The JTAG interface will allow you to modify the flash memory and other interesting debugging features. This page lists open source software which can program the JTAG port.
WARNING: Please remember that the flash memory addresses may differ between the various models. Make sure you know which model you have.
Openwince is a collection of tools for programming on Windows CE devices. The JTAG utility is a small part of that project. It supports only parallel port cables, and has not made a release for a while. For an up to date version, consider UrJTAG (below).
UrJTAG is a fork of the Openwince JTAG Tools, which continues its development, adding features and support for more cables, e.g. FT2232-based USB cables, flash devices, CPUs, etc.
OpenOCD (On Chip Debugger) is a complete debugging environment for various embedded hardware. It supports a large variety of interface cables, including many USB cables.
HairyDairyMaid is a debrick utility / firmware flasher, originally written for the Linksys WRT54G.
- w:JTAG (Wikipedia)