Very interesting!
> As such, during my investigation I found a bit of code mapped to an unknown memory area 0x0081_0000. It contained what seemed to be a vector table, code for bootstrapping the system, and then some USB code with a small protocol to do some debug operations. The code was written as it was supposed to live at address 0x00 (which is where the Flash is mapped to in normal conditions).
Is this something you can pattern-match directly from the assembly, or was this dis-assembled to C or so?
Finding the memory area involves running code on the device that scans the entire memory range (catching data aborts where needed).
As for figuring out what the code does, it's a combination of staring at the hex, disassembly and semi de-compiled code.