I think a good start would be to start with a device that has the newest updated wimax firmware and *is working* and dumping the partition like this:
Dump your wimax data by issuing "fastboot oem saveprt2sd wimax -n wimax.bin" command (varies, anywhere between 7 to 8.5 MB, mine was 7MB)
Dump complete partition (~12MB) by issuing "fastboot oem saveprt2sd wimax -n wimax.bin -a" comman
( from http://forum.xda-developers.com/showthread.php?t=716694
And see what the differences are after intentionally messing it up.
Then do the same thing on a device still running 24772 with first a working image and then a messed up one. (Once you have the backup getting back to a working state should not be an issue as seen in that thread.)
Doing it with 2 different versions should give us a good idea of what they're doing that flash_image is not. Well, we already know they saving and adding the keypair, but this should put us on the right track as to how to do it ourselves.
My phone's currently stock and on the official 1.47 release because I had other issues and had to go in and get a replacement setup on friday or I'd take a look.