BTW, CHDK doesn't use any exploit or vulnerability as all Canon cameras can boot from the SD memory, you only need to know the firmware file format, that it is of course already documented by the folks from CHDK.