Tenda AC15 固件修改

MTD size

 

mtd0: 0100000000010000 "All"

mtd1: 0004000000010000 "Bootloader"

mtd2: 00f7000000010000 "KernelFS"

mtd3: 00da61a800010000 "RootFS"

mtd4: 0001000000010000 "crash"

mtd5: 0001000000010000 "Policy"

mtd6: 0001000000010000 "CFM_BACKUP"

mtd7: 0001000000010000 "CFM"

mtd8: 0001000000010000 "nvram"

 

 

Binwalk 信息

DECIMAL       HEXADECIMAL     DESCRIPTION

--------------------------------------------------------------------------------

64            0x40            TRX firmware header, little endian,image size: 10629120 bytes, CRC32: 0xAB135998, flags: 0x0, version: 1, headersize: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x1C9E58, rootfsoffset: 0x0

92            0x5C            LZMA compressed data, properties:0x5D, dictionary size: 65536 bytes, uncompressed size: 4585280 bytes

1875608       0x1C9E98        Squashfs filesystem, little endian,version 4.0, compression:xz, size: 8749996 bytes, 928 inodes, blocksize: 131072bytes, created: 2017-05-26 02:03:03

 

mkimage 信息

 

Created:      Fri May 26 10:03:05 2017

Image Type:   ARM Linux Kernel Image (lzma compressed)

Data Size:    10629120 Bytes = 10380.00 kB = 10.14 MB

Load Address:80000000

Entry Point:  c0008000

 

分区，可以使用下面的binwalk解包：

https://github.com/Chengjian-Tang/binwalk

Kernel:5C - 1C9E97

ROOT:1C9E98 - end

 

Root分区解压

unsquashfs -d root root.img

 

打包root fs为squash fs

 mksquashfs ./root root_new.img -noappend-root-owned -comp xz -b 128k

 

 

打包为trx

 ./trx -o ac15.bin -m 100000000 -f kernel.bin-f root_new.img

 

将trx打包为可刷的image

mkimage -A arm -a 0x80000000 -e 0xc0008000 -C lzma -d ac15.bin ac15_new.bin

 

 

在image 中修改Tenda header

 

0x20: 02 00 00 00 00 03 00 19 00 A2 20 40 00 00 00 00

红色部分为固件总长度需要修改为imageheader中payload的长度加上0x40。如下：

 

Image header 0x00~0x19数据，红色部分为payload的长度

0x00:27 05 19 56 6D AA 74 95 5A 25 4A 03 00 A2 20 00

包含/opt分区，可以安装entware的修改版如下：

https://github.com/Chengjian-Tang/Stock_AC15_FW_custom