Use DB2020 script in jdflasher, jump down the rabbit hole, connect holding C, select 'ofs', navigate to tpa/preset/system/menu, copy menu.ml and associated png files. done.