If I understand it correctly, a stub 'software bootloader' gets uploaded to RAM, is executed and the real 'flashing' happens there.

I checked the following ROM commands, but some of them are not working (ISP_ECHO, ISP_MEMORY_READ, ISP_DEBUG_INFO).
Are these not implemented? Is it possible to do flashing without the software loader (just the ROM).

ISP_ECHO = 0xC1
ISP_NOP = 0xC2
ISP_MEMORY_WRITE = 0xC3
ISP_MEMORY_READ = 0xC4
ISP_MEMORY_BOOT = 0xC5
ISP_DEBUG_INFO = 0xD1
ISP_CHANGE_BAUDRATE = 0xc6