Installing LEDE/u-boot via brnboot web interface (without rs232)

Ha! It worked! I successfully installed u-boot and OpenWrt on my O2 box 6431 over ethernet, completely without requireing any rs232 access what so ever!

UPDATE: later builds like 18.06.1 including LUCI might work without problems...
I updated the links here to 18.06.1 but I haven't tested it myself so far (@drvcucwk has tested the 18.06-SNAPSHOT build successfully I think).


  1. The latest brn build.
  2. The latest nor build.
  3. An u-boot nor build.
  4. A workstation with some kind of *NIX shell to ssh, dd and sftp/scp some stuff (Swan is great for Windows users!).
  5. One ethernet interface of your workstation must be connected to the router and configured to use the ip+netmask (just to be on the safe side).

Steps to reproduce:

  1. Install OpenWrt via brnboot's recover web interface.
    1. Press and hold the reset button while you power on the Router and release it ~5 seconds later (the power LED should be blinking/lit red).
    2. Open , select Firmware as target and choose the brn build.
    3. Press apply and wait ~6 minutes. Running a continuous ping against the router (e.g. ping -t on Windows) might indicate when flashing is done: The router answers before and after but not during the flashing process.
      Note: The webif might show a bundle of garbled characters - this is normal.
    4. After cycling the power of the router and giving it time to boot OpenWrt should be installed and usable, but if you want up to ~9 MiB free flash space you still need to get rid of the rest of the original firmware.
  2. Backup the boot_parms / board_config MTD partition.
    1. SSH into the running OpenWrt.
    2. Identify the 128KiB MTD partition board_config beginning at 0xFE0000 with
      dmesg | grep -i -e mtd -e 0x0 && echo && cat /proc/mtd
      (see default flash layout if necessary).
    3. Copy that MTD partition: dd if=/dev/mtd? of=/tmp/board_config.dump (replace ? with the correct number from the last step - usually 0).
    4. Get that file into your working directory with sftp/scp (e.g. scp -P ?22? root@ ./<path>/.).
    5. This is the perfect opportunity to make backups of the other remaining original partitions too (boot, Configuration, Certificate, Special_Area, Primary_Setting and Code_Image_0/1 I think - It may even be possible to recreate the original firmware by duplicating Code_Image_? to _0 and _1).
  3. Create a 16MiB firmware image for a full flash just for your router (*).
    1. Copy u-boot:
      dd of=./cImage.bin if=./u-boot.bin
    2. Integrate your oWRT nor image (at position 0x80000):
      dd bs=1024 seek=512 of=./cImage.bin if=./***NOR-squashfs-sysupgrade.bin
    3. Finish the image with the board_config (at 0xfe0000) and verify it's size (exactly 16 MiB = 16777216 Byte):
      dd bs=1024 seek=16256 of=./cImage.bin if=./board_config.dump
    4. Optional step - Add a 128KiB (131.072 byte) non-empty uboot environment with correct CRC between uboot and OpenWrt to make it usable for the uboot-envtools with:
      dd bs=1024 seek=384 conv=notrunc if=/<path>/uBoot-Env.bin of=cImage.bin
  4. Flash cImage.bin on your router via brnboot's hidden recover web interface ( similar to 1. - just select "Master" instead of Firmware or Bootloader.

Now your router should be running with OpenWrt and be able to use the whole flash (-768 KiB for u-boot + env. and config).

(*) I tried a partial flash image without the board_config part but brnboot's webif didn't accept it and this 16 MiB image is only for the specific router the board_config came from!
If you want to use it for other o2 6431 boxes you need to repeat at least step 3.3.

While writing 4. I noticed this is not news at all (on oWRT's brnboot wiki page):

When the flashing is finished, the page may reload and show some garbled crap. Be sure to wait unil the flashing is finished before powercycling the device. On my IAD 4421 with 8MiB of NOR flash, a "master" flash (reflashing the entire flash, including the bootloader and the ART partition) took about 5 minutes.

... but i couldn't find any (step by step) guide explaining how to to this. ?!

Now can someone please put this guide on the oWRT wiki? I really don't want to mess with that heap of jumbled up (old) information... Or can I create a new page in the LEDE Wiki?

Can someone verify this works? My router keeps crashing randomly because it's still running 17.01.4 and so far I couldn't find the time to compile a proper image...

Ugh! I only looked in the release folder and couldn't find anything.

Which guide did you follow? All I found were the oWRT wiki and other old entries.

Btw. proto=none didn't help at all with 17.01.4 - the router sill hung randomly.