OpenWrt Forum Archive

Topic: RouterBOARD SPI configuration partition checksums?

The content of this topic has been archived on 17 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Post #1
matthewr21
19 Oct 2014, 01:16

I have been examining the contents of the SPI flash chip on some Mikrotik RouterBOARDs, and I noticed that in the Hard and Soft configuration partitions, it has the magic draH or tfoS, then a 32-bit checksum, then a series of configuration fields.

I want to be able to modify the RouterBOOT settings in the Soft configuration partition from within OpenWRT, but I need to calculate the correct checksum so that RouterBOOT doesn't just erase it and write default values.

Does anybody happen to know what algorithm is used to calculate the checksum, and what parts it is calculated over?  I've tried all the combinations with CRC32, and none of them produced the value actually stored in flash at this position.

Example soft_config on RB433AH:

root@OpenWrt:/# hexdump -C /dev/mtdblock3
00000000  74 66 6f 53 a1 43 88 3b  00 04 00 0c 00 00 03 60  |tfoS.C.;.......`|
00000010  00 04 00 0a 00 00 00 02  00 04 00 01 00 00 00 00  |................|
00000020  00 04 00 02 00 00 00 02  00 04 00 03 00 00 00 01  |................|
00000030  00 04 00 04 00 00 00 00  00 04 00 05 00 00 00 00  |................|
00000040  00 04 00 07 00 00 00 00  00 04 00 09 00 00 00 01  |................|
00000050  00 04 00 0f 00 00 00 00  00 04 00 15 00 00 00 00  |................|
00000060  00 04 00 17 00 00 00 00  00 04 00 0d 00 00 00 00  |................|
00000070  00 08 00 06 33 2e 31 38  00 00 00 00 00 08 00 0b  |....3.18........|
00000080  00 00 00 00 00 00 01 4f  00 00 00 00 00 00 00 00  |.......O........|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000
Post #2
matthewr21
19 Oct 2014, 02:31

From some googling and experimenting, it seems that the Soft configuration partiton uses the Ethernet Frame Check Sequence algorithm, and there is a utility called rbcfg that implements a way of changing the settings.  The checksum is calculated over the entire 4K partition, with the checksum field set to 0x00000000.  The checksum is stored in big-endian format.

I compared the hard_config partitions between two RB433AH boards and found only the software ID, MAC, and Serial Number fields changed, so there is no checksum.  (This could be useful, if, for example, you populate more stuff on a low-end version of a board and need to change the model number passed to the kernel.)

(Last edited by matthewr21 on 19 Oct 2014, 02:33)

The discussion might have continued from here.