Quote "It may be the case that these are the very routines we need to convince the camera we have called prior to our "shoot without setting up the mechanism" routine, since I would assume one of the things that the factory tests do is actually take a picture."
I wholeheartedly agree, certainly with the 2nd part. Effectively, if possible, that would translate to disconnecting the entire 48-pin main PCB connector, and be able to shoot. Ideally, phantom ZOOM should work too, because you do need to set full zoom if you want to prevent Canon PC software from applying barrel correction (explained much earlier in this thread).
Quote "Which suggests there may well be an error register, or registers, and this could be what is polled to see if we have a problem and need to shut down."
This seems to agree with a post-ASSERT continued limp-mode & shutdown, a sort-of "mecha task" that possibly exists at the lowest-level protection ring.
edit:
I managed to locate the IRIS RESET PI pins on the main connector. It's just a matter of bringing them out to the outside world and scoping them down.
