ARM Cortex M3 firmware
Are you certain you can't access the SWD pins on the device? It seems unlikely that the manufacturer would have a part that they are unable to debug themselves. Its not like they have shown any concern about protecting ttheir IP to date. Check that the ST bootloader doesn't respond too. Maybe the manufactturer wrote custom tools to interface to this bootloader.  

You have disassembled the bin file, I assume. Did you spot anything that looks like a vector table? Unlike the A-class cores which have  a block of LDR PC,[PC#0x20] repeated (or something similar) - followed by a string of addresses, in M-class, the vector table is always a list of addresses with bit 0 set (same as for any branch to Thumb). Before the vector addresses is the initial stack pointer value. Actually any PC relative load-pc ought to give you some clues, again these will reference an odd-number value.