0020020 55 6e 63 6f 6d 70 72 65 73 73 69 6e 67 20 4c 69
          U   n   c   o   m   p   r   e   s   s   i   n   g  sp   L   i
0020040 6e 75 78 2e 2e 2e 20 0a 00 00 00 00 4f 6b 2c 20
          n   u   x   .   .   .  sp  nl nul nul nul nul   O   k   ,  sp
0020060 62 6f 6f 74 69 6e 67 20 74 68 65 20 6b 65 72 6e
          b   o   o   t   i   n   g  sp   t   h   e  sp   k   e   r   n
0020100 65 6c 2e 0a 00 00 00 00 1f 8b 08 08 a4 70 0f 41
          e   l   .  nl nul nul nul nul  us  vt  bs  bs   $   p  si   A
0020120 02 0b 55 4e 45 58 2d 47 49 53 4c 2d 54 2d 4c 32
        stx  vt   U   N   E   X   -   G   I   S   L   -   T   -   L   2
0020140 2d 32 30 30 37 31 33 54 32 5f 55 2e 62 69 6e 00
          -   2   0   0   7   1   3   T   2   _   U   .   b   i   n nul
0020160 ec 5c 7f 6c 14 d7 9d ff ce cc da ac cd 02 6b 7b
          l   \ del   l dc4   W  gs del   N   L   Z   ,   M stx   k   {
0020200 0d 6b 6a f0 6e 76 c7 5e 82 8f 2c 61 09 76 b3 09
         cr   k   j   p   n   v   G   ^ stx  si   ,   a  ht   v   3  ht

Power-On Self Testing...
Testing SYS Controller...
Testing MEM Controller...
SDRAM Configuration:ROW11_COL8_BANK2
Testing SDRAM Memory ...
From 0x80000000 - 0x807FFFFF
Testing CPU Data RAM...
Testing CPU Internal Registers...
Testing Timer 0...
Testing Timer 1...
Testing DMA Controller...
Testing INT Controller...
Testing PCMCIA Controller...
Testing USB Controller...
Testing Ethernet 0 MAC...
Testing Ethernet 1 MAC...
Testing Cardbus...
Testing PCI...
Power-On Self Test Passed








          Bootloader Version 00-03-02, Aug 29 2003 21:45:21



       Copyright 2003. All rights reserved. 








Press any key to stop auto-boot...
 0
auto-booting...

========POR reset========
****** Now used Flash Size: 1MB ******

Start of heap: 0x8065b390
End of heap: 0x80800000
register_function
Initializing LANSW!
Initializing LANSW done!
ifdata.if_name[0] is eth0
ifdata.if_name[0] is eth1
ifdata.if_name[0] is wls0

Firmware Version: 20-07-13T2, Aug 02 2004 11:53:05
Copyright 2002-2003. All rights reserved. 
Scanning PCI Bus...
    scan PCI deviceNo=1
      Found ISL3890 Wireless Device: PCIDEV=1, DEVNUM=4, NICNO=0
***iface=2, dev_num=4
pk_init:bigbufsiz[800]=2048 
PHY is switch controller ***IP175A***!
Network PORT 1 <--> 100M Full Duplex

WLAN0 Zone Number is 0
******** WLAN Disabled *******
******* AP CONFIG LAUNCHED *******
******** Isolated Disabled *******
********prohibited configuration Disabled *******
WLS Channel number is 6 
Finished wlan firmware download
br0: port 0.0.0.1(eth1 rootport) entering listening state
br0: port 0.0.0.2(wls0 rootport) entering listening state
NAT/Firewall starting...
MaxSessionNumber: 65536
NAT/Firewall started!
Now try to get the configuration file...
interface eth1 uses following ip settings: 192.168.62.1/255.255.255.0
Initialization of NAT/Firewall policy database succeeded!
load_pptp_wan: encryption option=e1
sleep...
SD9218> 
L2TP: started
network_thread started
sg_wlan_1x_init
WPA disabled!
hapd->device=80355714
WPA init.....
1x is disbled(0)!
dhcp_update_table called, iface=1
start_ip=192.168.62.50, end_ip=192.168.62.100
route_cfg_update: dycfg.tx_protocol=0, dycfg.rx_protocol=0, dycfg.mode=0
br0: port 0.0.0.2(wls0 rootport) entering learning state
br0: port 0.0.0.1(eth1 rootport) entering learning state
br0: port 0.0.0.2(wls0 rootport) entering forwarding state
br0: topology change detected, propagating
br0: port 0.0.0.1(eth1 rootport) entering forwarding state
br0: topology change detected, propagating
dhcp_update_table return

   general         - main menu
   sysconfig       - sysconfig menu
   ifconfig        - ifconfig menu
   debug           - system debug menu
   diagnostic      - diagnostic aid menu
   dhcpsrv         - DHCP server
   firewall        - firewall menu
   sntp            - SNTP menu
   wdog            - Watch dog menu
   log             - WAN log menu
   mppp            - PPP managemnt menu
   wlan            - wlan menu
   pppoe           - pppoe menu
   pptp            - PPTP
   u_mctestc       - u_mctest client menu
   ping            - menu to set/view values for ping
   tftps           - tftp server menu
   rip             - RIP menu
   l2tp            - L2TP menu
   wpa             - wpa menu

                       Main menu

        ?         - print this menu
        f         - load from Flash and go
        l         - load from TFTP server to SDRAM (no save to Flash, no go)
        L         - load from TFTP server to SDRAM and go (no save to Flash)
        @         - load from TFTP server to SDRAM,save to Flash and go
        g         - go from address
        b         - show boot parameters
        c         - change boot parameters
        d         - display factory default parameters
        m         - modify/set factory default parameters
        p         - ping test (ping other station from the target)
        r         - read memory
        s         - change mac address only
        w         - write memory

Data organisation:
0x80010000 == Offset 0x00000070 (kernel?)
0x80100000 == Offset 0x000F0070
0x80200000 == offset 0x001f0070 (initrd)

The information below was learned from the NC1200-W10 firmware 
(C61200-WX-2.00.01-61002-A0.img)

Image file format: 
File length = 0x27CF28

Header specific to the NC1200.
00 00 00 00 - unknown
00 27 ce f8 - data length? (file length - 0x30)
34 12 00 00 - unknown
04 9a 4f ba - unknown
40 00 93 bb - unknown
63 29 32 3c - unknown
2e 25 24 61 - unknown
65 40 71 00 - unknown
73 53 32 24 - unknown
37 5f 26 28 - unknown
40 30 49 7d - unknown
75 79 30 26 - unknown 

Header common to NC1200 and Sweex WF514 / LC000060
(This is what the bootloader tftp requires)
27 05 19 56 - Header Magic
ba 92 6e af - Header checksum (32-bit CRC init 0, XOR 0)
45 20 9f 14 - unknown
00 27 ce b8 - Data length
80 01 00 00 - Load address
80 01 00 00 - Entry point
a3 5a b4 66 - Data Checksum (32-bit CRC init 0, XOR 0)
12 0c 02 00 - Image type (12 0c 02 01 = R3000C RtosTx Kernel Image (gzip compressed)?)
                         (12 0c 02 00 = R3000C RtosTx Kernel Image (uncompressed)?)
32 bytes    - ASCII description for data.



Some offsets into the main .img file: 
(gzip data)
0x00003440 - gzipped data for the Linux kernel and filesystem (must be kernel + initrd)
Within this gzipped data, 
offset:
0x001f0000 - ramdisk ext2 filesystem. 

dd if=C61200-WX-2.00.01-61002-A0.img bs=13376 skip=1 of=offset_00003440
dd if=offset_00003440 bs=2031616 skip=1 of=offset_001f0000.gz

gunzip offset_001f0000.gz
mount -o loop offset_001f0000 mountpoint
This is the RAM disk mounted at boot.
umount mountpoint
gzip -9 offset_001f0000

/* This is a hacked up application that will add a header to raw data
 * for loading into a SD9218 SoC. */
 
 /* It is completely dumb, and will probably wreck your hardware */
 /* You have been warned :) */
 

#include <stdio.h>
#include <string.h>
#include <sys/types.h>

static const unsigned long crcTable[256] = 
{
    0x00000000L,0x77073096L,0xee0e612cL,0x990951baL,
    0x076dc419L,0x706af48fL,0xe963a535L,0x9e6495a3L,
    0x0edb8832L,0x79dcb8a4L,0xe0d5e91eL,0x97d2d988L,
    0x09b64c2bL,0x7eb17cbdL,0xe7b82d07L,0x90bf1d91L,
    0x1db71064L,0x6ab020f2L,0xf3b97148L,0x84be41deL,
    0x1adad47dL,0x6ddde4ebL,0xf4d4b551L,0x83d385c7L,
    0x136c9856L,0x646ba8c0L,0xfd62f97aL,0x8a65c9ecL,
    0x14015c4fL,0x63066cd9L,0xfa0f3d63L,0x8d080df5L,
    0x3b6e20c8L,0x4c69105eL,0xd56041e4L,0xa2677172L,
    0x3c03e4d1L,0x4b04d447L,0xd20d85fdL,0xa50ab56bL,
    0x35b5a8faL,0x42b2986cL,0xdbbbc9d6L,0xacbcf940L,
    0x32d86ce3L,0x45df5c75L,0xdcd60dcfL,0xabd13d59L,
    0x26d930acL,0x51de003aL,0xc8d75180L,0xbfd06116L,
    0x21b4f4b5L,0x56b3c423L,0xcfba9599L,0xb8bda50fL,
    0x2802b89eL,0x5f058808L,0xc60cd9b2L,0xb10be924L,
    0x2f6f7c87L,0x58684c11L,0xc1611dabL,0xb6662d3dL,
    0x76dc4190L,0x01db7106L,0x98d220bcL,0xefd5102aL,
    0x71b18589L,0x06b6b51fL,0x9fbfe4a5L,0xe8b8d433L,
    0x7807c9a2L,0x0f00f934L,0x9609a88eL,0xe10e9818L,
    0x7f6a0dbbL,0x086d3d2dL,0x91646c97L,0xe6635c01L,
    0x6b6b51f4L,0x1c6c6162L,0x856530d8L,0xf262004eL,
    0x6c0695edL,0x1b01a57bL,0x8208f4c1L,0xf50fc457L,
    0x65b0d9c6L,0x12b7e950L,0x8bbeb8eaL,0xfcb9887cL,
    0x62dd1ddfL,0x15da2d49L,0x8cd37cf3L,0xfbd44c65L,
    0x4db26158L,0x3ab551ceL,0xa3bc0074L,0xd4bb30e2L,
    0x4adfa541L,0x3dd895d7L,0xa4d1c46dL,0xd3d6f4fbL,
    0x4369e96aL,0x346ed9fcL,0xad678846L,0xda60b8d0L,
    0x44042d73L,0x33031de5L,0xaa0a4c5fL,0xdd0d7cc9L,
    0x5005713cL,0x270241aaL,0xbe0b1010L,0xc90c2086L,
    0x5768b525L,0x206f85b3L,0xb966d409L,0xce61e49fL,
    0x5edef90eL,0x29d9c998L,0xb0d09822L,0xc7d7a8b4L,
    0x59b33d17L,0x2eb40d81L,0xb7bd5c3bL,0xc0ba6cadL,
    0xedb88320L,0x9abfb3b6L,0x03b6e20cL,0x74b1d29aL,
    0xead54739L,0x9dd277afL,0x04db2615L,0x73dc1683L,
    0xe3630b12L,0x94643b84L,0x0d6d6a3eL,0x7a6a5aa8L,
    0xe40ecf0bL,0x9309ff9dL,0x0a00ae27L,0x7d079eb1L,
    0xf00f9344L,0x8708a3d2L,0x1e01f268L,0x6906c2feL,
    0xf762575dL,0x806567cbL,0x196c3671L,0x6e6b06e7L,
    0xfed41b76L,0x89d32be0L,0x10da7a5aL,0x67dd4accL,
    0xf9b9df6fL,0x8ebeeff9L,0x17b7be43L,0x60b08ed5L,
    0xd6d6a3e8L,0xa1d1937eL,0x38d8c2c4L,0x4fdff252L,
    0xd1bb67f1L,0xa6bc5767L,0x3fb506ddL,0x48b2364bL,
    0xd80d2bdaL,0xaf0a1b4cL,0x36034af6L,0x41047a60L,
    0xdf60efc3L,0xa867df55L,0x316e8eefL,0x4669be79L,
    0xcb61b38cL,0xbc66831aL,0x256fd2a0L,0x5268e236L,
    0xcc0c7795L,0xbb0b4703L,0x220216b9L,0x5505262fL,
    0xc5ba3bbeL,0xb2bd0b28L,0x2bb45a92L,0x5cb36a04L,
    0xc2d7ffa7L,0xb5d0cf31L,0x2cd99e8bL,0x5bdeae1dL,
    0x9b64c2b0L,0xec63f226L,0x756aa39cL,0x026d930aL,
    0x9c0906a9L,0xeb0e363fL,0x72076785L,0x05005713L,
    0x95bf4a82L,0xe2b87a14L,0x7bb12baeL,0x0cb61b38L,
    0x92d28e9bL,0xe5d5be0dL,0x7cdcefb7L,0x0bdbdf21L,
    0x86d3d2d4L,0xf1d4e242L,0x68ddb3f8L,0x1fda836eL,
    0x81be16cdL,0xf6b9265bL,0x6fb077e1L,0x18b74777L,
    0x88085ae6L,0xff0f6a70L,0x66063bcaL,0x11010b5cL,
    0x8f659effL,0xf862ae69L,0x616bffd3L,0x166ccf45L,
    0xa00ae278L,0xd70dd2eeL,0x4e048354L,0x3903b3c2L,
    0xa7672661L,0xd06016f7L,0x4969474dL,0x3e6e77dbL,
    0xaed16a4aL,0xd9d65adcL,0x40df0b66L,0x37d83bf0L,
    0xa9bcae53L,0xdebb9ec5L,0x47b2cf7fL,0x30b5ffe9L,
    0xbdbdf21cL,0xcabac28aL,0x53b39330L,0x24b4a3a6L,
    0xbad03605L,0xcdd70693L,0x54de5729L,0x23d967bfL,
    0xb3667a2eL,0xc4614ab8L,0x5d681b02L,0x2a6f2b94L,
    0xb40bbe37L,0xc30c8ea1L,0x5a05df1bL,0x2d02ef8dL
};

unsigned int calculateCrc(unsigned int crc, unsigned char * pucData, unsigned int length)
{
    unsigned int i;

    for(i = 0; i < length; i++)
    {
        crc = crcTable[(crc ^ pucData[i]) & 0xff] ^ (crc >> 8);
    }

    return crc;
}

write32ToBE(unsigned char *data, unsigned int value)
{
    *data++ = ((value >> 24) & 0xFF);
    *data++ = ((value >> 16) & 0xFF);
    *data++ = ((value >> 8) & 0xFF);
    *data++ = ((value >> 0) & 0xFF);
}

unsigned int read32FromBE(unsigned char *data)
{
    unsigned int value;

    value =  ((*data++ << 24) & 0xFF000000);
    value |= ((*data++ << 16) & 0x00FF0000);
    value |= ((*data++ <<  8) & 0x0000FF00);
    value |= ((*data++ <<  0) & 0x000000FF);

    return value;
}

unsigned int read16FromBE(unsigned char *data)
{
    unsigned int value;

    value = ((*data++ <<  8) & 0x0000FF00);
    value |= ((*data++ <<  0) & 0x000000FF);

    return value;
}

int main (int argc, char **argv)
{
    FILE *inFile, *outFile;
    char *filename;
    char outFileName[]="zrtos.img";
    long dataLength = 0;
    int i, j;
    unsigned char *ptr;
    unsigned char readBuffer[1024];
    unsigned char headerBuffer[64];
    int bytesRead;

    unsigned int headerChecksum = 0;
    unsigned int dataChecksum = 0;
    unsigned int loadAddress = 0x80010000;
    unsigned int entryAddress = 0x80010000;
    unsigned int imageType = 0x120C0200;

    if (argc != 2)
    {
        printf("Please supply %s <filename>\r\n", argv[0]);
        return 1;
    }

    filename = argv[1];

    printf("Creating SD9218 boot image...\r\n");

    inFile = fopen(filename, "rb");
    if (inFile == NULL)
    {
        printf("Unable to open %s for reading.\r\n", filename);
        return -1;
    }
    outFile = fopen(outFileName, "wb");
    if (outFile == NULL)
    {
        printf("Unable to open %s for writing.\r\n", outFileName);
        return -1;
    }

    // Ok, we have our source and destination files, lets generate the header.
    
    if (fseek(inFile, 0, SEEK_END))
    {
        printf("Unable to get file length.\r\n");
        return -1;
    }
    dataLength = ftell(inFile);
    rewind(inFile);
    
    if (dataLength == 0)
    {
        printf("Please supply a file with some data in it!\r\n");
        return -1;
    }

    // Reserve 64 bytes for the header.
    memset(headerBuffer, 0, sizeof(headerBuffer));
    fwrite(headerBuffer, 1, sizeof(headerBuffer), outFile);

    dataChecksum = 0;
    for (i=0; (i<dataLength) && (bytesRead > 0); i+=bytesRead)
    {
        bytesRead = fread(readBuffer, 1, sizeof(readBuffer), inFile);
        fwrite(readBuffer, 1, bytesRead, outFile);
        dataChecksum = calculateCrc(dataChecksum, readBuffer, bytesRead);
    }

    // Now populate the header.
    write32ToBE(&headerBuffer[0], 0x27051956);    // Magic number
    write32ToBE(&headerBuffer[4], 0x00000000); // Header Checksum
    write32ToBE(&headerBuffer[8], 0x45209f14);    // Unknown
    write32ToBE(&headerBuffer[12], dataLength);    // Data Length
    write32ToBE(&headerBuffer[16], loadAddress);    // Load Address
    write32ToBE(&headerBuffer[20], entryAddress);    // Entry Point
    write32ToBE(&headerBuffer[24], dataChecksum);    // Data Checksum
    write32ToBE(&headerBuffer[28], imageType);    // Image Type
    strcpy(&headerBuffer[32], "LinuxImage");

    // Calculate the header checksum.
    // (This isn't a checksum at all, it's a CRC...
    headerChecksum = calculateCrc(0, headerBuffer, sizeof(headerBuffer));

    write32ToBE(&headerBuffer[4], headerChecksum); // Header Checksum

    printf("Data Size:        %d Bytes\r\n", dataLength);
    printf("Load Address:     0x%08X\r\n", loadAddress);
    printf("Entry Point:      0x%08X\r\n", entryAddress);
    printf("Header Checksum:  0x%08X\r\n", headerChecksum);
    printf("Image Checksum:   0x%08X\r\n", dataChecksum);

    rewind(outFile);
    fwrite(headerBuffer, 1, sizeof(headerBuffer), outFile);

    fclose (outFile);
    fclose (inFile);

    return 0;
}

dd if=/dev/zero of=ramdisk bs=1024 count=6144
mkfs.ext2 ramdisk
mkdir mnt
mount -o loop ramdisk mnt

umount mnt
gzip -9 ramdisk

#!/bin/bash

echo "Replacing ramdisk with $1"

# Extract the Kernel from firmware image
dd if=C61200-WX-2.00.01-61002-A0.img bs=13376 skip=1 of=kernel.gz
cp C61200-WX-2.00.01-61002-A0.img C61200-WX-custom.img
gunzip kernel.gz
# Overwrite the existing ramdisk with our new one
dd if=/dev/zero of=kernel bs=1 seek=2031616 conv=notrunc count=1929216
dd if=$1 of=kernel bs=2031616 seek=1 conv=notrunc
gzip kernel -v9

# Clear a space for our image.
dd if=/dev/zero of=C61200-WX-custom.img bs=13376 seek=1 conv=notrunc count=192

# Put it back into the firmware image.
dd if=kernel.gz of=C61200-WX-custom.img bs=13376 seek=1 conv=notrunc
rm kernel.gz

# Create a tftp compatible image
dd if=C61200-WX-custom.img of=C61200-WX-custom.raw bs=112 skip=1
./create_header C61200-WX-custom.raw

rm C61200-WX-custom.raw

for file in `ls *.gz`; do gunzip $file; done