Glad you got it sorted, I just realised I missed the part about you having a Gateway.-10E should be exploitable , its the 4.X browser (and I can launch gateway via it). just seems like the exploit chain for rxtools is missing.
Edit - Yup. I rolled back to 2.6 and it's exploit chain works , so I can update the browser and then swap back.
Gateway added support for booting sysNAND a little while ago, so for future reference;
From their release notes:
– Added option to boot into SYSNAND mode directly even with EMUNAND on SD card
We received plenty of feedback regarding our previous firmware release and we heard you!
In our last release we realised there was no easy way to boot into SYSNAND mode, so we got you covered now!
From now on, while in the Gateway menu with the boot icons visible, simply hold B while booting into Gateway mode or Classic mode!
You will then be asked to confirm booting into SYSNAND mode by pressing X.