@waterwings
Did you check PB2Rec and Rec2PB address too?
SD4000:
ROM:FF898B40 AC_PB2Rec ; CODE XREF: AC_PB2PC:loc_FF897B44
ROM:FF898B40 ; AC_EnryPB+D0 ...
ROM:FF898B40 STMFD SP!, {R4,LR} ; PB2Rec
ROM:FF898B44 LDR R0, =0x10A5
ROM:FF898B48 BL eventproc_export_IsControlEventActive
ROM:FF898B4C CMP R0, #0
ROM:FF898B50 LDMNEFD SP!, {R4,PC}
ROM:FF898B54 MOV R0, #0x60
ROM:FF898B58 ADR R1, aAcPb2rec ; "AC:PB2Rec"
ROM:FF898B5C BL LogPrintf ; LOCATION: CameraLog.c:237
ROM:FF898B60 MOV R0, #0xD
ROM:FF898B64 BL _sub_FF896F60__CameraConState.c__215 ; LOCATION: CameraConState.c:215
ROM:FF898B68 BL DispSwCon_MuteOnPhysicalScreen
ROM:FF898B6C MOV R0, #1
ROM:FF898B70 BL AC_ExitPB
ROM:FF898B74 LDMFD SP!, {R4,LR}
ROM:FF898B78 MOV R0, #0
ROM:FF898B7C B sub_FF83C1D8
ROM:FF898B7C ; End of function AC_PB2Rec
ROM:FF897590 AC_Rec2PB ; CODE XREF: EnrySRec:loc_FF8978EC
ROM:FF897590 STMFD SP!, {R4,LR} ; Rec2PB
ROM:FF897594 ADR R1, aAcRec2pb ; "AC:Rec2PB"
ROM:FF897598 MOV R0, #0x60
ROM:FF89759C BL LogPrintf ; LOCATION: CameraLog.c:237
ROM:FF8975A0 LDR R1, =0x3580
ROM:FF8975A4 MOV R0, #0
ROM:FF8975A8 STR R0, [R1,#0x80]
ROM:FF8975AC BL sub_FF89BBFC
ROM:FF8975B0 MOV R0, #1
ROM:FF8975B4 BL sub_FF83C1D8
ROM:FF8975B8 BL sub_FF97A664
ROM:FF8975BC CMP R0, #0
ROM:FF8975C0 BEQ loc_FF8975D0
ROM:FF8975C4 BL sub_FF89073C
ROM:FF8975C8 CMP R0, #0
ROM:FF8975CC BLNE DispSwCon_MuteOnPhysicalScreen
ROM:FF8975D0
ROM:FF8975D0 loc_FF8975D0 ; CODE XREF: AC_Rec2PB+30
ROM:FF8975D0 BL ShutdownRecMode
ROM:FF8975D4 LDMFD SP!, {R4,LR}
ROM:FF8975D8 MOV R0, #0x10
ROM:FF8975DC B _sub_FF896F60__CameraConState.c__215 ; LOCATION: CameraConState.c:215
ROM:FF8975DC ; End of function AC_Rec2PB
Else maybe overwrite switch_mode_usb() with different control event id may help?