Thanks for this super good description! I followed it and almost got it right, but then I bricked my device because of a stupid error and not paying attention to terminal output. Here's a short excerpt of the last bit of commands I sent through ssh
oot@EX5601-T1:/tmp# tar xvf openwrt-25.12.3-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin
sysupgrade-zyxel_ex5601-t0-stock/
sysupgrade-zyxel_ex5601-t0-stock/CONTROL
sysupgrade-zyxel_ex5601-t0-stock/kernel
tar: short read
root@EX5601-T1:/tmp# ubiattach -d 9 -p /dev/mtd6
UBI device number 9, total 256 LEBs (65011712 bytes, 62.0 MiB), available 0 LEBs (0 bytes), LEB size 253952 bytes (248.0 KiB)
root@EX5601-T1:/tmp# ubirmvol /dev/ubi9 -N kernel
root@EX5601-T1:/tmp# ubirmvol /dev/ubi9 -N rootfs
root@EX5601-T1:/tmp# ubirmvol /dev/ubi9 -N zydefault
root@EX5601-T1:/tmp# ubirmvol /dev/ubi9 -N rootfs_data
root@EX5601-T1:/tmp# ubimkvol /dev/ubi9 -N kernel -s $(ls -l sysupgrade-zyxel_ex5601-t0-stock/kernel | awk '{print $5}')
Volume ID 0, size 17 LEBs (4317184 bytes, 4.1 MiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "kernel", alignment 1
root@EX5601-T1:/tmp# ubimkvol /dev/ubi9 -N rootfs -s $(ls -l sysupgrade-zyxel_ex5601-t0-stock/root | awk '{print $5}')
ls: sysupgrade-zyxel_ex5601-t0-stock/root: No such file or directory
ubimkvol: option requires an argument: s
ubimkvol version 2.1.2 - a tool to create UBI volumes.
Usage: ubimkvol <UBI device node file name> [-h] [-a <alignment>] [-n <volume ID>] [-N <name>]
[-s <bytes>] [-S <LEBs>] [-t <static|dynamic>] [-V] [-m] [-k]
[--alignment=<alignment>][--vol_id=<volume ID>] [--name=<name>]
[--size=<bytes>] [--lebs=<LEBs>] [--type=<static|dynamic>] [--help]
[--version] [--maxavsize] [--skipcheck]
Example: ubimkvol /dev/ubi0 -s 20MiB -N config_data - create a 20 Megabytes volume
named "config_data" on UBI device /dev/ubi0.
-a, --alignment=<alignment> volume alignment (default is 1)
-n, --vol_id=<volume ID> UBI volume ID, if not specified, the volume ID
will be assigned automatically
-N, --name=<name> volume name
-s, --size=<bytes> volume size volume size in bytes, kilobytes (KiB)
or megabytes (MiB)
-S, --lebs=<LEBs count> alternative way to give volume size in logical
eraseblocks
-m, --maxavsize set volume size to maximum available size
-t, --type=<static|dynamic> volume type (dynamic, static), default is dynamic
-k, --skipcheck skip the CRC check done at volume open time
-h, -?, --help print help message
-V, --version print program version
root@EX5601-T1:/tmp# ubimkvol /dev/ubi9 -N rootfs_data -m
Set volume size to 49774592
Volume ID 1, size 196 LEBs (49774592 bytes, 47.4 MiB), LEB size 253952 bytes (248.0 KiB), dynamic, name "rootfs_data", alignment 1
root@EX5601-T1:/tmp# ubiupdatevol /dev/ubi9_0 sysupgrade-zyxel_ex5601-t0-stock/kernel
root@EX5601-T1:/tmp# ubiupdatevol /dev/ubi9_1 sysupgrade-zyxel_ex5601-t0-stock/root
ubiupdatevol: error!: stat failed on "sysupgrade-zyxel_ex5601-t0-stock/root"
root@EX5601-T1:/tmp# sync
root@EX5601-T1:/tmp# fw_setenv boot_flag 0
root@EX5601-T1:/tmp# reboot
root@EX5601-T1:/tmp# Connection to 192.168.40.1 closed by remote host.
Connection to 192.168.40.1 closed.
```
As you may notice, I downloaded the image for the t0, while the device identifies as t1. Not sure if that was the reason for the errors, but I didn't really look (I should sleep more!) and went ahead. Now the device boots into a red power LED and won't even respond to pushing the reset button with the pin.
It's not a big deal since this device was just lying in my cupboard and I wanted to repurpose it as a switch/ap, but if someone has a hint how I could still revive it I would give that a shot. (but not today, I am getting some rest now). I know there is such a thing as serial connection, I've used it on ESP microcontroller devices with an Arduino IDE or ESPhome but never tried it with a router. Would that work with a device such as this: https://nabatechshop.com/wp-content/uploads/2025/07/ESP8266-ESP-01-USB-Programmer-CH340-USB-to-UART-Adapter-min.jpg . If so, what software should I use for establishing communication?
