I'm seeing the same in the 70D firmware. Haven't quite finished analysing it yet, but it's looking like if you set the right flag in the Bootflags area (F8000000?) (like you do for F8000004 to get the camera to boot an autoexec.bin off the memory card) the code will branch to an area where the Factory Adjust menu is set up.
So, crafting a special .FIR that sets the Factory Adjustment (?) mode flag is probably the way in, but I'm guessing.