tl;dr:
1. Calculate the xor difference between original hash and new hash2. Run subset sum solver on random hashes to find a subset nullifying the changes3. Profit!
Full writeup: https://github.com/p4-team/ctf/tree/master/2017-12-29-34c3/crypto_software_update