I found a function that checks for an uppercase "EYEFI" string.
sx150 100a:
sub_ffa70630:
ffa70630: e92d4010 push {r4, lr}
ffa70634: e3a02005 mov r2, #5
ffa70638: e28f1fe6 add r1, pc, #920 ; ffa709d8: (46455945) *"EYEFI"
ffa7063c: ebf68e8f bl strncmp
ffa70640: e2700001 rsbs r0, r0, #1
ffa70644: 33a00000 movcc r0, #0
ffa70648: e8bd8010 pop {r4, pc}
sub_ff9170c8: ; 8 refs
ff9170c8: e92d401c push {r2, r3, r4, lr}
ff9170cc: e59f0480 ldr r0, =0xa5940
ff9170d0: e5d01006 ldrb r1, [r0, #6]
ff9170d4: e3510000 cmp r1, #0
ff9170d8: 15d00001 ldrbne r0, [r0, #1]
ff9170dc: 1a00000d bne loc_ff917118
ff9170e0: e1a0000d mov r0, sp
ff9170e4: eb0152f9 bl sub_ff96bcd0 ; retrieve some card(?) related data
ff9170e8: e3500000 cmp r0, #0
ff9170ec: 1a000008 bne loc_ff917114
ff9170f0: e1a0000d mov r0, sp
ff9170f4: eb05654d bl sub_ffa70630 ; check for EYEFI in the previously retrieved data
ff9170f8: e3500000 cmp r0, #0
ff9170fc: 0a000004 beq loc_ff917114
ff917100: e59f0450 ldr r0, =0x10c2
ff917104: ebfe11c2 bl IsControlEventActive_FW
ff917108: e3500000 cmp r0, #0
ff91710c: 13a00001 movne r0, #1
ff917110: 1a000000 bne loc_ff917118
loc_ff917114: ; 2 refs
ff917114: e3a00000 mov r0, #0
loc_ff917118: ; 2 refs
ff917118: e8bd801c pop {r2, r3, r4, pc}
sub_ff9170c8 is the only function that calls the string checker routine, it could be the card type detector. One could peek (and poke if brave enough) around 0xa5940, maybe the detection can be sabotaged...
By poking I mean specifically the bytes at 0xa5941 and 0xa5946, as the above routine expects.
This will obviously only work if the data around 0xa5940 is not refreshed continuously. Even if it "works", the result may not be useful at all, since the firmware may have already detected the card in the boot process.