The JTAG interface will allow you to modify the flash memory and other interesting debugging features. This page lists open source software which can program the JTAG port.
WARNING: Please remember that the flash memory addresses may differ between the various models. Make sure you know which model you have.
Openwince is a collection of tools for programming on Windows CE devices. The JTAG utility is a small part of that project. It supports only parallel port cables, and has not made a release for a while.
OpenOCD (On Chip Debugger) is a complete debugging environment for various embedded hardware. It supports a large variety of interface cables, including many USB cables.
HairyDairyMaid is a debrick utility / firmware flasher, originally written for the Linksys WRT54G.
- w:JTAG (Wikipedia)