the hermes patch for 3.55 is exact the same thing the rogero CFW 4.xx have right now (payload) but with the diff that i haved this payload lv2 patch in my cfw since a few month's now. I just never released my cfw or the .tcl patches.
And no mm do not patch on the fly. MM mount a payload into lv2 where it stays till you cold reboot your con. I added the hermes payload into my cfw cause to this time deank have not shared the bd-emu.bin together with mm and as i was left for a year and then come back after i just hated it to google why my games not work and i hated it to google for that damn bd-emu.bin. Just stupid. There for i added hermes payload to the lv2 of my cfw.
The "Sys_cal_yada_yada" isn't incomplete. This is in case of the version you have still use unself to decrypt. But unself fail on some self'S and you would need to use unself2 or scetool on it to get the correct file out. You can test this by just take lv2_kernel.self and first use unself then unself2 and give a look on the size if both files. There you have why "there is no search pattern at all"