tl;dr:

1. Calculate the xor difference between original hash and new hash
2. Run subset sum solver on random hashes to find a subset nullifying the changes
3. Profit!

Full writeup: https://github.com/p4-team/ctf/tree/master/2017-12-29-34c3/crypto_software_update

Original writeup (https://github.com/p4-team/ctf/tree/master/2017-12-29-34c3/crypto_software_update).