1

I'm trying to modify an openWRT frimware in order to be able to flash it in a router, these are the steps:

  1. download the latest nbg-419n2-initramfs-kernel.bin use hexedit and
  2. change first 4 bytes to “Zyxel-like” u-boot magic number FF A8 30 90
  3. count new CRC32 of u-boot header (64 bytes) and write next 4 bytes (7A BE 7A CE for openwrt-18.06.5-ramips-rt305x-nbg-419n2-initramfs-kernel.bin)
  4. start tftp server IP 192.168.1.82 rename changed image file to NBG419Nv2.bin and set to tftp server connect any lan port with server press and hold the WPS key button on device and power on after 20-30 second your
  5. openWrt on ip 192.168.1.1 is ready and waiting

Step 3 is the problem for me, I can't figure out how to calculate the new CRC32 of the u-boot header. I don't know where does it start and ends, I know it's a 64 bytes however. What do I use to calculate it? (I tried crc32 tool on Linux)

1

I figured it out:

You reset the checksum to ZEROs then you calculate CRC32 of the u boot header (from first byte to 64th byte)

AA XX YY ZZ 00 00 00 00 ....

the first 4 bytes are for magic word; the next 4 bytes are the checksum.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.