Thanks for the hints. I attach a list of all 105 DryOS commands with some explanation I gatherd. It seems to me that this shell is limited to manufacturing diagnostic.
Yeah dry shell is pretty limited on powershots.
FWIW, if you can script interaction with the serial console, it seems like it shouldn't be a huge amount of effort to dump RAM/ROM that way. If you get a dump of the firmware, finding a place you can use xm execute arbitrary code should be pretty straightforward.
edit:
Saw your talk comment on the wiki. That "welcome" message on your wiki talk from me is auto-generated, we really don't use talk for much. The forum is much better for discussion. I don't think the wiki lets you attach spreadsheet files. You could link your post with the attachment from a wiki page, or host it elsewhere like a google doc.