(wifi specific discussion split to
https://chdk.setepontos.com/index.php?topic=10724.msg145454#msg145454 - not sure it makes sense to try to split up. I'll try to keep things that are wifi only in that thread for now, but don't worry about replying in the wrong thread)
Here's patch that enables the black screen unlock for all models, except very early vxworks (ixus30, 40, 50, 700 and s2is). The cameras without support just have the additional code disabled, because the cameracon_state variable isn't found.
This works completely for me on a540, d10, sx160 and elph130. On my dryos >=r55 cameras (g7x, sx710, elph180, sx730) switching to rec using switch_mode_usb fails, but switching with half press after that works, and subsequent switches are OK.
I'm inclined to check this patch in roughly as is, because it seems to be a significant improvement for most cameras.
My test case is:
connect using chdkptp over usb
!con:ptp_get_object_handles()
rec
shoot
record video
play
rec
Poking the variable discussed earlier makes switch_mode_usb work as expected on the dry55+ cams. When connected to USB, I don't see the menu issues mentioned in
https://chdk.setepontos.com/index.php?topic=10724.msg145470#msg145470 (on elph180, the variable is 0x23b4)
My current thinking is the menu weirdness on wifi isn't caused by variable, rather it's other state associated with wifi (perhaps because rec+wifi on these cams expects to run from the mobile app), and the variable just allows getting into rec in the first place.
I suspect the variable needing to be poked is a change between dryos r52 (elph130 and sx280 don't need it) and r55. The same variable appears to be present on elph130 (0x2934) but it isn't set by con:ptp_get_object_handles().
It would be nice to know if it's required in r54 (r54 cams include ixus145_elph135, ixus150_elph140, ixus265_elph340, sx600, sx700), I wasn't able to tell for sure from disassembly.
The code related to cameracon_state and this variable seems to center around a function that has a switch on cameracon_state (elph130 ff0810e8, elph180 ff858684, g7x fc0dfe1c)
It appears to take 2 parameters that look like levent IDs (or 0), and transitions to the next cameracon_state. On the cameras the require poking the variable, it's set in the cases related transitioning to state 3 and state 4 (often cases 0xd and 0xe, but varies). The immediately following variable seems to often be set with it.
edit:
A couple more observations
Sending the black screen unlock 4482 / 4418 event when the screen isn't black seems harmless. It also unlocks the keyboard, like 4484 / 4420.