If you mean the bootloader in the binary file you got from the BDM... The first four bytes are the initial stack pointer, and the next four bytes are where executions starts. Jump to that address in...

If your coding guy wants a collaborator, my email address is NSFW, outlook, com.

I haven't been making any changes to the OS yet, yet but I have been doing some reverse engineering:
...

As far as I'm aware, any 2-bar or 3-bar custom OS will be a pirated HP Tuners or EFI-Live OS.

But if anyone has created a freeware custom OS, I'd love to know about it.