i just figured i'd drop this little note in to help with "direction".
bsquare worked in conjunction with compaq and microsoft to help roll out the MSN companion software. bsquare has a "remote update" suite they've developed for CE and NTe called "RDA" (the client is called "RDU"). RDU works independantly of the RDA server, so "renegade updates" are possible.
read more about RDA at the above link.
the way the update software is described, it seems very likely that this functionality was included in the MSN companion.
a hacked update (for those of you who have taken a stab at building your own nk0.bin) should be easy to perform. the above pdf outlines creation of the xml file for controlling updates, like how to tell devices running RDU to delete files, change registry entries (yes, this thing does have a registry), and install new files. bsquare even built in the feature to compress multiple files into one... this "compression" is probably also used for the clientman file.
let's try to figure this out, this may be the easy out everyone is looking for.
oh, it also appears that eshell support is included in the default image... but it appears to be bound to the non-existant onboard ethernet, which is some amd chipset (you can hex edit through the the CF and find this)