I think I've gotten a dump of the stock firmware. I tftped out openrg1.img and openrg2.img from /mnt/jffs2. These are both uImages bootable from U-Boot, and they both seem to boot the router into the stock firmware. Does anyone know what the difference would be between these two images?
Also, I found the flash layout in the boot menu, accessible by holding escape during kernel boot. It looks like this:
Flash layout:
Section 00 Type FACTORY Range 0x00000000-0x00020000 MaxSize 0x0001FF6C
Flash file: /mnt/jffs2/rg_factory
Size 0x0000040A Name 'Downloaded at: Fri Dec 14 19:02:44 2007'
Checksum 0x0000EB9E Counter 0x0000000B Start Offset 0x00000000
Section 01 Type CONF Range 0x00000000-0x00020000 MaxSize 0x0001FF6C
Flash file: /mnt/jffs2/rg_conf1
Size 0x000075B6 Name 'rg_conf'
Checksum 0x003A4EAB Counter 0x00012CED Start Offset 0x00000000
Section 02 Type CONF Range 0x00000000-0x00020000 MaxSize 0x0001FF6C
Flash file: /mnt/jffs2/rg_conf2
Size 0x000075B6 Name 'rg_conf'
Checksum 0x003A1A25 Counter 0x00012CE9 Start Offset 0x00000000
Section 03 Type BACKUP_CONF Range 0x00000000-0x00020000 MaxSize 0x0001FF6C
Flash file: /mnt/jffs2/backup_rg_conf
Size 0x00007E70 Name 'rg_conf'
Checksum 0x003F08CB Counter 0x000095EE Start Offset 0x00000000
Section 04 Type IMAGE Range 0x00000000-0x00F00000 MaxSize 0x00EFFF6C
Flash file: /mnt/jffs2/openrg1.img
Size 0x00636110 Name 'FEROCEON Version 4.7.5.3.31.2.19.40.21.24 Downloaded at: Fri Aug 12 00:32:36 2016'
Checksum 0x32418435 Counter 0x00009601 Start Offset 0x00000000
Section 05 Type IMAGE Range 0x00000000-0x00F00000 MaxSize 0x00EFFF6C
Flash file: /mnt/jffs2/openrg2.img
Size 0x00636110 Name 'FEROCEON Version 4.7.5.3.31.2.19.40.21.24 Downloaded at: Fri Aug 12 00:34:32 2016'
Checksum 0x3241843E Counter 0x0000960C Start Offset 0x00000000
Section 06 Type LOG Range 0x00000000-0x00040000 MaxSize 0x0003FF6C
Flash file: /mnt/jffs2/persistent_log
Size 0x00004A54 Name 'Persistent_log'
Checksum 0x00243A30 Counter 0x00012CEC Start Offset 0x00000000
Total 7 sections found.
Does backing up these 7 flash files constitute backing up the original firmware? How would I go about restoring these files from U-Boot?