Loox n5x0 OS_xxxU.nbf header format
total 42 bytes header, the rest is not crypted os rom image (what we usually call nb0 or n_d)
4 bytes - model name (N500, N520 or N560) + 11 bytes empty (filled with 0x00) +9 bytes version (e.g. 1.22.0001) + 1 byte 0x20 (space) +3 bytes language (e.g. ENG, ITA, GER) + 2 bytes empty (0x0) +4 bytes - reversed crc32 checksum (if we have, for example, 1163FCED, then we write ED FC 63 11) + 4 bytes - size of decrypted part (reversed somehow? we have 2100000 and write 00001002) + 4 bytes - rom base flash address (seems it it 80400000, we type 00 00 04 80, don`t play with it)
all this is true for OS_yyyU.nbf ( yyy means rom version), bootloader nbf is coded otherwise, it is usually named BL_xxx_G3.nbf or bl_xxx_G4.nbf. xxx - bl version. I suppose you delete file bl_xxx_G4.nbf or bl_xxx_G3.nbf. new pda`s come with g4 flash, it will be killed with g3 update. and, anyhow, bootloader update is always dangerous and not recommended.
wait a bit - in some days i`ll post a tutorial how to extract os rom image from n500/n520 and probably n560 pda.