QNAP TS-228 u-boot firmware

I am looking for somebody with a functioning QNAP TS-228 (32 bit; non-a version). I had a firmware upgrade gone bad and the firmware got corrupted. I have a usb ttl so I managed to connect to serial console and somewhat fix the box (extracted/decrypted the latest QTS firmware and replaced the faulty files).
Unfortunately - I also managed to break the u-boot. Since there is no recovery firmware for this model, I installed the u-boot image from TS-228a (newer model). So the NAS now boots fully, but I have to manually run a bootr u-boot command every time i power it on.

< cut messages >
get_bootparam:
------------can't find tmp/factory/000BootParam.h
Factory RO: MMC
Factory RO: seq#:0x1, size:0x200
[ENV] read_env from factory failed
[ENV] Using default environment variables

In:    serial
Out:   serial
Err:   serial
Net:   Realtek PCIe GBE Family Controller mcfg = 0024
dev->name=r8168#0
Hit Esc or Tab key to enter console mode or rescue linux:  0
------------can't find tmp/factory/recovery

Press Install Button

(Re)start USB...
USB0:   USB EHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found

1: Hub,  USB Revision 2.0
 - u-boot EHCI Host Controller
 - Class: Hub
 - PacketSize: 64  Configurations: 1
 - Vendor: 0x0000  Product 0x0000 Version 1.0
   Configuration: 1
   - Interfaces: 1 Self Powered 0mA
     Interface: 0
     - Alternate Setting 0, Endpoints: 1
     - Class Hub
     - Endpoint 1 In Interrupt MaxPacket 8 Interval 255ms


USB device -1: device type unknown

** Invalid boot device **
Loading "rescue.emmc.dtb" from USB failed.
Enter console mode, disable watchdog ...

Realtek>

Realtek> env print
baudrate=115200
bootargs=console=ttyS0,115200 earlyprintk loglevel=4
bootcmd=bootr
bootdelay=0
ethact=r8168#0
ethaddr=00:10:20:30:40:50
fdt_loadaddr=0x01FF2000
gatewayip=192.168.100.254
ipaddr=192.168.100.1
kernel_loadaddr=0x03000000
mtd_part=mtdparts=rtk_nand:
netmask=255.255.255.0
rescue_audio=bluecore.audio
rescue_cmd=go ru
rescue_dtb=rescue.emmc.dtb
rescue_rootfs=rescue.root.emmc.cpio.gz_pad.img
rescue_vmlinux=emmc.uImage
rootfs_loadaddr=0x02200000
serverip=192.168.100.2

Even though the boot env variable is set to bootr I always have to execute it manually to start up the box:

Realtek> bootr
Start Boot Setup ...
[INFO] fw desc table base: 0x00620000, count: 6
Normal boot fw follow...
Kernel:
         FW Image to 0x03000000, size=0x00592a00, 0x2c95 blocks (0x03592a00)
         FW Image fr 0x008b7600, fr block 0x45bb (non-lzma)
DT:
         FW Image to 0x01ff2000, size=0x000064fa, 0x33 blocks (0x01ff84fa)
         FW Image fr 0x00630000, fr block 0x3180 (non-lzma)
resolution = <0x500 0x2d0>
ROOTFS:
         FW Image to 0x02200000, size=0x00400000, 0x2000 blocks (0x02600000)
         FW Image fr 0x01a4a000, fr block 0xd250 (non-lzma)
Audio FW:
         FW Image to 0x01b00000, size=0x0027f528, 0x13fb blocks (0x01d7f528)
         FW Image fr 0x00638000, fr block 0x31c0 (non-lzma)
Start A/V Firmware ...
e# Booting kernel from L
 gaHDcyM IIm aRgea awt  0E30n0a00b00l e:... M

Also tried to contact the qnap support but they were no help.

Since I don't know exactly what the problem is, I need a full dump of the /dev/mmcblk0 from a TS-228 to fix my box. I would be greatfull to anyone willing to share this with me.

Something like this should do the trick:

gzip </dev/mmcblk0 > /share/Public/emmc.img.gz

Thanks!