Also keep in mind that many constants end up as immediate values that are scattered around the code, and that you can only write complete sectors. Writing a sector that happens to overlap with code the firmware is actually running would be a Bad Thing, since flash must be erased before writing. There might be other issues with this as well.
Oh, this reminds me of a uc I've worked with that allows erasing its internal flash in 1k sectors but it's really only safe to do it in blocks of 4 sectors unless you only cycle it a couple of times because the other 3 sectors need to be refreshed and may corrupt if you don't. We probably have no clue what sort of caveats like this Canon's flash may have.
It should be possible to determine what is required by looking at the canon functions that erase/write ROM. (crash log, factory mode adjustment tables, param tables)
The caveat is that these are never in areas that contain code, so any interaction with running code accessing the same sector would be unknown. To be safe, you'd want your entire code running in RAM (as the canon firmware updater does) but that would mean copying/implementing the flash handling functions yourself, unless you can find a canon updater to use.
You could try doing your flashing in a minimal diskboot, but then you'd have to be sure the functions you used did not depend on OS data structures.
The romstarter code might have flash writing functions as well, (should be safe if you aren't re-writing the romstarter, which I would definitely avoid!) but my impression is that it expects to just load an updater.
This whole approach of trying to raise the factory firmware limit strikes me as misguided. In my experience of the canon firmware, there is not likely to just be a single value you can change. The canon firmware uses tables of allowable shutters speeds and those have to correspond to ui elements etc. I think you'd be better off trying to hack the desired functionality into capt_seq using override values, so an override takes place when half press starts as well as after. It seems like you should be able to trick the camera into previewing using the override values.
Any of this will require extensive analysis and experimentation.
