I have been playing around with a Technicolor TG799vac  that I was given  from my isp  when I signed up and I have been trying to get access to the file system.

There is a active serial console as I can see all the boot process happen but it seems that the terminal has been disabled, I have so far de-soldered the main flash chip and dumped the file system manually, so I have access to the read-only squashfs   https://forum.openwrt.org/viewtopic.php?id=67564 and having a browse through some of the files it looks like it is running a modified version of openwrt.

Is there anyway to re-enable the serial terminal by modifying the rootfs and then re-flashing the NAND and re-installing the chip?

I have a couple of similar routers, namely the 799vac XTREAM (different BroadCom SoC, fancy ARM cortex stuff - bcm63138/bcm63137) and 789vac (which also runs the bcm63168 I believe - in fact the firmware suggests the 789vac and 799vac are the same thing, maybe up to some VOIP chips)

Did you have any more luck with the JTAG header? I've hooked this up on the XTREAM and I get some gibberish in OpenOCD in terms of devices on the JTAG chain (finds 6 devices but nothing with a valid IDCODE), so I'm assuming there might be some bit blocking JTAG debugging? I'm not sure.

Also - how did you go about dumping the NAND? Did you de-solder and solder to a flash drive controller?

The flashing process is fairly straightforward and I do have some signed firmware dumps available unencrypted. When uploading through the web interface/doing an ISP update the router does check a signature on the firmware files to make sure they're properly signed, I'm not sure if the BOOTP bootloader firmware uploader does the same thing (I could probably check).

I never did have any luck with dumping the flash, but a exploit came about that allowed for root access so in the end I just used that. https://forum.openwrt.org/viewtopic.php?id=67564