Zisa OP-151S modify SquashFS - help CRC calculation

For Developers
1

Hi all,

i'm trying to modify the ImageB of this GPON stick, but i've problem with CRC check when uBoot tries to run the image with this error:

FALCON => env set active_image B
FALCON => saveenv
Saving Environment to SPI Flash...
SF: Detected GD25Q64B with page size 4 KiB, total 8 MiB
Erasing SPI flash...Writing to SPI flash...done
FALCON => boot
SF: Detected GD25Q64B with page size 4 KiB, total 8 MiB
sf read 0x80effe00 0x400000 0x390000
cur_crc = 3b50fc9a crc_in_image = fc1ee545
ImageB head check ERROR!

I'm attaching the mtd3 image that I'm trying to use.
Anyone can help me how to calculate correct CRC?

mtd3_mod

Thanks in advance

2

This script shows the location and function used to calculate the CRC for all 3 locations in the firmware.

Original openwrt topic for this module:

1 Like
3

i've tried that scripts (setting up all firmware-mod-kit stuff) but still get CRC error :frowning:

4

@centaur do you have Zisa version or Zyxel?
I currently have the Zyxel, looks like the uBoot calculate CRC in a different way.

Can you send me (if you have Zisa) the mtd0 of your stick?

Thanks in advance

5

All of my modules are currently in storage. I do not have the original Zisa module but rather some other substitute. It will be a while before I get to them and configure some devices.
The script from github creates an .upf update file, which is best used via the web interface. There is also a command line equivalent.

In another ZISA topic there is a link to a complete OP151S dump called mtd5, including mtd0, Env, ImageA, ImageB,Config, SECTION_EGIS, rootfs, rootfs_data

https://www.dropbox.com/s/v1sxo2js25t0csv/zisa_fw_for_g-010s-p.7z?dl=1

The mtd0 can be extraced from it.

dd if=mtd5 of=mtd0 bs=1 count=393216

md5sum: a040a841999efafe44391f704edbc3c8
U-Boot 2011.12-lantiq-gpon-1.2.16-svn24575 (Oct 11 2014 - 16:42:08)

Some additional links with .upf files

https://valero-torres.es/wp-content/uploads/2017/07/Firmware_SFP_ONT_-_ZISA_-OP151S-4114943.7z
https://drive.google.com/drive/folders/1FwgzzbNyeh3Uu04yWo5GZLd3ZOgHr8Ck
6

we have found thanks to another user a WA to make the CRC corrected.

Essentialy:

(extract first 512 byte of firmware into GitHub repository)
dd if=3FE45464AOCK21.upf.tmp bs=1 count=512 of=ZISA.header

(merge this header with mtd3 dump of Zyxel stick)
cat ZISA header mtd3 > mtd3.zisa.header

Use the file mtd3.zisa.hear with firmware-mod-kit as input firmware

After repacked remove the first 512byte and then mtd can be reflashed from OpenWRT

dd if=${FIRMWARE_OUT} of=mtd3.crc_ok.bin skip=512 bs=1

1 Like
7

Good info. I'm sure it will be useful to someone.