[Droid Ultra Q&A, Help & Troubleshooting] songjacked:
Not sure how helpful it'll be, but I sort of puzzled it out using the various guides and posts from the Ultra and Turbo forums. I am not very familiar with any of the tools or methods the original posters used, so definitely beware when following what I did. I'm sure there are faster/better ways of doing things, but I at least managed to get Cerberus flashed into my system without breaking anything.

I started by pulling my system image via adb

I didn't have a Linux install handy, so I got an Ubuntu VM set up using VirtualBox, and followed the guide for modifying Droid Turbo system images.

The only part that worried me a bit was after initially converting the Ultra system image to a VirtualBox .vdi file, the output .vdi was much smaller in a file size. Didn't seem to be a problem at the end though, as when I converted the .vdi file back the Ultra system image format, the original file size was restored.

Now, the next part is splitting the modified Ultra system image into the writable chunks. If you peek into the partitions.txt file that accompanied the initial rooting files, you'll see that the system image is actually split into 132 separate systemXXX files, each 16 MB each. I'm not familiar enough with Linux to use the split command, but I found a Windows tool that seemed to replicate the functionality called HJSplit. I just selected the initial image file and set the split output files to be 16MB. Afterwards, I just renamed the split files to follow the naming convention the root tool uses (systemXXX.mbn). You'll also need to split the your original Ultra system image into the same 132 chunks for file comparison.

Now that you have your split system images, you'll need to compare the split systemXXX files from the modified system image against the split files from the original image to find out exactly which of the modified files are actually necessary to flash back to the Ultra. This is the part where I

really

hope someone chimes in with a easier verification method, but I tediously used HxD to compare individual files against each other. You'll definitely want to only flash the system files that are actually modified, since apparently a full system flash would take nearly a whole day to complete.

After you've gotten your selected modified systemXXX files together, you can start setting up your folder to flash. You'll want to follow the structure of the _root folder from the root flashing tool.

Create your _Name folder, and place your modified system images in it. You'll also need to copy over the partitions.txt, sbl1.mbn, and sbl2.mbn files from the _root folder into yours.

Next, you'll need to create your Python script, and your batch file to actually run things. Things get a little dicey here, since I don't know anything about Python, I just edited the existing qdloadRoot.py file. (If someone familiar with the tool could chime in if that method is dangerous or not, it'd be really appreciated.) If you open the file, there's a section labled BOOT_PARTITIONS where it apparently lists the files for flashing back to the device. I edited it to match the systemXXX.mbn files I wanted to flash, leaving the sbl entries untouched. Save the file as qdloadName.py, and then you can move on to making your .bat file. Again, I just edited the existing RUN_Root.bat to match the names of my .py and flash folder.

Once it's all set up, get your Ultra into fastboot, run BLBROKE.bat and then run your own .bat file. Process time can vary based on how many system chunks you have to flash, but with any luck, your phone will boot up normally and your desired apps should be installed as system apps.

This is a really rough guide, but I hope you find it helpful.