Skip to content

Instantly share code, notes, and snippets.

@zambelly

zambelly/build.sh Secret

Created August 18, 2021 08:08
Show Gist options
  • Save zambelly/bf9d27cc872b807ef5e6faa408501748 to your computer and use it in GitHub Desktop.
Save zambelly/bf9d27cc872b807ef5e6faa408501748 to your computer and use it in GitHub Desktop.
Download ZIP
UF-Instant firmware patching script
Raw
build.sh
#!/bin/bash -xe
OLT_FW=https://dl.ui.com/firmwares/ufiber/UF-OLT.v4.3.1.3909.210421.0814.tar
GPON_SN=ZTEG01020304
GPON_SN_RAW=5a54454701020304
GPON_MAC=01:02:03:04:05:06
[ $UID != 0 ] && echo "You need to be root" && exit 1
wget -O UF-OLT.tar $OLT_FW
mkdir oltfw
(
cd oltfw
tar -xf ../UF-OLT.tar
unsquashfs squashfs.tmp
mv squashfs-root/usr/share/onufw/UF-ONU.UF-INSTANT.* ../
)
rm -rf oltfw UF-OLT.tar
FW_NAME_GLOB=(UF-ONU.UF-INSTANT.*)
FW_NAME="${FW_NAME_GLOB[0]%.img}"
rm -rf $FW_NAME $FW_NAME.mod* $FW_NAME.tar
tail -c +57 $FW_NAME.img >$FW_NAME.tar
mkdir $FW_NAME
(
cd $FW_NAME
tar -xf ../$FW_NAME.tar
unsquashfs rootfs
sed -i "s/%c%c%c%c%02x%02x%02x%02x/$GPON_SN\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/" squashfs-root/lib/modules/ubnthal.ko
sed -i "s/%02x%02x%02x%02x%02x%02x%02x%02x/$GPON_SN_RAW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/" squashfs-root/lib/modules/ubnthal.ko
perl -pi -e "s/%02x:%02x:%02x:%02x:%02x:%02x\n/$GPON_MAC\n\0\0\0\0\0\0\0\0\0\0\0\0/" squashfs-root/lib/modules/ubnthal.ko
mksquashfs squashfs-root rootfs.mod -comp lzma -always-use-fragments -b 131072
mv rootfs.mod rootfs
chmod 700 rootfs
md5sum $(cut -d' ' -f3 <md5.txt | xargs) >md5.mod.txt
mv md5.mod.txt md5.txt
tar -cf ../$FW_NAME.mod.tar --owner=builder:1000 --group=builder:1000 $(tar -tf ../$FW_NAME.tar | xargs)
)
{
printf 'UBNT.ONU'
for _ in $(seq 1 27); do printf '\x00'; done
printf '\x01\x00\x00\x00\x00'
printf '%08x\n' $(($(stat -c %s "$FW_NAME.mod.tar") + 56)) | xxd -r -p
printf '\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\xee\xc6'
cat $FW_NAME.mod.tar
} >$FW_NAME.mod.img
CKSUM=$(crc32 $FW_NAME.mod.img)
echo "$CKSUM" | xxd -r -p | dd bs=1 seek=44 of=$FW_NAME.mod.img conv=notrunc
rm -rf $FW_NAME $FW_NAME.img $FW_NAME.mod.tar $FW_NAME.tar
@3DJupp
Copy link

3DJupp commented Nov 10, 2021

Sorry but i had to revert my recent comment. Great patching script 👍
Could you please append the way how firmware images are written?

# transfer it via scp (config backup)
scp ubnt@192.168.1.1:/tmp/v4.1.0.359-b87.191101.0940_backup.img /tmp
# transfer new firmware
scp UF-ONU.UF-INSTANT.v4.3.1.913-d48.210415.0811.mod.img ubnt@192.168.1.1:/tmp
# check version
fwversion /tmp/UF-ONU.UF-INSTANT.v4.3.1.913-d48.210415.0811.mod.img
Magic:    UBNT.ONU
Size:   3440696
CRC:      cd2bec0e
Supported devices: 0000eec6
Offset:   56
version=v4.3.1.913-d48.210415.0811
# upgrade fw
fwupdate /tmp/UF-ONU.UF-INSTANT.v4.3.1.913-d48.210415.0811.mod.img

Could you please add the latest FW?
OLT_FW=https://dl.ui.com/firmwares/ufiber/UF-OLT.v4.3.3.4046.210622.0853.tar
And last but not least: Could you please patch the SLID/PLOAM?

@3DJupp
Copy link

3DJupp commented Nov 12, 2021 •
edited
Loading

Extracting the fw might be possible in just a few lines:

curl -# https://dl.ui.com/firmwares/ufiber/UF-OLT.v4.3.3.4046.210622.0853.tar | tar -xv squashfs.tmp
unsquashfs -f squashfs.tmp -e /usr/share/onufw/ && mv squashfs-root/usr/share/onufw/UF-ONU.* ./ && rm -rf squashfs-root squashfs.tmp

But i still had no luck with the PLOAM/SLID 😄

@Danno88-88
Copy link

So were you able to patch firmware with serial,slid,PLOAM?

@jjeziorny
Copy link

jjeziorny commented Nov 15, 2021 •
edited
Loading

I'm trying to test this, however the fwupdate never completes. Looks like it overloads the cpu during the check firmware stage and freezes the device

Update attempt

# fwupdate /tmp/UF-ONU.UF-INSTANT.v4.3.1.913-d48.210415.0811.mod.img 
Starting upgrade of image 1 with image /tmp/UF-ONU.UF-INSTANT.v4.3.1.913-d48.210415.0811.mod.img...
Check firmware...

Running top on a sepparate window I can see the load average goes above 5.

Mem: 17220K used, 2700K free, 0K shrd, 180K buff, 4512K cached
CPU: 23.5% usr 75.7% sys  0.0% nice  0.0% idle  0.0% io  0.0% irq  0.7% softir
Load average: 5.58 3.09 1.31
  PID  PPID USER     STAT   VSZ %MEM %CPU COMMAND
  555   553 ubnt     R     3948 19.8 47.9 fwinfo -i /tmp/UF-ONU.UF-INSTANT.v4.3
  553   551 ubnt     S     6860 34.4 26.9 /bin/sh /etc/scripts/fwu_starter.sh 1
  127     2 ubnt     SW<      0  0.0 15.9 [sfp_main]
  160     1 ubnt     S     2616 13.1  3.8 /bin/discoverd

Not sure if CPU overload is the issue, but the update never passes the check stage and the device becomes unresponsive via ssh (ping still works)

@m0veax
Copy link

m0veax commented Dec 13, 2023

Check if telnet works. SSH does not starts on it own on all devices / firmware version combinations.

You can start SSH using this command on the device:

dropbear -R

@obenturk
Copy link

obenturk commented Feb 7, 2024 •
edited
Loading

Latest firmware 07/02/2024

`
#!/bin/bash -xe
OLT_FW=https://dl.ui.com/firmwares/ufiber/v4.7.0/UF-OLT.v4.7.0.5939.240110.1233.tar
GPON_SN=???????????
GPON_SN_RAW=???????????
GPON_MAC=??:??:??:??:??:??

[ $UID != 0 ] && echo "You need to be root" && exit 1

wget -O UF-OLT.tar $OLT_FW
mkdir oltfw
(
cd oltfw
tar -xf ../UF-OLT.tar
unsquashfs squashfs.tmp
mv squashfs-root/usr/share/onufw/UF-ONU.UF-INSTANT.* ../
)
rm -rf oltfw UF-OLT.tar

FW_NAME_GLOB=(UF-ONU.UF-INSTANT.*)
FW_NAME="${FW_NAME_GLOB[0]%.img}"

rm -rf $FW_NAME $FW_NAME.mod* $FW_NAME.tar

tail -c +57 $FW_NAME.img >$FW_NAME.tar
mkdir $FW_NAME
(
cd $FW_NAME
tar -xf ../$FW_NAME.tar
unsquashfs rootfs
sed -i "s/%c%c%c%c%02x%02x%02x%02x/$GPON_SN\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/" squashfs-root/lib/modules/ubnthal.ko
sed -i "s/%02x%02x%02x%02x%02x%02x%02x%02x/$GPON_SN_RAW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/" squashfs-root/lib/modules/ubnthal.ko
perl -pi -e "s/%02x:%02x:%02x:%02x:%02x:%02x\n/$GPON_MAC\n\0\0\0\0\0\0\0\0\0\0\0\0/" squashfs-root/lib/modules/ubnthal.ko
mksquashfs squashfs-root rootfs.mod -comp lzma -always-use-fragments -b 131072
mv rootfs.mod rootfs
chmod 700 rootfs
md5sum $(cut -d' ' -f3 <md5.txt | xargs) >md5.mod.txt
mv md5.mod.txt md5.txt

tar -cf ../$FW_NAME.mod.tar --owner=builder:1000 --group=builder:1000 $(tar -tf ../$FW_NAME.tar | xargs)

)

{
printf 'UBNT.ONU'
for _ in $(seq 1 27); do printf '\x00'; done
printf '\x01\x00\x00\x00\x00'
printf '%08x\n' $(($(stat -c %s "$FW_NAME.mod.tar") + 56)) | xxd -r -p
printf '\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\xee\xc6'
cat $FW_NAME.mod.tar
} >$FW_NAME.mod.img

CKSUM=$(crc32 $FW_NAME.mod.img)
echo "$CKSUM" | xxd -r -p | dd bs=1 seek=44 of=$FW_NAME.mod.img conv=notrunc

rm -rf $FW_NAME $FW_NAME.img $FW_NAME.mod.tar $FW_NAME.tar

`

@m0veax
Copy link

m0veax commented Feb 7, 2024 •
edited
Loading

@obenturk did it worked for you? Here the dream machine didn’t recognized the new values using another solution. But I didn’t patched the MAC

@obenturk
Copy link

I don't want to test ISP yet because last time when I plug fiber cable it generated alarm on the OLT side and even ISP ONU blocked by the OLT.

But EdgeRouter4 recognized the UFinstant with new values. Also flash get and set working properly even after reboot.

@obenturk did it worked for you? Here the dream machine didn’t recognized the new values using another solution. But I didn’t patched the MAC

@obenturk
Copy link

obenturk commented Feb 10, 2024 •
edited
Loading

Could someone please help me to update following entry in ubnthal.ko?

[cat /proc/ubnthal/model]
UF-Instant

sed -i "s/UF-Instant/$GPON_MODEL/" squashfs-root/lib/modules/ubnthal.ko

Did not worked. It made ubnthal directory never created.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment