I'll post some more info, I found today. Some of this is guesses and assumptions from working with other devices.
DO NOT JUST TRUST THIS INFO. A meter or a scope is your friend.
I'm going to guess that J505 is the com port. People working with the V1000H report the following settings work;
Baud rate - 115200, 8N1, flow control - none
DO NOT JUST CONNECT A COMPUTER COM PORT TO THE UNIT. You need a level translator. The port is probably running at 3.3 or 5 volt TTL levels. The translators are easily found on Ebay.
The com port should provide access to the CFE boot loader.
My next guess is that J201 is the EJTAG port. The JTAG port will allow you to fully dump the flash (plus much more). You need to build a very basic device to connect to this port. Searches for HairyDairyMaid will provide help. This software URL should work. It supports both the processor (Version 1. Our's is a version 3) and the flash chip.
The JTAG pinout might be close to this: http://www.interfacebus.com/Design_C..._JTAG_Bus.html
but only consider the first 12 pins.
Remember, this is not our device and any testing has to be done in a nonintrusive manner.
I (personally) have no desire to replace Aliant's firmware but to only add changes that can't be done via the provided GUI.