Or even find the /etc/shadow contents in the hexeditor and empty the root password field. Searching for "root:" usually gets you to the right place.
Most *nix systems are happy if you pad the left over bytes with newlines, so there's no need to mess with the filesystem metadata or anything like that. :D
The link for the option goes to a page that talks about editing /etc/default/boot, that's why I thought maybe it could be found with a hex editor on the disk image :)
It used to be a common thing to recompile, at least partially, the kernel image for your specific deployment, instead of having what some called "table-driven OS".
Ultimately I say I prefer today's modular linux, though ZFS module allowing editing of parameters after boot pushes it a bit further :D
