Hm. Good question.

You'd have to know the correct flash address, and then send the file with upload.exe. But if I recall correctly, the address is going to be different depending on how much flash is being taken up by hijack. I don't know how to calculate that.