you see bootloader fot find other (re)start code?)
Actually, I didn't find any thing usefull in the bootloader, yet. I don't know what code (firmware or bootloader) is runned when the battery is closed.
You can see what adress in mem writes every default value(--- Change OLC --- block)?
i sink when OS in camera load this data maybe changed (need check this if you can)...
The values printed in the OLC are properties changed and stored by "PropertyServer". It's an instance and it have interface like "GetSomething" "SetSomething" "LoadSomething" "SaveSomething" - And the last two of them are for writing and loadin it from the 3V memory I think.
That's for answering, now for my findings. For those of you that work on 400D, I have a big present :-) Full (debug level=1) log from the loading until state 0x40, and then pressed jump, menu, trash, jump, and others. Only jump(162) and trash(165) are making any effect. based on the earlyer logs I found the place where keys are made the messages for MainControll (T=2). But I can't find why and where are the other keys blocked !? It's now the most important thing to find, becose if I could unblock them, I could do something usefull and dump the logs.
The full log is in the attachment
EDIT: log changed. thanks _MAG_ :-)