Hello,
If you try to flash your Nand chip with a programmer, think you don't need a full flash. You can take the CFE ver 3.0 and convert it to big endian binary file. Then flash it to your chip, and after that you will have access to the RS-232 console. That's what i'm trying to do in that moment, because i didn't find any dump of the vu+ duo. A dump that you can make from a telnet session is not ok, i think, because the flash memory mapped in a non linear way.
The real flash on the chip begin with the CFE, and this CFE is mapped at 0x00100000 on the system.
That is what i understand for the moment.