Does that help in finding the viewport_buffers and/or different get_viewport_fb_d/live_d ... functions ?
These are
buffers with the Y411 variant of YUV, their width is likely 720, height is 240 or 480. It could be however that Canon has changed things in DIGIC 4+ and introduced a different YUV variant for live buffers.
If you're not sure about the viewport addresses, you can try to hunt them down visually.
Once you have collected buffer addresses, you can search for them in ROM and RAM. Note that the live buffers are usually quad-buffered (in known new cameras), that's 4 consecutive equal size buffers. Also note that new cameras have other framebuffers in various sizes, which are not used by CHDK.
fb_d is the playback mode buffer, the others are obviously only active in record mode (you'll need to request new RAM dumps from the whole RAM - unless you're only suspecting a smaller area). The RAW buffers may overwrite these buffers' content after a shot is taken.
edit:
Wait a second... If chdkptp is working, it's enough to confirm that the "viewfinder" (live tab) shows what's on the LCD - no need for those huge dumps.
