Zisa OP-151S modify SquashFS - help CRC calculation

Hi all,

i'm trying to modify the ImageB of this GPON stick, but i've problem with CRC check when uBoot tries to run the image with this error:

FALCON => env set active_image B
FALCON => saveenv
Saving Environment to SPI Flash...
SF: Detected GD25Q64B with page size 4 KiB, total 8 MiB
Erasing SPI flash...Writing to SPI flash...done
FALCON => boot
SF: Detected GD25Q64B with page size 4 KiB, total 8 MiB
sf read 0x80effe00 0x400000 0x390000
cur_crc = 3b50fc9a crc_in_image = fc1ee545
ImageB head check ERROR!

I'm attaching the mtd3 image that I'm trying to use.
Anyone can help me how to calculate correct CRC?


Thanks in advance

This script shows the location and function used to calculate the CRC for all 3 locations in the firmware.

Original openwrt topic for this module:

1 Like

i've tried that scripts (setting up all firmware-mod-kit stuff) but still get CRC error :frowning:

@centaur do you have Zisa version or Zyxel?
I currently have the Zyxel, looks like the uBoot calculate CRC in a different way.

Can you send me (if you have Zisa) the mtd0 of your stick?

Thanks in advance

All of my modules are currently in storage. I do not have the original Zisa module but rather some other substitute. It will be a while before I get to them and configure some devices.
The script from github creates an .upf update file, which is best used via the web interface. There is also a command line equivalent.

In another ZISA topic there is a link to a complete OP151S dump called mtd5, including mtd0, Env, ImageA, ImageB,Config, SECTION_EGIS, rootfs, rootfs_data


The mtd0 can be extraced from it.

dd if=mtd5 of=mtd0 bs=1 count=393216

md5sum: a040a841999efafe44391f704edbc3c8
U-Boot 2011.12-lantiq-gpon-1.2.16-svn24575 (Oct 11 2014 - 16:42:08)

Some additional links with .upf files


we have found thanks to another user a WA to make the CRC corrected.


(extract first 512 byte of firmware into GitHub repository)
dd if=3FE45464AOCK21.upf.tmp bs=1 count=512 of=ZISA.header

(merge this header with mtd3 dump of Zyxel stick)
cat ZISA header mtd3 > mtd3.zisa.header

Use the file mtd3.zisa.hear with firmware-mod-kit as input firmware

After repacked remove the first 512byte and then mtd can be reflashed from OpenWRT

dd if=${FIRMWARE_OUT} of=mtd3.crc_ok.bin skip=512 bs=1

1 Like

Good info. I'm sure it will be useful to someone.