Here's how cory described it....
"Copy code and a 'stub' are inserted at the tail end of arm9, which takes the embedded bankswitching code 'stub' and copies it to 0x23B0F00, arm9 entry is patched to jump to the copy code (so the secure CRC will be buggered in the patched header), FLASH ident responses are patched in 2 locations, and FLASH bankswitching is patched to jump to the copied 'stub'. arm9 region is padded to (arm9 size+copy patch size+arm9 footer size) + pad to align to 512 bytes, all other offsets in the header are shifted to match the new offsets and the FAT table is iterated through to change it's offsets and verify the data at those offsets."
Your probably better off asking help from the EZ Flash team. Though they probable wouldnt care about it these days.