I checked out changeset 8159 (the last one with 40d changes) and compiled it with arm toolchain 4.6.2. It went without problems, I did not try any newer version)
Then I took the 5D installer from installer/5DC.111, replaced the addresses of LEDs and write_bootflag/read_bootflag functions with the ones found on the first page of this thread, compiled and created installer firmware with dissect_fw3 and assemble_fw tools. There is no known address for write_card_bootflag so I formatted the card manually.
Then It successfully enabled the bootflag and the camera is able to boot the built magic lantern, which works good enough to show menu. Then I dumped the fw and run ARM-console on it. Too bad that I don't understand the ARM assembler much.
I wanted the fps override function for night focusing, but I could not find anything like shadow registers, so I ended with a hack that writes hardcoded value to fps register from ISO prop handler each time when iso is set to 1600.
Also I noticed that the camera is rather unstable and crashes after several shots. I disabled everything except boot code and finally found that it gets fixed by calling cache_unlock() from ml_hijack_create_task_cmd_shell() in platform/40D.111/init.c.
Then I just re-enabled the ISO prop hack.
The camera now provides all the functionality that I need and is quite stable, so I don't plan to work on it further,