OK so it looks like service mode can be used as a CRC01 stamping tool
1) Copy your modified .cfg files to be stamped (without any checksum) into \flashfs\system\service\appcore.d\config.d\
2) Start service mode via web interface
3) Using serial or telnet console ( no need to wait for service mode restart) ,
copy the files from \temp\appcore.d\config.d\*.* to your user flash \hack dir
4) Delete the files you
put in \flashfs\system\service\appcore.d\config.d\
(not sure if these are what caused problems before, but better be safe as it was a fiddle to recover)
Make sure the original conf.cfg is stil there.
You now have some CRC'd .cfg files in \hack, which you can try putting in your hack\crc folder to see what they do on the next cold boot.
Note it is not beyond doubt that some resource hacks might cause crashyness if you create resources that bork anything that runs beore applaunch,dat and progressapp (dunno if there are) , however it should in principle be recoverable by starting in E4 mode by cold booting with USB plugged in. Probably. YYMV.
Using this method to create a CRC'd PIP .cfg file from this
# Generated at CONFIG_DATE CONFIG_TIME
.caps.config.ui.fusion.PIP.enabled bool true
the PIP display mode now works.
I have tried putting a CRC32 on these files but it doesn;t work. CRC32 should for for .rsc files that go in the factory directory, but not sure if you can do anything useful other than change USB mode.
Detailed analysis of the resource attributes shown by rls -lll may give cluse about which reesources can be changed by which method.
now what else can we enable.....? Must read that Ex manual to see what other features the E8 adds...
Just to reiterate - cfg files with CRC01 are almost certainly unit-specific, so need to be generated on the actual unit being hacked.
As & when we find the hidden menu, this will all still be possible without opening, over the RNDIS connection. The only thing that the serial link is currently essential for is to enable USB RNDIS. Incidentally, the first thing you should do before any other hacking, as soon as you have RNDIS running is make a copy of everything in \flashfs as this is all put on at the factory and not easily replaceable,
You can do this at the console by copying to the user partition but it's a pain as there are many directories.
I've not yet managed to get any FTP client other than Windows comamnd-line FTP to work ( have tried FTPsurfer and WinSCP)