both inside and outside the cradle. However I was not able to see the USB bit I had identified before. What would its address be? Nafraf had made me a patch back then so that I just used the "Show misc. Values" feature I think.
physw_status on this camera is 3 32 bit words starting at 0x10FF0. The USB bit is in 0x10FF4. I'm a little surprised the first is all 0. You should see the last FFFF change if you press buttons on the camera.
When the tools menu crashes in 1.4, what happens? Does the camera hang, or shut down?
My a540 hung once, but it seems to work most of the time.
Also, can you open the games menu? It works in a similar way to the "tools" menu, so it might have similar problems.
edit:
I've now had the games menu freeze
once twice on A540 as well.