losetup /dev/loop0 initrd.bin
modprobe block2mtd block2mtd=/dev/loop0,$[65536*4]
mount -tjffs2 /dev/mtdblock0 /mnt
(it took me quite a while to figure out). But you'll quickly find out you can not write anything to it. Freeing little space will not help, you have to free a _lot_ to be able to do even small writes. Just rm -r usr/lib/ipkg -- it will be awhile before _that_ will work.
Now peek into /etc/ts.conf. It says module_raw collie; oops, that should be module_raw input, and you'll also need /dev/input* . Unfortunately, that is not enough to get mouse in X to work :-(. (Can anyone help?)
So next step.. getting at least shell. Just edit
etc/X11/Xinit.d/30xTs_Calibrate , include /usr/bin/rxvt as a second line. Shell actually works (wow!)... unfortunately only about half of keyboard works, anything special does not, and Fn does not work. 12keymap should initialize it, and /proc/cpuinfo looks as expected... I'll play a bit more, but unix shell without special characters and numbers is not easy.
Ouch and for person asking about thinkfinger & PAM integration... be little patient, Timo is working on that.