Using the 16 pin chip clip, connect the modem 16 pin SPI flash MX25L6406E to the SPI Hook using the pin table below.

The connections will look like this. My wires were the wrong gender so I had to use a breadboard in between.

flashrom that comes with Ubuntu 16.04 does not include support for the FT2232H Hi-Speed Dual USB UART/FIFO IC and must be recompiled using the following steps.

$ sudo apt-get install libftdi1
$ sudo apt-get build-dep flashrom
$ cd flashroom-*
$ make

1. Run the tool and read the contents of the flash chip.

$ sudo ./flashrom -p ft2232_spi:type=2232h,port=A,divisor=4 -c "MX25L6406E/MX25L6408E" -r sb6141.bin
flashrom v0.9.9-rc1-r1942 on Linux 4.4.0-59-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on ft2232_spi.
Reading flash... done.

2. Create a backup of the file.

cp sb6141.bin sb6141-edit.bin

3. Erase the application partitions. This creates a blank (0xff) file to serve as the erase. (0xff signifies an erased byte) in most SPI flash memory chips.

tr '\0' '\377' < /dev/zero | dd of=ubfi_blank.bin bs=1 count=3866624
dd if=ubfi_blank.bin conv=notrunc of=sb6141-edit.bin bs=1 seek=262144

4. Write the forceWare application to both partitions.

dd if=forceWare-1.4b1-mod2.bin conv=notrunc of=sb6141-edit.bin bs=1 seek=262144
dd if=forceWare-1.4b1-mod2.bin conv=notrunc of=sb6141-edit.bin bs=1 seek=4128768

5. Flash the new flash image to the SPI flash.

$ sudo ./flashrom -p ft2232_spi:type=2232h,port=A,divisor=4 -c "MX25L6406E/MX25L6408E" --layout sb6141.layout --image ubfi1 --image ubfi2 -w sb6141-edit.bin 
flashrom v0.9.9-rc1-r1942 on Linux 4.4.0-59-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using regions: "ubfi1", "ubfi2".
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on ft2232_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

6. Disconnect the chip clip and power cycles the modem.

7. Connect to the modem over SSH using user root password force.

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@192.168.100.1

8. Connect to the web interface http://192.168.100.1 using user admin password force.