diff --git a/brick/scripts/README.md b/brick/scripts/README.md
new file mode 100644
index 00000000..e6d0f3f0
--- /dev/null
+++ b/brick/scripts/README.md
@@ -0,0 +1,10 @@
+# Patched EV3 image
+
+The file `ev3-fs.patch` summarizes the changes done to the original V1.09D image.
+You can see some text files are edited, the `d_usbdev.ko` is updated (sources in `../kernel`),
+`uf2d` added (sources in `../uf2daemon`), and a stock `nbd.ko` module is added.
+
+Additionally, the `edimax01.ko` is replaced by now much more popular `rtl8192cu.ko` (also stock).
+
+The init script has a hook for running a shell script from `/mnt/ramdisk/`. This can be used
+for testing different modules etc.
diff --git a/brick/scripts/ev3-fs.patch b/brick/scripts/ev3-fs.patch
new file mode 100644
index 00000000..91b0288d
--- /dev/null
+++ b/brick/scripts/ev3-fs.patch
@@ -0,0 +1,36 @@
+diff -ur orig-ev3/etc/init.d/ev3init.sh dev-ev3/etc/init.d/ev3init.sh
+--- orig-ev3/etc/init.d/ev3init.sh	1970-01-01 01:00:00.000000000 +0100
++++ dev-ev3/etc/init.d/ev3init.sh	2017-07-25 15:55:03.642866971 +0100
+@@ -60,3 +60,6 @@
+ sleep 2
+ hciattach /dev/ttyS2 texas 2000000 "flow" "nosleep" $STRING
+ sdptool add SP
++
++insmod /lib/modules/2.6.33-rc4/kernel/drivers/net/wireless/rtl8192cu.ko
++. /mnt/ramdisk/rc.local || :
+Only in orig-ev3/home/root/lms2012/sys: exit~
+diff -ur orig-ev3/home/root/lms2012/sys/init dev-ev3/home/root/lms2012/sys/init
+--- orig-ev3/home/root/lms2012/sys/init	1970-01-01 01:00:00.000000000 +0100
++++ dev-ev3/home/root/lms2012/sys/init	2017-07-26 18:36:03.814459337 +0100
+@@ -5,13 +5,15 @@
+ var=$(printf 'HostStr=%s SerialStr=%s' $(cat /home/root/lms2012/sys/settings/BrickName) $(cat /home/root/lms2012/sys/settings/BTser))
+ echo $var > /home/root/lms2012/sys/settings/UsbInfo.dat
+ 
++insmod ${PWD}/mod/nbd.ko
++${PWD}/uf2d
+ insmod ${PWD}/mod/d_iic.ko `cat /home/root/lms2012/sys/settings/HwId`
+ insmod ${PWD}/mod/d_uart.ko `cat /home/root/lms2012/sys/settings/HwId`
+ insmod ${PWD}/mod/d_power.ko `cat /home/root/lms2012/sys/settings/HwId`
+ insmod ${PWD}/mod/d_pwm.ko `cat /home/root/lms2012/sys/settings/HwId`
+ insmod ${PWD}/mod/d_ui.ko `cat /home/root/lms2012/sys/settings/HwId`
+ insmod ${PWD}/mod/d_analog.ko `cat /home/root/lms2012/sys/settings/HwId`
+-insmod ${PWD}/mod/d_usbdev.ko `cat /home/root/lms2012/sys/settings/UsbInfo.dat`
++insmod ${PWD}/mod/d_usbdev.ko `cat /home/root/lms2012/sys/settings/UsbInfo.dat` file=/dev/nbd0
+ insmod ${PWD}/mod/d_usbhost.ko
+ insmod ${PWD}/mod/d_sound.ko `cat /home/root/lms2012/sys/settings/HwId`
+ insmod ${PWD}/mod/d_bt.ko `cat /home/root/lms2012/sys/settings/HwId`
+Binary files orig-ev3/home/root/lms2012/sys/mod/d_usbdev.ko and dev-ev3/home/root/lms2012/sys/mod/d_usbdev.ko differ
+Only in dev-ev3/home/root/lms2012/sys/mod: nbd.ko
+Only in dev-ev3/home/root/lms2012/sys: uf2d
+Only in orig-ev3/lib/modules/2.6.33-rc4/kernel/drivers/net/wireless: edimax01.ko
+Only in dev-ev3/lib/modules/2.6.33-rc4/kernel/drivers/net/wireless: rtl8192cu.ko
diff --git a/brick/scripts/img.js b/brick/scripts/img.js
index b421a138..87844399 100644
--- a/brick/scripts/img.js
+++ b/brick/scripts/img.js
@@ -1,14 +1,34 @@
 #!/bin/sh
 
 let fs = require("fs")
+  let bootargs = "mem=${memsize} initrd=${filesysaddr},${filesyssize} root=/dev/ram0 rw rootfstype=cramfs console=${console} ip=${ipaddr} lpj=747520 quiet"
+let bootnews = "mem=64M initrd=0xC1180000,10M root=/dev/ram0 rw rootfstype=cramfs console=${console} lpj=747520 quiet musb_hdrc.debug=2"
+let piggy = true
 
 function build() {
+  if (bootnews.length > bootargs.length) {
+    console.log("args too long")
+    return
+  }
+
+  while (bootnews.length < bootargs.length)
+    bootnews += " "
+
   let cr = fs.readFileSync("cram.bin")
   if (cr.length > 10878976) {
     console.log("too big")
     return
   }
-  let img = fs.readFileSync("boot.bin")
+  let img = fs.readFileSync("EV3 Firmware V1.09D.bin")
+
+  for (let i = 0; i < bootnews.length; ++i) {
+    if (img[0x21DDA + i] != bootargs.charCodeAt(i)) {
+      console.log("boot args mismatch")
+      return 
+    }
+    img[0x21DDA + i] = bootnews.charCodeAt(i)
+  }
+  
   let off = 0x250000
   if (img[off] != 0x45 || img[off + 1] != 0x3d) {
     console.log("bad magic: " + img[off] + " / " + img[off+1])
@@ -17,8 +37,8 @@ function build() {
 
   cr.copy(img, off)
 
-  let kern = fs.readFileSync("piggy-patched.gzip")
-  off = 0x0005540f
+  let kern = fs.readFileSync(piggy ? "piggy-patched.gzip" : "linux/arch/arm/boot/uImage")
+  off = piggy ? 0x0005540f : 0x00050000
 
   if (img[off] != kern[0] || img[off+1] != kern[1]) {
     console.log("bad kernel magic: " + img[off] + " / " + img[off+1])
diff --git a/brick/scripts/mkimg b/brick/scripts/mkimg
index f67277d3..b4377b8b 100755
--- a/brick/scripts/mkimg
+++ b/brick/scripts/mkimg
@@ -1,4 +1,6 @@
 #!/bin/sh
+# dd if=EV3\ Firmware\ V1.09D.bin of=orig.cram bs=65536 skip=37 count=400
+
 sudo mkfs.cramfs dev-ev3 cram.bin
 node img
 ls -l firmware.bin