Where do those keys leaked?
I think there is no need to read/write the flash directly. Only the base date needs to be modified in the .bin files somewhere that sets the "minimal" date set. Isn't it?
The keys were in the original firmware update, they left them in by mistake. I don't know if anyone openly posted them, but how/where to find them was widely discussed (if you want a more specific answer, don't look at me - I think it's actually in an earlier post in this thread).
I'm not sure if it's possible to modify a file before updating the scope, or to write to the scope's filesystem. I'd imagine they might at least have check-summed / signed the update package, in which case you'd be out of luck. Worst case you might brick the scope, which is why I'm not going to be trying it on mine any time soon.
However if you *could* modify the files on the device, either by changing the update package or writing to the flash, it would be easier to just take out the license check than to piss about with dates and trial licenses.