1

I want to modify a firmware image for a WiFi router. The image file consist of an UBI image, 0x04100000 bytes in size. Additonally, 20 bytes of unknown metadata have been appended to the UBI image data. I have two different official firmware files for this router. After comparing those 20 bytes of both files I am convinced now that the first 4 bytes are a 32 bit CRC of some sort.

Because CRC32 is very common, I tried CRC32 with various common start values and polynominals without luck. I applied it only across the UBI data before those 20 bytes, the UBI data with the remaining 16 bytes and the UBI data with the whole 20 bytes while using a 0x00000000 and 0xffffffff placeholder for the CRC.

enter image description here

What could I try next? Is there a way to programatically find CRC32 start values/polynominals when the data and CRC are given?

Here are the files: https://drive.google.com/file/d/15n_Pg8zeSOf_VCcflWoTaMm8MwxBaFXk/view?usp=drive_link

Decompiling the Broadcom CFE bootloader that installs the firmware would be an option but isn't going to be easy at all.

Thanks!

1 Answer 1

2

OK my question didn't age well. Turns out "RevEng" was the tool I needed:

reveng.exe -w 32 -fs 010139.3.4.001.0-dec-crc.bin
reveng.exe: warning: you have only given 1 sample
reveng.exe: warning: to reduce false positives, give 4 or more samples
width=32  poly=0x04c11db7  init=0xffffffff  refin=true  refout=true  xorout=0x00000000  check=0x340bc6d9  residue=0x00000000  name="CRC-32/JAMCRC"

The input file for RevEng contained the UBI image data plus the 4 bytes CRC appended to the end (thats what RevEng expects).

1
  • You can accept this as an answer.
    – sudhackar
    Feb 6 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.