TTL进CFE求助 - WR541G+

fox5188

大扫除挖出个 WR541G+ (Ver1.5, PCB版本6.1, AR2317+88E6060), 无心硬改了, 只想刷个固件玩玩.
手头只有 USB-TTL 板 (FT232RL), 不打算再去搞个编程器了.
目前 TTL 三根线保证连接无误, 驱动正常, 端口和速率正确, SecureCRT 可以正常收发...
但是无法进入CFE, 路由通电后显示如下:

.
AR2315 rev 0x00000090 startup...
Attached TCP/IP interface to ae unit 0
Attaching interface lo0...done
.
USRCONF : g_size = 18488
Name = MODULE_USR_CONF_T , size = 12
Name = UC_IEEE802_1X_CFG_DATA_T , size = 512
Name = UC_ADVANCED_CFG_T , size = 16
Name = UC_ARP_CFG_T , size = 652
Name = UC_BPA_CFG_DATA_T , size = 912
Name = UC_DDNS_T , size = 1480
Name = UC_DHCPC_CFG_DATA_T , size = 416
Name = UC_DHCPS_CFG_AND_STATIC_T , size = 708
Name = UC_FIRE_WALL_STATE_T , size = 1992
Name = UC_FORWARD_VIRTUAL_SERVE_CLASS_T , size = 1572
Name = UC_LAN_CFG_DATA_T , size = 8
Name = UC_L2TP_CFG_DATA_T , size = 1472
Name = UC_MAC_CONFIG_T , size = 80
Name = UC_PPPOE_CFG_DATA_T , size = 1568
Name = UC_NTP_PREFER_SRV_CFG_DATA_T , size = 28
Name = UC_STATIC_IP_CFG_DATA_T , size = 144
Name = UC_SATTIC_ROUTE_CFG_DATA_T , size = 328
Name = UC_MANAGE_USERS_T , size = 64
Name = UC_UTILITIES_T , size = 16
Name = UC_WANCONNTYPE_T , size = 16
Name = UC_WLAN_CFG_T , size = 5016
Name = UC_PPTP_CFG_DATA_T , size = 1472
Name = UC_NETWORK_PSEUDO_T , size = 4
wireless access point starting...
wlan0 Ready
.
entering tddp...
.
                            Software Platform for ARM
  Copyright(C) 2001-2004 by TP-LINK TECHNOLOGIES CO., LTD.
  Creation date: Nov 22 2007, 16:58:12
.
  Press CTRL-B to enter bootmenu...
.
  Boot Menu:
     1:  Download application program
     2:  Modify Bootrom password
     3:  Exit the menu
     4:  Reboot
     5:  User commond line
        Enter your choice(1-4):

整个启动过程中, 无数次尝试各种中断 (各种按键组合, 以及 reset 按钮等) 均无效 (可显示 ^@ 但对启动无影响), 直到显示 Boot Menu 后卡在这里.
此时按任意数字, 重复显示此 Boot Menu, 发送某些字符会返回相应命令的结果, 例如: i (ifconfig), r (route), n (netstat) 等, 然后仍然显示该menu. Ctrl-P 没有任何效果.
路由指示灯正常闪烁, 连上 Lan 或 wlan, 或在 web 页面尝试更新固件等, 在 SecureCRT 里均有对应显示.

请问这种情况能否通过 TTL 线刷固件? 个人觉得 bootloader 是好的 应该有戏吧.....