Here is another option /sbin/rollback wich is used to switch between firmwares i think, but as i said, i haven`t found the reserve partition of exe.img anywhere.
Here is reserve copy of appdata on mmc flash.
Missing copy of exe.img explanes why does TV crash after toggling. Because authuld starts reading hashes for other partitions instead of existing ones.
Weird...
