the 1000D uses vxworks like the 400D.
strings:
"host:/tornado2.2/target/proj/juno/default/vxWorks"
ROM:FF810008 aCopyright19992 DCB "Copyright 1999-2001 ARM Limited",0xA
ROM:FF810008 DCB "Copyright 1999-2001 Wind River Systems, Inc."
sig also work fine

and the code also gets loaded to 0x1900 like with the 400D
ROM:FF8100DC MOV R12, SP
ROM:FF8100E0 STMFD SP!, {R4,R11,R12,LR,PC}
ROM:FF8100E4 SUB R11, R12, #4
ROM:FF8100E8 MOV R4, R0
ROM:FF8100EC LDR R3, =0x37840
ROM:FF8100F0 SUB R2, R3, #0x1900
ROM:FF8100F4 MOV R3, R2,LSR#2
ROM:FF8100F8 LDR R0, =off_FFD51840
ROM:FF8100FC MOV R1, #0x1900
ROM:FF810100 MOV R2, R3
ROM:FF810104 BL sub_FF81011C
ROM:FF810108 MOV R0, R4
ROM:FF81010C BL usrInit
ROM:FF810110 LDMDB R11, {R4,R11,SP,PC}
i allready compared the dump with a 1.0.8 400D dump and its near the same. thats why it shouldnt be a big problem to port it to the 1000D.
ROM:FFFF439C aEos_develop DCB "EOS_DEVELOP",0 ; DATA XREF: sub_FFFF4144+11Co
ROM:FFFF439C ; sub_FFFF4144+138o ...
ROM:FFFF43A8 aBootdisk DCB "BOOTDISK",0 ; DATA XREF: sub_FFFF4144+12Co
ROM:FFFF43A8 ; sub_FFFF4144+148o ...
is also there and ..
ROM:FFFF30B4 aAutoexec_bin DCB "AUTOEXEC.BIN",0 ; DATA XREF: sub_FFFF3004+48o
ROM:FFFF30B4 ; sub_FFFF3004+6Co