So far, interrupting the boot process at
Hit any key to stop autoboot: 5
renders the following output:
ZHAL>
An typing a '?' will yeld:
ATEN x[,y] set BootExtension Debug Flag (y=password)
ATSE x show the seed of password generator
ATDC disable check model mechanism
ATSH dump manufacturer related data in ROM
ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
ATGO boot up whole system
ATSR [x] system reboot
ATUR x[,y] upgrade RAS image (filename, partition number)
This looks a lot like OpenWrt style U-Boot so it might be a modified bootloader. Know any magic commands to throw at it to gain some insight of its Flash structure? All i know so far is that its size is 0x8000000.