Well, the "ANIM" "header" (footer?) is always fixed, but the starting offset of the animation itself is variable ... it's semantically "right justified" to the end of the kernel, so the starting byte moves around depending on the length of the animation.

Here's a slightly modified (edited for readability) example from jemplode:

ByteArrayOutputStream baos = new ByteArrayOutputStream();
LittleEndianOutputStream eos = new LittleEndianOutputStream(baos);
// ... write the raw animation data to stream here ...
eos.flush();
int size = baos.size();
eos.writeUnsigned32(0xA0000 - (size + 8));
eos.write(new byte[] { 'A', 'N', 'I', 'M' });
eos.close();
byte[] animBytes = baos.toByteArray();
HijackUtils.upload(inetAddress, "/proc/empeg_kernel", new ByteArrayInputStream(animBytes), 0xA0000 - _animBytes.length, _animBytes.length, null);