The only legal way you can obtain that firmware is by owning a MessagePad 2000/2100, or at the very least its complete motherboard (although in the latter case I wish you all the best in extracting the ROM image -- AFAIK it can only be done from a working MessagePad). Be advized that Apple is apparently following the OpenEinstein project with its usual beady patent lawyer eyes and that any illegal providing of MessagePad ROM images might result in a swift termination of the project. This is one case I certainly don't want the P2P "community" to jump on.