This box is supported at least partially by OpenWRT. This might make it easy to "cheat" on this target but regardless it still makes for a nice illustration as the TI DSP is not documented, supports JTAG as well as the FPGA and the FLASH is a TSOP chip that we can desocket for dumping.
- TI AR7 family TNETD7200ZDW DSP MIPS32 TI info (de) - supposedly no datasheet. However, the OpenWRT group has good documentation and appear to have somehow confirmed EJTAG though I have not seen a footprint. They suggest that it is similar to some OMAP DSP's so perhaps a footprint was gandered from these. Usefull:  
- Xilinx Spartan3 XC32400 144pin [chrome://downloads/Users/cyphunk/Downloads/ds099.pdf full datasheet]
- NOR FLASH Macronix MX 29LV640MTTC-90G 2.7-3.6v (datasheet). Can be parallel dumped.
- 4 pin unpopulated throughole header next to TI.
- 28 pin unpopulated pads on bottom of board.
- 5 pads on bottom edge near power and antenna.
Interesting markings and observations
- 4 pads with solder on bottom of board. At least one of those is connected to Xilinx JTAG.
- Examine layout to determine if Xilinx provides usefull debug or dump access of flash (since JTAG access would come quick). Judging from exposed traces alone it potentially does connect to the FLASH.
- If Xilinx and TI JTAG are chained it might not be hard to map.
- TI supports RS232, worth mapping/finding
- TSOP Flash can be dumped
- Other areas?