[Fuhu Nabi 2] aicjofs:
Keep in mind I had the Nabi 2S for all of a day, so what I am about to say only applies to the Nabi 2 not 2S. If you see no menu then there is a non functioning bootloader, or at least it doesn't load all the way. It won't front any USB port, and you won't see it with lusb. There is a way to manually start "forced recovery" though(or there was on the Nabi2) See this: https://xdaforums.com/showpost.php?p=46694284&postcount=1701 If you can short the solder joints, I would assume the 2S has them too. That will start the 3pserver on the tegra itself, and bring up a USB interface. I don't think you need the APX driver for linux but you might check. There are plenty of linux nvflash binaries out there. Here is one that should work for tegra3 for sure: http://www.androidroot.mobi/pages/guides/tegra3-guide-nvflash-jellybean/ or search github and compile your own. That would allow what you want, however... I'm not sure where the bootloader partition is. In the notes I linked above I listed a cat /proc/partitions which I will markup below

179 0 15269888 mmcblk0

179 1 8192 mmcblk0p1 <---likely recovery partition but maybe boot

179 2 8192 mmcblk0p2 <---likely boot partition but maybe recovery

179 3 2048 mmcblk0p3 <---if like a Nabi 2 the EKS with crypto key

179 4 2048 mmcblk0p4 <---if like a Nabi 2 the linux backup partition table.

179 5 2097152 mmcblk0p5 <--- preload aka addon partition with all the Nabi apps and media

179 6 1572864 mmcblk0p6 <--- system partition

179 7 2097152 mmcblk0p7 <--- cache partition

179 8 2048 mmcblk0p8 <--- not sure

179 9 32768 mmcblk0p9 <---if like a Nabi 2 the USP or staging partition for placing blob files for flashing

179 10 2048 mmcblk0p10 <---Not sure

179 11 9435136 mmcblk0p11 <--- data partition

179 32 4096 mmcblk0boot1

179 16 4096 mmcblk0boot0

The problem here is the Nabi 2 had a 6MB partition that was clearly the bootloader. A 2MB that was the Nvidia/Tegra partition table(different structure then a linux PT), and a 4MB partition for the device parameters. Those are "nvidia partitions" and don't show up in the linux partition table. For the Nabi 2 the bootloader was nvidia partition 4

I would go about it like this:

Tear open the Nabi and see if it has the pins to force tegra to 3pserver

Get nvflash binary or compile one

Get the bootloader.bin from here(note the name is bootloader2S.bin and the commands below I have bootloader.bin so rename it: https://xdaforums.com/showpost.php?p=58603231&postcount=2504

Force the tablet to 3pserver with the pins

Check to see if it's there with lusb

Use the commands(if you are a linux guy I assume you know you may need sudo, or ./nvflash, etc, etc)

nvflash --bl bootloader.bin --getpartitiontable partitiontable.txt

^^^examine the partitiontable.txt and see if it clarifies where the bootloader might be. They like to call it EBT in tegra. I would tell you how to flash the botloader but I just don't know where it is. The bootloader tries to load the boot.img from the boot partition, and has some sort of watchdog where if it doesn't load boot.img in such and such amount of time, it will try and load recovery.img. If that doesn't happen it just sits there staring at you. You could try and flash boot and recovery and maybe that brings you back to something more familiar. Examine the partition table text and find out which is boot and recovery. Boot is usually LNX, and recovery SOS.

If you are still in nvflash mode after all of this and havent shut down the tablet use commands below. If you have to restart you need have a first command of "nvflash --bl bootloader.bin <some command>" then all subsequent commands just need "nvflash --resume <some command>"

If it's exactly like a Nabi 2 then this would be the flow. So if your partitiontable.txt shows EBT as 4, SOS as 7, and LNX as 8

nvflash --resume --rawdeviceread 0 3072 nabibricksafe.img

nvflash --resume --read 4 04_EBT_raw.img

nvflash --resume --read 7 07_SOS_raw.img

nvflash --resume --read 8 08_LNX_raw.img

<optional>

nvflash --resume --download 4 bootloader.bin

nvflash --resume --download 7 twrp.img

nvflash --resume --download 8 twrp.img

nvflash --resume --go

^^^I have no idea about the 3072. That gets the first 3 "nvidia partitions" on a Nabi2 but that may not be long enough for a 2S, you can make it a larger read to be on the safe side(maybe 6000). You are basically reading the critical part of the tablet, backing up the current partition 4, 7, and 8, before reloading 7,8 with TWRP. Then tablet should restart. Remember if you have to restart the tablet the "resume" won't work, you will need to issue something with -bl bootloader.bin after a fresh boot as the first command of the session. You could add

nvflash --resume --download 4 bootloader.bin

in the above if the partition table confirms its the bootloader partition(EBT). In fact that may actually be the ONLY command you need to bring back the bootloader text, I'm just being cautious since it's not my tablet and taking a conservative approach.

That will put TWRP in both boot and recovery partitions so that hopefully you can boot TWRP somehow. If we can, then we can go back and fix things in TWRP. This may be all you need.

Side note: I never used nvflash on a 2S so who even knows if all this typing means anything, and maybe the emmc is just bad and none of this matters. I'm just try to give you all the major things I can think of to save you time. Good luck!