(s1k1 - s2k1r2-1r1) mod n = (s2Mr2-1r1 - h2r2-1r1 + h1) mod n
So let me see if I understand this correctly, and for brevity all sides of each equation are mod n.
(s1k1 - h1)r1-1 mod n = (s2(Nk1 + M) - h2)r2-1 mod n
(s1k1 - h1) mod n = (s2(Nk1 + M) - h2)r2-1r1 mod n
(s1k1 - h1) mod n = (Ns2k1 + s2M - h2)r2-1r1 mod n
(s1k1 - h1) mod n = Ns2k1r2-1r1 + s2Mr2-1r1 - h2r2-1r1 mod n
s1k1 - Ns2k1r2-1r1 mod n = s2Mr2-1r1 - h2r2-1r1 + s1h1 mod n (this is the one you corrected, all I did differently is I injected an N term. You missed an s1 at the end)
k1(s1 - Ns2r2-1r1) mod n = s2Mr2-1r1 - h2r2-1r1 + s1h1 mod n
k1 = (s2Mr2-1r1 - h2r2-1r1 + s1h1)(s1 - Ns2r2-1r1)-1 mod n
While this is correct, I could expand the right hand side to remove all those parentheses but it would look like a hairy mess
k1 = s1s2Mr2-1r1 - s1h2r2-1r1 + s1s1h1 - s2Mr2-1r1N-1s2-1r2r1-1 + h2r2-1r1N-1s2-1r2r1-1 - s1h1N-1s2-1r2r1-1 mod n
which can naturally be simplified to
k1 = s1s2Mr2-1r1 - s1h2r2-1r1 + 2s1h1 - MN-1 + h2N-1s2-1 - s1h1N-1s2-1r2r1-1 mod n
The terms without an M or N can be cached if you code this which'll save a some runtime, assuming signatures and message hashes are constant (which means we're just brute-forcing k by assuming the other k is different from k by a linear term, Nk + M).