Skip to content

Instantly share code, notes, and snippets.

@zambelly
Created August 18, 2021 08:08
Show Gist options
  • Save zambelly/bf9d27cc872b807ef5e6faa408501748 to your computer and use it in GitHub Desktop.
Save zambelly/bf9d27cc872b807ef5e6faa408501748 to your computer and use it in GitHub Desktop.
UF-Instant firmware patching script
#!/bin/bash -xe
OLT_FW=https://dl.ui.com/firmwares/ufiber/UF-OLT.v4.3.1.3909.210421.0814.tar
GPON_SN=ZTEG01020304
GPON_SN_RAW=5a54454701020304
GPON_MAC=01:02:03:04:05:06
[ $UID != 0 ] && echo "You need to be root" && exit 1
wget -O UF-OLT.tar $OLT_FW
mkdir oltfw
(
cd oltfw
tar -xf ../UF-OLT.tar
unsquashfs squashfs.tmp
mv squashfs-root/usr/share/onufw/UF-ONU.UF-INSTANT.* ../
)
rm -rf oltfw UF-OLT.tar
FW_NAME_GLOB=(UF-ONU.UF-INSTANT.*)
FW_NAME="${FW_NAME_GLOB[0]%.img}"
rm -rf $FW_NAME $FW_NAME.mod* $FW_NAME.tar
tail -c +57 $FW_NAME.img >$FW_NAME.tar
mkdir $FW_NAME
(
cd $FW_NAME
tar -xf ../$FW_NAME.tar
unsquashfs rootfs
sed -i "s/%c%c%c%c%02x%02x%02x%02x/$GPON_SN\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/" squashfs-root/lib/modules/ubnthal.ko
sed -i "s/%02x%02x%02x%02x%02x%02x%02x%02x/$GPON_SN_RAW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/" squashfs-root/lib/modules/ubnthal.ko
perl -pi -e "s/%02x:%02x:%02x:%02x:%02x:%02x\n/$GPON_MAC\n\0\0\0\0\0\0\0\0\0\0\0\0/" squashfs-root/lib/modules/ubnthal.ko
mksquashfs squashfs-root rootfs.mod -comp lzma -always-use-fragments -b 131072
mv rootfs.mod rootfs
chmod 700 rootfs
md5sum $(cut -d' ' -f3 <md5.txt | xargs) >md5.mod.txt
mv md5.mod.txt md5.txt
tar -cf ../$FW_NAME.mod.tar --owner=builder:1000 --group=builder:1000 $(tar -tf ../$FW_NAME.tar | xargs)
)
{
printf 'UBNT.ONU'
for _ in $(seq 1 27); do printf '\x00'; done
printf '\x01\x00\x00\x00\x00'
printf '%08x\n' $(($(stat -c %s "$FW_NAME.mod.tar") + 56)) | xxd -r -p
printf '\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\xee\xc6'
cat $FW_NAME.mod.tar
} >$FW_NAME.mod.img
CKSUM=$(crc32 $FW_NAME.mod.img)
echo "$CKSUM" | xxd -r -p | dd bs=1 seek=44 of=$FW_NAME.mod.img conv=notrunc
rm -rf $FW_NAME $FW_NAME.img $FW_NAME.mod.tar $FW_NAME.tar
@m0veax
Copy link

m0veax commented Feb 7, 2024

@obenturk did it worked for you? Here the dream machine didn’t recognized the new values using another solution. But I didn’t patched the MAC

@obenturk
Copy link

I don't want to test ISP yet because last time when I plug fiber cable it generated alarm on the OLT side and even ISP ONU blocked by the OLT.

But EdgeRouter4 recognized the UFinstant with new values. Also flash get and set working properly even after reboot.

@obenturk did it worked for you? Here the dream machine didn’t recognized the new values using another solution. But I didn’t patched the MAC

@obenturk
Copy link

obenturk commented Feb 10, 2024

Could someone please help me to update following entry in ubnthal.ko?

[cat /proc/ubnthal/model]
UF-Instant

sed -i "s/UF-Instant/$GPON_MODEL/" squashfs-root/lib/modules/ubnthal.ko

Did not worked. It made ubnthal directory never created.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment