Sorry been really busy lately. I have a plan that I think will work (with minimal modifications to ninjhax) but I haven't had time to sit down and write the code. I'll post my plan here in case someone wants to beat me to it:
-Run a custom first stage code.bin that sets up all the data and a function hook to second stage.
-Load "spider_thread0_rop" which does rohax
-rohax eventually calls "spider_code" which does some work getting handles until it hits an infinite loop
-We remove the infinite loop and call the function hook to second stage
-The second stage is similar to "sn_secondary_payload" but start at around line 554. This sets up the handlers and loads boot.3dsx.
I think some changes also has to be made to do cleanup of spider handles and memory. But that should be the gist of it. Right now, I only modified the ninjhax build system to support building spiderninja with a buildVersion.py argument. Take care of the most important things first