I do not understand. ISp with FlashMagic is straight forward, IAP require you have some code to process it. When your loader is running, what comes in and what comes out is TOTALLY controlled by the code you have loaded and what you send. The ROM bootloader is not described anywhere I know of, probably because it does not need be, just use FlashMagic, it takes care of everything. Once you have loaded your IAP loader (with FlashMagic) you can load 'your way'

Erik