1. Create on SD card file "00078400.597" with "[OPEN_DEBUG_MENU]" and LF char.
2. Create on SD card file "DEVELOP.MOD" exact 10 bytes long with binary content:
For Development Menu 1-6: 07 01 2C 1F 10 03 1E 16 05 2D
For Development Menu 1-7: 07 1A 02 0A 19 18 1B 1C 05 11
Use hexeditor to enter these bytes.
3. Turn off camera, plugin this SD card. Leave card door open. Hold "menu" button and turn camera on.
Via bootcoder @ DPR Forum
The binary file by bootcoder is also made available by him here.