never done much with the DSA except verifying that it used the same crypto algos back then (posted my DSA ida in the other thread).
But what you wanna do is, take openocd + gdb for blackfin, and step through the bootup process. if memory serves right execution started somewhere 0xef000000 as init vector (the blackfin datasheet is your friend), and then u trace through it. probably an LDR stream somewhere that gets then copied to RAM and executed, find the copy action, then dump the RAM blocks and you will have a boot loader image. reassemble that as an LDR stream.
here is a sample for a lcd test tool for the ds2000, and creating a RigolDsExe.ldr which the ds2000 will happly execute from an USB stick. (maybe the DSA does too, never tried, give it an endless loop and see if it hangs actually)
files below are posted in the other thread.
#!/bin/bash
CC=/opt/uClinux/bfin-elf/bin/bfin-elf-gcc
rm *.o
$CC -nostartfiles -nodefaultlibs -c init.S -Iinclude -mcpu=bf526
$CC -nostartfiles -nodefaultlibs -c main.c -Iinclude -mcpu=bf526
$CC -nostartfiles -nodefaultlibs init.o main.o -T bfin.ld -o my.elf
bfin-uclinux-ldr -T bf526 -c --dma 6 RigolDsExe.ldr my.elf
bfin-uclinux-objcopy --gap-fill=0xff -O binary my.elf my.bin
cp my.bin /var/lib/tftpboot/