For the brave, here's modified cramfs tools from Cygwin which I used to extract and reassemble the cramfs image. To make sure you get the same permissions in your new filesystem, use a devtable file (-d in cramfsk and -D in mkcramfs).
A few things to know to minimize a chance to brick your device:
1) Linux0 and Rootfs2 are kernel and root fs used in the recovery (update) mode. It's best not to touch them.
2) USB control is handled by switcher.so (loaded by tinyhttp) in normal mode, and by /opt0/UsbUpdater in recovery mode. So, disabling any of them will leave you without a way to control the unit via USB.
3) Using USB interface, in normal mode you cannot write flash partitions and in recovery mode you cannot read and write files.