I wonder how 400plus does this. Got a ROM dump from 400D (as the portable ROM dumper works there too), but didn't attempt to emulate it beyond what already happened to work. It boots the GUI (I didn't do anything special for that), but the buttons are not working, as the MPU messages use a different format. I can ask Edu to capture diagnostic logs or whatever else I need to understand how it works, so it should be doable.
Did I hear my name...?

This is what we did in 400plus:
* Users can write a complete dump of the current camera configuration (mode, exposure, aperture, iso, ...) to the card; there is a structure in RAM called "DPData" that contains that info.
* Users can also assign each one of those dumps to one of the scene modes (this is done purely in 400plus, the original firmware is not aware of this).
* We intercept intercom messages, and when we detect that the user moved the wheel to a scene mode, we recall the configuration we had dumped previously, and then we apply it as if the user was navigating the menus.
* We also save the configuration from the manual modes and recall them when the user goes back from an override scene mode to a manual mode.
* If the user moves the wheel too fast, weird things happen...
All the interesting code is in those two files:
*
https://github.com/eduperez/400plus/blob/master/cmodes.c*
https://github.com/eduperez/400plus/blob/master/snapshots.cI made lots of mistakes during the development of that feature (we did not have an emulator back then

), and I never experienced any ERR70 or (soft)bricks... perhaps the 400D is more resilient than other cameras

.