what you doing is the wrong way, the firmware is for all models, so it does not matter what inside (unless you wish to search the whole firmware for model checks and patch it then). The best way is to patch the model itself, and this has been saved somewhere. The RTC clocke does have some user bytes, but htey can't be used (without special tricks) to store model. Are there any eeproms on the board? i bet the altera cpld is readback protected, but well, just try to dump it. If the model check is really in that cpld (and not eeprom) then it is still possible to change it, e.g. by watching the bus for call just before model check in fw, and then sending the crafted info back. When eepom used, then it will be much easier. Or even simple tricks like some "not populated" parts, TEK did that on other models and one can hack them very easy (which still did't change anything, without calibration mainly useless - and to run cal one need anyway some gears, so ppl who can calobrate have enought money anyways to buy higher TEK models).