Oleg, there is no way to "upload" to the bootloader area using the API calls (which are contained in the bootloader.) The special SFRs, which are used in the bootloader, must be used in user code space when re-programming the bootloader space. The special undocumented SFRs, and MOVC's are what is needed... but to know the special undocumented SFRs, you must get info from Atmel one way or another.

Jimmie, the characters are not echoed. The protocol is a derivative of Philips IAP protocol. It only echoes the "U" character for autobauding.