Thanks, that proved very useful to have indeed.
Is there some similar documentation of the protocol used earlier in the process, e.g. to upload the updater (USB HID)?
In particular I seem to be missing something rather crucial. Based on the sbloader code I found elsewhere in the forum I've managed to upload updater_ivt.sb, but afterwards nothing happens, I suspect it's not started since I don't see the USB MSC device appearing. Of course MFG can run its boot command just fine, and after finishing the USB MSC device appears. I've compared the USB traffic and have found no discernable difference (no missing packages, BLTC commands are same, CBWs are same).