Moxa N5610 programming

[oh4mvh]

Hello all,
I have rather old Moxa Nport 5600 series server N5610-16_28. FW is v2.1.18 and from serial console I can find it is test version 1.2 text on boot. One day in the past I tried to upgrade this device to recent v3.x version, but that failed somehow so that e.g. telnet and http configuration is not possible any more (its internal server refuses connect seen in wireshark), and nport configurator is not able to configure it and runs into timeout. I got also FW v2.1.25 (as .rom file) from local representative to try upgrade with nport configurator. This was not either successfull. Moxa charges too much to investigate what is wrong with my unit.
Since this device is something I would like to get it work because it still valuable for me and in the same time study how it works, I opended it and found processor board without JTAG connector. See photo how it looks like. Now I have soldered JTAG connector on board and played with Segger Jlink+. First I read firmware on file. Secondly I erased the flash and wrote content back to flash verify this process works as expected. 
Then I played with .rom file to flash it. I have not got it work, most probably it is just not suitable as it is. If there is somebody who has suitable firmware to this unit suitable for programming via JTAG, I'm interested in.
What I don't understand  completely is how the Segger's Jlink flash application should be set regarding the RAM and flash bank. Application doesn't have processor Samsung S3C2500B device support on its list, but S3C2510B and/or ARM9 works read/write as I wrote above. When I read I set "use target RAM 512kB 0x0" and flash bank base address 0x8000 0000. But when I write the firmware i need to set "use target RAM 512 0x4000 0000" and flash bank base address 0x0. Is there someone how could explain why this reading and writing need to be performed on different memory locations?
Furthermore, there seems to be readable content even in memory address 0x0000 0000 and upwards. I assume processor starts reading memory on 0x0000 0000 when it is powered on. Perhaps there is in the beginning partition table describing the filesystem.
I have not been able to read system configuration settings in 0xF000 0000 address to see how memory remapping is set when original firmware is running.
Any hints are appreciated, thanks in advance.
Best regards