Thanks to this discussion, I've been able to figure out the structure of the 40D's romStart function. See below for the latest FLIST.TXT which has all of the function calls labeled from romStart() onward. This should help quite a lot to duplicate the work of owerlord in getting AUTOEXEC.BIN to run on the 40D.