Hi ! After a lot (40+) IDA sessions I think I got all addresses needed for the NHSTUB.
I compiled a little overview, including the necessary source changes & addresses above,
for you people who would like to check it. It does not do much at the moment, just reboots,
but should be adequate to test the addresses for all (?) cams.
-- Implements 'Cold Reboot'
-- Works only with diskboot.bin
(although, should be able to load a ps.fir first and then swap to diskboot.bin)
-- Should be applicable to any recent trunk (if working before

)
please report if it does/doesn't work for you !
source + comment attached edit: removed, see 2 posts further for corrected version
wim