I finally got some time to try recovering my ER-X again, and got it unbricked. This is what I did:
Downloaded and built openwrt on my Fedora (linux) PC:
$ git clone https://git.openwrt.org/openwrt.git $ cd openwrt $ ./scripts/feeds update -a $ ./scripts/feeds install -a $ sudo dnf install zlib-static $ make menuconfig
Target System: Ralink RT288x/RT3xxx
Subtarget: MT7621 based boards
Target Profile: Ubiquiti EdgeRouter X
Target Images
Select RAMdisk
Save and Exit
$ make
This took a while to compile everything, and gave me:
bin/ramips/openwrt-ramips-mt7621-ubnt-erx-initramfs-kernel.bin
I then copied this file to a TFTP server (I used tftp-server on my Fedora - you could probably use something like tftpd64 on Windows).
On the ER-X, I had it taken apart, and hooked up to its serial port (see a few pages back for how to do this). I then booted the device and used option 1 on the uboot bootloader to boot from TFTP.
I gave it an IP on my LAN, told it the IP of my TFTP server, told it the filename of the openwrt .bin file above, and it booted openwrt it without a problem.
I then mounted the ubiquiti partition with:
$ sudo mount -t ubifs /dev/ubi0_0 /mnt
At that point, I backed up everything on the partition using SCP, and deleted everything on it.
I then used my Fedora machine to download the same ER-X firmware file that I had installed on the device before I bricked it, extracted the contents of the archive, and renamed the following files:
squashfs.tmp --> squashfs.img squashfs.tmp.md5 --> squashfs.img.md5 version.tmp --> version
I then used SCP to copy the 3 files to the ubiquiti device, and put them in /mnt (the partition I had mounted).
I rebooted the device and it booted normally without a problem.
I then got the latest firmware image, upgraded it, and it worked great after that as well.
Note: The files I restored did NOT include the actual kernel (vmlinux). I'm not entirely sure how to mount the partition that stores the kernel using openwrt (if it can be mounted at all - maybe it just gets written to some specific address on the disk with dd?). If anyone knows how to get to the kernel partition, please let us know.