Important Note: This method requires removing the SST37 PROM chip from the Series-3 motherboard, which is difficult and may end up rendering your (expensive) Tivo useless!
Inferring some info from the DT PROM hack thread, I managed to get some work done on the Series 3 TCD648 PROM v3.16. Like the SD Dual-Tuner model, the S3 has a compressed image as part of the bootup code. As mrpenguin describes in the other thread, First there is a check code you need to disable. For v3.16 PROM this should be at 0x6D4C.
Then you need to locate the gzip signature 1F 8B 08 (the 08 indicates max compression) within the binary PROM code which marks the compressed portion and save it out seperately from the rest of the PROM code for further editing. I did this by using the editor to delete everything before the gzip portion begins, and save as a new binary file. For v3.16 PROM this compressed portion should begin at 0xB5C8.
Then you must unpack this compressed portion, edit the hex, and recompress with gzip -9n. Be wary of compressor tools which want to add flags and comments to your re-compressed image since the original PROM has none of that. I don't know how well the S3 would handle extra cruft. I ended up using plain gzip within cygwin.
Use the editor to glue your newly compressed image back into the original PROM code at the same place the old image was. Save it and burn to a new chip.
First edit (hex):
Address Orig_Value Change_Value
0x6D4C 04 40 00 12 00 00 00 00
(Note that address 0x31B8 is from the beginning of the smaller binary file after you've chopped this piece of PROM clean away from the rest and uncompressed it. Be sure to re-compress with gzip -9n when you're finished here)
Edit within gzip compressed portion:
Addr Orig_Value Change_Value
0x31B8 10 43 00 0A 10 00 00 0A
Added confusion since the target code 10 43 00 0A is found twice within the internal compressed image -- Once at 0x31B8 (which I edited) and another at 0x8BBC (which I left alone). Discussion on how important this might be can follow.
Once you've verified your S3 Tivo still boots, you can pull the drive and use mrblack's venerable replace_initrd on the hard drive's boot kernel.