The boot ROM's recovery mode lets you load arbitrary code into RAM and then boot it. The conventional way to use this is load a flasher program that you then use to flash a new OS image, but you can use it to run any Linux kernel and and software of your choice purely from RAM, which can then do what it likes to the existing OS install. See http://linux-sunxi.org/FEL/USBBoot