Hi ChipRocker,
yes, I use IDA and sometimes arm-elf-objdump. If you have IDA, load the BASE.RKW as embedded rom-image, choose ARM architecture and load address (ROM) 0x5FFFFFD4. When its loaded go to location 0x60000000 and press 'c'. This should give you a branch (/jump) to some code thats installs the ARM exception handlers. Following the reset vector directs you to the firmwares main(). By comparing the disassembly with the source from the SDK (rename those sub_XXX by pressing 'n') its quite easy to make sense out of it. For a more detailed description have a look at this:
RKW Firmware Patching (dont use that patching program on the page).
Btw, Im also working on getting a real firmware running on the rk27 platform to get rid of this ultra crappy RockOS. So far I was aiming at ucLinux. I didnt get the UART working, so development is going really slow. A major step would be to get some virtual UART via USB (using CDC and ACM). I already found code for a virtual usb uart implementation for another platform but this doesnt seem to become easy at all (at least for me).
Regards