*WARNING* don't follow this unless you understand the risk to your warranty sanity etc. I have a repaired old ADSL2MUE with serial console and working JTAG connection for emergency use. Oh and yes this is a long post... Inspired by the http://www.bitsum.com/firmware_mod_kit.htm published by the Jeremy Collake (who cracked the WRT54G vxworks problem), I have just found a package of Unsquashfs 1.3r3 squashfs-tools.tar.bz2 posted on the openwrt WRTP54G document page http://wiki.openwrt.org/OpenWrtDocs/Hardware/Linksys/ WRTP54G [direct link not working] I have tried and failed in the past to mount squashfs-lzma images under linux (need to patch and recompile kernel) but have now managed to do it from the command line without having to compile anything. It just happens that the Linksys 4.22 beta posted on this site http://www.linksysinfo.org/forums/showthread.php?t=45550 uses a very similar version of squashfs-lzma 1.3, other versions would need custom tools. There's not a lot you can do with this, but changing web pages is one, adding scripts clearly possible, modules probably would have to be compiled against an identical kernel but for academic interest only here's how it can be done:- Note - I used as linux box, probably could do the extraction under cygwin but you really need a linux disk partition to preserve case and file properties if you want to re-squash. 1. Split the firmware upgrade image into two parts, the first contains the header and kernel. The second the squashfs filesystem. I give the commands and the responses. Code: root:# dd if=LKS.single.annexA.upgrade.422.EU.img of=orig422knl.img ibs=1K count=476 476+0 records in 952+0 records out 487424 bytes (487 kB) copied, 0.060558 seconds, 8.0 MB/s root:# dd if=LKS.single.annexA.upgrade.422.EU.img of=orig422fs.img ibs=1K skip=476 1392+1 records in 2784+1 records out 1425416 bytes (1.4 MB) copied, 0.174192 seconds, 8.2 MB/s 2. Unsquash the filesystem and show the contents now in squashfs-root are accessible Code: root:# ./unsquashfs-lzma orig422fs.img created 141 files created 36 directories created 83 symlinks created 0 devices created 0 fifos root:# ls squashfs-root bin/ dev/ etc/ lib/ proc/ sbin/ usr/ var/ var.tar root:# ls squashfs-root/usr/www/html AdminDiag-p.htm AdminSyslog.htm SetupBMO.htm StatusLan.htm dhcp_table.htm reboot.htm AdminDiag.htm AdminUpgrade.htm SetupNETs.htm StatusModem.htm images/ save.htm AdminManage.htm Setup1483bs.htm SetupPPPoA.htm blank.htm index.html update_result.html AdminRestore.htm Setup1483r.htm SetupPPPoE.htm contype.htm js/ upgrade.htm 3. Just to check the process I don't make any changes but re-squash the filesystem Code: root:# ./mksquashfs-lzma squashfs-root nsp.annexA.squashfs.img Creating little endian filesystem on nsp.annexA.squashfs.img, block size 32768. Little endian filesystem, data block size 32768, compressed data, compressed metadata Filesystem size 1389.07 Kbytes (1.36 Mbytes) 27.62% of uncompressed filesystem size (5030.02 Kbytes) Inode table size 2196 bytes (2.14 Kbytes) 47.53% of uncompressed inode table size (4620 bytes) Directory table size 1970 bytes (1.92 Kbytes) 62.11% of uncompressed directory table size (3172 bytes) Number of duplicate files found 5 Number of inodes 260 Number of files 141 Number of symbolic links 83 Number of device nodes 0 Number of fifo nodes 0 Number of socket nodes 0 Number of directories 36 Number of uids 2 root (0) unknown (500) Number of gids 4. Add back the header and kernel section Code: cp orig422knl.img mytest.img root:# dd if=nsp.annexA.squashfs.img of=mytest.img conv=notrunc oflag=append 2784+0 records in 2784+0 records out 1425408 bytes (1.4 MB) copied, 0.0962899 seconds, 14.8 MB/s 5. Add the TI checksum, using the binary in Russian Acorp source not the perl script on the openwrt page (not tried but should work) Code: root:# ../source/nsp/tools/bin/tichksum mytest.img File doesn't contain the checksum, adding Calculated checksum is 5F2E30AF Added successfully 6. Compare the new image with the original, same size but... Code: root:# ls -l LKS.single.annexA.upgrade.422.EU.img mytest.img -rwxr--r-- 1 user user 1912840 2005-09-30 01:14 LKS.single.annexA.upgrade.422.EU.img* -rw-r--r-- 1 root root 1912840 2007-03-04 11:59 mytest.img root:# diff LKS.single.annexA.upgrade.422.EU.img mytest.img Binary files LKS.single.annexA.upgrade.422.EU.img and mytest.img differ 7. Try it anyway, load from web interface, this is what is reported on the serial console:- Code: ****************** NSP Firmware Upgrade ****************** Mounting PROC on /var/proc...OK Mounting DEV on /var/dev...OK Pivoting / to /var...OK Changing work dir to / ...OK Unmounting /flash/proc...OK Unmounting /flash/dev...OK Unmounting /flash...OK Upgrading flash memory... FLASH /tmp/fw.bin... Progress: |********************************| 100% SETMTDS /tmp/fw.bin : /dev/mtdblock/4. MTD4 = 0x90020000,0x90400000 MTD1 = 0x90020090,0x90097000 MTD0 = 0x90097000,0x90400000 REBOOT. Restarting system. Minimal POST completed... Success. Last reset cause: Software reset (memory controller also reset) PSPBoot1.2 rev: 220.127.116.11 (c) Copyright 2002-2004 Texas Instruments, Inc. All Rights Reserved. Press ESC for monitor... 1 (psbl) Booting... Launching kernel decompressor. Starting LZMA Uncompression Algorithm. Copyright (C) 2003 Texas Instruments Incorporated; Copyright (C) 1999-2003 Igor Pavlov. Compressed file is LZMA format. Kernel decompressor was successful ... launching kernel. LINUX started... Config serial console: ttyS0,38400 Auto Detection SANGAM chip This SOC has MDIX cababilities on chip. CPU revision is: 00018448 Primary instruction cache 16kb, linesize 16 bytes (4 ways) Primary data cache 16kb, linesize 16 bytes (4 ways) Number of TLB entries 16. Linux version 2.4.17_mvl21-malta-mips_fp_le (firstname.lastname@example.org) (gcc version 2.95.3 20010315 (release/MontaVista)) #1 Mon Aug 8 16:09:32 CST 2005 ... 8. Do a hard reset, enter ISP details, it seems to work Now can I add back those web pages that were seen in version 2.17Ti, enable half bridge mode and snmp etc...?