I checked the files you dumped. You modified was the nvram,not the bdata.You can try to mod the raw bin at 0x5AC000 as A5 5A 00 00 .Check whether the factory mode is turned on! In the factory mode ssh telnet uart are forced enable.Finally, hope success!