I hacked my camera's firmware manually by using an exploit to cause it to execute arbitrary code - and then blinking out the entire firmware in 0's and 1's on the autofocus LED - read in by a photo transistor attached to a sound cable plugged into my microphone port - and then put back into 0's and 1's... Then disassembled the ARM9 code in it and worked on porting CHDK to it... I'm pretty sure having a whole OS at my disposal should make this a lot easier