@Fraser
My methods aren't pretty- I basically took the stock PS24/32 firmware and compared it against a development version of the Razor (now ThermoSight) firmware and looked at the changes in hex. I also used RealTerm with USB Spy drivers to log the instructions passed during flash and configuration. The premise was that FLIR probably didn't write entirely new firmware for the upper tier product. However, the Razor firmware won't actually run in a non-Thermosight product, so I basically started guessing at the sections and did a crude copy/paste to get features from one to the other (I don't have my "hex map" I was building anymore). Several modifications had to be made, because the display scaling (for the UI, not the thermal) between the PS and TS is different, so initially the output was larger than the screen. If you notice even in this version the battery meter is missing, it's actually to the upper right off screen but I couldn't alter its position without causing a UI glitch.
The PS24 and 32 both have less memory available to write than the Thermosight which limits the feature set that could be grafted. The user interface that manages most of the upper functions requires about 60% (I think, I don't have the exact size of it any more) of the available write space. The palette code and functional programming take up the rest. The reticles are written on the end of the flash, where the lower-memory PS units basically write into nowhere. If you manipulate the UI relative to the reticles, you may get lucky and have one available. However, the config flag doesn't have anywhere to write so it goes away on a power off.
I'm not certain if the video out via USB still works on this firmware, I don't have the adapter cable to test it. I know the video out on the pads still works though.
If you disassemble either a PS or TS, take notice of the battery and whether it has specs. I think the TS and PS use different measuring points because a 1:1 value on PS hardware reports a low battery condition. That's why the battery numbers I show to program look so low (but when the physical voltage reaches a low point, low alarm is still triggered correctly).