So, I looked into the ARM reference and into ixus860is_dump ... which might be close to sd1100 or not.
(only have arm-objdump ... stuff like IDA only exists in proptary windows world

)
1. it looks for DISKBOOT.BIN and then Upgrader.bin. confirmed.
r0 -> *file (?!)
ff8650cc: e5d02000 ldrb r2, [r0]
ff8650d0: e3520000 cmp r2, #0 ; 0x0
ff8650d4: 112fff1e bxne lr
ff8650d8: e5902010 ldr r2, [r0, #16]
ff8650dc: e59f303c ldr r3, [pc, #60] ; ff865120 <_binary_ixus860is_dump_start+0x55120>
-> "gaon"isoy
ff8650e0: e1520003 cmp r2, r3
ff8650e4: 05902020 ldreq r2, [r0, #32]
ff8650e8: 059f3034 ldreq r3, [pc, #52] ; ff865124 <_binary_ixus860is_dump_start+0x55124>
-> gaon"isoy"
ff8650ec: 01520003 cmpeq r2, r3
ff8650f0: 012fff1e bxeq lr
...
don't understand the rest, yet.
2. it looks first byte if 0x00, and then checks "gaonisoy" ...
confirmed.
0x00 => brick
0x00 and "gaon" at #16 and "isoy" at #32 => no brick, (but still hates usb)
I googled for that string. Found "yosinoag", which is a litte japanese assurance company.
ff82bbd8: e59d1000 ldr r1, [sp]
ff82bbdc: e1a00004 mov r0, r4
ff82bbe0: eb00e539 bl ff8650cc <_binary_ixus860is_dump_start+0x550cc>
ff82bbe4: e3a00101 mov r0, #1073741824 ; 0x40000000
ff82bbe8: e5906000 ldr r6, [r0]
ff82bbec: e59d5000 ldr r5, [sp]
ff82bbf0: ebffbf31 bl ff81b8bc <_binary_ixus860is_dump_start+0xb8bc> IRQ off?!
ff82bbf4: e3a03c19 mov r3, #6400 ; 0x1900
ff82bbf8: e1a02005 mov r2, r5
ff82bbfc: e1a01004 mov r1, r4
ff82bc00: e3a00c19 mov r0, #6400 ; 0x1900
ff82bc04: e12fff36 blx r6
ff82bc08: e8bd40f8 ldmia sp!, {r3, r4, r5, r6, r7, lr}
ff82bc0c: ea006226 b ff8444ac <_binary_ixus860is_dump_start+0x344ac>
So, it gets the jump address from 0x40000000 ...
Questions:
Has canon implemented exception handling?
What happens on other cams, if there is a undefined instruction or a breakpoint (freeze/brick/reboot/poweroff)?
In which mode does the ARM cpu run (LE, User Mode, whatever)? Do we have a MMU?