OK, I've had a closer look at u-boot.map and u-boot.bin...
The command table starts at offset 0x001268e into u-boot.bin and each entry is 24 bytes. The first entry is:
001268e: 90 e0 04 38 02 00 00 00 00 00 00 00 86 08 04 38 98 e0 04 38 ba e0 04 38
Which decodes down to:
90 e0 04 38 => cmd_tbl_t->name ASCII string at offset 0xe090 in u-boot.bin "autoscr"
02 00 00 00 => cmd_tbl_t->maxargs 2
00 00 00 00 = cmd_tbl_t->repeatable 0
86 08 04 38 => cmd_tbl_t->cmd u-boot.map => do_autoscript ()
98 e0 04 38 => cmd_tbl_t->usage ASCII string at offset 0xe098 in u-boot.bin "autoscr - run script from memory"
ba e0 04 38 => cmd_tbl_t->help ASCII string at offset 0xe0ba in u-boot.bin "[addr] - run script starting at addr - A valid autoscr header must be present"
So the table and all the references in it are valid and u-boot.map suggest it should be located at 0x540, but what is this relative to, and how does it end up there? I feel I'm getting closer, but missing one tiny, but critical, bit of info.
Sorry if this all seems obvious, but this is the first time I've dealt with data at such a low level
Regards,
Graeme