For firmware 1.01C the d4b key is located at 0x7E3618 and the d4b IV at 0x3EDA1B.
(The actual key/IV pair is the same as for SD4500 and possibly S95)
These together with a PID of 0x3211 encrypt successfully the PS.FI2 .
I check d4b key of SX130, SD4500 and S95 and key is the same, but
are You sure about offset for d4b IV key?
I check with d4b IV key for SD4500 and it is not the same key ( d4b IV key offset for SD4500 is 0x43B71C, confirmed).
I cant find information about d4b IV key offset for S95.
Please check d4b IV key offset.
UPDATE
d4b IV key offset is wrong
Correct info:
For firmware 1.01C the d4b key is located at 0x7E3618 and the d4b IV at 0x3EDA0C (length 16 bytes/32 hex values)
(The actual key/IV pair is the confirmed same as for SD4500 and S95).