Finally managed to get a different crash_unlock.img file from https://www.wutaijie.cn/?p=254, which is really got the mtd partition writable. I completed all the rest of the steps, but instead of having ssh permanently even the existing one is disappeared. After upgrade to the miwifi_r3600_firmware_f7f3e_1.0.67 firmware telnet is working, so then I was able to turn turn back ssh!!!
All the files collected for this or other methods are here: