It is possible to change device boot loader from the OpenWrt, e.g. to downgrade it for enabling serial access. There are 2 bootloaders in the board: routerboot2 (main loader) and routerboot (backup loader, on the beginning on the flash). I am recommending to experiment with the main (routerboot2) loader which is located on the mtd3 partition, because if it is damaged board can still be booted using routerboot. If routerboot is damaged you will have to reflash the memory chip using programmer. You can choose which loader to use using rbcfg tool or from the routeros menu. To force boot from the backup loader turn device on with button pressed and wait ~30 seconds. To change the loader you will have to: Download boot loader image from the vendor web site, use url like http://i.mt.lv/routerboard/files/qca9531L_3.27.fwf. First 32 bytes of the file is a header, which should be removed before flashing, e.g. using dd command: dd if=./qca9531L_3.27.fwf of=./routerboot-3.27 bs=4 skip=8. Flash protection needs to be removed in the mach-rb941.c for the routerboot2 (or routerboot) partitions. Do backup of the partition first and flash your stripped boot loader using mtd tool. Restart device, that's it :) This post shows how to update to the latest 6.43.7 bootloader on rb-941-2nd-tc with the routeros interface