connect a serial cable to the rj45 serial port of the device and set the baudrate to 9600

to enter uboot command prompt you need to trigger the undocumented key 'k'
this is followed by a password prompt. the password is: fap22b1!$ 

place factory-to-ddwrt.bin on a tftp server. we assume the tftp server is running on 192.168.1.10 which is the default
server setting for this device

now run the following commands

nand erase 0 0x8000000
tftpboot factory-to-ddwrt.ubi
nand write $fileaddr 0 $filesize
saveenv