@1
589  int v3; // r1@1
590  int v4; // r4@1
591
592  v2 = a2;
593  v3 = *(_DWORD *)a2;
594  v4 = a1;
595  *(_DWORD *)a1 = v3;
596  *(_DWORD *)(a1 + *(_DWORD *)(v3 - 12)) = *(_DWORD *)(v2 + 36);
597  *(_DWORD *)(a1 + 4) = *(_DWORD *)(v2 + 40);
598  android::BBinder::_BBinder(a1 + 4, v2 + 20);
599  android::ICameraService::_ICameraService(v4, v2 + 4);
600  return v4;
601}
602// 68007128: using guessed type int __fastcall android__BBinder___BBinder(_DWORD, _DWORD);
603// 68007170: using guessed type int __fastcall android__ICameraService___ICameraService(_DWORD, _DWORD);
604
605//----- (68007AE0) --------------------------------------------------------
606int __fastcall sub_68007AE0(int a1)
607{
608  int v1; // r4@1
609  int v2; // r5@1
610
611  v1 = a1;
612  *(_DWORD *)a1 = (char *)&_vtable_for_android::BnCameraService + 12;
613  v2 = a1 + 16;
614  *(_DWORD *)(a1 + 16) = (char *)&_vtable_for_android::BnCameraService + 160;
615  *(_DWORD *)(a1 + 4) = (char *)&_vtable_for_android::BnCameraService + 64;
616  sub_68007AA8(a1, (int)((char *)&_VTT_for_android::BnCameraService + 4));
617  android::RefBase::_RefBase(v2);
618  return v1;
619}
620// 68007140: using guessed type int __fastcall android__RefBase___RefBase(_DWORD);
621
622//----- (68007B24) --------------------------------------------------------
623int __fastcall _virtual_thunk_to_android::BnCameraService::_BnCameraService(int a1)
624{
625  return sub_68007AE0(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
626}
627
628//----- (68007B3C) --------------------------------------------------------
629void *__fastcall sub_68007B3C(int a1)
630{
631  void *v1; // r4@1
632
633  v1 = (void *)a1;
634  sub_68007AE0(a1);
635  operator delete(v1);
636  return v1;
637}
638
639//----- (68007B50) --------------------------------------------------------
640void *__fastcall _virtual_thunk_to_android::BnCameraService::_BnCameraService(int a1)
641{
642  return sub_68007B3C(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
643}
644
645//----- (68007B60) --------------------------------------------------------
646int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_construct(int a1, int a2, int a3)
647{
648  int v3; // r5@1
649  int v4; // r4@1
650  int result; // r0@2
651
652  v3 = a3;
653  v4 = a2;
654  while ( v3 )
655  {
656    android::String8::String8(v4);
657    result = android::String8::String8(v4 + 4);
658    --v3;
659    v4 += 8;
660  }
661  return result;
662}
663// 6800717C: using guessed type int __fastcall android__String8__String8(_DWORD);
664
665//----- (68007B84) --------------------------------------------------------
666int __fastcall sub_68007B84(int a1)
667{
668  int v1; // r4@1
669
670  v1 = a1;
671  android::String8::_String8(a1 + 4);
672  android::String8::_String8(v1);
673  return v1;
674}
675// 68007188: using guessed type int __fastcall android__String8___String8(_DWORD);
676
677//----- (68007B98) --------------------------------------------------------
678int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_destroy(int a1, int a2, int a3)
679{
680  int v3; // r5@1
681  int v4; // r4@1
682  int result; // r0@2
683
684  v3 = a3;
685  v4 = a2;
686  while ( v3 )
687  {
688    --v3;
689    result = sub_68007B84(v4);
690    v4 += 8;
691  }
692  return result;
693}
694
695//----- (68007BB0) --------------------------------------------------------
696int __fastcall sub_68007BB0(int a1)
697{
698  int v1; // r0@1
699
700  v1 = android::IPCThreadState::self(a1);
701  return android::IPCThreadState::getCallingPid(v1);
702}
703// 68007194: using guessed type int __fastcall android__IPCThreadState__self(_DWORD);
704// 680071A0: using guessed type int __fastcall android__IPCThreadState__getCallingPid(_DWORD);
705
706//----- (68007BBC) --------------------------------------------------------
707int __fastcall sub_68007BBC(int a1)
708{
709  int v1; // r0@1
710
711  v1 = android::IPCThreadState::self(a1);
712  return android::IPCThreadState::getCallingUid(v1);
713}
714// 68007194: using guessed type int __fastcall android__IPCThreadState__self(_DWORD);
715// 680071AC: using guessed type int __fastcall android__IPCThreadState__getCallingUid(_DWORD);
716
717//----- (68007BC8) --------------------------------------------------------
718int __fastcall android::wp<android::CameraService::Client>::promote(int a1, int a2)
719{
720  int v2; // r4@1
721  int v3; // r5@1
722
723  v2 = *(_DWORD *)a2;
724  v3 = a1;
725  if ( *(_DWORD *)a2 && !android::RefBase::weakref_type::attemptIncStrong(*(_DWORD *)(a2 + 4), a1) )
726    v2 = 0;
727  *(_DWORD *)v3 = v2;
728  return v3;
729}
730// 680071B8: using guessed type int __fastcall android__RefBase__weakref_type__attemptIncStrong(_DWORD, _DWORD);
731
732//----- (68007BE4) --------------------------------------------------------
733int __fastcall android::sp<android::IBinder>::_sp(int a1)
734{
735  int v1; // r4@1
736
737  v1 = a1;
738  if ( *(_DWORD *)a1 )
739    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 12), a1);
740  return v1;
741}
742// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
743
744//----- (68007C00) --------------------------------------------------------
745int __fastcall android::sp<android::CameraService::Client>::_sp(int a1)
746{
747  int v1; // r4@1
748
749  v1 = a1;
750  if ( *(_DWORD *)a1 )
751    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 12), a1);
752  return v1;
753}
754// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
755
756//----- (68007C1C) --------------------------------------------------------
757int __fastcall android::sp<android::MemoryHeapBase>::operator_(int a1, int a2)
758{
759  int v2; // r4@1
760  int v3; // r5@1
761
762  v2 = a1;
763  v3 = a2;
764  if ( a2 )
765    android::RefBase::incStrong(a2 + *(_DWORD *)(*(_DWORD *)a2 - 16), a1);
766  if ( *(_DWORD *)v2 )
767    android::RefBase::decStrong(*(_DWORD *)v2 + *(_DWORD *)(**(_DWORD **)v2 - 16), v2);
768  *(_DWORD *)v2 = v3;
769  return v2;
770}
771// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
772// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
773
774//----- (68007C4C) --------------------------------------------------------
775int __fastcall android::sp<android::MemoryHeapBase>::operator_(int a1, int a2)
776{
777  int v2; // r5@1
778  int v3; // r4@1
779
780  v2 = *(_DWORD *)a2;
781  v3 = a1;
782  if ( *(_DWORD *)a2 )
783    android::RefBase::incStrong(v2 + *(_DWORD *)(*(_DWORD *)v2 - 16), a1);
784  if ( *(_DWORD *)v3 )
785    android::RefBase::decStrong(*(_DWORD *)v3 + *(_DWORD *)(**(_DWORD **)v3 - 16), v3);
786  *(_DWORD *)v3 = v2;
787  return v3;
788}
789// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
790// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
791
792//----- (68007C7C) --------------------------------------------------------
793int __fastcall android::sp<android::IMemoryHeap>::_sp(int a1)
794{
795  int v1; // r4@1
796
797  v1 = a1;
798  if ( *(_DWORD *)a1 )
799    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 12), a1);
800  return v1;
801}
802// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
803
804//----- (68007C98) --------------------------------------------------------
805int __fastcall android::sp<android::MemoryHeapBase>::_sp(int a1)
806{
807  int v1; // r4@1
808
809  v1 = a1;
810  if ( *(_DWORD *)a1 )
811    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 16), a1);
812  return v1;
813}
814// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
815
816//----- (68007CB4) --------------------------------------------------------
817int __fastcall android::sp<android::ICameraClient>::_sp(int a1)
818{
819  int v1; // r4@1
820
821  v1 = a1;
822  if ( *(_DWORD *)a1 )
823    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 12), a1);
824  return v1;
825}
826// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
827
828//----- (68007CD0) --------------------------------------------------------
829int __fastcall android::sp<android::ICameraClient>::operator_(int a1, int a2)
830{
831  int v2; // r5@1
832  int v3; // r4@1
833
834  v2 = *(_DWORD *)a2;
835  v3 = a1;
836  if ( *(_DWORD *)a2 )
837    android::RefBase::incStrong(v2 + *(_DWORD *)(*(_DWORD *)v2 - 12), a1);
838  if ( *(_DWORD *)v3 )
839    android::RefBase::decStrong(*(_DWORD *)v3 + *(_DWORD *)(**(_DWORD **)v3 - 12), v3);
840  *(_DWORD *)v3 = v2;
841  return v3;
842}
843// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
844// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
845
846//----- (68007D00) --------------------------------------------------------
847int __fastcall android::sp<android::Overlay>::_sp(int a1)
848{
849  int v1; // r4@1
850
851  v1 = a1;
852  if ( *(_DWORD *)a1 )
853    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 12), a1);
854  return v1;
855}
856// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
857
858//----- (68007D1C) --------------------------------------------------------
859int __fastcall android::sp<android::ISurface>::operator_(int a1, int a2)
860{
861  int v2; // r5@1
862  int v3; // r4@1
863
864  v2 = *(_DWORD *)a2;
865  v3 = a1;
866  if ( *(_DWORD *)a2 )
867    android::RefBase::incStrong(v2 + *(_DWORD *)(*(_DWORD *)v2 - 12), a1);
868  if ( *(_DWORD *)v3 )
869    android::RefBase::decStrong(*(_DWORD *)v3 + *(_DWORD *)(**(_DWORD **)v3 - 12), v3);
870  *(_DWORD *)v3 = v2;
871  return v3;
872}
873// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
874// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
875
876//----- (68007D4C) --------------------------------------------------------
877int __fastcall android::sp<android::CameraService>::operator_(int a1, int a2)
878{
879  int v2; // r5@1
880  int v3; // r4@1
881
882  v2 = *(_DWORD *)a2;
883  v3 = a1;
884  if ( *(_DWORD *)a2 )
885    android::RefBase::incStrong(v2 + *(_DWORD *)(*(_DWORD *)v2 - 12), a1);
886  if ( *(_DWORD *)v3 )
887    android::RefBase::decStrong(*(_DWORD *)v3 + *(_DWORD *)(**(_DWORD **)v3 - 12), v3);
888  *(_DWORD *)v3 = v2;
889  return v3;
890}
891// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
892// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
893
894//----- (68007D7C) --------------------------------------------------------
895int __fastcall android::sp<android::CameraHardwareInterface>::operator_(int a1, int a2)
896{
897  int v2; // r5@1
898  int v3; // r4@1
899
900  v2 = *(_DWORD *)a2;
901  v3 = a1;
902  if ( *(_DWORD *)a2 )
903    android::RefBase::incStrong(v2 + *(_DWORD *)(*(_DWORD *)v2 - 12), a1);
904  if ( *(_DWORD *)v3 )
905    android::RefBase::decStrong(*(_DWORD *)v3 + *(_DWORD *)(**(_DWORD **)v3 - 12), v3);
906  *(_DWORD *)v3 = v2;
907  return v3;
908}
909// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
910// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
911
912//----- (68007DAC) --------------------------------------------------------
913int __fastcall android::sp<android::MediaPlayer>::clear(int result)
914{
915  int v1; // r4@1
916
917  v1 = result;
918  if ( *(_DWORD *)result )
919  {
920    result = android::RefBase::decStrong(*(_DWORD *)result + *(_DWORD *)(**(_DWORD **)result - 12), result);
921    *(_DWORD *)v1 = 0;
922  }
923  return result;
924}
925// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
926
927//----- (68007DC8) --------------------------------------------------------
928int __fastcall android::sp<android::MediaPlayer>::operator_(int a1, int a2)
929{
930  int v2; // r4@1
931  int v3; // r5@1
932
933  v2 = a1;
934  v3 = a2;
935  if ( a2 )
936    android::RefBase::incStrong(a2 + *(_DWORD *)(*(_DWORD *)a2 - 12), a1);
937  if ( *(_DWORD *)v2 )
938    android::RefBase::decStrong(*(_DWORD *)v2 + *(_DWORD *)(**(_DWORD **)v2 - 12), v2);
939  *(_DWORD *)v2 = v3;
940  return v2;
941}
942// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
943// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
944
945//----- (68007DF8) --------------------------------------------------------
946int __fastcall android::sp<android::MediaPlayer>::operator_(int a1, int a2)
947{
948  int v2; // r5@1
949  int v3; // r4@1
950
951  v2 = *(_DWORD *)a2;
952  v3 = a1;
953  if ( *(_DWORD *)a2 )
954    android::RefBase::incStrong(v2 + *(_DWORD *)(*(_DWORD *)v2 - 12), a1);
955  if ( *(_DWORD *)v3 )
956    android::RefBase::decStrong(*(_DWORD *)v3 + *(_DWORD *)(**(_DWORD **)v3 - 12), v3);
957  *(_DWORD *)v3 = v2;
958  return v3;
959}
960// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
961// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
962
963//----- (68007E28) --------------------------------------------------------
964int __fastcall android::sp<android::MediaPlayer>::_sp(int a1)
965{
966  int v1; // r4@1
967
968  v1 = a1;
969  if ( *(_DWORD *)a1 )
970    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 12), a1);
971  return v1;
972}
973// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
974
975//----- (68007E44) --------------------------------------------------------
976int __fastcall android::sp<android::CameraService::Client>::operator_(int a1, int a2)
977{
978  int v2; // r5@1
979  int v3; // r4@1
980
981  v2 = *(_DWORD *)a2;
982  v3 = a1;
983  if ( *(_DWORD *)a2 )
984    android::RefBase::incStrong(v2 + *(_DWORD *)(*(_DWORD *)v2 - 12), a1);
985  if ( *(_DWORD *)v3 )
986    android::RefBase::decStrong(*(_DWORD *)v3 + *(_DWORD *)(**(_DWORD **)v3 - 12), v3);
987  *(_DWORD *)v3 = v2;
988  return v3;
989}
990// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
991// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
992
993//----- (68007E74) --------------------------------------------------------
994int __fastcall android::sp<android::CameraService::Client>::operator_(int a1, int a2)
995{
996  int v2; // r4@1
997  int v3; // r5@1
998
999  v2 = a1;
1000  v3 = a2;
1001  if ( a2 )
1002    android::RefBase::incStrong(a2 + *(_DWORD *)(*(_DWORD *)a2 - 12), a1);
1003  if ( *(_DWORD *)v2 )
1004    android::RefBase::decStrong(*(_DWORD *)v2 + *(_DWORD *)(**(_DWORD **)v2 - 12), v2);
1005  *(_DWORD *)v2 = v3;
1006  return v2;
1007}
1008// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
1009// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
1010
1011//----- (68007EA4) --------------------------------------------------------
1012int __fastcall android::CameraService::Client::handleGenericDataTimestamp(int a1, int a2, int _R2)
1013{
1014  int v7; // r4@1
1015  int v11; // [sp+Ch] [bp-14h]@1
1016
1017  __asm { VMOV            D8, R2, R3 }
1018  v7 = a1;
1019  android::sp<android::ICameraClient>::sp((int)&v11, a1 + 20);
1020  pthread_mutex_unlock((pthread_mutex_t *)(v7 + 80));
1021  if ( v11 )
1022  {
1023    _R3 = *(_DWORD *)v11;
1024    __asm { VMOV            R2, R3, D8 }
1025    (*(void (__cdecl **)(int, _DWORD))(*(_DWORD *)v11 + 24))(v11, *(_DWORD *)(*(_DWORD *)v11 + 24));
1026  }
1027  return android::sp<android::ICameraClient>::_sp((int)&v11);
1028}
1029
1030//----- (68007EE8) --------------------------------------------------------
1031int __fastcall android::CameraService::Client::handleGenericData(int a1, int a2)
1032{
1033  int v2; // r4@1
1034  int v4; // [sp+4h] [bp-14h]@1
1035
1036  v4 = a2;
1037  v2 = a1;
1038  android::sp<android::ICameraClient>::sp((int)&v4, a1 + 20);
1039  pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
1040  if ( v4 )
1041    (*(void (**)(void))(*(_DWORD *)v4 + 20))();
1042  return android::sp<android::ICameraClient>::_sp((int)&v4);
1043}
1044
1045//----- (68007F18) --------------------------------------------------------
1046int __fastcall android::CameraService::Client::handleGenericNotify(int a1, int a2, int a3)
1047{
1048  int v3; // r4@1
1049  int v5; // [sp+4h] [bp-1Ch]@1
1050  int v6; // [sp+8h] [bp-18h]@1
1051
1052  v5 = a2;
1053  v6 = a3;
1054  v3 = a1;
1055  android::sp<android::ICameraClient>::sp((int)&v5, a1 + 20);
1056  pthread_mutex_unlock((pthread_mutex_t *)(v3 + 80));
1057  if ( v5 )
1058    (*(void (**)(void))(*(_DWORD *)v5 + 16))();
1059  return android::sp<android::ICameraClient>::_sp((int)&v5);
1060}
1061
1062//----- (68007F4C) --------------------------------------------------------
1063int __fastcall android::CameraService::Client::handleSceneDetection(int a1, int a2, int a3)
1064{
1065  int v3; // r4@1
1066  int v5; // [sp+4h] [bp-14h]@1
1067  int v6; // [sp+8h] [bp-10h]@1
1068
1069  v5 = a2;
1070  v6 = a3;
1071  v3 = a1;
1072  android::sp<android::ICameraClient>::sp((int)&v5, a1 + 20);
1073  pthread_mutex_unlock((pthread_mutex_t *)(v3 + 80));
1074  if ( v5 )
1075    (*(void (**)(void))(*(_DWORD *)v5 + 20))();
1076  return android::sp<android::ICameraClient>::_sp((int)&v5);
1077}
1078
1079//----- (68007F7C) --------------------------------------------------------
1080int __fastcall android::CameraService::Client::handleFaceDetection(int a1, int a2, int a3)
1081{
1082  int v3; // r4@1
1083  int v4; // r1@1
1084  int v6; // [sp+4h] [bp-14h]@1
1085  int v7; // [sp+8h] [bp-10h]@1
1086
1087  v7 = a3;
1088  v3 = a1;
1089  v6 = 0;
1090  v4 = a1 + 24;
1091  if ( !*(_BYTE *)(a1 + 76) )
1092    v4 = a1 + 20;
1093  android::sp<android::ICameraClient>::operator_((int)&v6, v4);
1094  pthread_mutex_unlock((pthread_mutex_t *)(v3 + 80));
1095  if ( v6 )
1096    (*(void (**)(void))(*(_DWORD *)v6 + 20))();
1097  return android::sp<android::ICameraClient>::_sp((int)&v6);
1098}
1099
1100//----- (68007FBC) --------------------------------------------------------
1101int __fastcall _non_virtual_thunk_to_android::CameraService::dump(int a1, int a2, int a3)
1102{
1103  return android::CameraService::dump(a1 - 4, a2, a3);
1104}
1105
1106//----- (68007FC4) --------------------------------------------------------
1107int __fastcall android::CameraService::dump(int a1, int a2, int a3)
1108{
1109  int v3; // r6@1
1110  int v4; // r7@1
1111  int v5; // r8@1
1112  int v6; // r9@1
1113  int v7; // r0@1
1114  int v8; // r0@2
1115  int v9; // r7@2
1116  int v10; // r0@2
1117  int v11; // r4@3
1118  int v12; // r5@8
1119  int v13; // r5@18
1120  int v14; // r4@18
1121  int v15; // r11@19
1122  int v16; // r11@20
1123  int result; // r0@23
1124  pthread_mutex_t *mutex; // [sp+Ch] [bp-154h]@3
1125  signed int v19; // [sp+14h] [bp-14Ch]@8
1126  int v20; // [sp+18h] [bp-148h]@18
1127  signed int v21; // [sp+18h] [bp-148h]@6
1128  const char *v22; // [sp+20h] [bp-140h]@6
1129  char v23; // [sp+24h] [bp-13Ch]@19
1130  char v24; // [sp+28h] [bp-138h]@11
1131  char v25; // [sp+2Ch] [bp-134h]@1
1132  const void *v26; // [sp+30h] [bp-130h]@1
1133  char v27; // [sp+34h] [bp-12Ch]@2
1134  int v28; // [sp+134h] [bp-2Ch]@1
1135
1136  v3 = a2;
1137  v4 = a3;
1138  v5 = a1;
1139  v28 = _stack_chk_guard;
1140  android::String8::String8(&v26);
1141  android::String16::String16(&v25, "android.permission.DUMP");
1142  v6 = android::checkCallingPermission(&v25);
1143  v7 = android::String16::_String16(&v25);
1144  if ( v6 )
1145  {
1146    v11 = 0;
1147    mutex = (pthread_mutex_t *)(v5 + 16);
1148    while ( pthread_mutex_trylock(mutex) )
1149    {
1150      ++v11;
1151      usleep(0xEA60u);
1152      if ( v11 == 50 )
1153      {
1154        android::String8::String8(&v22, off_6800C018);
1155        write(v3, v22, *((_DWORD *)v22 - 3) - 1);
1156        android::String8::_String8(&v22);
1157        v21 = 0;
1158        goto LABEL_8;
1159      }
1160    }
1161    v21 = 1;
1162LABEL_8:
1163    v12 = 0;
1164    v19 = 0;
1165    while ( v12 < *(_DWORD *)(v5 + 52) )
1166    {
1167      android::wp<android::CameraService::Client>::promote((int)&v22, v5 + 8 * v12 + 20);
1168      if ( v22 )
1169      {
1170        android::IInterface::asBinder(&v24, *((_DWORD *)v22 + 5));
1171        sprintf(&v27, "Client[%d] (%p) PID: %d\n", v12, *(_DWORD *)&v24, *((_DWORD *)v22 + 9));
1172        android::sp<android::IBinder>::_sp((int)&v24);
1173        android::String8::append(&v26, &v27);
1174        write(v3, v26, *((_DWORD *)v26 - 3) - 1);
1175        (*(void (**)(void))(**((_DWORD **)v22 + 10) + 104))();
1176        android::sp<android::CameraService::Client>::_sp((int)&v22);
1177        v19 = 1;
1178      }
1179      else
1180      {
1181        android::sp<android::CameraService::Client>::_sp((int)&v22);
1182      }
1183      ++v12;
1184    }
1185    if ( !v19 )
1186    {
1187      android::String8::append(&v26, "No camera client yet.\n");
1188      write(v3, v26, *((_DWORD *)v26 - 3) - 1);
1189    }
1190    if ( v21 )
1191      pthread_mutex_unlock(mutex);
1192    v13 = 0;
1193    v14 = 0;
1194    v20 = *(_DWORD *)(v4 + 8);
1195    while ( 1 )
1196    {
1197      ++v14;
1198      if ( v14 >= v20 )
1199        break;
1200      android::String16::String16(&v23, "-v");
1201      v15 = sub_68007954();
1202      android::String16::_String16(&v23);
1203      if ( v15 )
1204      {
1205        android::String8::String8(&v22, *(_DWORD *)(v4 + 4) + 4 * v14);
1206        v16 = atoi(v22);
1207        sprintf(&v27, "Set Log Level to %d", v16);
1208        android::String8::append(&v26, &v27);
1209        android_atomic_release_store(v16, &unk_6800D370);
1210        android::String8::_String8(&v22);
1211      }
1212      v13 += 4;
1213    }
1214  }
1215  else
1216  {
1217    v8 = sub_68007BB0(v7);
1218    v9 = v8;
1219    v10 = sub_68007BBC(v8);
1220    snprintf(&v27, 0x100u, "Permission Denial: can't dump CameraService from pid=%d, uid=%d\n", v9, v10);
1221    android::String8::append(&v26, &v27);
1222    write(v3, v26, *((_DWORD *)v26 - 3) - 1);
1223  }
1224  android::String8::_String8(&v26);
1225  result = 0;
1226  if ( v28 != _stack_chk_guard )
1227    _stack_chk_fail(0);
1228  return result;
1229}
1230// 6800717C: using guessed type int __fastcall android__String8__String8(_DWORD);
1231// 68007188: using guessed type int __fastcall android__String8___String8(_DWORD);
1232// 680071DC: using guessed type int __fastcall android__String16__String16(_DWORD, _DWORD);
1233// 680071E8: using guessed type int __fastcall android__checkCallingPermission(_DWORD);
1234// 680071F4: using guessed type int __fastcall android__String16___String16(_DWORD);
1235// 6800720C: using guessed type int __fastcall android__String8__append(_DWORD, _DWORD);
1236// 6800723C: using guessed type int __fastcall android__IInterface__asBinder(_DWORD, _DWORD);
1237// 68007254: using guessed type int __fastcall android__String8__String8(_DWORD, _DWORD);
1238// 6800726C: using guessed type int __fastcall android_atomic_release_store(_DWORD, _DWORD);
1239// 68007278: using guessed type int __fastcall android__String8__String8(_DWORD, _DWORD);
1240// 68007284: using guessed type int __fastcall _stack_chk_fail(_DWORD);
1241// 6800C018: using guessed type char *off_6800C018;
1242
1243//----- (68008220) --------------------------------------------------------
1244int __fastcall android::CameraService::setCameraFree(int a1, int a2)
1245{
1246  return android_atomic_release_store(0, a1 + 4 * (a2 + 14));
1247}
1248// 6800726C: using guessed type int __fastcall android_atomic_release_store(_DWORD, _DWORD);
1249
1250//----- (68008230) --------------------------------------------------------
1251int __fastcall android::CameraService::setCameraBusy(int a1, int a2)
1252{
1253  return android_atomic_release_store(1, a1 + 4 * (a2 + 14));
1254}
1255// 6800726C: using guessed type int __fastcall android_atomic_release_store(_DWORD, _DWORD);
1256
1257//----- (68008240) --------------------------------------------------------
1258signed int __fastcall android::CameraService::Client::getOrientation(int a1, signed int a2, int a3)
1259{
1260  signed int result; // r0@2
1261
1262  if ( a3 )
1263  {
1264    if ( !a2 )
1265      return 1;
1266    if ( a2 == 90 )
1267      return 5;
1268    if ( a2 == 180 )
1269      return 2;
1270    if ( a2 == 270 )
1271      return 6;
1272  }
1273  else
1274  {
1275    result = a2;
1276    if ( !a2 )
1277      return result;
1278    if ( a2 == 90 )
1279      return 4;
1280    if ( a2 == 180 )
1281      return 3;
1282    if ( a2 == 270 )
1283      return 7;
1284  }
1285  _android_log_print(6, "CameraService", "Invalid setDisplayOrientation degrees=%d", a2);
1286  return -1;
1287}
1288// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1289
1290//----- (680082A0) --------------------------------------------------------
1291signed int __fastcall android::CameraService::Client::checkPid(int a1)
1292{
1293  signed int result; // r0@2
1294
1295  if ( sub_68007BB0(a1) == *(_DWORD *)(a1 + 36) )
1296  {
1297    result = 0;
1298  }
1299  else
1300  {
1301    _android_log_print(
1302      5,
1303      "CameraService",
1304      "attempt to use a locked camera from a different process (old pid %d, new pid %d)");
1305    result = 16;
1306  }
1307  return result;
1308}
1309// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1310
1311//----- (680082D0) --------------------------------------------------------
1312signed int __fastcall android::CameraService::Client::checkPidAndHardware(int a1)
1313{
1314  int v1; // r4@1
1315  signed int result; // r0@1
1316  int v3; // r0@3
1317
1318  v1 = a1;
1319  result = android::CameraService::Client::checkPid(a1);
1320  if ( !result )
1321  {
1322    if ( !*(_DWORD *)(v1 + 40) )
1323    {
1324      v3 = sub_68007BB0(0);
1325      _android_log_print(6, "CameraService", "attempt to use a camera after disconnect() (pid %d)", v3);
1326      result = -38;
1327    }
1328  }
1329  return result;
1330}
1331// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1332
1333//----- (68008300) --------------------------------------------------------
1334signed int __fastcall android::CameraService::Client::lockIfMessageWanted(int a1, int a2)
1335{
1336  int v2; // r9@1
1337  int v3; // r4@1
1338  pthread_mutex_t *v4; // r10@1
1339  int v5; // r5@1
1340  int v7; // [sp+0h] [bp-30h]@1
1341
1342  v7 = a1;
1343  v2 = a1;
1344  v3 = a2;
1345  v4 = (pthread_mutex_t *)(a1 + 80);
1346  v5 = 0;
1347  while ( 1 )
1348  {
1349    if ( !(v3 & *(_DWORD *)(v2 + 92)) )
1350    {
1351      _android_log_print(5, "CameraService", "lockIfMessageWanted(%d): dropped unwanted message", v3, v7);
1352      return 0;
1353    }
1354    if ( !pthread_mutex_trylock(v4) )
1355      break;
1356    if ( !v5 && unk_6800D370 > 0 )
1357      _android_log_print(3, "CameraService", "lockIfMessageWanted(%d): enter sleep", v3, v7);
1358    ++v5;
1359    usleep(0x2710u);
1360  }
1361  if ( v5 )
1362  {
1363    if ( unk_6800D370 > 0 )
1364      _android_log_print(3, "CameraService", "lockIfMessageWanted(%d): waited for %d ms", v3, 10 * v5);
1365  }
1366  return 1;
1367}
1368// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1369
1370//----- (680083B0) --------------------------------------------------------
1371__int64 __fastcall android::CameraService::Client::copyFrameAndPostCopiedFrame(__int64 a1, int a2, int a3, size_t a4)
1372{
1373  int v4; // r9@1
1374  __int64 v5; // kr00_8@1
1375  int v6; // r8@1
1376  int v7; // r7@3
1377  int v8; // r6@4
1378  int v9; // r0@4
1379  int v10; // r3@6
1380  void *v11; // r6@12
1381  int v12; // r0@12
1382  int v13; // r3@12
1383  int v14; // r6@16
1384  pthread_mutex_t *v15; // r4@18
1385  int v16; // r6@20
1386  void (__fastcall *v17)(_DWORD, _DWORD, _DWORD); // r5@20
1387  __int64 v19; // [sp+0h] [bp-30h]@1
1388  int v20; // [sp+8h] [bp-28h]@1
1389  int v21; // [sp+Ch] [bp-24h]@1
1390
1391  v19 = a1;
1392  v20 = a2;
1393  v21 = a3;
1394  v4 = a3;
1395  v5 = a1;
1396  v6 = a2;
1397  if ( unk_6800D370 > 1 )
1398    _android_log_print(3, "CameraService", "copyFrameAndPostCopiedFrame");
1399  v21 = 0;
1400  v7 = *(_DWORD *)(v5 + 88);
1401  if ( v7 )
1402  {
1403    if ( a4 <= (*(int (__fastcall **)(int))(*(_DWORD *)(v7 + *(_DWORD *)(*(_DWORD *)v7 - 12)) + 24))(v7 + *(_DWORD *)(*(_DWORD *)v7 - 12)) )
1404      goto LABEL_10;
1405    v10 = *(_DWORD *)(v5 + 88);
1406    if ( v10 )
1407    {
1408      android::RefBase::decStrong(v10 + *(_DWORD *)(*(_DWORD *)v10 - 16), v5 + 88);
1409      *(_DWORD *)(v5 + 88) = 0;
1410    }
1411    v8 = operator new(52);
1412    android::MemoryHeapBase::MemoryHeapBase();
1413    v9 = v5 + 88;
1414  }
1415  else
1416  {
1417    v8 = operator new(52);
1418    android::MemoryHeapBase::MemoryHeapBase();
1419    v9 = v5 + 88;
1420  }
1421  android::sp<android::MemoryHeapBase>::operator_(v9, v8);
1422LABEL_10:
1423  if ( *(_DWORD *)(v5 + 88) )
1424  {
1425    android::sp<android::MemoryHeapBase>::operator_((int)&v21, v5 + 88);
1426    v11 = (void *)(*(int (__fastcall **)(int))(*(_DWORD *)(v21 + *(_DWORD *)(*(_DWORD *)v21 - 12)) + 20))(v21 + *(_DWORD *)(*(_DWORD *)v21 - 12));
1427    v12 = (*(int (**)(void))(**(_DWORD **)v6 + 20))();
1428    memcpy(v11, (const void *)(v12 + v4), a4);
1429    v13 = v21;
1430    if ( v21 )
1431      v13 = v21 + *(_DWORD *)(*(_DWORD *)v21 - 12);
1432    HIDWORD(v19) = v13;
1433    if ( v13 )
1434      android::RefBase::incStrong(v13 + *(_DWORD *)(*(_DWORD *)v13 - 12), (char *)&v19 + 4);
1435    v14 = operator new(36);
1436    android::MemoryBase::MemoryBase();
1437    v20 = v14;
1438    if ( v14 )
1439      android::RefBase::incStrong(v14 + *(_DWORD *)(*(_DWORD *)v14 - 12), &v20);
1440    v15 = (pthread_mutex_t *)(v5 + 80);
1441    android::sp<android::IMemoryHeap>::_sp((int)((char *)&v19 + 4));
1442    if ( v20 )
1443    {
1444      pthread_mutex_unlock(v15);
1445      v16 = *HIDWORD(v5);
1446      v17 = *(void (__fastcall **)(_DWORD, _DWORD, _DWORD))(*(_DWORD *)*HIDWORD(v5) + 20);
1447      LODWORD(v19) = v20;
1448      if ( v20 )
1449        android::RefBase::incStrong(v20 + *(_DWORD *)(*(_DWORD *)v20 - 12), &v19);
1450      v17(v16, 16, &v19);
1451      if ( (_DWORD)v19 )
1452        android::RefBase::decStrong(v19 + *(_DWORD *)(*(_DWORD *)v19 - 12), &v19);
1453    }
1454    else
1455    {
1456      _android_log_print(6, "CameraService", "failed to allocate space for frame callback");
1457      pthread_mutex_unlock(v15);
1458    }
1459    if ( v20 )
1460      android::RefBase::decStrong(v20 + *(_DWORD *)(*(_DWORD *)v20 - 12), &v20);
1461  }
1462  else
1463  {
1464    _android_log_print(6, "CameraService", "failed to allocate space for preview buffer");
1465    pthread_mutex_unlock((pthread_mutex_t *)(v5 + 80));
1466  }
1467  android::sp<android::MemoryHeapBase>::_sp((int)&v21);
1468  return v19;
1469}
1470// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
1471// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
1472// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1473// 6800729C: using guessed type int __fastcall operator new(_DWORD);
1474// 680072A8: using guessed type int android__MemoryHeapBase__MemoryHeapBase(void);
1475// 680072C0: using guessed type int android__MemoryBase__MemoryBase(void);
1476
1477//----- (68008564) --------------------------------------------------------
1478int __fastcall sub_68008564(int a1)
1479{
1480  int v1; // r0@1
1481  int v2; // r0@1
1482
1483  v1 = (*(int (**)(void))(*(_DWORD *)a1 + 32))();
1484  v2 = android::IPCThreadState::self(v1);
1485  android::IPCThreadState::flushCommands(v2);
1486  return 0;
1487}
1488// 68007194: using guessed type int __fastcall android__IPCThreadState__self(_DWORD);
1489// 680072CC: using guessed type int __fastcall android__IPCThreadState__flushCommands(_DWORD);
1490
1491//----- (68008578) --------------------------------------------------------
1492int __fastcall android::CameraService::Client::disableMsgType(int a1, int a2)
1493{
1494  int v2; // r5@1
1495
1496  v2 = a1;
1497  android_atomic_and(~a2, a1 + 92);
1498  return (*(int (**)(void))(**(_DWORD **)(v2 + 40) + 24))();
1499}
1500// 680072D8: using guessed type int __fastcall android_atomic_and(_DWORD, _DWORD);
1501
1502//----- (68008594) --------------------------------------------------------
1503int __fastcall android::CameraService::Client::handleCompressedPicture(int a1, int a2, int a3)
1504{
1505  int v3; // r4@1
1506  int v5; // [sp+4h] [bp-14h]@1
1507  int v6; // [sp+8h] [bp-10h]@1
1508
1509  v5 = a2;
1510  v6 = a3;
1511  v3 = a1;
1512  android::CameraService::Client::disableMsgType(a1, 256);
1513  android::sp<android::ICameraClient>::sp((int)&v5, v3 + 20);
1514  pthread_mutex_unlock((pthread_mutex_t *)(v3 + 80));
1515  if ( v5 )
1516    (*(void (**)(void))(*(_DWORD *)v5 + 20))();
1517  return android::sp<android::ICameraClient>::_sp((int)&v5);
1518}
1519
1520//----- (680085CC) --------------------------------------------------------
1521void __fastcall android::CameraService::Client::handleRawPicture(int a1, int a2, int a3, int a4)
1522{
1523  int v4; // r5@1
1524  int v5; // r4@1
1525  int v6; // r0@1
1526  __int64 v7; // [sp+0h] [bp-20h]@1
1527  int v8; // [sp+8h] [bp-18h]@1
1528  int v9; // [sp+Ch] [bp-14h]@1
1529
1530  v8 = a3;
1531  v9 = a4;
1532  v4 = a2;
1533  v5 = a1;
1534  android::CameraService::Client::disableMsgType(a1, 128);
1535  (*(void (__fastcall **)(char *))(**(_DWORD **)v4 + 16))((char *)&v7 + 4);
1536  v6 = *(_DWORD *)(v5 + 84);
1537  if ( v6 && !*(_BYTE *)(v5 + 44) )
1538    (*(void (**)(void))(*(_DWORD *)v6 + 28))();
1539  android::sp<android::ICameraClient>::sp((int)&v7, v5 + 20);
1540  pthread_mutex_unlock((pthread_mutex_t *)(v5 + 80));
1541  if ( (_DWORD)v7 )
1542    (*(void (**)(void))(*(_DWORD *)v7 + 20))();
1543  android::sp<android::ICameraClient>::_sp((int)&v7);
1544  android::sp<android::IMemoryHeap>::_sp((int)((char *)&v7 + 4));
1545}
1546
1547//----- (68008628) --------------------------------------------------------
1548int __fastcall android::CameraService::Client::handlePostview(int a1, int a2, int a3)
1549{
1550  int v3; // r4@1
1551  int v5; // [sp+4h] [bp-14h]@1
1552  int v6; // [sp+8h] [bp-10h]@1
1553
1554  v5 = a2;
1555  v6 = a3;
1556  v3 = a1;
1557  android::CameraService::Client::disableMsgType(a1, 64);
1558  android::sp<android::ICameraClient>::sp((int)&v5, v3 + 20);
1559  pthread_mutex_unlock((pthread_mutex_t *)(v3 + 80));
1560  if ( v5 )
1561    (*(void (**)(void))(*(_DWORD *)v5 + 20))();
1562  return android::sp<android::ICameraClient>::_sp((int)&v5);
1563}
1564
1565//----- (6800865C) --------------------------------------------------------
1566int __fastcall android::CameraService::Client::handlePreviewData(int a1, int a2)
1567{
1568  int v2; // r4@1
1569  int v3; // r0@2
1570  int v4; // r6@4
1571  int v5; // r3@12
1572  int v7; // [sp+8h] [bp-20h]@8
1573  char v8; // [sp+Ch] [bp-1Ch]@1
1574  size_t v9; // [sp+10h] [bp-18h]@18
1575  int v10; // [sp+14h] [bp-14h]@18
1576
1577  v2 = a1;
1578  (*(void (__fastcall **)(char *))(**(_DWORD **)a2 + 16))(&v8);
1579  if ( !*(_BYTE *)(v2 + 44) )
1580  {
1581    v3 = *(_DWORD *)(v2 + 84);
1582    if ( v3 )
1583      (*(void (**)(void))(*(_DWORD *)v3 + 28))();
1584  }
1585  v4 = *(_DWORD *)(v2 + 60);
1586  if ( v4 & 1 )
1587  {
1588    android::sp<android::ICameraClient>::sp((int)&v7, v2 + 20);
1589    if ( !v7 || *(_DWORD *)(v2 + 60) & 2 )
1590    {
1591      if ( unk_6800D370 > 1 )
1592        _android_log_print(3, "CameraService", "Disable preview callback");
1593      v5 = *(_BYTE *)(v2 + 44);
1594      *(_DWORD *)(v2 + 60) &= 0xFFFFFFF8u;
1595      if ( v5 )
1596        android::CameraService::Client::disableMsgType(v2, 16);
1597    }
1598    if ( v7 )
1599    {
1600      if ( v4 & 4 )
1601      {
1602        if ( unk_6800D370 > 1 )
1603          _android_log_print(3, "CameraService", "frame is copied");
1604        android::CameraService::Client::copyFrameAndPostCopiedFrame(__PAIR__(&v7, v2), (int)&v8, v10, v9);
1605      }
1606      else
1607      {
1608        if ( unk_6800D370 > 1 )
1609          _android_log_print(3, "CameraService", "frame is forwarded", v4 << 29);
1610        pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
1611        (*(void (**)(void))(*(_DWORD *)v7 + 20))();
1612      }
1613    }
1614    else
1615    {
1616      pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
1617    }
1618    android::sp<android::ICameraClient>::_sp((int)&v7);
1619  }
1620  else
1621  {
1622    if ( unk_6800D370 > 1 )
1623      _android_log_print(3, "CameraService", "frame callback is disabled");
1624    pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
1625  }
1626  return android::sp<android::IMemoryHeap>::_sp((int)&v8);
1627}
1628// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1629
1630//----- (68008798) --------------------------------------------------------
1631int __fastcall android::CameraService::Client::enableMsgType(int a1, int a2)
1632{
1633  int v2; // r5@1
1634
1635  v2 = a1;
1636  android_atomic_or(a2, a1 + 92);
1637  return (*(int (**)(void))(**(_DWORD **)(v2 + 40) + 20))();
1638}
1639// 680072E4: using guessed type int __fastcall android_atomic_or(_DWORD, _DWORD);
1640
1641//----- (680087B4) --------------------------------------------------------
1642signed int __fastcall android::CameraService::Client::sendCommand(int a1, signed int a2, signed int a3)
1643{
1644  int v3; // r4@1
1645  signed int v4; // r5@1
1646  signed int v5; // r7@1
1647  int v6; // r0@2
1648  signed int v7; // r9@3
1649  int v8; // r2@15
1650  signed int v9; // r0@17
1651  int v10; // r1@20
1652  int v11; // r0@11
1653  int v12; // r1@11
1654  int v13; // r0@8
1655  int v14; // r1@8
1656
1657  v3 = a1;
1658  v4 = a2;
1659  v5 = a3;
1660  if ( unk_6800D370 > 0 )
1661  {
1662    v6 = sub_68007BB0(a1);
1663    _android_log_print(3, "CameraService", "sendCommand (pid %d)", v6);
1664  }
1665  pthread_mutex_lock((pthread_mutex_t *)(v3 + 80));
1666  v7 = android::CameraService::Client::checkPidAndHardware(v3);
1667  if ( v7 )
1668    goto LABEL_27;
1669  if ( v4 == 327680 )
1670  {
1671    v11 = v3;
1672    v12 = 65536;
1673    goto LABEL_25;
1674  }
1675  if ( v4 > 327680 )
1676  {
1677    if ( v4 == 393216 )
1678    {
1679      v13 = v3;
1680      v14 = 131072;
1681      goto LABEL_23;
1682    }
1683    if ( v4 != 458752 )
1684    {
1685LABEL_26:
1686      v7 = (*(int (**)(void))(**(_DWORD **)(v3 + 40) + 96))();
1687      goto LABEL_27;
1688    }
1689    v11 = v3;
1690    v12 = 131072;
1691LABEL_25:
1692    android::CameraService::Client::disableMsgType(v11, v12);
1693    goto LABEL_26;
1694  }
1695  if ( v4 != 3 )
1696  {
1697    if ( v4 == 262144 )
1698    {
1699      v13 = v3;
1700      v14 = 65536;
1701LABEL_23:
1702      android::CameraService::Client::enableMsgType(v13, v14);
1703      goto LABEL_26;
1704    }
1705    goto LABEL_26;
1706  }
1707  if ( (*(int (**)(void))(**(_DWORD **)(v3 + 40) + 52))() )
1708  {
1709    v7 = -38;
1710  }
1711  else
1712  {
1713    v8 = *(_DWORD *)(v3 + 32) == 1;
1714    v9 = android::CameraService::Client::getOrientation(v3, v5, v8);
1715    if ( v9 == -1 )
1716    {
1717      v7 = -22;
1718    }
1719    else
1720    {
1721      if ( *(_DWORD *)(v3 + 64) != v9 )
1722      {
1723        v10 = *(_DWORD *)(v3 + 48);
1724        *(_DWORD *)(v3 + 64) = v9;
1725        if ( v10 )
1726          *(_DWORD *)(v3 + 68) = 1;
1727      }
1728    }
1729  }
1730LABEL_27:
1731  pthread_mutex_unlock((pthread_mutex_t *)(v3 + 80));
1732  return v7;
1733}
1734// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1735
1736//----- (680088A4) --------------------------------------------------------
1737signed int __fastcall android::CameraService::Client::takePicture(int a1)
1738{
1739  int v1; // r4@1
1740  int v2; // r0@2
1741  signed int v3; // r6@3
1742
1743  v1 = a1;
1744  if ( unk_6800D370 > 0 )
1745  {
1746    v2 = sub_68007BB0(a1);
1747    _android_log_print(3, "CameraService", "takePicture (pid %d)", v2);
1748  }
1749  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
1750  v3 = android::CameraService::Client::checkPidAndHardware(v1);
1751  if ( !v3 )
1752  {
1753    android::CameraService::Client::enableMsgType(v1, 450);
1754    v3 = (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 80))();
1755  }
1756  pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
1757  return v3;
1758}
1759// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1760
1761//----- (68008904) --------------------------------------------------------
1762signed int __fastcall android::CameraService::Client::cancelAutoFocus(int a1)
1763{
1764  int v1; // r4@1
1765  int v2; // r0@2
1766  signed int v3; // r5@3
1767
1768  v1 = a1;
1769  if ( unk_6800D370 > 0 )
1770  {
1771    v2 = sub_68007BB0(a1);
1772    _android_log_print(3, "CameraService", "cancelAutoFocus (pid %d)", v2);
1773  }
1774  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
1775  v3 = android::CameraService::Client::checkPidAndHardware(v1);
1776  if ( !v3 )
1777    v3 = (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 76))();
1778  pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
1779  return v3;
1780}
1781// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1782
1783//----- (6800895C) --------------------------------------------------------
1784signed int __fastcall android::CameraService::Client::autoFocus(int a1)
1785{
1786  int v1; // r4@1
1787  int v2; // r0@2
1788  signed int v3; // r5@3
1789
1790  v1 = a1;
1791  if ( unk_6800D370 > 0 )
1792  {
1793    v2 = sub_68007BB0(a1);
1794    _android_log_print(3, "CameraService", "autoFocus (pid %d)", v2);
1795  }
1796  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
1797  v3 = android::CameraService::Client::checkPidAndHardware(v1);
1798  if ( !v3 )
1799    v3 = (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 72))();
1800  pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
1801  return v3;
1802}
1803// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1804
1805//----- (680089B4) --------------------------------------------------------
1806int __fastcall android::CameraService::Client::recordingEnabled(int a1)
1807{
1808  int v1; // r4@1
1809  int v2; // r0@2
1810  pthread_mutex_t *v3; // r5@3
1811  int v4; // r4@4
1812
1813  v1 = a1;
1814  if ( unk_6800D370 > 0 )
1815  {
1816    v2 = sub_68007BB0(a1);
1817    _android_log_print(3, "CameraService", "recordingEnabled (pid %d)", v2);
1818  }
1819  v3 = (pthread_mutex_t *)(v1 + 80);
1820  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
1821  if ( android::CameraService::Client::checkPidAndHardware(v1) )
1822    v4 = 0;
1823  else
1824    v4 = (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 64))();
1825  pthread_mutex_unlock(v3);
1826  return v4;
1827}
1828// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1829
1830//----- (68008A0C) --------------------------------------------------------
1831int __fastcall android::CameraService::Client::previewEnabled(int a1)
1832{
1833  int v1; // r4@1
1834  int v2; // r0@2
1835  pthread_mutex_t *v3; // r5@3
1836  int v4; // r4@4
1837
1838  v1 = a1;
1839  if ( unk_6800D370 > 0 )
1840  {
1841    v2 = sub_68007BB0(a1);
1842    _android_log_print(3, "CameraService", "previewEnabled (pid %d)", v2);
1843  }
1844  v3 = (pthread_mutex_t *)(v1 + 80);
1845  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
1846  if ( android::CameraService::Client::checkPidAndHardware(v1) )
1847    v4 = 0;
1848  else
1849    v4 = (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 52))();
1850  pthread_mutex_unlock(v3);
1851  return v4;
1852}
1853// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1854
1855//----- (68008A64) --------------------------------------------------------
1856int __fastcall android::CameraService::Client::releaseRecordingFrame(int a1)
1857{
1858  pthread_mutex_t *v1; // r4@1
1859  int v2; // r5@1
1860
1861  v1 = (pthread_mutex_t *)(a1 + 80);
1862  v2 = a1;
1863  pthread_mutex_lock((pthread_mutex_t *)(a1 + 80));
1864  if ( !android::CameraService::Client::checkPidAndHardware(v2) )
1865    (*(void (**)(void))(**(_DWORD **)(v2 + 40) + 68))();
1866  return pthread_mutex_unlock(v1);
1867}
1868
1869//----- (68008A90) --------------------------------------------------------
1870int __fastcall android::CameraService::Client::stopPreview(int a1)
1871{
1872  int v1; // r4@1
1873  int v2; // r0@2
1874  int v3; // r0@4
1875  int v4; // r3@7
1876
1877  v1 = a1;
1878  if ( unk_6800D370 > 0 )
1879  {
1880    v2 = sub_68007BB0(a1);
1881    _android_log_print(3, "CameraService", "stopPreview (pid %d)", v2);
1882  }
1883  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
1884  if ( !android::CameraService::Client::checkPidAndHardware(v1) )
1885  {
1886    *(_DWORD *)(v1 + 72) = 0;
1887    android::CameraService::Client::disableMsgType(v1, 16);
1888    (*(void (**)(void))(**(_DWORD **)(v1 + 40) + 48))();
1889    v3 = *(_DWORD *)(v1 + 84);
1890    if ( v3 && !*(_BYTE *)(v1 + 44) )
1891      (*(void (**)(void))(*(_DWORD *)v3 + 32))();
1892    v4 = *(_DWORD *)(v1 + 88);
1893    if ( v4 )
1894    {
1895      android::RefBase::decStrong(v4 + *(_DWORD *)(*(_DWORD *)v4 - 16), v1 + 88);
1896      *(_DWORD *)(v1 + 88) = 0;
1897    }
1898  }
1899  return pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
1900}
1901// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
1902// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1903
1904//----- (68008B14) --------------------------------------------------------
1905int __fastcall android::CameraService::Client::setPreviewCallbackFlag(int a1, int a2)
1906{
1907  int v2; // r4@1
1908  int v3; // r5@1
1909  int v4; // r0@2
1910  int v5; // r0@4
1911
1912  v2 = a1;
1913  v3 = a2;
1914  if ( unk_6800D370 > 0 )
1915  {
1916    v4 = sub_68007BB0(a1);
1917    _android_log_print(3, "CameraService", "setPreviewCallbackFlag(%d) (pid %d)", v3, v4);
1918  }
1919  pthread_mutex_lock((pthread_mutex_t *)(v2 + 80));
1920  if ( !android::CameraService::Client::checkPidAndHardware(v2) )
1921  {
1922    v5 = *(_BYTE *)(v2 + 44);
1923    *(_DWORD *)(v2 + 60) = v3;
1924    if ( v5 )
1925    {
1926      if ( v3 & 1 )
1927        android::CameraService::Client::enableMsgType(v2, 16);
1928      else
1929        android::CameraService::Client::disableMsgType(v2, 16);
1930    }
1931  }
1932  return pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
1933}
1934// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
1935
1936//----- (68008B80) --------------------------------------------------------
1937signed int __fastcall android::CameraService::Client::connect(int a1, int a2)
1938{
1939  int v2; // r4@1
1940  int v3; // r6@1
1941  int v4; // r5@1
1942  char v5; // r3@4
1943  int v6; // r1@6
1944  signed int v7; // r7@8
1945  int v8; // r11@9
1946  int v9; // r10@9
1947  int v11; // [sp+8h] [bp-30h]@9
1948  int v12; // [sp+Ch] [bp-2Ch]@9
1949
1950  v2 = a1;
1951  v3 = a2;
1952  v4 = sub_68007BB0(a1);
1953  if ( unk_6800D370 > 0 )
1954    _android_log_print(3, "CameraService", "connect E (pid %d)", v4);
1955  pthread_mutex_lock((pthread_mutex_t *)(v2 + 80));
1956  v5 = v4 != *(_DWORD *)(v2 + 72);
1957  v6 = *(_DWORD *)(v2 + 36);
1958  *(_BYTE *)(v2 + 76) = v5;
1959  if ( !v6 || !android::CameraService::Client::checkPid(v2) )
1960  {
1961    if ( *(_DWORD *)(v2 + 20)
1962      && (android::IInterface::asBinder(&v12, *(_DWORD *)v3),
1963          android::IInterface::asBinder(&v11, *(_DWORD *)(v2 + 20)),
1964          v8 = v12,
1965          v9 = v11,
1966          android::sp<android::IBinder>::_sp((int)&v11),
1967          android::sp<android::IBinder>::_sp((int)&v12),
1968          v8 == v9) )
1969    {
1970      if ( unk_6800D370 > 0 )
1971        _android_log_print(3, "CameraService", "Connect to the same client");
1972    }
1973    else
1974    {
1975      v7 = 0;
1976      *(_DWORD *)(v2 + 36) = v4;
1977      *(_DWORD *)(v2 + 60) = 0;
1978      android::sp<android::ICameraClient>::operator_(v2 + 20, v3);
1979      if ( unk_6800D370 > 0 )
1980      {
1981        _android_log_print(3, "CameraService", "connect X (pid %d)", v4);
1982        goto LABEL_15;
1983      }
1984    }
1985    v7 = 0;
1986    goto LABEL_15;
1987  }
1988  v7 = 16;
1989  _android_log_print(
1990    5,
1991    "CameraService",
1992    "Tried to connect to a locked camera (old pid %d, new pid %d)",
1993    *(_DWORD *)(v2 + 36),
1994    v4);
1995LABEL_15:
1996  pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
1997  return v7;
1998}
1999// 6800723C: using guessed type int __fastcall android__IInterface__asBinder(_DWORD, _DWORD);
2000// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2001
2002//----- (68008CA4) --------------------------------------------------------
2003signed int __fastcall android::CameraService::Client::unlock(int a1)
2004{
2005  int v1; // r4@1
2006  int v2; // r7@1
2007  signed int v3; // r5@3
2008  int v4; // r3@8
2009
2010  v1 = a1;
2011  v2 = sub_68007BB0(a1);
2012  if ( unk_6800D370 > 0 )
2013    _android_log_print(3, "CameraService", "unlock (pid %d)", v2);
2014  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
2015  v3 = android::CameraService::Client::checkPid(v1);
2016  if ( !v3 )
2017  {
2018    *(_DWORD *)(v1 + 36) = 0;
2019    if ( unk_6800D370 > 0 )
2020      _android_log_print(3, "CameraService", "clear mCameraClient (pid %d)", v2);
2021    if ( android::CameraService::isExtension(*(_DWORD *)(v1 + 16)) )
2022      android::sp<android::ICameraClient>::operator_(v1 + 24, v1 + 20);
2023    v4 = *(_DWORD *)(v1 + 20);
2024    if ( v4 )
2025    {
2026      android::RefBase::decStrong(v4 + *(_DWORD *)(*(_DWORD *)v4 - 12), v1 + 20);
2027      *(_DWORD *)(v1 + 20) = 0;
2028    }
2029  }
2030  pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
2031  return v3;
2032}
2033// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
2034// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2035
2036//----- (68008D4C) --------------------------------------------------------
2037signed int __fastcall android::CameraService::Client::lock(int a1)
2038{
2039  int v1; // r4@1
2040  int v2; // r5@1
2041  pthread_mutex_t *v3; // r6@3
2042  signed int v4; // r4@4
2043
2044  v1 = a1;
2045  v2 = sub_68007BB0(a1);
2046  if ( unk_6800D370 > 0 )
2047    _android_log_print(3, "CameraService", "lock (pid %d)", v2);
2048  v3 = (pthread_mutex_t *)(v1 + 80);
2049  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
2050  if ( *(_DWORD *)(v1 + 36) )
2051  {
2052    v4 = android::CameraService::Client::checkPid(v1);
2053  }
2054  else
2055  {
2056    *(_DWORD *)(v1 + 36) = v2;
2057    v4 = 0;
2058  }
2059  pthread_mutex_unlock(v3);
2060  return v4;
2061}
2062// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2063
2064//----- (68008DA4) --------------------------------------------------------
2065int __fastcall android::CameraService::Client::getParameters(int a1, int a2)
2066{
2067  pthread_mutex_t *v2; // r5@1
2068  int v3; // r6@1
2069  int v4; // r4@1
2070  int v5; // r0@3
2071  int v6; // r0@4
2072  char v8; // [sp+Ch] [bp-2Ch]@3
2073  int v9; // [sp+24h] [bp-14h]@3
2074
2075  v2 = (pthread_mutex_t *)(a2 + 80);
2076  v3 = a2;
2077  v4 = a1;
2078  pthread_mutex_lock((pthread_mutex_t *)(a2 + 80));
2079  if ( android::CameraService::Client::checkPidAndHardware(v3) )
2080  {
2081    android::String8::String8(v4);
2082  }
2083  else
2084  {
2085    (*(void (__fastcall **)(char *))(**(_DWORD **)(v3 + 40) + 92))(&v8);
2086    android::CameraParameters::flatten(&v9, &v8);
2087    v5 = android::CameraParameters::_CameraParameters(&v8);
2088    if ( unk_6800D370 > 0 )
2089    {
2090      v6 = sub_68007BB0(v5);
2091      _android_log_print(3, "CameraService", "getParameters (pid %d) (%s)", v6, v9);
2092    }
2093    android::String8::String8(v4, &v9);
2094    android::String8::_String8(&v9);
2095  }
2096  pthread_mutex_unlock(v2);
2097  return v4;
2098}
2099// 6800717C: using guessed type int __fastcall android__String8__String8(_DWORD);
2100// 68007188: using guessed type int __fastcall android__String8___String8(_DWORD);
2101// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2102// 680072FC: using guessed type int __fastcall android__CameraParameters__flatten(_DWORD, _DWORD);
2103// 68007308: using guessed type int __fastcall android__CameraParameters___CameraParameters(_DWORD);
2104// 68007314: using guessed type int __fastcall android__String8__String8(_DWORD, _DWORD);
2105
2106//----- (68008E2C) --------------------------------------------------------
2107int __fastcall sub_68008E2C(int a1, int a2)
2108{
2109  int v2; // r4@1
2110  int v3; // r5@1
2111
2112  v2 = a1;
2113  v3 = a2;
2114  ((void (*)(void))android::String8::String8)();
2115  android::String8::String8(v2 + 4, v3 + 4);
2116  return v2;
2117}
2118// 68007314: using guessed type int __fastcall android__String8__String8(_DWORD, _DWORD);
2119
2120//----- (68008E44) --------------------------------------------------------
2121int __fastcall android::move_backward_type<android::key_value_pair_t<android::String8_android::String8>>(int a1, int a2, int a3)
2122{
2123  int v3; // r5@1
2124  int v4; // r4@1
2125  int v5; // r7@1
2126  int v6; // r6@1
2127  int v7; // r8@3
2128  int result; // r0@3
2129
2130  v3 = a1;
2131  v4 = a2;
2132  v5 = a3;
2133  v6 = 0;
2134  while ( 1 )
2135  {
2136    v7 = v4 + v6;
2137    result = v3 + v6;
2138    v6 += 8;
2139    if ( !v5 )
2140      break;
2141    --v5;
2142    sub_68008E2C(result, v7);
2143    sub_68007B84(v7);
2144  }
2145  return result;
2146}
2147
2148//----- (68008E70) --------------------------------------------------------
2149int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_move_backward(int a1, int a2, int a3, int a4)
2150{
2151  return android::move_backward_type<android::key_value_pair_t<android::String8_android::String8>>(a2, a3, a4);
2152}
2153
2154//----- (68008E80) --------------------------------------------------------
2155int __fastcall android::move_forward_type<android::key_value_pair_t<android::String8_android::String8>>(int result, int a2, int a3)
2156{
2157  int v3; // r8@1
2158  int v4; // r5@1
2159  int v5; // r7@1
2160  int i; // r4@1
2161
2162  v3 = result + 8 * a3;
2163  v4 = a3;
2164  v5 = a2 + 8 * a3;
2165  for ( i = 0; ; result = sub_68007B84(v5 + i) )
2166  {
2167    i -= 8;
2168    if ( !v4 )
2169      break;
2170    --v4;
2171    sub_68008E2C(v3 + i, v5 + i);
2172  }
2173  return result;
2174}
2175
2176//----- (68008EB0) --------------------------------------------------------
2177int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_move_forward(int a1, int a2, int a3, int a4)
2178{
2179  return android::move_forward_type<android::key_value_pair_t<android::String8_android::String8>>(a2, a3, a4);
2180}
2181
2182//----- (68008EC0) --------------------------------------------------------
2183int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_splat(int a1, int a2, int a3, int a4)
2184{
2185  int v4; // r4@1
2186  int v5; // r6@1
2187  int v6; // r5@1
2188  int result; // r0@2
2189
2190  v4 = a3;
2191  v5 = a4;
2192  v6 = a2;
2193  while ( v5 )
2194  {
2195    result = sub_68008E2C(v6, v4);
2196    v6 += 8;
2197    --v5;
2198  }
2199  return result;
2200}
2201
2202//----- (68008EDC) --------------------------------------------------------
2203int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_copy(int a1, int a2, int a3, int a4)
2204{
2205  int v4; // r4@1
2206  int v5; // r5@1
2207  int v6; // r7@1
2208  int v7; // r6@1
2209  int v8; // r1@3
2210  int result; // r0@3
2211
2212  v4 = a2;
2213  v5 = a3;
2214  v6 = a4;
2215  v7 = 0;
2216  while ( 1 )
2217  {
2218    v8 = v5 + v7;
2219    result = v4 + v7;
2220    v7 += 8;
2221    if ( !v6 )
2222      break;
2223    sub_68008E2C(result, v8);
2224    --v6;
2225  }
2226  return result;
2227}
2228
2229//----- (68008F00) --------------------------------------------------------
2230int __fastcall sub_68008F00(int a1, int a2, int a3)
2231{
2232  int v3; // r4@1
2233  int v4; // r7@1
2234  int v6; // [sp+4h] [bp-1Ch]@1
2235  int v7; // [sp+8h] [bp-18h]@1
2236
2237  v6 = a2;
2238  v7 = a3;
2239  v3 = a1;
2240  v4 = a2;
2241  android::String8::String8(&v6);
2242  android::SortedVectorImpl::SortedVectorImpl(v3, 8, 0);
2243  *(_DWORD *)v3 = &_vtable_for_android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>[8];
2244  android::String8::String8(v3 + 20, &v6);
2245  android::String8::_String8(&v6);
2246  android::CameraParameters::unflatten(v3, v4);
2247  return v3;
2248}
2249// 6800717C: using guessed type int __fastcall android__String8__String8(_DWORD);
2250// 68007188: using guessed type int __fastcall android__String8___String8(_DWORD);
2251// 68007314: using guessed type int __fastcall android__String8__String8(_DWORD, _DWORD);
2252// 68007320: using guessed type int __fastcall android__SortedVectorImpl__SortedVectorImpl(_DWORD, _DWORD, _DWORD);
2253// 6800732C: using guessed type int __fastcall android__CameraParameters__unflatten(_DWORD, _DWORD);
2254
2255//----- (68008F4C) --------------------------------------------------------
2256signed int __fastcall android::CameraService::Client::setParameters(int a1, int a2)
2257{
2258  int v2; // r4@1
2259  int v3; // r5@1
2260  int v4; // r0@2
2261  int v5; // r2@3
2262  signed int v6; // r8@3
2263  char v8; // [sp+8h] [bp-30h]@4
2264
2265  v2 = a1;
2266  v3 = a2;
2267  if ( unk_6800D370 > 0 )
2268  {
2269    v4 = sub_68007BB0(a1);
2270    _android_log_print(3, "CameraService", "setParameters (pid %d) (%s)", v4, *(_DWORD *)v3);
2271  }
2272  pthread_mutex_lock((pthread_mutex_t *)(v2 + 80));
2273  v6 = android::CameraService::Client::checkPidAndHardware(v2);
2274  if ( !v6 )
2275  {
2276    sub_68008F00((int)&v8, v3, v5);
2277    v6 = (*(int (**)(void))(**(_DWORD **)(v2 + 40) + 88))();
2278    android::CameraParameters::_CameraParameters(&v8);
2279  }
2280  pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
2281  return v6;
2282}
2283// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2284// 68007308: using guessed type int __fastcall android__CameraParameters___CameraParameters(_DWORD);
2285
2286//----- (68008FC4) --------------------------------------------------------
2287unsigned int __fastcall android::compare_type<android::key_value_pair_t<android::String8_android::String8>>(const char **a1, const char **a2)
2288{
2289  const char *v2; // r4@1
2290  const char *v3; // r5@1
2291  int v4; // r6@1
2292
2293  v2 = *a2;
2294  v3 = *a1;
2295  v4 = strcmp(*a2, *a1);
2296  return ((unsigned int)v4 >> 31) - ((unsigned int)strcmp(v3, v2) >> 31);
2297}
2298
2299//----- (68008FE4) --------------------------------------------------------
2300unsigned int __fastcall android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>::do_compare(int a1, const char **a2, const char **a3)
2301{
2302  return android::compare_type<android::key_value_pair_t<android::String8_android::String8>>(a2, a3);
2303}
2304
2305//----- (68008FF0) --------------------------------------------------------
2306int __fastcall sub_68008FF0(int a1)
2307{
2308  int v1; // r4@1
2309
2310  v1 = a1;
2311  *(_DWORD *)a1 = &_vtable_for_android::SortedVector<android::key_value_pair_t<android::String8_android::String8>>[8];
2312  android::VectorImpl::finish_vector();
2313  android::SortedVectorImpl::_SortedVectorImpl(v1);
2314  return v1;
2315}
2316// 68007344: using guessed type int android__VectorImpl__finish_vector(void);
2317// 68007350: using guessed type int __fastcall android__SortedVectorImpl___SortedVectorImpl(_DWORD);
2318
2319//----- (68009030) --------------------------------------------------------
2320int __fastcall android::CameraService::Client::registerPreviewBuffers(int a1)
2321{
2322  int v1; // r4@1
2323  int v2; // r8@1
2324  int v3; // r7@1
2325  int v4; // r2@1
2326  int v5; // r4@1
2327  char v7; // [sp+1Ch] [bp-64h]@1
2328  char v8; // [sp+3Ch] [bp-44h]@1
2329  char v9; // [sp+54h] [bp-2Ch]@1
2330  int v10; // [sp+58h] [bp-28h]@1
2331  int v11; // [sp+5Ch] [bp-24h]@1
2332
2333  v1 = a1;
2334  (*(void (__fastcall **)(char *))(**(_DWORD **)(a1 + 40) + 92))(&v8);
2335  android::CameraParameters::getPreviewSize(&v8, &v11, &v10);
2336  v2 = v11;
2337  v3 = v10;
2338  (*(void (__fastcall **)(char *))(**(_DWORD **)(v1 + 40) + 8))(&v9);
2339  android::ISurface::BufferHeap::BufferHeap(&v7, v2, v3, v2);
2340  android::sp<android::IMemoryHeap>::_sp((int)&v9);
2341  v5 = (*(int (__cdecl **)(_DWORD, char *, int, _DWORD, int))(**(_DWORD **)(v1 + 84) + 24))(
2342         *(_DWORD *)(v1 + 84),
2343         &v7,
2344         v4,
2345         *(_DWORD *)(**(_DWORD **)(v1 + 84) + 24),
2346         v3);
2347  if ( v5 )
2348    _android_log_print(6, "CameraService", "registerBuffers failed with status %d", v5);
2349  android::ISurface::BufferHeap::_BufferHeap(&v7);
2350  android::CameraParameters::_CameraParameters(&v8);
2351  return v5;
2352}
2353// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2354// 68007308: using guessed type int __fastcall android__CameraParameters___CameraParameters(_DWORD);
2355// 6800735C: using guessed type int __fastcall android__CameraParameters__getPreviewSize(_DWORD, _DWORD, _DWORD);
2356// 68007368: using guessed type int __fastcall android__ISurface__BufferHeap__BufferHeap(_DWORD, _DWORD, _DWORD, _DWORD);
2357// 68007374: using guessed type int __fastcall android__ISurface__BufferHeap___BufferHeap(_DWORD);
2358
2359//----- (680090C4) --------------------------------------------------------
2360int __fastcall sub_680090C4(int a1)
2361{
2362  int v1; // r4@1
2363  int result; // r0@1
2364
2365  v1 = a1;
2366  result = android_atomic_dec();
2367  if ( result == 1 )
2368  {
2369    result = v1 - 4;
2370    if ( v1 != 4 )
2371      result = (*(int (__fastcall **)(int))(*(_DWORD *)(v1 - 4) + 4))(result);
2372  }
2373  return result;
2374}
2375// 68007380: using guessed type int android_atomic_dec(void);
2376
2377//----- (680090E0) --------------------------------------------------------
2378int __fastcall android::sp<android::OverlayRef>::operator_(int a1, int a2)
2379{
2380  int v2; // r5@1
2381  int v3; // r4@1
2382
2383  v2 = *(_DWORD *)a2;
2384  v3 = a1;
2385  if ( *(_DWORD *)a2 )
2386    android_atomic_inc(v2 + 4);
2387  if ( *(_DWORD *)v3 )
2388    sub_680090C4(*(_DWORD *)v3 + 4);
2389  *(_DWORD *)v3 = v2;
2390  return v3;
2391}
2392// 6800738C: using guessed type int __fastcall android_atomic_inc(_DWORD);
2393
2394//----- (68009100) --------------------------------------------------------
2395int __fastcall sub_68009100(int a1, int a2)
2396{
2397  int v2; // r4@1
2398  int v3; // r5@1
2399  int v4; // r1@1
2400  int result; // r0@1
2401
2402  v2 = a1;
2403  v3 = a2;
2404  android::ICamera::ICamera();
2405  android::BBinder::BBinder(v2 + 4, v3 + 20);
2406  v4 = *(_DWORD *)v3;
2407  *(_DWORD *)v2 = *(_DWORD *)v3;
2408  *(_DWORD *)(v2 + *(_DWORD *)(v4 - 12)) = *(_DWORD *)(v3 + 36);
2409  result = v2;
2410  *(_DWORD *)(v2 + 4) = *(_DWORD *)(v3 + 40);
2411  return result;
2412}
2413// 68007398: using guessed type int android__ICamera__ICamera(void);
2414// 680073A4: using guessed type int __fastcall android__BBinder__BBinder(_DWORD, _DWORD);
2415
2416//----- (6800912C) --------------------------------------------------------
2417int __fastcall android::CameraService::releaseSound(int a1)
2418{
2419  pthread_mutex_t *v1; // r5@1
2420  int v2; // r4@1
2421  int v3; // r1@3
2422
2423  v1 = (pthread_mutex_t *)(a1 + 64);
2424  v2 = a1;
2425  pthread_mutex_lock((pthread_mutex_t *)(a1 + 64));
2426  if ( unk_6800D370 > 0 )
2427    _android_log_print(3, "CameraService", "CameraService::releaseSound ref=%d", *(_DWORD *)(v2 + 84));
2428  v3 = *(_DWORD *)(v2 + 84);
2429  *(_DWORD *)(v2 + 84) = v3 - 1;
2430  if ( v3 == 1 )
2431  {
2432    if ( *(_DWORD *)(v2 + 68) )
2433    {
2434      android::MediaPlayer::disconnect();
2435      android::sp<android::MediaPlayer>::clear(v2 + 68);
2436    }
2437    if ( *(_DWORD *)(v2 + 72) )
2438    {
2439      android::MediaPlayer::disconnect();
2440      android::sp<android::MediaPlayer>::clear(v2 + 72);
2441    }
2442    if ( *(_DWORD *)(v2 + 76) )
2443    {
2444      android::MediaPlayer::disconnect();
2445      android::sp<android::MediaPlayer>::clear(v2 + 76);
2446    }
2447    if ( *(_DWORD *)(v2 + 80) )
2448    {
2449      android::MediaPlayer::disconnect();
2450      android::sp<android::MediaPlayer>::clear(v2 + 80);
2451    }
2452  }
2453  return pthread_mutex_unlock(v1);
2454}
2455// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2456// 680073B0: using guessed type int android__MediaPlayer__disconnect(void);
2457
2458//----- (680091B0) --------------------------------------------------------
2459int __fastcall sub_680091B0(int a1)
2460{
2461  int v1; // r5@1
2462  int v2; // r4@1
2463
2464  v1 = a1;
2465  v2 = operator new(112);
2466  android::MediaPlayer::MediaPlayer();
2467  if ( android::MediaPlayer::setDataSource(v2, v1, 0) )
2468  {
2469    v2 = 0;
2470    _android_log_print(6, "CameraService", "Failed to load CameraService sounds: %s", v1);
2471  }
2472  else
2473  {
2474    android::MediaPlayer::setAudioStreamType(v2, 7);
2475    android::MediaPlayer::prepare(v2);
2476  }
2477  return v2;
2478}
2479// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2480// 6800729C: using guessed type int __fastcall operator new(_DWORD);
2481// 680073BC: using guessed type int android__MediaPlayer__MediaPlayer(void);
2482// 680073C8: using guessed type int __fastcall android__MediaPlayer__setDataSource(_DWORD, _DWORD, _DWORD);
2483// 680073D4: using guessed type int __fastcall android__MediaPlayer__setAudioStreamType(_DWORD, _DWORD);
2484// 680073E0: using guessed type int __fastcall android__MediaPlayer__prepare(_DWORD);
2485
2486//----- (680091FC) --------------------------------------------------------
2487signed int __fastcall android::CameraService::setShutterSound(int a1, int a2, int a3)
2488{
2489  int v3; // r3@1
2490  int v4; // r4@1
2491  int v5; // r5@1
2492  int v6; // r1@2
2493  const char *v7; // r2@2
2494  int v8; // r0@8
2495  int v9; // r0@12
2496
2497  v3 = a3;
2498  v4 = a1;
2499  v5 = a2;
2500  if ( !a2 )
2501  {
2502    v6 = (int)"CameraService";
2503    v7 = "setShutterSound shutter_val.file_name is NULL, returning";
2504LABEL_14:
2505    _android_log_print(6, v6, v7, v3);
2506    return -2147483648;
2507  }
2508  if ( a3 )
2509  {
2510    if ( a3 != 1 )
2511    {
2512      _android_log_print(6, "CameraService", "setShutterSound Failed kind:%d", a3);
2513      return -2147483648;
2514    }
2515    if ( *(_DWORD *)(a1 + 80) )
2516    {
2517      android::MediaPlayer::disconnect();
2518      android::sp<android::MediaPlayer>::clear(v4 + 80);
2519    }
2520    v9 = sub_680091B0(v5);
2521    android::sp<android::MediaPlayer>::operator_(v4 + 80, v9);
2522    if ( !*(_DWORD *)(v4 + 80) )
2523    {
2524      v6 = (int)"CameraService";
2525      v7 = "setShutterSound Shutter sound file is not exist";
2526      goto LABEL_14;
2527    }
2528  }
2529  else
2530  {
2531    if ( *(_DWORD *)(a1 + 76) )
2532    {
2533      android::MediaPlayer::disconnect();
2534      android::sp<android::MediaPlayer>::clear(v4 + 76);
2535    }
2536    v8 = sub_680091B0(v5);
2537    android::sp<android::MediaPlayer>::operator_(v4 + 76, v8);
2538    v3 = *(_DWORD *)(v4 + 76);
2539    if ( !v3 )
2540    {
2541      v6 = (int)"CameraService";
2542      v7 = "setShutterSound Shutter sound file is not exist";
2543      goto LABEL_14;
2544    }
2545  }
2546  return 0;
2547}
2548// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2549// 680073B0: using guessed type int android__MediaPlayer__disconnect(void);
2550
2551//----- (680092B4) --------------------------------------------------------
2552signed int __fastcall android::CameraService::Client::setShutterSound(int a1, int a2, int a3)
2553{
2554  return android::CameraService::setShutterSound(*(_DWORD *)(a1 + 16), a2, a3);
2555}
2556
2557//----- (680092C0) --------------------------------------------------------
2558int __fastcall android::CameraService::loadSound(int a1)
2559{
2560  pthread_mutex_t *v1; // r5@1
2561  int v2; // r4@1
2562  int v3; // r0@3
2563  int v4; // r0@4
2564  int v5; // r0@4
2565
2566  v1 = (pthread_mutex_t *)(a1 + 64);
2567  v2 = a1;
2568  pthread_mutex_lock((pthread_mutex_t *)(a1 + 64));
2569  if ( unk_6800D370 > 0 )
2570    _android_log_print(3, "CameraService", "CameraService::loadSound ref=%d", *(_DWORD *)(v2 + 84));
2571  v3 = *(_DWORD *)(v2 + 84);
2572  *(_DWORD *)(v2 + 84) = v3 + 1;
2573  if ( !v3 )
2574  {
2575    v4 = sub_680091B0((int)"/system/media/audio/ui/camera_click.ogg");
2576    android::sp<android::MediaPlayer>::operator_(v2 + 68, v4);
2577    v5 = sub_680091B0((int)"/system/media/audio/ui/VideoRecord.ogg");
2578    android::sp<android::MediaPlayer>::operator_(v2 + 72, v5);
2579  }
2580  return pthread_mutex_unlock(v1);
2581}
2582// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2583
2584//----- (68009330) --------------------------------------------------------
2585int __fastcall android::CameraService::playSound(int a1, int a2)
2586{
2587  int v2; // r4@1
2588  int v3; // r5@1
2589  int v4; // r1@4
2590  int v5; // r1@5
2591  int v7; // [sp+0h] [bp-18h]@1
2592  int v8; // [sp+4h] [bp-14h]@1
2593
2594  v7 = a1;
2595  v8 = a2;
2596  v2 = a1;
2597  v3 = a2;
2598  if ( unk_6800D370 > 0 )
2599    _android_log_print(3, "CameraService", "playSound(%d)", a2, v7, v8);
2600  pthread_mutex_lock((pthread_mutex_t *)(v2 + 64));
2601  v8 = 0;
2602  if ( *(_BYTE *)(v2 + 88) && (v4 = v2 + 4 * (v3 + 18), *(_DWORD *)(v4 + 4)) )
2603    v5 = v4 + 4;
2604  else
2605    v5 = v2 + 4 * v3 + 68;
2606  android::sp<android::MediaPlayer>::operator_((int)&v8, v5);
2607  if ( v8 )
2608  {
2609    android::AudioSystem::getStreamVolumeIndex(7, &v7);
2610    if ( v7 )
2611    {
2612      android::MediaPlayer::seekTo(v8, 0);
2613      android::MediaPlayer::start(v8);
2614    }
2615  }
2616  android::sp<android::MediaPlayer>::_sp((int)&v8);
2617  return pthread_mutex_unlock((pthread_mutex_t *)(v2 + 64));
2618}
2619// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2620// 680073EC: using guessed type int __fastcall android__AudioSystem__getStreamVolumeIndex(_DWORD, _DWORD);
2621// 680073F8: using guessed type int __fastcall android__MediaPlayer__seekTo(_DWORD, _DWORD);
2622// 68007404: using guessed type int __fastcall android__MediaPlayer__start(_DWORD);
2623
2624//----- (680093BC) --------------------------------------------------------
2625int __fastcall android::CameraService::Client::handleShutter(int a1, int a2)
2626{
2627  int v2; // r4@1
2628  int v3; // r5@1
2629  int v4; // r0@1
2630  int v5; // r6@10
2631  int v6; // r8@12
2632  int v7; // r7@12
2633  int v8; // r3@12
2634  int v9; // r0@12
2635  int v10; // r0@12
2636  int v11; // r0@13
2637  char v13; // [sp+18h] [bp-68h]@12
2638  char v14; // [sp+38h] [bp-48h]@8
2639  char v15; // [sp+50h] [bp-30h]@12
2640  int v16; // [sp+54h] [bp-2Ch]@9
2641  int v17; // [sp+58h] [bp-28h]@9
2642  int v18; // [sp+5Ch] [bp-24h]@4
2643
2644  v2 = a1;
2645  v3 = a2;
2646  android::CameraService::playSound(*(_DWORD *)(a1 + 16), 0);
2647  v4 = *(_DWORD *)(v2 + 84);
2648  if ( v4 && !*(_BYTE *)(v2 + 44) )
2649    (*(void (**)(void))(*(_DWORD *)v4 + 32))();
2650  android::sp<android::ICameraClient>::sp((int)&v18, v2 + 20);
2651  if ( v18
2652    && (pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80)),
2653        (*(void (**)(void))(*(_DWORD *)v18 + 16))(),
2654        !android::CameraService::Client::lockIfMessageWanted(v2, 2)) )
2655  {
2656    v11 = (int)&v18;
2657  }
2658  else
2659  {
2660    android::CameraService::Client::disableMsgType(v2, 2);
2661    if ( *(_DWORD *)(v2 + 84) && !*(_BYTE *)(v2 + 44) )
2662    {
2663      (*(void (__fastcall **)(char *))(**(_DWORD **)(v2 + 40) + 92))(&v14);
2664      if ( v3 )
2665      {
2666        v5 = *(_DWORD *)(v3 + 4);
2667        v17 = *(_DWORD *)v3 & 0xFFFFFFFE;
2668        v16 = v5 & 0xFFFFFFFE;
2669        if ( unk_6800D370 > 0 )
2670          _android_log_print(3, "CameraService", "Snapshot image width=%d, height=%d");
2671      }
2672      else
2673      {
2674        android::CameraParameters::getPictureSize(&v14, &v17, &v16);
2675      }
2676      v6 = v17;
2677      v7 = v16;
2678      (*(void (__fastcall **)(char *))(**(_DWORD **)(v2 + 40) + 12))(&v15);
2679      android::ISurface::BufferHeap::BufferHeap(&v13, v6, v7, v6);
2680      android::sp<android::IMemoryHeap>::_sp((int)&v15);
2681      v9 = (*(int (__cdecl **)(_DWORD, char *, _DWORD, int, int))(**(_DWORD **)(v2 + 84) + 24))(
2682             *(_DWORD *)(v2 + 84),
2683             &v13,
2684             *(_DWORD *)(**(_DWORD **)(v2 + 84) + 24),
2685             v8,
2686             v7);
2687      v10 = android::IPCThreadState::self(v9);
2688      android::IPCThreadState::flushCommands(v10);
2689      android::ISurface::BufferHeap::_BufferHeap(&v13);
2690      android::CameraParameters::_CameraParameters(&v14);
2691    }
2692    pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
2693    v11 = (int)&v18;
2694  }
2695  return android::sp<android::ICameraClient>::_sp(v11);
2696}
2697// 68007194: using guessed type int __fastcall android__IPCThreadState__self(_DWORD);
2698// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2699// 680072CC: using guessed type int __fastcall android__IPCThreadState__flushCommands(_DWORD);
2700// 68007308: using guessed type int __fastcall android__CameraParameters___CameraParameters(_DWORD);
2701// 68007368: using guessed type int __fastcall android__ISurface__BufferHeap__BufferHeap(_DWORD, _DWORD, _DWORD, _DWORD);
2702// 68007374: using guessed type int __fastcall android__ISurface__BufferHeap___BufferHeap(_DWORD);
2703// 68007410: using guessed type int __fastcall android__CameraParameters__getPictureSize(_DWORD, _DWORD, _DWORD);
2704
2705//----- (680094E8) --------------------------------------------------------
2706int __fastcall android::CameraService::Client::stopRecording(int a1)
2707{
2708  int v1; // r4@1
2709  int v2; // r0@2
2710  int v3; // r3@4
2711
2712  v1 = a1;
2713  if ( unk_6800D370 > 0 )
2714  {
2715    v2 = sub_68007BB0(a1);
2716    _android_log_print(3, "CameraService", "stopRecording (pid %d)", v2);
2717  }
2718  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
2719  if ( !android::CameraService::Client::checkPidAndHardware(v1) )
2720  {
2721    android::CameraService::playSound(*(_DWORD *)(v1 + 16), 1);
2722    android::CameraService::Client::disableMsgType(v1, 32);
2723    (*(void (**)(void))(**(_DWORD **)(v1 + 40) + 60))();
2724    v3 = *(_DWORD *)(v1 + 88);
2725    if ( v3 )
2726    {
2727      android::RefBase::decStrong(v3 + *(_DWORD *)(*(_DWORD *)v3 - 16), v1 + 88);
2728      *(_DWORD *)(v1 + 88) = 0;
2729    }
2730  }
2731  return pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
2732}
2733// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
2734// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2735
2736//----- (68009560) --------------------------------------------------------
2737int __fastcall _non_virtual_thunk_to_android::CameraService::onTransact(int a1, int a2, int a3, int a4)
2738{
2739  return android::CameraService::onTransact(a1 - 4, a2, a3, a4);
2740}
2741
2742//----- (68009568) --------------------------------------------------------
2743int __fastcall android::CameraService::onTransact(int a1, int a2, int a3, int a4)
2744{
2745  int v4; // r7@1
2746  int v5; // r5@1
2747  int v6; // r4@1
2748  int v7; // r8@1
2749  int v8; // r6@2
2750  int v9; // r10@3
2751  int v10; // r0@3
2752  int v11; // r0@4
2753  int result; // r0@4
2754  int v13; // [sp+4h] [bp-2Ch]@1
2755  int v14; // [sp+8h] [bp-28h]@1
2756  int v15; // [sp+Ch] [bp-24h]@1
2757
2758  v13 = a2;
2759  v14 = a3;
2760  v15 = a4;
2761  v4 = a4;
2762  v5 = a1;
2763  v6 = a2;
2764  v7 = a3;
2765  if ( (unsigned int)(a2 - 3) > 1
2766    || (v8 = sub_68007BB0(a1), v8 == getpid())
2767    || (android::String16::String16(&v15, "android.permission.CAMERA"),
2768        v9 = android::checkCallingPermission(&v15),
2769        v10 = android::String16::_String16(&v15),
2770        v9) )
2771  {
2772    result = android::BnCameraService::onTransact(v5, v6, v7, v4);
2773  }
2774  else
2775  {
2776    v11 = sub_68007BBC(v10);
2777    _android_log_print(
2778      6,
2779      "CameraService",
2780      "Permission Denial: can't use the camera pid=%d, uid=%d",
2781      v8,
2782      v11,
2783      v13,
2784      v14,
2785      v15);
2786    result = -1;
2787  }
2788  return result;
2789}
2790// 680071DC: using guessed type int __fastcall android__String16__String16(_DWORD, _DWORD);
2791// 680071E8: using guessed type int __fastcall android__checkCallingPermission(_DWORD);
2792// 680071F4: using guessed type int __fastcall android__String16___String16(_DWORD);
2793// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2794// 68007428: using guessed type int __fastcall android__BnCameraService__onTransact(_DWORD, _DWORD, _DWORD, _DWORD);
2795
2796//----- (680095E8) --------------------------------------------------------
2797int __fastcall android::CameraService::removeClient(int a1, int a2)
2798{
2799  int v2; // r5@1
2800  int v3; // r4@3
2801  pthread_mutex_t *v4; // r6@3
2802  int v5; // r8@3
2803  int v6; // r7@5
2804  int v7; // r5@11
2805  int result; // r0@16
2806  int v9; // [sp+0h] [bp-50h]@0
2807  int v10; // [sp+4h] [bp-4Ch]@0
2808  int v11; // [sp+8h] [bp-48h]@1
2809  int v12; // [sp+14h] [bp-3Ch]@1
2810  int v13; // [sp+18h] [bp-38h]@8
2811  int v14; // [sp+1Ch] [bp-34h]@8
2812  char v15; // [sp+20h] [bp-30h]@5
2813  int v16; // [sp+24h] [bp-2Ch]@4
2814
2815  v2 = a1;
2816  v12 = a2;
2817  v11 = sub_68007BB0(a1);
2818  if ( unk_6800D370 > 0 )
2819    _android_log_print(3, "CameraService", "CameraService::removeClient E (pid %d)", v11);
2820  v3 = 0;
2821  v4 = (pthread_mutex_t *)(v2 + 16);
2822  v5 = v2;
2823  while ( v3 < *(_DWORD *)(v2 + 52) )
2824  {
2825    v16 = 0;
2826    pthread_mutex_lock((pthread_mutex_t *)(v2 + 16));
2827    if ( *(_DWORD *)(v5 + 20) )
2828    {
2829      v6 = v2 + 8 * v3 + 20;
2830      android::wp<android::CameraService::Client>::promote((int)&v15, v2 + 8 * v3 + 20);
2831      android::sp<android::CameraService::Client>::operator_((int)&v16, (int)&v15);
2832      android::sp<android::CameraService::Client>::_sp((int)&v15);
2833      if ( v16 )
2834      {
2835        android::IInterface::asBinder(&v14, *(_DWORD *)v12);
2836        android::IInterface::asBinder(&v13, *(_DWORD *)(v16 + 20));
2837        v10 = v14;
2838        v9 = v13;
2839        android::sp<android::IBinder>::_sp((int)&v13);
2840        android::sp<android::IBinder>::_sp((int)&v14);
2841        if ( v10 == v9 )
2842        {
2843          if ( unk_6800D370 > 0 )
2844            _android_log_print(3, "CameraService", "removeClient: clear camera %d", v3, v9, v10);
2845          v7 = v2 + 8 * (v3 + 2);
2846          if ( *(_DWORD *)(v7 + 4) )
2847          {
2848            android::RefBase::weakref_type::decWeak(*(_DWORD *)(v7 + 8), v6);
2849            *(_DWORD *)(v7 + 4) = 0;
2850          }
2851          pthread_mutex_unlock(v4);
2852          android::sp<android::CameraService::Client>::_sp((int)&v16);
2853          break;
2854        }
2855      }
2856      else
2857      {
2858        if ( *(_DWORD *)(v5 + 20) )
2859        {
2860          android::RefBase::weakref_type::decWeak(*(_DWORD *)(v5 + 24), v6);
2861          *(_DWORD *)(v5 + 20) = 0;
2862        }
2863      }
2864    }
2865    ++v3;
2866    pthread_mutex_unlock((pthread_mutex_t *)(v2 + 16));
2867    android::sp<android::CameraService::Client>::_sp((int)&v16);
2868    v5 += 8;
2869  }
2870  result = unk_6800D370;
2871  if ( unk_6800D370 > 0 )
2872    result = _android_log_print(3, "CameraService", "CameraService::removeClient X (pid %d)", v11, v9, v10);
2873  return result;
2874}
2875// 6800723C: using guessed type int __fastcall android__IInterface__asBinder(_DWORD, _DWORD);
2876// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2877// 68007434: using guessed type int __fastcall android__RefBase__weakref_type__decWeak(_DWORD, _DWORD);
2878
2879//----- (68009744) --------------------------------------------------------
2880int __fastcall _non_virtual_thunk_to_android::CameraService::_CameraService(int a1)
2881{
2882  return android::CameraService::_CameraService(a1 - 4);
2883}
2884// 6800974C: using guessed type int __fastcall android__CameraService___CameraService(_DWORD);
2885
2886//----- (6800974C) --------------------------------------------------------
2887int __fastcall android::CameraService::_CameraService(int a1)
2888{
2889  int v1; // r4@1
2890  int v2; // r6@1
2891  int v3; // r9@1
2892  int v4; // r6@6
2893  int v5; // t1@8
2894  int v6; // r6@10
2895  int v7; // t1@12
2896  int v8; // r2@14
2897  int v9; // r1@14
2898  int v10; // r3@14
2899  int v11; // r2@14
2900
2901  v1 = a1;
2902  v2 = 0;
2903  *(_DWORD *)a1 = &_vtable_for_android::CameraService[12];
2904  v3 = a1 + 92;
2905  *(_DWORD *)(a1 + 92) = &_vtable_for_android::CameraService[172];
2906  *(_DWORD *)(a1 + 4) = &_vtable_for_android::CameraService[76];
2907  while ( v2 < *(_DWORD *)(v1 + 52) )
2908  {
2909    if ( *(_DWORD *)(v1 + 4 * (v2 + 14)) )
2910      _android_log_print(6, "CameraService", "camera %d is still in use in destructor!", v2);
2911    ++v2;
2912  }
2913  dword_6800D374[0] = 0;
2914  android::sp<android::MediaPlayer>::_sp(v1 + 80);
2915  android::sp<android::MediaPlayer>::_sp(v1 + 76);
2916  android::sp<android::MediaPlayer>::_sp(v1 + 72);
2917  android::sp<android::MediaPlayer>::_sp(v1 + 68);
2918  pthread_mutex_destroy((pthread_mutex_t *)(v1 + 64));
2919  v4 = v1 + 52;
2920  while ( v4 != v1 + 36 )
2921  {
2922    v5 = *(_DWORD *)(v4 - 8);
2923    v4 -= 8;
2924    if ( v5 )
2925      android::RefBase::weakref_type::decWeak(*(_DWORD *)(v4 + 4), v4);
2926  }
2927  v6 = v1 + 36;
2928  while ( v6 != v1 + 20 )
2929  {
2930    v7 = *(_DWORD *)(v6 - 8);
2931    v6 -= 8;
2932    if ( v7 )
2933      android::RefBase::weakref_type::decWeak(*(_DWORD *)(v6 + 4), v6);
2934  }
2935  pthread_mutex_destroy((pthread_mutex_t *)(v1 + 16));
2936  v8 = *(_DWORD *)&_VTT_for_android::CameraService[4];
2937  v9 = *(_DWORD *)&_VTT_for_android::CameraService[52];
2938  *(_DWORD *)v1 = *(_DWORD *)&_VTT_for_android::CameraService[4];
2939  v10 = *(_DWORD *)(v8 - 12);
2940  v11 = *(_DWORD *)&_VTT_for_android::CameraService[56];
2941  *(_DWORD *)(v1 + v10) = v9;
2942  *(_DWORD *)(v1 + 4) = v11;
2943  sub_68007AA8(v1, (int)&_VTT_for_android::CameraService[8]);
2944  android::RefBase::_RefBase(v3);
2945  return v1;
2946}
2947// 68007140: using guessed type int __fastcall android__RefBase___RefBase(_DWORD);
2948// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
2949// 68007434: using guessed type int __fastcall android__RefBase__weakref_type__decWeak(_DWORD, _DWORD);
2950// 6800974C: using guessed type int __fastcall android__CameraService___CameraService(_DWORD);
2951
2952//----- (68009860) --------------------------------------------------------
2953void *__fastcall _non_virtual_thunk_to_android::CameraService::_CameraService(int a1)
2954{
2955  return android::CameraService::_CameraService((void *)(a1 - 4));
2956}
2957
2958//----- (68009868) --------------------------------------------------------
2959void *__fastcall android::CameraService::_CameraService(void *a1)
2960{
2961  void *v1; // r4@1
2962
2963  v1 = a1;
2964  android::CameraService::_CameraService(a1);
2965  operator delete(v1);
2966  return v1;
2967}
2968// 6800974C: using guessed type int __fastcall android__CameraService___CameraService(_DWORD);
2969
2970//----- (6800987C) --------------------------------------------------------
2971int __fastcall android::CameraService::_CameraService(int a1, int a2)
2972{
2973  int v2; // r5@1
2974  int v3; // r1@1
2975  int v4; // r4@1
2976  int v5; // r6@1
2977  int v6; // r6@6
2978  int v7; // t1@8
2979  int v8; // r6@10
2980  int v9; // t1@12
2981  int v10; // r2@14
2982
2983  v2 = a2;
2984  v3 = *(_DWORD *)a2;
2985  v4 = a1;
2986  v5 = 0;
2987  *(_DWORD *)a1 = v3;
2988  *(_DWORD *)(a1 + *(_DWORD *)(v3 - 12)) = *(_DWORD *)(v2 + 60);
2989  *(_DWORD *)(a1 + 4) = *(_DWORD *)(v2 + 64);
2990  while ( v5 < *(_DWORD *)(v4 + 52) )
2991  {
2992    if ( *(_DWORD *)(v4 + 4 * (v5 + 14)) )
2993      _android_log_print(6, "CameraService", "camera %d is still in use in destructor!", v5);
2994    ++v5;
2995  }
2996  unk_6800D374 = 0;
2997  android::sp<android::MediaPlayer>::_sp(v4 + 80);
2998  android::sp<android::MediaPlayer>::_sp(v4 + 76);
2999  android::sp<android::MediaPlayer>::_sp(v4 + 72);
3000  android::sp<android::MediaPlayer>::_sp(v4 + 68);
3001  pthread_mutex_destroy((pthread_mutex_t *)(v4 + 64));
3002  v6 = v4 + 52;
3003  while ( v6 != v4 + 36 )
3004  {
3005    v7 = *(_DWORD *)(v6 - 8);
3006    v6 -= 8;
3007    if ( v7 )
3008      android::RefBase::weakref_type::decWeak(*(_DWORD *)(v6 + 4), v6);
3009  }
3010  v8 = v4 + 36;
3011  while ( v8 != v4 + 20 )
3012  {
3013    v9 = *(_DWORD *)(v8 - 8);
3014    v8 -= 8;
3015    if ( v9 )
3016      android::RefBase::weakref_type::decWeak(*(_DWORD *)(v8 + 4), v8);
3017  }
3018  pthread_mutex_destroy((pthread_mutex_t *)(v4 + 16));
3019  v10 = *(_DWORD *)(v2 + 4);
3020  *(_DWORD *)v4 = v10;
3021  *(_DWORD *)(v4 + *(_DWORD *)(v10 - 12)) = *(_DWORD *)(v2 + 52);
3022  *(_DWORD *)(v4 + 4) = *(_DWORD *)(v2 + 56);
3023  sub_68007AA8(v4, v2 + 8);
3024  return v4;
3025}
3026// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3027// 68007434: using guessed type int __fastcall android__RefBase__weakref_type__decWeak(_DWORD, _DWORD);
3028
3029//----- (68009968) --------------------------------------------------------
3030signed int __fastcall android::CameraService::getCameraInfo(int a1, int a2, int a3)
3031{
3032  signed int result; // r0@3
3033
3034  if ( a2 < 0 || a2 >= *(_DWORD *)(a1 + 52) )
3035  {
3036    result = -22;
3037  }
3038  else
3039  {
3040    HAL_getCameraInfo(a2, a3);
3041    result = 0;
3042  }
3043  return result;
3044}
3045// 6800744C: using guessed type int __fastcall HAL_getCameraInfo(_DWORD, _DWORD);
3046
3047//----- (68009988) --------------------------------------------------------
3048int __fastcall android::wp<android::CameraService::Client>::operator_(int a1, int *a2)
3049{
3050  int v2; // r5@1
3051  int v3; // r4@1
3052  int *v4; // r6@1
3053  int v5; // r6@3
3054  int result; // r0@5
3055
3056  v2 = *a2;
3057  v3 = a1;
3058  v4 = a2;
3059  if ( *a2 )
3060    v2 = android::RefBase::createWeak(v2 + *(_DWORD *)(*(_DWORD *)v2 - 12), a1);
3061  v5 = *v4;
3062  if ( *(_DWORD *)v3 )
3063    android::RefBase::weakref_type::decWeak(*(_DWORD *)(v3 + 4), v3);
3064  *(_DWORD *)v3 = v5;
3065  result = v3;
3066  *(_DWORD *)(v3 + 4) = v2;
3067  return result;
3068}
3069// 68007434: using guessed type int __fastcall android__RefBase__weakref_type__decWeak(_DWORD, _DWORD);
3070// 68007458: using guessed type int __fastcall android__RefBase__createWeak(_DWORD, _DWORD);
3071
3072//----- (680099B8) --------------------------------------------------------
3073int __fastcall sub_680099B8(int a1, int a2)
3074{
3075  int v2; // r4@1
3076  int v3; // r5@1
3077  int v4; // r1@1
3078  int result; // r0@1
3079
3080  v2 = a1;
3081  v3 = a2;
3082  android::ICameraService::ICameraService();
3083  android::BBinder::BBinder(v2 + 4, v3 + 20);
3084  v4 = *(_DWORD *)v3;
3085  *(_DWORD *)v2 = *(_DWORD *)v3;
3086  *(_DWORD *)(v2 + *(_DWORD *)(v4 - 12)) = *(_DWORD *)(v3 + 36);
3087  result = v2;
3088  *(_DWORD *)(v2 + 4) = *(_DWORD *)(v3 + 40);
3089  return result;
3090}
3091// 680073A4: using guessed type int __fastcall android__BBinder__BBinder(_DWORD, _DWORD);
3092// 68007464: using guessed type int android__ICameraService__ICameraService(void);
3093
3094//----- (680099E4) --------------------------------------------------------
3095int __fastcall android::CameraService::CameraService(int a1)
3096{
3097  int v1; // ST00_4@1
3098  int v2; // r4@1
3099  int v3; // r2@1
3100  int v4; // r1@1
3101  __pid_t v5; // r0@1
3102  int v6; // r0@1
3103  int v7; // r3@1
3104  int i; // r5@3
3105
3106  v1 = a1;
3107  v2 = a1;
3108  android::RefBase::RefBase(a1 + 92);
3109  sub_680099B8(v2, (int)&_VTT_for_android::CameraService[8]);
3110  v3 = *(_DWORD *)&_VTT_for_android::CameraService[4];
3111  v4 = *(_DWORD *)&_VTT_for_android::CameraService[52];
3112  *(_DWORD *)v2 = *(_DWORD *)&_VTT_for_android::CameraService[4];
3113  *(_DWORD *)(v2 + *(_DWORD *)(v3 - 12)) = v4;
3114  *(_DWORD *)(v2 + 4) = &_vtable_for_android::CameraService[76];
3115  *(_DWORD *)v2 = &_vtable_for_android::CameraService[12];
3116  *(_DWORD *)(v2 + 92) = &_vtable_for_android::CameraService[172];
3117  pthread_mutex_init((pthread_mutex_t *)(v2 + 16), 0);
3118  *(_DWORD *)(v2 + 20) = 0;
3119  *(_DWORD *)(v2 + 28) = 0;
3120  *(_DWORD *)(v2 + 36) = 0;
3121  *(_DWORD *)(v2 + 44) = 0;
3122  pthread_mutex_init((pthread_mutex_t *)(v2 + 64), 0);
3123  *(_DWORD *)(v2 + 68) = 0;
3124  *(_DWORD *)(v2 + 72) = 0;
3125  *(_DWORD *)(v2 + 76) = 0;
3126  *(_DWORD *)(v2 + 80) = 0;
3127  *(_DWORD *)(v2 + 84) = 0;
3128  v5 = getpid();
3129  v6 = _android_log_print(4, "CameraService", "CameraService started (pid=%d)", v5, v1);
3130  v7 = HAL_getNumberOfCameras(v6);
3131  *(_DWORD *)(v2 + 52) = v7;
3132  if ( v7 > 2 )
3133  {
3134    _android_log_print(6, "CameraService", "Number of cameras(%d) > MAX_CAMERAS(%d).", v7, 2);
3135    *(_DWORD *)(v2 + 52) = 2;
3136  }
3137  for ( i = 0; i < *(_DWORD *)(v2 + 52); ++i )
3138    android::CameraService::setCameraFree(v2, i);
3139  unk_6800D374 = v2;
3140  android::sp<android::MediaPlayer>::operator_(v2 + 76, 0);
3141  android::sp<android::MediaPlayer>::operator_(v2 + 80, 0);
3142  return v2;
3143}
3144// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3145// 68007470: using guessed type int __fastcall android__RefBase__RefBase(_DWORD);
3146// 68007488: using guessed type int __fastcall HAL_getNumberOfCameras(_DWORD);
3147
3148//----- (68009AE4) --------------------------------------------------------
3149int __fastcall android::CameraService::CameraService(int a1, int a2)
3150{
3151  int v2; // ST00_4@1
3152  int v3; // r5@1
3153  int v4; // r6@1
3154  int v5; // r4@1
3155  int v6; // r0@1
3156  int v7; // r0@1
3157  __pid_t v8; // r0@1
3158  int v9; // r0@1
3159  int v10; // r3@1
3160  int i; // r5@3
3161
3162  v2 = a1;
3163  v3 = a2;
3164  v4 = a2 + 4;
3165  v5 = a1;
3166  sub_680099B8(a1, a2 + 8);
3167  v6 = *(_DWORD *)(v3 + 4);
3168  *(_DWORD *)v5 = v6;
3169  *(_DWORD *)(v5 + *(_DWORD *)(v6 - 12)) = *(_DWORD *)(v4 + 48);
3170  *(_DWORD *)(v5 + 4) = *(_DWORD *)(v4 + 52);
3171  v7 = *(_DWORD *)v3;
3172  *(_DWORD *)v5 = *(_DWORD *)v3;
3173  *(_DWORD *)(v5 + *(_DWORD *)(v7 - 12)) = *(_DWORD *)(v3 + 60);
3174  *(_DWORD *)(v5 + 4) = *(_DWORD *)(v3 + 64);
3175  pthread_mutex_init((pthread_mutex_t *)(v5 + 16), 0);
3176  *(_DWORD *)(v5 + 20) = 0;
3177  *(_DWORD *)(v5 + 28) = 0;
3178  *(_DWORD *)(v5 + 36) = 0;
3179  *(_DWORD *)(v5 + 44) = 0;
3180  pthread_mutex_init((pthread_mutex_t *)(v5 + 64), 0);
3181  *(_DWORD *)(v5 + 68) = 0;
3182  *(_DWORD *)(v5 + 72) = 0;
3183  *(_DWORD *)(v5 + 76) = 0;
3184  *(_DWORD *)(v5 + 80) = 0;
3185  *(_DWORD *)(v5 + 84) = 0;
3186  v8 = getpid();
3187  v9 = _android_log_print(4, "CameraService", "CameraService started (pid=%d)", v8, v2);
3188  v10 = HAL_getNumberOfCameras(v9);
3189  *(_DWORD *)(v5 + 52) = v10;
3190  if ( v10 > 2 )
3191  {
3192    _android_log_print(6, "CameraService", "Number of cameras(%d) > MAX_CAMERAS(%d).", v10, 2);
3193    *(_DWORD *)(v5 + 52) = 2;
3194  }
3195  for ( i = 0; i < *(_DWORD *)(v5 + 52); ++i )
3196    android::CameraService::setCameraFree(v5, i);
3197  unk_6800D374 = v5;
3198  android::sp<android::MediaPlayer>::operator_(v5 + 76, 0);
3199  android::sp<android::MediaPlayer>::operator_(v5 + 80, 0);
3200  return v5;
3201}
3202// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3203// 68007488: using guessed type int __fastcall HAL_getNumberOfCameras(_DWORD);
3204
3205//----- (68009BC4) --------------------------------------------------------
3206int __fastcall sub_68009BC4(int a1)
3207{
3208  int v1; // r4@1
3209  int result; // r0@3
3210
3211  v1 = a1;
3212  if ( *(_DWORD *)a1 )
3213    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 12), a1);
3214  result = v1;
3215  *(_DWORD *)v1 = 0;
3216  return result;
3217}
3218// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
3219
3220//----- (68009BE4) --------------------------------------------------------
3221int __fastcall android::CameraService::Client::getBufferInfo(int a1, int a2)
3222{
3223  int v2; // r6@1
3224  int v3; // r4@1
3225  int v4; // r0@2
3226  int v5; // r0@3
3227  int result; // r0@4
3228
3229  v2 = a1;
3230  v3 = a2;
3231  if ( unk_6800D370 > 0 )
3232  {
3233    v4 = sub_68007BB0(a1);
3234    _android_log_print(3, "CameraService", "getBufferInfo (pid %d)", v4);
3235  }
3236  v5 = *(_DWORD *)(v2 + 40);
3237  if ( v5 )
3238  {
3239    result = (*(int (**)(void))(*(_DWORD *)v5 + 32))();
3240  }
3241  else
3242  {
3243    _android_log_print(6, "CameraService", "mHardware is NULL, returning.");
3244    sub_68009BC4(v3);
3245    result = -38;
3246  }
3247  return result;
3248}
3249// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3250
3251//----- (68009C48) --------------------------------------------------------
3252int __fastcall sub_68009C48(int result)
3253{
3254  *(_DWORD *)result = 0;
3255  return result;
3256}
3257
3258//----- (68009C50) --------------------------------------------------------
3259int __fastcall sub_68009C50(int result)
3260{
3261  *(_DWORD *)result = 0;
3262  return result;
3263}
3264
3265//----- (68009C58) --------------------------------------------------------
3266int __fastcall android::CameraService::Client::getClientFromCookie(int a1, int a2, int a3)
3267{
3268  int v3; // r4@1
3269  int v4; // r3@1
3270  int v5; // r1@3
3271  const char *v6; // r2@3
3272  int v8; // [sp+4h] [bp-14h]@1
3273  int v9; // [sp+8h] [bp-10h]@1
3274
3275  v8 = a2;
3276  v9 = a3;
3277  v3 = a1;
3278  (*(void (__fastcall **)(int *))(*dword_6800D374[0] + 44))(&v8);
3279  v4 = v8;
3280  if ( v8 )
3281  {
3282    if ( *(_DWORD **)(v8 + 16) == dword_6800D374[0] )
3283    {
3284      if ( *(_DWORD *)(v8 + 40) )
3285      {
3286        *(_DWORD *)v3 = v8;
3287        android::RefBase::incStrong(v4 + *(_DWORD *)(*(_DWORD *)v4 - 12), v3);
3288        goto LABEL_9;
3289      }
3290      v5 = (int)"CameraService";
3291      v6 = "mHardware == 0: callback after disconnect()?";
3292    }
3293    else
3294    {
3295      v5 = (int)"CameraService";
3296      v6 = "mismatch service!";
3297    }
3298    _android_log_print(6, v5, v6);
3299  }
3300  sub_68009C50(v3);
3301LABEL_9:
3302  android::sp<android::CameraService::Client>::_sp((int)&v8);
3303  return v3;
3304}
3305// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
3306// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3307
3308//----- (68009CCC) --------------------------------------------------------
3309int __fastcall android::CameraService::Client::dataCallbackTimestamp(int _R0, int a2, int a3, int a4, int a5)
3310{
3311  int v5; // r4@1
3312  int v10; // r5@1
3313  int v11; // r1@4
3314  int v14; // r0@8
3315  int v16; // [sp+Ch] [bp-24h]@3
3316
3317  v5 = a4;
3318  __asm { VMOV            D8, R0, R1 }
3319  v10 = a3;
3320  if ( unk_6800D370 > 1 )
3321    _android_log_print(3, "CameraService", "dataCallbackTimestamp(%d)", a3);
3322  android::CameraService::Client::getClientFromCookie((int)&v16, a5, a3);
3323  if ( !v16 )
3324    goto LABEL_9;
3325  if ( !android::CameraService::Client::lockIfMessageWanted(v16, v10) )
3326  {
3327    android::CameraService::Client::releaseRecordingFrameInternal(v16);
3328LABEL_9:
3329    v14 = (int)&v16;
3330    return android::sp<android::CameraService::Client>::_sp(v14);
3331  }
3332  if ( !*(_DWORD *)v5 )
3333  {
3334    _android_log_print(6, "CameraService", "Null data returned in data with timestamp callback");
3335    android::CameraService::Client::handleGenericNotify(v16, 1, -2147483648);
3336    goto LABEL_9;
3337  }
3338  __asm { VMOV            R2, R3, D8 }
3339  android::CameraService::Client::handleGenericDataTimestamp(v16, v11, _R2);
3340  v14 = (int)&v16;
3341  return android::sp<android::CameraService::Client>::_sp(v14);
3342}
3343// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3344
3345//----- (68009D6C) --------------------------------------------------------
3346int __fastcall android::CameraService::Client::dataCallback(int a1, int a2, int a3)
3347{
3348  int v3; // r4@1
3349  int v4; // r5@1
3350  int v5; // r6@1
3351  int v6; // r2@4
3352  int v7; // r3@4
3353  int v9; // [sp+4h] [bp-14h]@1
3354
3355  v9 = a2;
3356  v3 = a1;
3357  v4 = a2;
3358  v5 = a3;
3359  if ( unk_6800D370 > 1 )
3360    _android_log_print(3, "CameraService", "dataCallback(%d)", a1, a1);
3361  android::CameraService::Client::getClientFromCookie((int)&v9, v5, a3);
3362  if ( v9 && android::CameraService::Client::lockIfMessageWanted(v9, v3) )
3363  {
3364    if ( *(_DWORD *)v4 )
3365    {
3366      if ( v3 == 128 )
3367      {
3368        android::CameraService::Client::handleRawPicture(v9, v4, v6, v7);
3369        return android::sp<android::CameraService::Client>::_sp((int)&v9);
3370      }
3371      if ( v3 > 128 )
3372      {
3373        if ( v3 == 65536 )
3374        {
3375          android::CameraService::Client::handleFaceDetection(v9, v4, v6);
3376          return android::sp<android::CameraService::Client>::_sp((int)&v9);
3377        }
3378        if ( v3 == 131072 )
3379        {
3380          android::CameraService::Client::handleSceneDetection(v9, v4, v6);
3381          return android::sp<android::CameraService::Client>::_sp((int)&v9);
3382        }
3383        if ( v3 == 256 )
3384        {
3385          android::CameraService::Client::handleCompressedPicture(v9, v4, v6);
3386          return android::sp<android::CameraService::Client>::_sp((int)&v9);
3387        }
3388      }
3389      else
3390      {
3391        if ( v3 == 16 )
3392        {
3393          android::CameraService::Client::handlePreviewData(v9, v4);
3394          return android::sp<android::CameraService::Client>::_sp((int)&v9);
3395        }
3396        if ( v3 == 64 )
3397        {
3398          android::CameraService::Client::handlePostview(v9, v4, v6);
3399          return android::sp<android::CameraService::Client>::_sp((int)&v9);
3400        }
3401      }
3402      android::CameraService::Client::handleGenericData(v9, v3);
3403      return android::sp<android::CameraService::Client>::_sp((int)&v9);
3404    }
3405    _android_log_print(6, "CameraService", "Null data returned in data callback");
3406    android::CameraService::Client::handleGenericNotify(v9, 1, -2147483648);
3407  }
3408  return android::sp<android::CameraService::Client>::_sp((int)&v9);
3409}
3410// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3411
3412//----- (68009E50) --------------------------------------------------------
3413int __fastcall android::CameraService::Client::notifyCallback(int a1, int a2, int a3, int a4)
3414{
3415  int v4; // r7@1
3416  int v5; // r4@1
3417  int v6; // r5@1
3418  int v8; // [sp+4h] [bp-1Ch]@1
3419  int v9; // [sp+8h] [bp-18h]@1
3420
3421  v8 = a2;
3422  v9 = a3;
3423  v4 = a4;
3424  v5 = a1;
3425  v6 = a2;
3426  if ( unk_6800D370 > 1 )
3427    _android_log_print(3, "CameraService", "notifyCallback(%d)", a1, a1);
3428  android::CameraService::Client::getClientFromCookie((int)&v8, v4, a3);
3429  if ( v8 && android::CameraService::Client::lockIfMessageWanted(v8, v5) )
3430  {
3431    if ( v5 == 2 )
3432      android::CameraService::Client::handleShutter(v8, v6);
3433    else
3434      android::CameraService::Client::handleGenericNotify(v8, v5, v6);
3435  }
3436  return android::sp<android::CameraService::Client>::_sp((int)&v8);
3437}
3438// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3439
3440//----- (68009EB8) --------------------------------------------------------
3441int __fastcall android::CameraService::getClientById(int a1, int a2, int a3)
3442{
3443  int v3; // r4@1
3444
3445  v3 = a1;
3446  if ( a3 >= 0 && a3 < *(_DWORD *)(a2 + 52) )
3447    android::wp<android::CameraService::Client>::promote(a1, a2 + 8 * a3 + 20);
3448  else
3449    sub_68009C50(a1);
3450  return v3;
3451}
3452
3453//----- (68009EDC) --------------------------------------------------------
3454int __fastcall sub_68009EDC(int a1)
3455{
3456  int v1; // r4@1
3457  int result; // r0@3
3458
3459  v1 = a1;
3460  if ( *(_DWORD *)a1 )
3461    android::RefBase::decStrong(*(_DWORD *)a1 + *(_DWORD *)(**(_DWORD **)a1 - 12), a1);
3462  result = v1;
3463  *(_DWORD *)v1 = 0;
3464  return result;
3465}
3466// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
3467
3468//----- (68009EFC) --------------------------------------------------------
3469int __fastcall android::CameraService::Client::Client(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8)
3470{
3471  int v8; // r5@1
3472  int v9; // r8@1
3473  int v10; // r4@1
3474  int v11; // r7@1
3475  int v12; // r10@1
3476  int v13; // r3@1
3477  int v14; // r3@1
3478  int v15; // r0@1
3479  int v16; // r0@1
3480  int v17; // r8@1
3481  int v18; // r0@3
3482  char v19; // r0@3
3483  int v20; // r2@3
3484  int v21; // r2@4
3485  signed int v22; // r0@6
3486  int v24; // [sp+0h] [bp-28h]@1
3487
3488  v24 = a1;
3489  v8 = a2;
3490  v9 = a2 + 4;
3491  v10 = a1;
3492  v11 = a3;
3493  v12 = a4;
3494  sub_68009100(a1, a2 + 8);
3495  v13 = *(_DWORD *)(v8 + 4);
3496  *(_DWORD *)v10 = v13;
3497  *(_DWORD *)(v10 + *(_DWORD *)(v13 - 12)) = *(_DWORD *)(v9 + 48);
3498  *(_DWORD *)(v10 + 4) = *(_DWORD *)(v9 + 52);
3499  v14 = *(_DWORD *)v8;
3500  *(_DWORD *)v10 = *(_DWORD *)v8;
3501  *(_DWORD *)(v10 + *(_DWORD *)(v14 - 12)) = *(_DWORD *)(v8 + 60);
3502  v15 = *(_DWORD *)(v8 + 64);
3503  *(_DWORD *)(v10 + 16) = 0;
3504  *(_DWORD *)(v10 + 20) = 0;
3505  *(_DWORD *)(v10 + 4) = v15;
3506  *(_DWORD *)(v10 + 24) = 0;
3507  *(_DWORD *)(v10 + 40) = 0;
3508  *(_DWORD *)(v10 + 48) = 0;
3509  v16 = pthread_mutex_init((pthread_mutex_t *)(v10 + 80), 0);
3510  *(_DWORD *)(v10 + 84) = 0;
3511  *(_DWORD *)(v10 + 88) = 0;
3512  v17 = sub_68007BB0(v16);
3513  if ( unk_6800D370 > 0 )
3514    _android_log_print(3, "CameraService", "Client::Client E (pid %d)", v17, v24);
3515  android::sp<android::CameraService>::operator_(v10 + 16, v11);
3516  android::sp<android::ICameraClient>::operator_(v10 + 20, v12);
3517  sub_68009EDC(v10 + 24);
3518  android::sp<android::CameraHardwareInterface>::operator_(v10 + 40, a5);
3519  *(_DWORD *)(v10 + 28) = a6;
3520  *(_DWORD *)(v10 + 36) = a8;
3521  v18 = *(_DWORD *)(v10 + 40);
3522  *(_DWORD *)(v10 + 32) = a7;
3523  v19 = (*(int (__cdecl **)(int))(*(_DWORD *)v18 + 40))(v18);
3524  *(_DWORD *)(v10 + 92) = 0;
3525  *(_DWORD *)(v10 + 72) = 0;
3526  *(_BYTE *)(v10 + 44) = v19;
3527  (*(void (__cdecl **)(_DWORD))(**(_DWORD **)(v10 + 40) + 16))(*(_DWORD *)(v10 + 40));
3528  android::CameraService::Client::enableMsgType(v10, 13);
3529  v20 = *(_DWORD *)(v10 + 32);
3530  *(_DWORD *)(v10 + 52) = 0;
3531  v21 = v20 == 1;
3532  *(_DWORD *)(v10 + 56) = 0;
3533  *(_DWORD *)(v10 + 60) = 0;
3534  v22 = android::CameraService::Client::getOrientation(v10, 0, v21);
3535  *(_DWORD *)(v10 + 68) = 0;
3536  *(_DWORD *)(v10 + 64) = v22;
3537  android::CameraService::setCameraBusy(*(_DWORD *)v11, a6);
3538  android::CameraService::loadSound(*(_DWORD *)v11);
3539  *(_BYTE *)(v10 + 76) = 0;
3540  if ( unk_6800D370 > 0 )
3541    _android_log_print(3, "CameraService", "Client::Client X (pid %d)", v17, a6);
3542  return v10;
3543}
3544// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3545
3546//----- (6800A05C) --------------------------------------------------------
3547int __fastcall android::CameraService::Client::Client(int a1, int a2, int a3, int a4, int a5, int a6, int a7)
3548{
3549  int v7; // r4@1
3550  int v8; // r5@1
3551  int v9; // r10@1
3552  int v10; // r7@1
3553  int v11; // r2@1
3554  int v12; // r1@1
3555  int v13; // r0@1
3556  int v14; // r9@1
3557  int v15; // r0@3
3558  char v16; // r0@3
3559  int v17; // r3@3
3560  int v18; // r2@4
3561  signed int v19; // r0@6
3562  int v21; // [sp+0h] [bp-28h]@1
3563
3564  v21 = a1;
3565  v7 = a1;
3566  v8 = a3;
3567  v9 = a4;
3568  v10 = a2;
3569  android::RefBase::RefBase(a1 + 96);
3570  sub_68009100(v7, (int)&_VTT_for_android::CameraService::Client[8]);
3571  v11 = *(_DWORD *)&_VTT_for_android::CameraService::Client[4];
3572  v12 = *(_DWORD *)&_VTT_for_android::CameraService::Client[52];
3573  *(_DWORD *)v7 = *(_DWORD *)&_VTT_for_android::CameraService::Client[4];
3574  *(_DWORD *)(v7 + *(_DWORD *)(v11 - 12)) = v12;
3575  *(_DWORD *)(v7 + 16) = 0;
3576  *(_DWORD *)(v7 + 96) = &_vtable_for_android::CameraService::Client[228];
3577  *(_DWORD *)v7 = &_vtable_for_android::CameraService::Client[12];
3578  *(_DWORD *)(v7 + 20) = 0;
3579  *(_DWORD *)(v7 + 4) = &_vtable_for_android::CameraService::Client[132];
3580  *(_DWORD *)(v7 + 24) = 0;
3581  *(_DWORD *)(v7 + 40) = 0;
3582  *(_DWORD *)(v7 + 48) = 0;
3583  v13 = pthread_mutex_init((pthread_mutex_t *)(v7 + 80), 0);
3584  *(_DWORD *)(v7 + 84) = 0;
3585  *(_DWORD *)(v7 + 88) = 0;
3586  v14 = sub_68007BB0(v13);
3587  if ( unk_6800D370 > 0 )
3588    _android_log_print(3, "CameraService", "Client::Client E (pid %d)", v14, v21);
3589  android::sp<android::CameraService>::operator_(v7 + 16, v10);
3590  android::sp<android::ICameraClient>::operator_(v7 + 20, v8);
3591  sub_68009EDC(v7 + 24);
3592  android::sp<android::CameraHardwareInterface>::operator_(v7 + 40, v9);
3593  *(_DWORD *)(v7 + 28) = a5;
3594  *(_DWORD *)(v7 + 36) = a7;
3595  v15 = *(_DWORD *)(v7 + 40);
3596  *(_DWORD *)(v7 + 32) = a6;
3597  v16 = (*(int (__cdecl **)(int))(*(_DWORD *)v15 + 40))(v15);
3598  *(_DWORD *)(v7 + 92) = 0;
3599  *(_DWORD *)(v7 + 72) = 0;
3600  *(_BYTE *)(v7 + 44) = v16;
3601  (*(void (__cdecl **)(_DWORD))(**(_DWORD **)(v7 + 40) + 16))(*(_DWORD *)(v7 + 40));
3602  android::CameraService::Client::enableMsgType(v7, 13);
3603  v17 = *(_DWORD *)(v7 + 32);
3604  *(_DWORD *)(v7 + 52) = 0;
3605  v18 = v17 == 1;
3606  *(_DWORD *)(v7 + 56) = 0;
3607  *(_DWORD *)(v7 + 60) = 0;
3608  v19 = android::CameraService::Client::getOrientation(v7, 0, v18);
3609  *(_DWORD *)(v7 + 68) = 0;
3610  *(_DWORD *)(v7 + 64) = v19;
3611  android::CameraService::setCameraBusy(*(_DWORD *)v10, a5);
3612  android::CameraService::loadSound(*(_DWORD *)v10);
3613  *(_BYTE *)(v7 + 76) = 0;
3614  if ( unk_6800D370 > 0 )
3615    _android_log_print(3, "CameraService", "Client::Client X (pid %d)", v14, a5);
3616  return v7;
3617}
3618// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3619// 68007470: using guessed type int __fastcall android__RefBase__RefBase(_DWORD);
3620
3621//----- (6800A1E8) --------------------------------------------------------
3622int __fastcall android::CameraService::connect(int a1, int a2, int a3, int a4, unsigned __int8 a5)
3623{
3624  int v5; // r5@1
3625  int v6; // r4@1
3626  int v7; // r6@1
3627  int v8; // r10@1
3628  int v9; // r7@1
3629  int v10; // r9@4
3630  int v11; // r0@4
3631  int v12; // r0@5
3632  int v13; // r8@9
3633  int v14; // r9@10
3634  int v15; // r9@11
3635  int v16; // r8@11
3636  int v17; // r3@14
3637  int v18; // r11@24
3638  int v19; // r3@28
3639  int v21; // [sp+1Ch] [bp-4Ch]@24
3640  int v22; // [sp+24h] [bp-44h]@24
3641  int v23; // [sp+28h] [bp-40h]@22
3642  int v24; // [sp+2Ch] [bp-3Ch]@11
3643  int v25; // [sp+30h] [bp-38h]@11
3644  char v26; // [sp+34h] [bp-34h]@10
3645  int v27; // [sp+38h] [bp-30h]@6
3646  char v28; // [sp+3Ch] [bp-2Ch]@4
3647
3648  v5 = a1;
3649  v6 = a4;
3650  v7 = a2;
3651  v8 = a3;
3652  v9 = sub_68007BB0(a5);
3653  if ( unk_6800D370 > 0 )
3654    _android_log_print(3, "CameraService", "CameraService::connect E (pid %d, id %d)", v9, v6);
3655  if ( !a5
3656    || (android::String16::String16(&v28, "com.sonyericsson.permission.CAMERA_EXTENDED"),
3657        v10 = android::checkCallingPermission(&v28),
3658        v11 = android::String16::_String16(&v28),
3659        v10) )
3660  {
3661    v27 = 0;
3662    if ( v6 < 0 || v6 >= *(_DWORD *)(v7 + 52) )
3663    {
3664      _android_log_print(
3665        6,
3666        "CameraService",
3667        "CameraService::connect X (pid %d) rejected (invalid cameraId %d).",
3668        v9,
3669        v6);
3670      sub_68009C48(v5);
3671LABEL_33:
3672      android::sp<android::CameraService::Client>::_sp((int)&v27);
3673      return v5;
3674    }
3675    v13 = v7 + 8 * (v6 + 2);
3676    pthread_mutex_lock((pthread_mutex_t *)(v7 + 16));
3677    if ( *(_DWORD *)(v13 + 4) )
3678    {
3679      android::wp<android::CameraService::Client>::promote((int)&v26, v13 + 4);
3680      android::sp<android::CameraService::Client>::operator_((int)&v27, (int)&v26);
3681      android::sp<android::CameraService::Client>::_sp((int)&v26);
3682      v14 = v27;
3683      if ( v27 )
3684      {
3685        android::IInterface::asBinder(&v25, *(_DWORD *)v8);
3686        android::IInterface::asBinder(&v24, *(_DWORD *)(v27 + 20));
3687        v15 = v25;
3688        v16 = v24;
3689        android::sp<android::IBinder>::_sp((int)&v24);
3690        android::sp<android::IBinder>::_sp((int)&v25);
3691        if ( v15 == v16 )
3692        {
3693          if ( unk_6800D370 > 0 )
3694            _android_log_print(3, "CameraService", "CameraService::connect X (pid %d) (the same client)", v9);
3695          v17 = v27;
3696          *(_DWORD *)v5 = v27;
3697          if ( v17 )
3698            android::RefBase::incStrong(v17 + *(_DWORD *)(*(_DWORD *)v17 - 12), v5);
3699          goto LABEL_32;
3700        }
3701        _android_log_print(5, "CameraService", "CameraService::connect X (pid %d) rejected (existing client).", v9);
3702LABEL_21:
3703        sub_68009C48(v5);
3704LABEL_32:
3705        pthread_mutex_unlock((pthread_mutex_t *)(v7 + 16));
3706        goto LABEL_33;
3707      }
3708      if ( *(_DWORD *)(v13 + 4) )
3709      {
3710        android::RefBase::weakref_type::decWeak(*(_DWORD *)(v13 + 8), v13 + 4);
3711        *(_DWORD *)(v13 + 4) = v14;
3712      }
3713    }
3714    if ( !*(_DWORD *)(v7 + 4 * (v6 + 14)) )
3715    {
3716      HAL_openCameraHardware(&v23, v6);
3717      if ( v23 )
3718      {
3719        HAL_getCameraInfo(v6, &v21);
3720        v22 = v7;
3721        android::RefBase::incStrong(v7 + *(_DWORD *)(*(_DWORD *)v7 - 12), &v22);
3722        v18 = operator new(104);
3723        android::CameraService::Client::Client(v18, (int)&v22, v8, (int)&v23, v6, v21, v9);
3724        android::sp<android::CameraService::Client>::operator_((int)&v27, v18);
3725        if ( v22 )
3726          android::RefBase::decStrong(v22 + *(_DWORD *)(*(_DWORD *)v22 - 12), &v22);
3727        android::wp<android::CameraService::Client>::operator_(v7 + 8 * v6 + 20, &v27);
3728        *(_BYTE *)(v7 + 88) = a5;
3729        if ( unk_6800D370 > 0 )
3730          _android_log_print(3, "CameraService", "CameraService::connect X");
3731        v19 = v27;
3732        *(_DWORD *)v5 = v27;
3733        if ( v19 )
3734          android::RefBase::incStrong(v19 + *(_DWORD *)(*(_DWORD *)v19 - 12), v5);
3735      }
3736      else
3737      {
3738        _android_log_print(6, "CameraService", "Fail to open camera hardware (id=%d)", v6);
3739        sub_68009C48(v5);
3740      }
3741      if ( v23 )
3742        android::RefBase::decStrong(v23 + *(_DWORD *)(*(_DWORD *)v23 - 12), &v23);
3743      goto LABEL_32;
3744    }
3745    _android_log_print(
3746      5,
3747      "CameraService",
3748      "CameraService::connect X (pid %d) rejected (camera %d is still busy).",
3749      v9,
3750      v6);
3751    goto LABEL_21;
3752  }
3753  v12 = sub_68007BBC(v11);
3754  _android_log_print(6, "CameraService", "Permission Denial: can't use the extended camera pid=%d, uid=%d", v9, v12);
3755  sub_68009C48(v5);
3756  return v5;
3757}
3758// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
3759// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
3760// 680071DC: using guessed type int __fastcall android__String16__String16(_DWORD, _DWORD);
3761// 680071E8: using guessed type int __fastcall android__checkCallingPermission(_DWORD);
3762// 680071F4: using guessed type int __fastcall android__String16___String16(_DWORD);
3763// 6800723C: using guessed type int __fastcall android__IInterface__asBinder(_DWORD, _DWORD);
3764// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3765// 6800729C: using guessed type int __fastcall operator new(_DWORD);
3766// 68007434: using guessed type int __fastcall android__RefBase__weakref_type__decWeak(_DWORD, _DWORD);
3767// 6800744C: using guessed type int __fastcall HAL_getCameraInfo(_DWORD, _DWORD);
3768// 68007494: using guessed type int __fastcall HAL_openCameraHardware(_DWORD, _DWORD);
3769
3770//----- (6800A4AC) --------------------------------------------------------
3771int __fastcall sub_6800A4AC(int a1)
3772{
3773  int v1; // r4@1
3774  int v2; // r0@1
3775  int result; // r0@3
3776
3777  v1 = a1;
3778  v2 = *(_DWORD *)a1;
3779  if ( v2 )
3780    sub_680090C4(v2 + 4);
3781  result = v1;
3782  *(_DWORD *)v1 = 0;
3783  return result;
3784}
3785
3786//----- (6800A4C4) --------------------------------------------------------
3787signed int __fastcall android::CameraService::Client::setOverlay(int a1)
3788{
3789  int v1; // r4@1
3790  int (*v2)(void); // r3@6
3791  int v3; // r6@6
3792  int v4; // r0@6
3793  int v5; // r6@7
3794  signed int v6; // r5@13
3795  int v7; // r7@14
3796  int (__fastcall *v8)(_DWORD, _DWORD); // r8@14
3797  int v9; // r5@14
3798  int v10; // r2@19
3799  signed int v12; // [sp+0h] [bp-60h]@0
3800  int v13; // [sp+4h] [bp-5Ch]@0
3801  char v14; // [sp+8h] [bp-58h]@1
3802  int v15; // [sp+20h] [bp-40h]@14
3803  int v16; // [sp+24h] [bp-3Ch]@8
3804  int v17; // [sp+28h] [bp-38h]@6
3805  int v18; // [sp+2Ch] [bp-34h]@4
3806  int v19; // [sp+30h] [bp-30h]@1
3807  int v20; // [sp+34h] [bp-2Ch]@1
3808
3809  v1 = a1;
3810  (*(void (__fastcall **)(char *))(**(_DWORD **)(a1 + 40) + 92))(&v14);
3811  android::CameraParameters::getPreviewSize(&v14, &v20, &v19);
3812  if ( v20 != *(_DWORD *)(v1 + 52) || v19 != *(_DWORD *)(v1 + 56) || *(_DWORD *)(v1 + 68) )
3813  {
3814    v18 = 0;
3815    (*(void (**)(void))(**(_DWORD **)(v1 + 40) + 44))();
3816    sub_6800A4AC(v1 + 48);
3817    *(_DWORD *)(v1 + 68) = 0;
3818    android::sp<android::Overlay>::_sp((int)&v18);
3819  }
3820  if ( !*(_DWORD *)(v1 + 84) )
3821  {
3822    v2 = *(int (**)(void))(**(_DWORD **)(v1 + 40) + 44);
3823    v17 = 0;
3824    v3 = (int)&v17;
3825    v4 = v2();
3826    goto LABEL_17;
3827  }
3828  v5 = *(_DWORD *)(v1 + 48);
3829  if ( v5 )
3830    goto LABEL_19;
3831  do
3832  {
3833    v12 = 99;
3834    v13 = *(_DWORD *)(v1 + 64);
3835    (*(void (__fastcall **)(int *))(**(_DWORD **)(v1 + 84) + 36))(&v16);
3836    android::sp<android::OverlayRef>::operator_(v1 + 48, (int)&v16);
3837    if ( v16 )
3838      sub_680090C4(v16 + 4);
3839    if ( *(_DWORD *)(v1 + 48) )
3840      break;
3841    ++v5;
3842    _android_log_print(5, "CameraService", "Overlay create failed - retrying");
3843    usleep(0x4E20u);
3844  }
3845  while ( v5 != 50 );
3846  if ( *(_DWORD *)(v1 + 48) )
3847  {
3848    v7 = *(_DWORD *)(v1 + 40);
3849    v8 = *(int (__fastcall **)(_DWORD, _DWORD))(*(_DWORD *)v7 + 44);
3850    v9 = operator new(24);
3851    android::Overlay::Overlay(v9, v1 + 48);
3852    v15 = v9;
3853    if ( v9 )
3854      android::RefBase::incStrong(v9 + *(_DWORD *)(*(_DWORD *)v9 - 12), &v15);
3855    v3 = (int)&v15;
3856    v4 = v8(v7, &v15);
3857LABEL_17:
3858    v6 = v4;
3859    android::sp<android::Overlay>::_sp(v3);
3860    if ( v6 )
3861    {
3862      _android_log_print(6, "CameraService", "mHardware->setOverlay() failed with status %d\n", v6, v12, v13);
3863      goto LABEL_20;
3864    }
3865LABEL_19:
3866    v10 = v20;
3867    *(_DWORD *)(v1 + 56) = v19;
3868    v6 = 0;
3869    *(_DWORD *)(v1 + 52) = v10;
3870    goto LABEL_20;
3871  }
3872  v6 = -22;
3873  _android_log_print(6, "CameraService", "Overlay Creation Failed!");
3874LABEL_20:
3875  android::CameraParameters::_CameraParameters(&v14);
3876  return v6;
3877}
3878// 68007164: using guessed type int __fastcall android__RefBase__incStrong(_DWORD, _DWORD);
3879// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3880// 6800729C: using guessed type int __fastcall operator new(_DWORD);
3881// 68007308: using guessed type int __fastcall android__CameraParameters___CameraParameters(_DWORD);
3882// 6800735C: using guessed type int __fastcall android__CameraParameters__getPreviewSize(_DWORD, _DWORD, _DWORD);
3883// 680074A0: using guessed type int __cdecl android__Overlay__Overlay(_DWORD, _DWORD);
3884
3885//----- (6800A624) --------------------------------------------------------
3886signed int __fastcall android::CameraService::Client::startPreviewMode(int a1)
3887{
3888  int v1; // r4@1
3889  signed int result; // r0@4
3890  int v3; // r2@10
3891
3892  v1 = a1;
3893  if ( unk_6800D370 > 0 )
3894    _android_log_print(3, "CameraService", "startPreviewMode");
3895  if ( (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 52))() )
3896  {
3897    result = 0;
3898  }
3899  else
3900  {
3901    if ( *(_BYTE *)(v1 + 44) )
3902    {
3903      if ( !*(_DWORD *)(v1 + 84) || (result = android::CameraService::Client::setOverlay(v1)) == 0 )
3904        result = (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 36))();
3905    }
3906    else
3907    {
3908      android::CameraService::Client::enableMsgType(v1, 16);
3909      result = (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 36))();
3910      if ( !result )
3911      {
3912        v3 = *(_DWORD *)(v1 + 84);
3913        if ( v3 )
3914        {
3915          (*(void (__fastcall **)(_DWORD))(*(_DWORD *)v3 + 32))(*(_DWORD *)(v1 + 84));
3916          result = android::CameraService::Client::registerPreviewBuffers(v1);
3917        }
3918      }
3919    }
3920  }
3921  return result;
3922}
3923// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3924
3925//----- (6800A69C) --------------------------------------------------------
3926signed int __fastcall android::CameraService::Client::startRecordingMode(int a1)
3927{
3928  int v1; // r5@1
3929  signed int v2; // r4@4
3930
3931  v1 = a1;
3932  if ( unk_6800D370 > 0 )
3933    _android_log_print(3, "CameraService", "startRecordingMode");
3934  if ( (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 64))() )
3935  {
3936    v2 = 0;
3937  }
3938  else
3939  {
3940    if ( (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 52))()
3941      || (v2 = android::CameraService::Client::startPreviewMode(v1)) == 0 )
3942    {
3943      android::CameraService::Client::enableMsgType(v1, 32);
3944      android::CameraService::playSound(*(_DWORD *)(v1 + 16), 1);
3945      v2 = (*(int (**)(void))(**(_DWORD **)(v1 + 40) + 56))();
3946      if ( v2 )
3947        _android_log_print(6, "CameraService", "mHardware->startRecording() failed with status %d", v2);
3948    }
3949  }
3950  return v2;
3951}
3952// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3953
3954//----- (6800A720) --------------------------------------------------------
3955signed int __fastcall android::CameraService::Client::startCameraMode(int a1, int a2)
3956{
3957  int v2; // r4@1
3958  int v3; // r5@1
3959  signed int v4; // r7@3
3960  signed int v5; // r0@11
3961
3962  v2 = a1;
3963  v3 = a2;
3964  if ( unk_6800D370 > 0 )
3965    _android_log_print(3, "CameraService", "startCameraMode(%d)", a2);
3966  pthread_mutex_lock((pthread_mutex_t *)(v2 + 80));
3967  v4 = android::CameraService::Client::checkPidAndHardware(v2);
3968  if ( !v4 )
3969  {
3970    if ( v3 )
3971    {
3972      if ( v3 != 1 )
3973      {
3974        v4 = -2147483648;
3975        goto LABEL_16;
3976      }
3977      if ( !*(_DWORD *)(v2 + 84) )
3978      {
3979        v4 = -38;
3980        _android_log_print(6, "CameraService", "mSurface must be set before startRecordingMode.");
3981        goto LABEL_16;
3982      }
3983      v5 = android::CameraService::Client::startRecordingMode(v2);
3984    }
3985    else
3986    {
3987      if ( !*(_DWORD *)(v2 + 84) && unk_6800D370 > 0 )
3988        _android_log_print(3, "CameraService", "mSurface is not set yet.");
3989      v5 = android::CameraService::Client::startPreviewMode(v2);
3990    }
3991    v4 = v5;
3992  }
3993LABEL_16:
3994  pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
3995  return v4;
3996}
3997// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
3998
3999//----- (6800A7D4) --------------------------------------------------------
4000signed int __fastcall android::CameraService::Client::startRecording(int a1)
4001{
4002  int v1; // r4@1
4003  int v2; // r0@2
4004
4005  v1 = a1;
4006  if ( unk_6800D370 > 0 )
4007  {
4008    v2 = sub_68007BB0(a1);
4009    _android_log_print(3, "CameraService", "startRecording (pid %d)", v2);
4010  }
4011  return android::CameraService::Client::startCameraMode(v1, 1);
4012}
4013// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
4014
4015//----- (6800A80C) --------------------------------------------------------
4016signed int __fastcall android::CameraService::Client::startPreview(int a1)
4017{
4018  int v1; // r4@1
4019  int v2; // r0@2
4020
4021  v1 = a1;
4022  if ( unk_6800D370 > 0 )
4023  {
4024    v2 = sub_68007BB0(a1);
4025    a1 = _android_log_print(3, "CameraService", "startPreview (pid %d)", v2);
4026  }
4027  *(_DWORD *)(v1 + 72) = sub_68007BB0(a1);
4028  return android::CameraService::Client::startCameraMode(v1, 0);
4029}
4030// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
4031
4032//----- (6800A84C) --------------------------------------------------------
4033signed int __fastcall android::CameraService::Client::setPreviewDisplay(int a1, int a2)
4034{
4035  int v2; // r4@1
4036  int v3; // r6@1
4037  int v4; // r5@2
4038  int v5; // r0@2
4039  signed int v6; // r5@3
4040  int v7; // r11@4
4041  int v8; // r10@4
4042  int v9; // r0@9
4043  signed int v10; // r0@13
4044  int v12; // [sp+Ch] [bp-34h]@9
4045  int v13; // [sp+10h] [bp-30h]@4
4046  int v14; // [sp+14h] [bp-2Ch]@4
4047
4048  v2 = a1;
4049  v3 = a2;
4050  if ( unk_6800D370 > 0 )
4051  {
4052    v4 = *(_DWORD *)a2;
4053    v5 = sub_68007BB0(a1);
4054    _android_log_print(3, "CameraService", "setPreviewDisplay(%p) (pid %d)", v4, v5);
4055  }
4056  pthread_mutex_lock((pthread_mutex_t *)(v2 + 80));
4057  v6 = android::CameraService::Client::checkPidAndHardware(v2);
4058  if ( !v6 )
4059  {
4060    android::IInterface::asBinder(&v14, *(_DWORD *)v3);
4061    android::IInterface::asBinder(&v13, *(_DWORD *)(v2 + 84));
4062    v7 = v14;
4063    v8 = v13;
4064    android::sp<android::IBinder>::_sp((int)&v13);
4065    android::sp<android::IBinder>::_sp((int)&v14);
4066    if ( v7 != v8 )
4067    {
4068      if ( *(_DWORD *)(v2 + 84) )
4069      {
4070        if ( unk_6800D370 > 0 )
4071          _android_log_print(3, "CameraService", "clearing old preview surface %p");
4072        if ( *(_BYTE *)(v2 + 44) )
4073        {
4074          v9 = *(_DWORD *)(v2 + 40);
4075          v12 = 0;
4076          (*(void (**)(void))(*(_DWORD *)v9 + 44))();
4077          sub_6800A4AC(v2 + 48);
4078          android::sp<android::Overlay>::_sp((int)&v12);
4079        }
4080        else
4081        {
4082          (*(void (**)(void))(**(_DWORD **)(v2 + 84) + 32))();
4083        }
4084      }
4085      android::sp<android::ISurface>::operator_(v2 + 84, v3);
4086      sub_6800A4AC(v2 + 48);
4087      if ( (*(int (**)(void))(**(_DWORD **)(v2 + 40) + 52))() )
4088      {
4089        if ( *(_BYTE *)(v2 + 44) )
4090        {
4091          v10 = android::CameraService::Client::setOverlay(v2);
4092LABEL_16:
4093          v6 = v10;
4094          goto LABEL_17;
4095        }
4096        if ( *(_DWORD *)(v2 + 84) )
4097        {
4098          v10 = android::CameraService::Client::registerPreviewBuffers(v2);
4099          goto LABEL_16;
4100        }
4101      }
4102    }
4103  }
4104LABEL_17:
4105  pthread_mutex_unlock((pthread_mutex_t *)(v2 + 80));
4106  return v6;
4107}
4108// 6800723C: using guessed type int __fastcall android__IInterface__asBinder(_DWORD, _DWORD);
4109// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
4110
4111//----- (6800A968) --------------------------------------------------------
4112int __fastcall android::CameraService::Client::disconnect(int a1)
4113{
4114  int v1; // r4@1
4115  int v2; // r6@1
4116  int v3; // r3@5
4117  signed int v4; // r0@7
4118  int v5; // r1@7
4119  const char *v6; // r2@7
4120  int v7; // r3@13
4121  int v8; // r3@15
4122
4123  v1 = a1;
4124  v2 = sub_68007BB0(a1);
4125  if ( unk_6800D370 > 0 )
4126    _android_log_print(3, "CameraService", "disconnect E (pid %d)", v2);
4127  pthread_mutex_lock((pthread_mutex_t *)(v1 + 80));
4128  if ( android::CameraService::Client::checkPid(v1) )
4129  {
4130    _android_log_print(5, "CameraService", "different client - don't disconnect");
4131    return pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
4132  }
4133  v3 = *(_DWORD *)(v1 + 36);
4134  if ( v3 <= 0 )
4135  {
4136    if ( unk_6800D370 <= 0 )
4137      return pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
4138    v4 = 3;
4139    v5 = (int)"CameraService";
4140    v6 = "camera is unlocked (mClientPid = %d), don't tear down hardware";
4141LABEL_19:
4142    _android_log_print(v4, v5, v6, v3);
4143    return pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
4144  }
4145  if ( *(_DWORD *)(v1 + 40) )
4146  {
4147    if ( unk_6800D370 > 0 )
4148      _android_log_print(3, "CameraService", "hardware teardown");
4149    android::CameraService::Client::disableMsgType(v1, 511);
4150    (*(void (**)(void))(**(_DWORD **)(v1 + 40) + 48))();
4151    (*(void (**)(void))(**(_DWORD **)(v1 + 40) + 84))();
4152    (*(void (**)(void))(**(_DWORD **)(v1 + 40) + 100))();
4153    if ( *(_BYTE *)(v1 + 44) )
4154      sub_6800A4AC(v1 + 48);
4155    v7 = *(_DWORD *)(v1 + 40);
4156    if ( v7 )
4157    {
4158      android::RefBase::decStrong(v7 + *(_DWORD *)(*(_DWORD *)v7 - 12), v1 + 40);
4159      *(_DWORD *)(v1 + 40) = 0;
4160    }
4161    (*(void (**)(void))(**(_DWORD **)(v1 + 16) + 40))();
4162    v8 = *(_DWORD *)(v1 + 24);
4163    if ( v8 )
4164    {
4165      android::RefBase::decStrong(v8 + *(_DWORD *)(*(_DWORD *)v8 - 12), v1 + 24);
4166      *(_DWORD *)(v1 + 24) = 0;
4167    }
4168    (*(void (**)(void))(**(_DWORD **)(v1 + 16) + 40))();
4169    android::CameraService::setCameraFree(*(_DWORD *)(v1 + 16), *(_DWORD *)(v1 + 28));
4170    if ( unk_6800D370 > 0 )
4171    {
4172      v4 = 3;
4173      v3 = v2;
4174      v5 = (int)"CameraService";
4175      v6 = "disconnect X (pid %d)";
4176      goto LABEL_19;
4177    }
4178  }
4179  return pthread_mutex_unlock((pthread_mutex_t *)(v1 + 80));
4180}
4181// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
4182// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
4183
4184//----- (6800AAC4) --------------------------------------------------------
4185int __fastcall _non_virtual_thunk_to_android::CameraService::Client::_Client(int a1, int a2, int a3, pthread_t a4)
4186{
4187  return android::CameraService::Client::_Client(a1 - 4, a2, a3, a4);
4188}
4189
4190//----- (6800AACC) --------------------------------------------------------
4191int __fastcall android::CameraService::Client::_Client(int a1, int a2, int a3, pthread_t a4)
4192{
4193  int v4; // r4@1
4194  int v5; // r8@1
4195  int v6; // r6@1
4196  void *v7; // r3@3
4197  void **v8; // r7@4
4198  int v9; // r3@8
4199  int v10; // r0@10
4200  int v11; // r3@12
4201  int v12; // r3@14
4202  int v13; // r3@16
4203  int v14; // r2@16
4204  int v15; // r0@16
4205  int v16; // r3@16
4206  int v18; // [sp+4h] [bp-24h]@1
4207  int v19; // [sp+8h] [bp-20h]@1
4208  pthread_t th; // [sp+Ch] [bp-1Ch]@1
4209
4210  v18 = a2;
4211  v19 = a3;
4212  th = a4;
4213  v4 = a1;
4214  *(_DWORD *)a1 = &_vtable_for_android::CameraService::Client[12];
4215  v5 = a1 + 96;
4216  *(_DWORD *)(a1 + 96) = &_vtable_for_android::CameraService::Client[228];
4217  *(_DWORD *)(a1 + 4) = &_vtable_for_android::CameraService::Client[132];
4218  v6 = sub_68007BB0((int)&_vtable_for_android::CameraService::Client[132]);
4219  if ( unk_6800D370 > 0 )
4220    _android_log_print(3, "CameraService", "Client::~Client E (pid %d, this %p)", v6, v4, v18, v19, th);
4221  v7 = *(void **)(v4 + 84);
4222  if ( v7 )
4223  {
4224    v8 = (void **)*(_BYTE *)(v4 + 44);
4225    if ( !*(_BYTE *)(v4 + 44) )
4226    {
4227      pthread_create(&th, (const pthread_attr_t *)*(_BYTE *)(v4 + 44), (void *(*)(void *))sub_68008564, v7);
4228      pthread_join(th, v8);
4229    }
4230  }
4231  *(_DWORD *)(v4 + 36) = v6;
4232  android::CameraService::Client::disconnect(v4);
4233  android::CameraService::releaseSound(*(_DWORD *)(v4 + 16));
4234  if ( unk_6800D370 > 0 )
4235    _android_log_print(3, "CameraService", "Client::~Client X (pid %d, this %p)", v6, v4, v18, v19, th);
4236  android::sp<android::MemoryHeapBase>::_sp(v4 + 88);
4237  v9 = *(_DWORD *)(v4 + 84);
4238  if ( v9 )
4239    android::RefBase::decStrong(v9 + *(_DWORD *)(*(_DWORD *)v9 - 12), v4 + 84);
4240  pthread_mutex_destroy((pthread_mutex_t *)(v4 + 80));
4241  v10 = *(_DWORD *)(v4 + 48);
4242  if ( v10 )
4243    sub_680090C4(v10 + 4);
4244  v11 = *(_DWORD *)(v4 + 40);
4245  if ( v11 )
4246    android::RefBase::decStrong(v11 + *(_DWORD *)(*(_DWORD *)v11 - 12), v4 + 40);
4247  android::sp<android::ICameraClient>::_sp(v4 + 24);
4248  android::sp<android::ICameraClient>::_sp(v4 + 20);
4249  v12 = *(_DWORD *)(v4 + 16);
4250  if ( v12 )
4251    android::RefBase::decStrong(v12 + *(_DWORD *)(*(_DWORD *)v12 - 12), v4 + 16);
4252  v13 = *(_DWORD *)&_VTT_for_android::CameraService::Client[4];
4253  v14 = *(_DWORD *)&_VTT_for_android::CameraService::Client[52];
4254  *(_DWORD *)v4 = *(_DWORD *)&_VTT_for_android::CameraService::Client[4];
4255  v15 = *(_DWORD *)(v13 - 12);
4256  v16 = *(_DWORD *)&_VTT_for_android::CameraService::Client[56];
4257  *(_DWORD *)(v4 + v15) = v14;
4258  *(_DWORD *)(v4 + 4) = v16;
4259  sub_68007808(v4, (int)&_VTT_for_android::CameraService::Client[8]);
4260  android::RefBase::_RefBase(v5);
4261  return v4;
4262}
4263// 68007140: using guessed type int __fastcall android__RefBase___RefBase(_DWORD);
4264// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
4265// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
4266
4267//----- (6800AC20) --------------------------------------------------------
4268void *__fastcall _non_virtual_thunk_to_android::CameraService::Client::_Client(int a1, int a2, int a3, pthread_t a4)
4269{
4270  return android::CameraService::Client::_Client(a1 - 4, a2, a3, a4);
4271}
4272
4273//----- (6800AC28) --------------------------------------------------------
4274void *__fastcall android::CameraService::Client::_Client(int a1, int a2, int a3, pthread_t a4)
4275{
4276  void *v4; // r4@1
4277
4278  v4 = (void *)a1;
4279  android::CameraService::Client::_Client(a1, a2, a3, a4);
4280  operator delete(v4);
4281  return v4;
4282}
4283
4284//----- (6800AC3C) --------------------------------------------------------
4285int __fastcall android::CameraService::Client::_Client(int a1, int a2)
4286{
4287  int v2; // r6@1
4288  int v3; // r5@1
4289  int v4; // r4@1
4290  int v5; // r0@1
4291  int v6; // r6@1
4292  void *v7; // r3@3
4293  void **v8; // r7@4
4294  int v9; // r3@8
4295  int v10; // r0@10
4296  int v11; // r3@12
4297  int v12; // r3@14
4298  int v13; // r3@16
4299  pthread_t th; // [sp+Ch] [bp-1Ch]@5
4300
4301  v2 = *(_DWORD *)a2;
4302  v3 = a2;
4303  v4 = a1;
4304  *(_DWORD *)a1 = *(_DWORD *)a2;
4305  *(_DWORD *)(a1 + *(_DWORD *)(v2 - 12)) = *(_DWORD *)(a2 + 60);
4306  v5 = *(_DWORD *)(a2 + 64);
4307  *(_DWORD *)(v4 + 4) = v5;
4308  v6 = sub_68007BB0(v5);
4309  if ( unk_6800D370 > 0 )
4310    _android_log_print(3, "CameraService", "Client::~Client E (pid %d, this %p)", v6, v4);
4311  v7 = *(void **)(v4 + 84);
4312  if ( v7 )
4313  {
4314    v8 = (void **)*(_BYTE *)(v4 + 44);
4315    if ( !*(_BYTE *)(v4 + 44) )
4316    {
4317      pthread_create(&th, (const pthread_attr_t *)*(_BYTE *)(v4 + 44), (void *(*)(void *))sub_68008564, v7);
4318      pthread_join(th, v8);
4319    }
4320  }
4321  *(_DWORD *)(v4 + 36) = v6;
4322  android::CameraService::Client::disconnect(v4);
4323  android::CameraService::releaseSound(*(_DWORD *)(v4 + 16));
4324  if ( unk_6800D370 > 0 )
4325    _android_log_print(3, "CameraService", "Client::~Client X (pid %d, this %p)", v6, v4);
4326  android::sp<android::MemoryHeapBase>::_sp(v4 + 88);
4327  v9 = *(_DWORD *)(v4 + 84);
4328  if ( v9 )
4329    android::RefBase::decStrong(v9 + *(_DWORD *)(*(_DWORD *)v9 - 12), v4 + 84);
4330  pthread_mutex_destroy((pthread_mutex_t *)(v4 + 80));
4331  v10 = *(_DWORD *)(v4 + 48);
4332  if ( v10 )
4333    sub_680090C4(v10 + 4);
4334  v11 = *(_DWORD *)(v4 + 40);
4335  if ( v11 )
4336    android::RefBase::decStrong(v11 + *(_DWORD *)(*(_DWORD *)v11 - 12), v4 + 40);
4337  android::sp<android::ICameraClient>::_sp(v4 + 24);
4338  android::sp<android::ICameraClient>::_sp(v4 + 20);
4339  v12 = *(_DWORD *)(v4 + 16);
4340  if ( v12 )
4341    android::RefBase::decStrong(v12 + *(_DWORD *)(*(_DWORD *)v12 - 12), v4 + 16);
4342  v13 = *(_DWORD *)(v3 + 4);
4343  *(_DWORD *)v4 = v13;
4344  *(_DWORD *)(v4 + *(_DWORD *)(v13 - 12)) = *(_DWORD *)(v3 + 52);
4345  *(_DWORD *)(v4 + 4) = *(_DWORD *)(v3 + 56);
4346  sub_68007808(v4, v3 + 8);
4347  return v4;
4348}
4349// 680071C4: using guessed type int __fastcall android__RefBase__decStrong(_DWORD, _DWORD);
4350// 68007290: using guessed type int _android_log_print(_DWORD, _DWORD, const char *, ...);
4351
4352//----- (6800AD64) --------------------------------------------------------
4353void *__fastcall _virtual_thunk_to_android::CameraService::Client::_Client(int *a1, int a2, int a3)
4354{
4355  return android::CameraService::Client::_Client(
4356           (int)((char *)a1 + *(_DWORD *)(*a1 - 12)),
4357           *a1,
4358           a3,
4359           *(_DWORD *)(*a1 - 12));
4360}
4361
4362//----- (6800AD74) --------------------------------------------------------
4363int __fastcall _virtual_thunk_to_android::CameraService::Client::_Client(int *a1, int a2, int a3)
4364{
4365  return android::CameraService::Client::_Client(
4366           (int)((char *)a1 + *(_DWORD *)(*a1 - 12)),
4367           *a1,
4368           a3,
4369           *(_DWORD *)(*a1 - 12));
4370}
4371
4372//----- (6800AD84) --------------------------------------------------------
4373void *__fastcall _virtual_thunk_to_android::CameraService::_CameraService(int a1)
4374{
4375  return android::CameraService::_CameraService((void *)(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12)));
4376}
4377
4378//----- (6800AD94) --------------------------------------------------------
4379int __fastcall _virtual_thunk_to_android::CameraService::_CameraService(int a1)
4380{
4381  return android::CameraService::_CameraService(a1 + *(_DWORD *)(*(_DWORD *)a1 - 12));
4382}
4383// 6800974C: using guessed type int __fastcall android__CameraService___CameraService(_DWORD);
4384
4385// ALL OK, 152 function(s) have been successfully decompiled