Jason,

Although I didn't look deep into it, I believe the PDT is a Intel Hex format file. This would be a normal way to feed a processor's flash. I think (but should investicate)it is just the same data as the corresponding mdl.
I think in the remote are some more tables (including the actual program code).
Of course we should be able to extract them. The boot loader (which is ofcourse write protected, if they developed the remote correct) is probable able to extract all memory from remote. We must have a look at the initial serial communication.

adding page5: Hmm, this is probably not possible, I believe to many variables are involved. One example, the default button assignment is probably (grid position + pagenumber * 40 ).

Moving time, date etc.: This should be possible I think

Sharing info: Always interested.

Greetings Rene