Well, in case you ever consider going that way, I'll recommend you start by looking at the LinkIdentity parts of the code
Another vector for information could also be to look at the codestreams in the "Ned, the friendly debugger" interface.
While I haven't peeked much at Flarn's later progress, I do know that NED will let you switch the format of some VI resources into XML (Heap Save Format) - dunno if Flarn is utilizing that?!
(be warned though - this will most likely certainly cause LabVIEW to crash if trying to load the VI afterwards)
Also, for quick low-level access to the Resource Fork of LabVIEW VI's and a lot of other NI resource files -from inside LabVIEW- I suggest using the REdLoadResFile/REdSaveResFile (interface)functions found in LabVIEW.exe.
That at least cut away one level of abstraction for me, back when I had the time to immerse myself in this kind of 'research'.
Now off to figure out the "Keep code streams for heap peek" option..