So far, I've determined part of the EEPROM memory map and all keycodes. To make more progress, I'll need access to an upgraded remote (URC8800 or 9800) to see how the upgrade codes are stored.
Or maybe I'll release my software in the hopes that an advanced electonics hobbyist with an upgraded remote can post the memory dump. I've been using a Linux kernel driver I wrote to capture the EEPROM signals through the parallel port. I wrote another program to process the raw signal data and show the Serial-EEPROM operations (read/write address & data, etc.). I'm reluctant to do this though, because parallel port projects aren't for beginners and I don't want someone burning out their PC's parallel port (or remote).
01b-0ff: advanced codes (fixed size, 5 bytes each) & macros 1st byte is keycode 3rd-4th bytes are copies of device number
100-105: pointers
3ff-???: learned code data structures (variable size, 13-14 bytes each for my examples) 1st byte is keycode 3rd byte is length of learned code 4th-nth bytes are the learned code
