Hi @c-mauderer,
after a lot of headscratching I now have a way of flashing. Beware that this has only been tested once, and needs more testing.
After some searching I found the routine for the Nanobeam-AC that does it by patching 'ubntbox' so that the signature check is skipped.
A few hours with Ghidra and then the same result for ACB-ISP is to change byte 6016 into 10, first scp the file /sbin/ubntbox to your computer and then edit with hexedit and save it. Then scp the file to ubnt@192.168.1.1:/tmp/
So first problem solved, next generate file that can be used for flashing.
What I did then was to try several things, I'm not sure if everything I did is needed though.
I changed generic-ubnt.mk file in openwrt to this:
define Device/ubnt-acb
$(Device/ubnt)
UBNT_TYPE := ACB
UBNT_CHIP := qca9533
UBNT_BOARD := ACB
UBNT_VERSION := 2.5.0
ATH_SOC := qca9533
endef
define Device/ubnt_acb-isp
$(Device/ubnt-acb)
DEVICE_MODEL := airCube ISP
UBNT_BOARD := ACB-ISP
IMAGE_SIZE := 15744k
IMAGE/factory.bin := $$(IMAGE/sysupgrade.bin) | mkubntimage-split
endef
TARGET_DEVICES += ubnt_acb-isp
I changed mkfwimage.c in openwrt and added this under "WA" definition:
{
.name = "ACB",
.fw_layout = {
.kern_start = 0x9f050000,
.kern_entry = 0x80002000,
.firmware_max_length= 0x00F60000,
},
.sign = true,
},
The end result was to see if openwrt would generate the image file and build it like for Nanobeam-AC, but somehow it didn't do that. I still had the normal file so ubntbox didn't want it.
So I then had to generate the file by hand:
dd if=openwrt-ath79-generic-ubnt_acb-isp-squashfs-factory.bin of=old1 bs=1024k count=1
dd if=openwrt-ath79-generic-ubnt_acb-isp-squashfs-factory.bin of=old2 bs=1024k skip=1
./openwrt/build_dir/host/firmware-utils/bin/mkfwimage -B ACB -v ACB.ar934x.v2.5.0.be3e459.190520.1449 -k old1 -r old2 -o TEST.bin
I used the same version info as for the original firmware so that ubntbox likes the file.
Then scp the TEST.bin file to ubnt@192.168.1.1:/tmp/
I have only had time to test the update via console, but it should work via ssh.
Anyway, login to aircube, and run:
/tmp/ubntbox fwupdate.real -m /tmp/TEST.bin
Of course to get ssh access you need to edit the config file and upload it via the web interface.
This is tested on v2.5.0 of the original AirCube firmware.
Good luck and hopefully it works for you to, I will test more later.