Ubiquiti cfg partition

Ubiquiti WA devices contain a cfg mtd patition. It uses a proprietary format and holds device configuration as well as the contents of /var/etc/persistent

The config partition can store multiple configurations.

Each configuration starts with a 24 byte header:

Ubiquiti cfg header
name	magic	length	crc	unknown	id	padding
offset	0x00	0x04	0x08	0x0c	0x10	0x14
length	0x04	0x04	0x04	0x04	0x04	0x04
usage	header magic	payload length	crc32	unknown	config id
value	0x12345678					0x00000000

Seen values: 0x01000000, 0x02000000 Seems to identify the config currently in use, config with 0x01000000 is backup config

CRC32 of zlib deflated textual device config

The two most significant bytes seem to be always 0.

Seen values (lower 16 bit)
	hex	binary
device a	0x2831	0b0010100111101000
device b	0x29e8	0b0010101011010100
device c	0x2ad4	0b0010100000110001

The payload is zlib compressed and consists of the concatenation of textual device config and the tared and gziped folder /var/etc/persistent

Ubiquiti cfg partition

Layout

id

crc

unknown

Payload format