The Image Header provides some informations to the jboot (stock) bootloader to execute the bootstrap of the linux lzma image.
The Image Header located in the flash is 0x38 byte long. The Image size is variable and its value is reported in one field of the Image Header.
I'm currently able to decode only some field present in the Image Header, but not all.
With reference to the oem fw available from dlink DWR-921_RevC_Firmware3.01b07.bin, the Image Header is formatted as described below:
At power on reset the jboot should perform the foolowing operations:
verify the crc of the kernel and rootfs image
decompress the lzma image at the location reported in the field at 0x14 or 0x20 in the image
bootstrap the kernel with cmd line: console=ttyS1,57600n8 root=/dev/mtdblock3
This is the early log from the bootstrap:
Starting kernel @80000000...
THIS IS ASIC
Linux version 2.6.36 (firstname.lastname@example.org) (gcc version 4.3.5 (Buildroot 2011.05) ) #19 Thu Jul 7 15:20:08 CST 2016
FW Replacement using jboot
The jboot can be used to replace the fw image. To activate this function it is enough to send a character over the console during the firs seconds of the bootstrap. In this way the standard bootstrap process is interrupted and a web page appears at address 192.168.1.243.
This web page can load a “fw update file” and flash the new image accordingly.
The “fw update file” have a specific format and can be generated using the dlink binboy tool.
The “fw update file” is the concatenation of the following blocks:
specific file headers (0x50 bytes long)
kernel headers (almost identical to the one stored in the kernel flash partition) (0x38 bytes long)
kernel image in lzma format (variable size)
squashfs rootfs headers (0x50 bytes long)
squashfs rootfs image (variable size)
The file headers should be used to verify the file integrity and authenticity. Indeed jboot refuses the file if it is not properly formatted.
Currently the “specific file headers” is completely undecoded.
The kernel headers embedded in the “fw update file” is identical to the Kernel Image Header described in the previous section. The only differences is on the first byte: 0xff into the file, 0x04 into the flash.
With reference to the oem fw available from dlink DWR-921_RevC_Firmware3.01b07.bin:
The File generatedconcatenate the kernel lzma compressed, the rootfs and
toh/d-link/dwr-921_image_cracking.txt · Last modified: 2018/06/01 10:41 by tmomas