I'm trying to modify an openWRT frimware in order to be able to flash it in a router, these are the steps:

  1. download the latest nbg-419n2-initramfs-kernel.bin use hexedit and
  2. change first 4 bytes to “Zyxel-like” u-boot magic number FF A8 30 90
  3. count new CRC32 of u-boot header (64 bytes) and write next 4 bytes (7A BE 7A CE for openwrt-18.06.5-ramips-rt305x-nbg-419n2-initramfs-kernel.bin)
  4. start tftp server IP rename changed image file to NBG419Nv2.bin and set to tftp server connect any lan port with server press and hold the WPS key button on device and power on after 20-30 second your
  5. openWrt on ip is ready and waiting

Step 3 is the problem for me, I can't figure out how to calculate the new CRC32 of the u-boot header. I don't know where does it start and ends, I know it's a 64 bytes however. What do I use to calculate it? (I tried crc32 tool on Linux)

  • I don't understand step 3 and 4, can you guide me? Is there a clip to watch?
    – palm
    Commented Mar 16, 2023 at 8:30

1 Answer 1


I figured it out:

You reset the checksum to ZEROs then you calculate CRC32 of the u boot header (from first byte to 64th byte)

AA XX YY ZZ 00 00 00 00 ....

the first 4 bytes are for magic word; the next 4 bytes are the checksum.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.