First of all: Thanks mweerden for the great work!
I located the PTP functions in the
G9 1.00d firmware, if anyone else is interested:
NHSTUB(add_ptp_handler, 0xFF8D897C) // via ptp handler table
NHSTUB(get_ptp_handler_entry, 0xFF8D8F9😎 // via add_ptp_handler
NHSTUB(get_ptp_handler, 0xFF8D8B10) // directly below get_ptp_handler_entry
NHSTUB(rem_ptp_handler, 0xFF8D8A6😎 // directly below add_ptp_handler