I decided to begin a new thread - becose propably all the dslr have a bootloader.
I blinked it out from my 400D. It was at adress FFFF0000.
In the loader program of 400D firmware there are addresses:
bootloader 0xF87F0000 (+0x07800000 = 0xFFFF0000)
firmware 0xF8010000 (+0x07800000 = 0xFF810000)
Propably the addresses in the loader are the ROM *write* adreses. When you try to write to 0xFF810000 segment - it don't work - I didn't yet tried to write to the 0xF8010000 segment.
I attach the bootloader from 400D (all versions of firmware)
NEW: there is a "Run program from CF" option in the bootloader menu :-) I hope it's ELF. I'll check it tomorrow