I have been working on the CNC controller some more. In the meantime I have added a custom splash screen that Merlin201314 from the MadModder forums made. This is also the place where you can find latest information and downloads for the controller.
I have also found a way to run commands as root when installing firmware upgrades. This allows setting up the custom splash screens and also allows changing the ram file system of the controller some more to fit my needs.
For further analysis, I have dumped as much of the controller's filesystem and command outputs as I could. You can find most of them here: http://data.bmuessig.eu/CNC/DDCSV11/Dumps/Files/
Unfortunately, there is absolutely no info on the bootloader used. The only thing I managed to find out, is that if you connect a jumper across R91 it will try to boot from a connected USB stick. The bootloader does not accept any serial communication and does log almost nothing to the console.
Hardware-wise the controller features a Novoton N32905U1DN ARM9 CPU and 32 megabytes of RAM. It also has 1 gigabit (128 MB) of Hynix HY27UF081G2A flash memory. The screen is 480x272 pixels wide.
On the inside there is a conveniantly labeled test connector which unfortunately has a quite odd pin-spacing, so I had to use logic probes to hook it up to my measurement gear:
If you connect a 3.3v USB serial adapter to the RX and TX pins @ 115200 8N1 and listen with a terminal emulator like PuTTY, you will be presented with a root shell (just press Enter a few times):
Bridging R91 resulted in the following UART output: