[stephenf7072]

Ah damn, reserving the memory makes a whole lotta sense. Ye all be warned (be patient, and wait for a reply before hitting that enter button on the scary commands).

I went back through earlier posts looking for the flash chip and/or microcontroller datasheets, in case they give any hints to programming. The serial output still working means it might be possible to get the thing into programming mode or something.

I also noted:
1. Post #189 indicates the unpopulated SD card spot becomes active as part of the boot cycle. I doubt that's useful for me though.
2. Post #190 indicating there might be a 10-pin JTAG port. Now that's interesting - I have a JTAG programmer and have used it to program blank microcontroller memories to avoid using the serial interface.
3. Post #163 documents components, including flash and microcontroller(s). Useful for finding datasheets.
4. If you have the right blob of data and could access the pins on the flash, programming appears relatively simple (which probably means it isn't, but you never know)

Another lesson I've managed to learn the hard way is that the 2014 SZ Territory Titanium screen is different to the TS (different plug, and metal casing, I didn't have the heart to look at the actual circuitboard). Anyone want one...?