Rasputin <rasputin@submonkey.net>  wrote:
 > > One of the big barriers to doing this is that if you screw up the
 > > bootstrap loader there is no going back - you have a dead machine
 > > unless you have some very specialised equipment (a JTAG boundary
 > > programmer) and are able to do some SMD rework, at least, that is what
 > > was explained to me a while back.  Given this there is some reluctance
 > > to doing the development ;-)
 > 
 > Ah, I had some wierd notion of lazily reading the WinCE ROM 
 > image up a serial port to disk, then writing it back later.

presumably, this should be possible.  Given that, for code to execute,
the device needs to be readable by the cpu.  So unless there's some
mux'd chip-selects or something, one should be able to map the ROM
or Flash part in and suck out the contents of it.  If it's a flash
part (and I rather suspect it is).  So presumably one could issue
the correct sequence of 0x5555:0xaa and 0x2aaa:0x55's at it and
twiddle the bits back in...

Of course, this is all speculation on my part.  It'd be easy enough
to query the device, if we knew where it lived, to find out if it
responds like a flash part.