[Mark Nord]

ow do I access the file that gives the MD5 error? Is it in the /tmp/ directory?

You will have to edit flash_opt.300.sh in /Sony Reader/

Code throwing the error is here (assuming : unistaller package)

Spoiler:

if [ -f $TMP_IMG -a -f $TMP_MD5 ]
then
   # cp -f $SD_IMG $TMP_IMG
   REAL_MD5=`/usr/bin/md5sum $TMP_IMG | cut -f1 -d\  `
   TEST_MD5=`cut -f1 -d\  $TMP_MD5 `

   if [ $REAL_MD5 = $TEST_MD5 ]
   then
      echo "Mounting SD card image" >> $W_LOG
      mount -o loop -t cramfs $TMP_IMG /tmp/img_mnt >> $W_LOG 2>&1
      # mount --bind /tmp/img_mnt/bin /bin >> $W_LOG 2>&1
      # mount --bind /tmp/img_mnt/lib /lib >> $W_LOG 2>&1
      # mount --bind /tmp/img_mnt/usr /usr >> $W_LOG 2>&1
      mount --bind /tmp/img_mnt /opt >> $W_LOG 2>&1
      echo "Done mounting SD card image" >> $W_LOG
      UMT=1
   else
      echo "MD5 check failure [$REAL_MD5 != $TEST_MD5]" >> $W_LOG
      echo -n "9 $TMP_IMG MD5 failure." > $RESFILE
      exit 1
   fi
else
   echo "Image or md5 not found" >> $W_LOG
   echo -n "10 Image or MD5 not found on card." > $RESFILE
   exit 1
fi

While copying the files is done in /Sony Reader/software/autorun.js

Spoiler:

target.doDigit6 = function()
{
    //this.trace("[autorun] begin five\n");
    try {
		// this.screenshot ();
        err = this.prepareMcopy();
        if (err)
            return this.showMsg(err+"\n"+this.prompt);

        this.showMsg("Copying image files into memory...");

		// this.screenshot ();

        this.runCommand("mkdir -p /tmp/self_upgrade");
        if (!this.copyFile(this.driveroot+"/new_opt.300.img","/tmp/self_upgrade/new_opt.300.img"))
            return this.showMsg("error copying new_opt.300.img to /tmp/\n"+this.prompt);
        if (!this.copyFile(this.driveroot+"/new_opt.300.md5","/tmp/self_upgrade/new_opt.300.md5"))
            return this.showMsg("error copying new_opt.300.md5 to /tmp/\n"+this.prompt);

        if (!this.copyFile(this.driveroot+"/flash_opt.300.sh","/tmp/script.sh"))
            return this.showMsg("error copying flash_opt.300.sh to /tmp/\n"+this.prompt);
        this.showMsg("Flashing new Fsk filesystem.\nThis might take a few minutes.");
		// this.screenshot ();

        this.runScript();
        var res = this.fileToString("/tmp/result.log");
        if (!res)
        {

But while checking the code of the various scripts I came to the conclusion that the hack300Update most probably not only rewrites the FSK-partition but also the Rootfs. (cramfs.Rootfs.img)

So proper restoration will need to replace both partitions.

Which the PRS+ installer is trying to do:

Spoiler:

target.actions.backup = {
	confirmMessage : "CONFIRM_BACKUP_ALL",
	perform : function() {
		initTools();
		var fskPath = getUnusedFilename("/Data/" + versions.ebook.firmware + ".fsk");
		var rootPath = getUnusedFilename("/Data/" + versions.ebook.firmware + ".root");
		var root2Path = getUnusedFilename("/Data/" + versions.ebook.firmware + ".root2");
		var bootPath = getUnusedFilename("/Data/" + versions.ebook.firmware + ".boot");

		print(L("SAVING") + " BootImg...");
		exec("cat /dev/mtdblock9 > " + bootPath);

		print("OK Rootfs2...");
		exec("cat /dev/mtdblock13 > " + root2Path);

		print("OK Rootfs...");
		exec("cat /dev/mtdblock14 > " + rootPath);

		print("OK Fsk...");
		exec("cat /dev/mtdblock15 > " + fskPath);

		println("OK \n " + L("ALL_PARTITIONS_SAVED"));
	}
};

target.actions.flashRoot = {
	confirmMessage : "CONFIRM_FLASH_ROOT",
	perform : function() {
		initTools();
		print(L("COPYING_IMAGE"));
		var path = FIRMWARE_PATH + versions.ebook.model + "/" + versions.installer.firmware + ".root";
		var md5path = path + ".md5";
		copyFile(path, "/tmp/Rootfs.img");
		print("OK");
		flashImage(getFileContent(md5path, "--error--"), "Rootfs");
	}
};

but obviously lacks the the image "Rootfs.img"

So after hack300Update Rootfs and FSK will be the ons for a 505.
After Un-Installer Rootfs is still 505 and FSK for the 300 which will prevent the device from proper starting.

@Kartu: makes this any sense?
And if so, can you please provide a Rootfs.img?