Mmm.. so something a little more complex (or sloppy) could be say 20KB or so. One place we could store this is at the end of the kernel partition in flash, perhaps storing a signature of some kind to indicate whether or not it is present. The Hijack kernel would then just look for it, and play it instead of the stock animation.

To see if this is feasible, we first need to know whether or not we can "seek" to near the end of "/proc/empeg_kernel" and write only the tail of that partition. I suppose this should work just fine, but somebody has to try it and verify. You can seek using either HTTP "Range" or FTP "REST".

Then just read back the entire empeg_kernel, verify that the kernel itself is unmodified (in the usual way), and that the animation got placed at the end.

If that all works, then we just need the "signature" part. I propose this method:

Final eight bytes of kernel partition must contain "x1 x2 x3 x4 A N I M", where "x4x3x2x1" is the offset from the start of the partition (zero) to the beginning of the animation's "offset table".

So, for an animation that totals exactly 16376 bytes (including it's frame offset table), the animation would be written beginning at offset 0x9c000 of /proc/empeg_kernel, followed by "00 c0 09 00 A N I M" in the final eight bytes.

Simple, eh?