Zyxel EX5501 - Can we get it to boot OpenWrt or get root?

One way or another i going to hack you hack you hack yoooou

So i have a school project about hardware securety and im going to try to get in to this and fix my inteno eg 400 just for fun and old "dreams"

First findings : You can flash a image over tftp with network kable, if you are in UART (pinheads is allready install) and you activate flash over tftp, but i dont have a firmware build so i cant test.

Second findings, i cant get out the password hash from the bootloader, it just give me random error

last full boot up log: https://mega.nz/file/ogNTzDbA#5pf4moon4bPKEitCwFYft8JUWD_UvO6urhcDBmj08uc

New updare! Flashing over tftp enable via UART work fine =) and it update both the bootloader and the rest (in the menu it say it dont like images with bootloader but that is not true) I have also extracted the files with binwake and ubidump https://github.com/nlitsme/ubidump , is there any way i can repack it ?

i also have jtag readere but i dont know if i have found the pins or not
bilde

i got the sdk =) time to build:P

Good luck! Would love to have a look at those file you extracted if you are willing to share...