Assistance with BD-P1600 Repair?

Has anyone ever attempted to fix a Samsung BD-P1600 Blu-Ray player after a bad firmware update? I'm like 90% of the way there. I've already been able to get it to boot after flashing it with the European XEF version of the software, but I cannot use most of the streaming features that originally came with the player, a side effect of the European software, and it has the wrong region. All I need now is the rootfs.bin file from and American, XAA, version of the software. If anyone has done this fix themselves than they would likely have this file somewhere if it hasn't already been deleted. I know its a long shot, but you never know. Also, as a general point of information, the firmware from the Samsung website is encrypted, so it's no help.

Links to sites describing the repair process:
http://www.avforums.com/threads/damaged-samsung-bd-p1620-after-firmware-upgrade.1218447/
http://www.avforums.com/threads/hacking-samsung-bd-p1620a-bd-p3600.1245419/


Edit:
So I've discovered something which someone might be able to help me with even if they don't have the files. When it was first bricked and I cracked it open to try and repair it, I did a flash dump from the cfe into a file on my tftp server. More recently I copied partition 10 from the kernel to a flash drive, which supposedly is all the other partitions together, including the rootfs. When I compared this file to the flash dump from a year prior, the beginning part appeared exactly the same, so I though that by looking at the section in the copy of the partition that represents the rootfs, I could make a copy from the corresponding section in the flash dump and flash that as the rootfs. Sufficed to say, it didn't work, but just today I repeated the flash dump and found that it too is different than partition 10. It appears that beyond the first section of the file the flash dump has a completely different structure. When I compared the two sections in both flash dumps, they appeared very similar but has small differences in one section, which I would expect is a result of reflashing the rootfs. So now my question is is there a way to use the flash dump to repair the player?

Edit: Additional question, I was wondering if I would be able to use the cfe to directly rewrite the section of the flash that is different. Fortunately, the cfe section of the flash appears to remain identical in all versions of the flash file I have, so I wont be rewriting that part, hopefully preventing it from being completely unbootable should something not work. My problem is that I am having problems figuring out how to reflash the nand from the cfe. I'm using the command:

flash -offset=20000000 192.168.2.104:bh

I keep getting the error:

flash0: Device not found
*** command status = -6


I think this is because the command did not specify a flash area to write to, so I did show devices and got:

         uart0  16550 DUART at 0xB0400B00 channel 0
         flash0.cfe  New NAND flash at 00000000 offset 00000000 size 1536KB
      flash0.kernel  New NAND flash at 00000000 offset 00180000 size 5120KB
      flash0.rootfs  New NAND flash at 00000000 offset 00680000 size 40960KB
       flash0.pstor  New NAND flash at 00000000 offset 02E80000 size 8176KB
      flash0.splash  New NAND flash at 00000000 offset 0367C000 size 1280KB
   flash0.drmregion  New NAND flash at 00000000 offset 037BC000 size 128KB
      flash0.rawnvr  New NAND flash at 00000000 offset 037DC000 size 768KB
      flash0.macadr  New NAND flash at 00000000 offset 0389C000 size 16KB
       flash0.nvram  New NAND flash at 00000000 offset 038A0000 size 128KB
        flash0.swap  New NAND flash at 00000000 offset 038C0000 size 6400KB
         flash0.bbt  New NAND flash at 00000000 offset 03F00000 size 1024KB
         flash1.all  New NAND flash at 00000000 offset 00000000 size 65536KB
               eth0  BCM7038 Internal Ethernet at 0xB0080000

I'm not sure which one to choose. When I dumped the flash I used the command:

CFE>save 192.168.x.y:flash_dump 0x1fc00000 0x4000000

The definition of the save command is:

save                Save a region of memory to a remote file via TFTP

 

Any idea which part of the flash this is dumping from / which part I should write to?