Hi Jason, your efforts and this thread is so spectacular I made an account mostly just to say so. I have enough technical experience with PCBs and firmware to REALLY appreciate the time you've put in and your achievements. However the attention to detail in posting your findings is the most excellent.
I just got a 2013 TS (mid range) Territory which came with a blank screen, which is how I got here. I read the entire thread twice, and successfully started talking to my blank screen via COM port using your instructions.
However it seems like my corruptions might be a bit more terminal. I don't have a /packages directory. From the command line, I can explore the files, including those on the USB stick. But everything seems to be read-only (even when I use your trick of <mount -uw /dev/hd0>
< mount -uw /fs/usb0>). I can unmount the USB, but haven't been able to remount, even as read only. It seems to automatically mount/unmount when the stick is inserted/removed though.
I tried to copy one of your /package directories to the
ICC memory but since it's all read-only that failed. A manual mkdir also fails. The scary scripts to re-core it appear to be absent (no files with "core" in the name).
A complete(?) listing of files is attached, so is the complete lot of serial output during my boot - 46k lines of error messages (most removed because the attachment was too big), takes a couple of minutes. I can't actually get the files onto the USB stick because I can't get write access.
Any thoughts would be welcome. I've spent too much time on this and have too many other projects at the moment so will probably just bite the bullet and get an ALS or wrecker one. But if you're interested in interrogating mine, I'll send it to you (I'm in Melbourne).
Cheers,
Stephen
PS: I'd be reasonably confident in replacing the BGA flash chip, if you reckon you can program it (and want to go down that rabbit hole). It's a challenge, but with a temperature-controlled hot air soldering station, and lead-tinned pads/chip, it's doable.