I was wrong again!
actually there are 2 PRS.package, one will do an update, and one will do recovery mode...
I managed to extract the 2 package, and here are the 2 different scripts (update.sh):
-update mode: http://dl.dropbox.com/u/158338/ebook/update.sh
mount --bind ./shadow /etc/shadow
# exit 16
as you can see, in both cases chgboot normal is called, so maybe with chgboot it's possible to call other modes.
This is a nice method for booting in recovery without windows :P