Product code for finding correct images:
$ sysinfoclient -g /device/product-code

Get stock firmware and emmc image however you can. (on host computer) 
I used navifirmex in wine. If you wish you can rename/copy them as firmware.bin and emmc.bin.

Get open kernel (on host computer):
$ wget -q -O - http://maemo.cloud-7.de/HARM/N9/1.3/openmode-kernel/zImage-2.6.32.54-dfl61-20121301 > kernel_image

Open mode:
1. Shut down the N9
2. Run firmware flasher to flash fresh stock firmware + EMMC images (on host computer):
# flasher -f -F firmware.bin -F emmc.bin -R
3. Connect the USB cable (flash begins)
4. When flash is complete and N9 booted up, enable developer mode 
(don't add accounts or open any programs that would use them or you might have account related problems in openmode)
5. Remove the openmode warning:
# disclaimer-cal remove View-openmode
6. Shut down the N9
7. Run firmware flasher to flash open kernel (on host computer):
# flasher -a firmware.bin -k kernel_image --flash-only=kernel -f -R
8. Connect the USB cable 
9. When flash is complete and N9 booted up, check if you are in open mode:
# accli -I | grep mode

Openmode - Removing Aegis mounts:
$ rm -fr /home/user/.aegis
# mkdir /root/certs.bak
# cp -R /etc/ssl/certs /root/certs.bak
# rm /etc/aegisfs.d/*.* && /sbin/reboot
# mv -f /root/certs.bak /etc/ssl/certs