Started playing with CHDK for the SD940 a few days ago. Have a dump of the rev C firmware and so far can confirm that the correct value for decoding is NEED_ENCODED_DISKBOOT=3
(as used in platform/<camera>/sub/<version>/makefile.inc and referenced in tools/dancingbits.c).
For reference, the decoding pattern is at address FFB61EC8 and consists of 8 x 32bit words : 2,5,0,4,6,1,3,7. The subroutine that actually does the decoding is located at FF9D5364.
One small step - hopefully more to come.