Yeah. It should be always at the same place at the end of the flash chunk reserved for the kernel.

{

        // look for custom animation at tail end of kernel flash partition:

        const unsigned int kernel_start = EMPEG_FLASHBASE + 0x10000;

        unsigned int *p = (unsigned int *)(kernel_start + (0xa0000 - 4));

        if (*p == ('A'|('N'<<8)|('I'<<16)|('M'<<24))) {

                unsigned int offset = *(p - 1);

                if (offset >= 0x90000 && offset < (0xa0000 - (1024 + 8 + 8)) && !(offset & 3)) {

                        printk("Found custom animation at offset 0x%x\n", offset);

                        ani_ptr = (unsigned long *)(kernel_start + offset);

                }

        }

}

You could just use Mark Lord's Aniwrite utility on the empeg. It'll write it to the correct place for you. Just run it from the serial port or from telnet.