Notes on the ptt hack: (only known to work on basecode version 2.43, but I _think_ it works on the others too) Mods on page 77: zero bytes from $4D4A to (and including) $4D61 (hook kill in getRestrictionsOptions) Mods on page 0: zero bytes from $0aaa to (and including) $0ab8 (calls to _PTTReset and _SetAppRestrictions) What is left is (the patched version of) getRestrictionsOptions and DispResetComplete for fakeness purposes. Figured out by Mapar007, using brandonw's disassembly of the 2.43 os