Alright guys, I've got a step further (maybe you already did this).
The .elf file starts after the offset named in the header length. So when copying each decrypted section (.elf), do so from the [section.header.offset]-[header.length]. The block lengths will be the same. Paste each block to the actual offsets in the EBOOT.
After reading eboot.bin, I see the header length is 0x980. Also, the first encrypted section starts at 0980 for 1033b68 blocks. In the elf file, this block is from 0 to 1033b68 (section header - header length). (It seems the elf file is slightly smaller because unselfing strips the header away) So paste block elf 0-1033b68 to eboot 980-10344e8. Now do the same for the second block. Paste elf 1040000 (1040980-header) through 109fe9c (1040000+length) to eboot 1040980. Make any better sense?
Using this, I compared my fixed nfshp to the downloladed one that I've tested as working, and I now have VERY MINOR DIFFERENCES, so I know I'm on the right track. When using my fixed eboot, the game no longer gives an error, but it just goes back to the XMB after trying to load for several seconds. By comparing the sections of the elf (adjusted for header length) to the sections of the working fixed eboots, I can now see the same data. I am so close now, but I just can't get my damn eboot to work all the way. Hope this helps.