Ok these are my conclusions:
- The first section is included in the checksum, it won't allow changes in the strings of the 1st section.
- Same goes for the second section
- A "fixed" firmware with bytes tweaked to complain with the checksum is accepted, I just uploaded it with the patch supposed not to check the checksum
- My patch isn't working, checksum is still checked
- GREAT NEWS!!!
i switched "Update firmware?" with "Update fhrmwbre?" (word alignment, a+1=b, i-1=h to fix checksum) AND it was displayed on the screen, so we can execute code on the camera WITHOUT writing to the flash! - now we must find out how the checksum is calculated and where it's stored.