I took apart one of the phones this last Sunday.
I thought that we could dump the firmware and see if the password could be reset. But it turns out doesn't have spi flash. Instead it has a nand chip like you would find in a USB drive. It does parallel read and write. I don't think we have hardware that can dump nand. Maybe like an Arduino can do it?
The MXIC is the nand.
Note there is a 4 pin header right next to it. Could that be serial????
Realtek is Ethernet switch. Etrontech is ram. And DSP would be the processor.
Thomas