I investigated further on my "Mifi-F5" router: the Ralink-modified U-Boot contains a TFTP server but no TFTP client, and there are some additional restrictions on the firmware you are able to flash.
First, the "Image Name" must contain some tags, mine is "ZLMnet?MIFI10N?", I didn't push the test too far, but replacing the firmware by an OpenWRT one with the default name fails with "Bad illegal image !".
From the kernel partition saved as above, I used "binwalk" to extract the combined kernel/rootfs:
$ binwalk Kernel
DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0xF78DA7F, created: Tue Jul 16 15:14:46 2013, image size: 3657218 bytes, Data Address: 0x80000000, Entry Point: 0x803B6000, data CRC: 0xB632FDC7, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "ZLMnet?MIFIF10N?"
64 0x40 LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 6415715 bytes
I then rebuilt the image using:
$ mkimage -A mips -O linux -T kernel -C lzma -a 0x80000000 -e 0x803B6000 -n "ZLMnet?MIFIF10N?" -d _Kernel.extracted/zimage uimage.bin
$ binwalk uimage.bin
DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x37E7B8A7, created: Thu Jan 2 23:45:47 2014, image size: 3657218 bytes, Data Address: 0x80000000, Entry Point: 0x803B6000, data CRC: 0x16F9B842, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "ZLMnet?MIFIF10N?"
64 0x40 LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 6415715 bytes
Please note that the "data CRC" differs between the original image and the reconstructed image, although the kernel/rootfs is exactly the same byte for byte... It means that the CRC calculation was probably altered in some way to prevent people from messing with the router firmware...
When I try to flash the reconstructed image, I get a "Fuke you, illegal fireware !!!" message...
As a conclusion, I don't think it is worth pushing the investigation any further, as it may lead to solutions that are very device-specific (each Chinese manufacturer can alter the CRC its own way), so I think that @pratanczuk's method to replace both the bootlader and firmware from userland is better!
@pratanczuk: how did you generate these different binaries (OpenWRT release + patch)? I need to generate some for my 32MB version!
Also, do you have any information regarding the GPIOs you have found (where are they accessible on a picture)?
(Last edited by Squonk on 4 Jan 2014, 19:48)