That sounds very difficult to me. So i have only the chance to run my own firmware with that bootloader. That makes me a very sad.
That's already a good start !
What do you need to see that is in the bootloader and would not be in the firmware file?
Now I think you must disassemble the firmware and look for known PP registers to find what could be access to the buttons, LCD .. and try to reproduce the behaviour in your own (C / assembly) code.
I'm not familiar with PP, but I would start looking at the files firmware/export/pp*.h