I've got it -- and the procedure's (on Linux, at any rate) is much simpler, to boot. It's possible that it will behave differently with different cards, but this worked for me.
It turns out that there's no need at all to reformat the card. It can be formatted just fine in the camera. This left me with something like this:
# fdisk /dev/mmcblk0
The number of cylinders for this disk is set to 3625.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs
(e.g., DOS FDISK, OS/2 FDISK)
Command (m for help): p
Disk /dev/mmcblk0: 8239 MB, 8239710208 bytes
193 heads, 23 sectors/track, 3625 cylinders
Units = cylinders of 4439 * 512 = 2272768 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
/dev/mmcblk0p1 2 3626 8042496 b W95 FAT32
Notice that the partition starts on track 2. This leaves some space at the start of the card. So I created a new partition. But oops, I can't create partition 1 because it already exists, so it's going to be partition 2:
Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 2
First cylinder (1-3625, default 1):
Using default value 1
Command (m for help): t (If you don't do this, the camera won't know that it can boot from this partition)
Partition number (1-4): 2
Hex code (type L to list codes): 4
Changed system type of partition 2 to 4 (FAT16 <32M)
Command (m for help): p
Disk /dev/mmcblk0: 8239 MB, 8239710208 bytes
193 heads, 23 sectors/track, 3625 cylinders
Units = cylinders of 4439 * 512 = 2272768 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
/dev/mmcblk0p1 2 3626 8042496 b W95 FAT32
/dev/mmcblk0p2 1 1 2208 83 FAT16 <32M
Partition table entries are not in disk order
Oh. But there's this nice little 'f' command (to fix partition order) expert mode command:
Command (m for help): x
Expert command (m for help): f
Done.
Expert command (m for help): w
The partition table has been altered!
Now with that out of the way, everything's easy:
# mkfatfs -F 16 /dev/mmcblk0p1
# dd if=/dev/mmcblk0p1 of=boot.bin bs=32768
...edit 0x40...
# dd if=boot.bin of=/dev/mmcblk0p1 bs=32768
...remount the card, say on /media/CHDK...
# cp DISKBOOT.BIN vers.req /media/CHDK
# cp -r CHDK /media/CANON_DC (assuming that that's where the primary partition is mounted)
Eject the card, lock it, put it in the camera, and presto! It works!
