I understand why you changed 0x800000 to 0x7E0000. My question is how does it work without it?
It will work, but if the camera eats all the memory, the hack is gone...
I'm not sure if our camera can eat all it's memory, but on some (most) cameras with ML it happens.
Here is some info about "vmBaseGlobalMapInit" which I disabled to save cache-hacks:
http://www.vxdev.com/docs/vx55man/vxworks/ref/vmBaseLib.html
I did not know the purpose of this function, Thanks for the link.
Actually you can see my comments in our init.c where I've put the function back and NOP'ed another address.
This address was a call to cacheLib from this function and now when I've read the link, it makes sense.
0xAF, can 400plus catch "trash_button_released" or "jump_button_released" events? If not, check cSetSendButtonProc(&My_SendButtonToMC, 0); in my code. Could be useful for something.
Yeah, I saw the code yesterday, looks interesting.
We have JUMP and TRASH via MainCtrl, I disassembled the MainCtrl routine to get them.
Now with the cache-hacks, I was thinking to remove all this code.
Your code looks better, though.
SetSendButtonProc() this is the function, that could saved me a lot of reverse engineering time when I worked on MainCtrl.

Thanks.
I started to work on IR remote code. Right now I can make camera respond to any remote on any key but can't make it respond only on specific keys. Looks like firmware only checking for pulse width and time between pulses.
Code is in remote.h:
http://hostr.co/0MiULSEGLdt3
Yeah, this is cool.
I know about this settings in the firmware and I had the same idea back in the time, though I never started to play with them. I will check you work and may play with it a bit.
EDIT:
I see you have IR_Log() function, can you log all signals with it ?
I mean when you press some button on a remote, can you distinguish between different remotes/buttons ?
If so, this is great. If not, the enabling of all IR signals is still a good feature.
EDIT2:
BTW, do you know what this MachineCell is and what is it's purpose ?
It looks like it is for some Factory Tests ?
EDIT3:
I took the vram_copy() routine from your code, to invert the OLC colors.
It seems to work, but not when you start the camera for the first time, it draws white first, then after i force any gui update it draws black.
I guess this is because we cannot detect (GUIMode == OLC_MODE) in the first moments. I will try to find a solution.
EDIT3.1:
I've found it...
It was because at the start the camera is changing the mode for a while, to draw the animation for sensor cleaning... so the check should be:
if (FLAG_GUI_MODE == GUIMODE_OLC || FLAG_GUI_MODE == GUIMODE_ACTIVESWEEP_OLC) {...}