From WebOS Internals
Load Address: 0x40200000
The bootloader is actually stored outside the filesystem, starting from the second block of the Pre's flash disk.
This does some minimal hardware initialization, then loads the "real" bootloader and executes it. The "real" bootloader is tacked onto the end of boot.bin as a gzip. The offset of the "real" bootloader is different for every version. Table below will give you the right offset (If your version is not listed, then search with "hexdump -C boot-castle.bin | less" for the byte sequence "1f 8b" (the gzip format identifier)).
|Pre webOS 1.0.3 through webOS 1.2.1||0x19D0 (thanks roxfan)|
|Pre webOS 1.3.1||0x19f0|
6438a2f52ab18c0b71e9f95d4ad1980d webosdoctorp100eww-wr-1.1.3/webOS/boot-castle.bin 6438a2f52ab18c0b71e9f95d4ad1980d webosdoctorp100ewwbellmo-1.1.0/webOS/boot-castle.bin 6438a2f52ab18c0b71e9f95d4ad1980d webosdoctorp100ewwbellmo-1.2.1/webOS/boot-castle.bin 6438a2f52ab18c0b71e9f95d4ad1980d webosdoctorp100ewwsprint-1.0.3/webOS/boot-castle.bin 6438a2f52ab18c0b71e9f95d4ad1980d webosdoctorp100ewwsprint-1.2.1/webOS/boot-castle.bin 8f709233691f043b42d36f25c5398cde webosdoctorp100ewwbellmo-1.3.1/webOS/boot-castle.bin 8f709233691f043b42d36f25c5398cde webosdoctorp100ewwsprint-1.3.1/webOS/boot-castle.bin 8f709233691f043b42d36f25c5398cde webosdoctorp100ueu-wr-1.3.1/webOS/boot-castle.bin 02cfec1a9c7ae81316ac85c5c5979f9f webosdoctorp200ewwsprint-184.108.40.206/webOS/boot-pixie.bin 43647a5b1f746478d17584d7fd92c60c webosdoctorp200ewwsprint-1.3.2/webOS/boot-pixie.bin
"real" bootloader (bootie)
Load Address: 0x82000000
This looks a _lot_ like iBoot from the iPhoneOS devices, but others say that this is based off u-boot, so I will assume that is true and that iBoot is also based off of it. It even seems to have some of the u-boot commands, such as "printenv", "run", "setenv", "getenv", etc. I am currently looking into how to communicate with it as you can with iBoot.