Finally decided to give OpenWRT a go and ... I haven't gotten far.  :(

I have tried the page  ( .../toh/alfa.network/hornet-ub#installation  )  for installing OpenWRT over the OEM firmware ... result:  bad magic number.

Now when I try and rollback to original firmware, I get the same result, IE bad magic number.

So, its current status is: won't complete boot process.  OTherwise healthy, no physical damage etc.

I'm not sure what output/screens I should paste here to help you all help me, but am ready to do just that, as/when requested.  I have a TTL serial cable hooked up and that is working fine.

UPDATE: I have used XVI32 to check the first bytes on all firmwares Ive tried to flash, and all seem to have a correct 'magic number', IE 27 05 19 56.  So Im stumped.  Anyone??

(Last edited by sil5er on 23 Feb 2017, 08:09)

Try in U-Boot:

setenv bootcmd "bootm 0x9f050000 || bootm 0x9f650000 || bootm 0x9fe50000"
saveenv
reset

Thanks so much for your reply.  I tried your advice, but no success.  It saved ok, used printenv to check after reset and its still all there, but still errors with bad magic number.  So I tried them all, one by one, and same thing:

ar7240> bootm 0x9fe50000
## Booting image at 9fe50000 ...
Bad Magic Number
ar7240> bootm 0x9f650000
## Booting image at 9f650000 ...
Bad Magic Number
ar7240> bootm 0x9f050000
## Booting image at 9f050000 ...
Bad Magic Number

I am now concentrating on the original firmware from OEM website, as I am unsure if my changing "_image" to ".image" in the tarballs is helping or hindering me (ref hornet-UB hardware page).

Try LEDE: http://downloads.lede-project.org/relea … x/generic/

Thankyou, I will try this.  I have selected lede-17.01.0-r3205-59508e3-ar71xx-generic-hornet-ub-squashfs-factory.bin as best choice -- lots to choose from (!!), but there weren't that many 'factory' options.

I am still concerned that it's contents are kernel_image and rootfs_image.  The (OpenWRT) hardware page for my router notes that the extensions should be (changed to) .image ... so I will try it both ways and post results shortly.

If I wasn't using tftp to xfer the files I would be wondering if it the file xfer process was stripping the high bit etc.  I am also wondering about where Im cp.b ing the file to.  The idea (already tried, above) of trying to launch the code at different locations had also occured to me, but Im wondering if this needs to be matched with a different target for the cp.b also.

Standby ... results to follow shortly.  Thanks again.

@sil5er
I don't know if you figured this out by now, but maybe it will help someone else out. Plus a little reminder for me when I come a searching again later I'm sure. Sorry to bring an old post back. 
I deactivated my anti-virus and all was well after that. I'm not sure if it was the firewall or what. Windows firewall was still on but my Advast antivirus has all kinds of protection.... so I just shut it down until I was done....done in like under 2 minutes!!D If that. Good luck.

thanks for reminder, NO, in a word, I have not had success.  I put this project/box on my too hard pile, but am still keen to kick this goal.  any help/thoughts appreciated, cheers all.