Thanks!
I tried booting with another chamaleon bootloader in a usb stick (from this post) and then tried the com.apple.Boot.plist edit, and both lead the boot to almost the same point.

When I tried with the other chamaleon usb stick, the boot stuck in a line that started in AppleYukon2, then I don't remember what it said, and ended in "nothing received, soft reset of chip". After a long time (~15min) that message was repeated three times.

Now, loading with the bootloader from the drive (from this guide) the boot is stuck in "dsmos: Hook and decryption contexts set!".

Any ideas?
Thanks,
Rodrigo