manually nocert patch payload?
 

How is it done?

edit:

xipporterex seems to have this capability, will report back

edit: remove uldr with implantxip -imgstart 0 -uldr tryremove from ervius, patch payload with xipporterex makes a dud ROM... not sure what is going wrong but maybe the tool just doesn't work on TP, uldr reduces fine, but cannot be removed ?