Is anything known about how they are made? Is one able to just get a stream of either of these images either with or without moving the shutter?
I believe most of them are created from the full-size raw buffer (what ends up in a full-res silent picture). Writing to this buffer at the right moment (after CCDWriteEDmacCompleteCBR, or just before scsFinalReadoutDone) will alter the JPEG preview, and probably the RGB image as well.
For some low-level details, look
here.
For example, on 5D3, the 160x120 jpeg is created with:
[TTJ][167,79319,0] JPEG(160,120,8,0)
ShootSsDev:000afe98:00:00: *** SetEDmac(0x1c, 0x41565200, 0x0, 0x20000000), from ff3c6b38
ShootSsDev:000afe98:00:00: *** SetEDmac(0x20, 0x43270070, 0x16669c, 0x1), from ff576404
...
From the figure linked above, channel 0x1c = 28 uses an input buffer of 400x540 bytes.
The LCD image is created from a 2880x960 input buffer (channel 25, likely YUV422) and the output is 1440x480 (channel 18, YUV422 => 720x480 pixels), so that processing path probably uses some sort of 2x2 pixel binning.
Some of the intermediate buffers seem to be created directly from the image processor; they happen at the same time as CCDWrite (5D3: channel 0), and they are probably all waiting for sensor data to be read out.
You can get such logs from dm-spy-experiments branch, and the raw data for EDMAC activity charts from the "edmac" branch. DIGIC 4 cameras are easier to analyze, because all the transfers are initiated from the main CPU. On DIGIC 5, some of them are started from Eeko.
If you can make those graphs more readable, that would be very helpful.