The firmware of my Ixus950 (and I believe all other cameras with the same sensor -- A720, S5, Ixus80 to name a few) contains an interesting piece of code VsubCont.c, called from ImageSensorTask. The name immediately raises suspicion, as it reminds the mnemonics of Substrate Voltage Control in some CCD chips. The function (located at FF9B9C3C in my case) writes to three hardware ports (CCD voltage control??), 0xC022009C, 0xC0F18010, and 0xC0220090. Calling it with allowed parameters 1,2,4,8 doesn't produce anything spectacular -- just changing the live image brightness a bit. But does it actually change CCD voltages, and if so, which ones? The best way to find out would be to hook up a voltmeter to the sensor pins while writing to these ports -- but this requires opening up the cam, which I don't like. I thought you might have already taken one apart.
I remember on CCD webcams, if you reduced the voltage a bit, the image brightness was slightly darker. And when I was experimenting with the amp-off on my A530, I remember the same thing happened. If you further reduce the voltage, there's a point where the image gets black and some weird horizontal lines.
On A530, the CCD feeds from a voltage multiplier at some 13V. If the voltage multiplier is software-controllable we're right on track. At 10V (already out of specs) you still get images, but darker. My amp off reduces the voltage at some 6V, where you get nothing in live preview. The idea is to decrease the voltage inmediately when the exposure begins, and RESTORE the original volts before the exposure finishes, else you get a black image and maybe some white lines. If you decrease the volts even lower than 6V, there's a point where the CCD "turns off" and you might get nothing, even after restoring the original volts before the CCD readout.
I also remember on the Reflex 300D, it has a pin to control the CCD glow directly. Check:
http://glogg.jupiter-io.net/300D/amp_off/amp-off.asp and also
http://glogg.jupiter-io.net/300D/Regards!
PS: my friends tried out long exposures with sucess on A570, works!
