Patching IPv6 into DIR 615 builds [was: Unpacking LZMA fw]

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Ralink SoC based Hardware
Goto page 1, 2  Next
Author Message
DD-WRT Novice

Joined: 22 May 2010
Posts: 6

PostPosted: Tue Aug 10, 2010 12:59    Post subject: Patching IPv6 into DIR 615 builds [was: Unpacking LZMA fw] Reply with quote
//edit2: updated topic, as I now document what I try (!) to do to add IPv6 to BrainSlayers build... try because it doesn't work yet, but maybe if the topic reflects what actually is going on here more people will work on it ;D


Hi, I tried to unpack the firmware for the D-Link DIR-615 D with the firmware_mod_kit (svn trunk), but it fails to unsquashfs-lzma the squashfs-3-lzma.img, if I do it by hand:

root@loki:[...]# ./unsquashfs-lzma image_parts/squashfs-3-lzma.img
Can't find a SQUASHFS superblock on image_parts/squashfs-3-lzma.img

I guess that the image has some modified bits to work with the router, but as the image has been build somehow, shouldn't I be able to unpack & repack it somehow?

My goal is to add the IPv6 kernel modules I build, as well as radvd and aiccu to establish an IPv6 tunnel in my network...

Any help/hints would be useful ;-)


//edit: Firmware URL: - the ddwrt build

Last edited by archimedes on Fri Aug 13, 2010 10:48; edited 2 times in total
DD-WRT Novice

Joined: 28 Jul 2010
Posts: 49

PostPosted: Tue Aug 10, 2010 14:03    Post subject: Reply with quote
dude id love to be apart of this.

i have a Dir 300 rev b and id love ipv6.

ive tryed building from SVN

no luck..

if you can do this your a legend

you could remove those wifi hotspot crap to make room Smile
DD-WRT Novice

Joined: 22 May 2010
Posts: 6

PostPosted: Wed Aug 11, 2010 14:54    Post subject: Reply with quote
In a normal Linux system thats no problem, and I think the DIR615D flash image (don't know about DIR300, sry) should have the 100kB required for IPv6...

I have semester break now, so maybe I will try to see what I can do :D

Until now I found out how to unpack the firmware (ddwrt flash image, not factory!).

All tools are found in the firmware modkit:

mkdir tmp
untrx <imagefile> tmp/
cd tmp
dd if=segment1 of=squashfs.img bs=16 skip=49152 conv=notrunc
unsquashfs-lzma squashfs.img

And we get a squashfs-root dir with the FS contents.

How I did that (actually not that high magic Wink)
* Create some random, small squashfs images
* Look at them with hexdump
* Learn that 7368 7471 seems to be the magic header of a squashfs lzma image
* Find single occurence of that pattern in the untrx'd segment1
* Copy&unpack it

But I'm afraid that the first part of the image contains several other important things (like checksums, kernel, maybe bootloader) and that I copied more than only the image (I would trail some checksums/magic bytes at the end of the file, if I was to design a flash file), so this is only a minor first step, as even if I change the files, add IPv6 (& maybe remove some files like you suggested), create new squashfs, glue everything together and upload it, it just won't be accepted.

The checksums are what I'm afraid of. Maybe I should ask brainslayer about it...

Also, I don't know what untrx did to the file, the extract_firmware script uses it, so I did the same.
edit: It just ripped away the first 28 byte... hm... wonder what those are...

Finger for others/reminder for me:
DD-WRT Novice

Joined: 28 Jul 2010
Posts: 49

PostPosted: Wed Aug 11, 2010 15:54    Post subject: Reply with quote
yea man ill ask about i defo need ipv6 tbh you would be a legend you did this.

im a beta tester if needed.
DD-WRT Novice

Joined: 22 May 2010
Posts: 6

PostPosted: Thu Aug 12, 2010 17:10    Post subject: Reply with quote
Ok, changing the image seems quite complicated as I can't seem to find any documentation on that :(

So as a work arround (and to see if the modules I build actually work) I scp'd them onto the router and did insmod.
If that works, I could just write a simple loader script for IPv6 and the user space tools.

<this is b*llsh*t, see edit below>
But for some reason I get this error (in dmesg), though I should build the same kernel like the one in the image file:

ipv6: version magic ' mod_unload MIPS32_R1 32BIT ' should be ' mod_unload MIPS32_R2 32BIT '

</end of see edit>

Forcing it to load by changing the version magic with an editor results in:
<4>ipv6: Unknown symbol __ipv6_addr_type
<4>ipv6: Unknown symbol inet6_lookup
<4>ipv6: Unknown symbol secure_tcpv6_sequence_number
<4>ipv6: Unknown symbol ipv6_skip_exthdr
<4>ipv6: Unknown symbol inet6_hash_connect
<4>ipv6: Unknown symbol ipv6_ext_hdr
<4>ipv6: Unknown symbol __inet6_lookup_established
<4>ipv6: Unknown symbol __inet6_hash
<4>ipv6: Unknown symbol inet6_lookup_listener

Those are located in the kernel image (vmlinux) I build, but of course not in the kernel image running on the router.
So, there is no other way than changing the whole kernel tree in the image against the IPv6 version (or, if the vmlinux is in one partition on the router, flashing the new vmlinux to that partition, but I don't want to brick one of my routers by medling with the flash).

Btw: IPv6 kernel modules are >400kb in size -- that could be the reason we don't have IPv6. So I guess I need to do both changing the images kernel and writing a download script... :(

//edit: I thought the DIR 615 was RT2880, but it's RT3052 - using .config_rt3052 the "magic works" ^^'
DD-WRT Novice

Joined: 22 May 2010
Posts: 6

PostPosted: Fri Aug 13, 2010 11:40    Post subject: Reply with quote
Ok, small status report.
I found some infos at the OpenWRT website on how to create images for the DIR 615, so I was able to build actual images the router accepted.
But the router just enters an infinite reboot loop (emergency room still works, so I think it can't be bricked unless one does something extremly stupid Razz)

0. Have the ddwrt toolchain (toolchain-mipsel_gcc4.1.2) in your PATH
1. create build directory (in my case ~/ddwrt/BUILD/)
2. copy unpacked rootfs into that dir (see 2nd post if you don't know how to get it - or compile a custom rootfs from svn [I did NOT compile a custom one] Very Happy)
3. create your kernels vmlinux and copy it into the build dir (~/ddwrt/BUILD/) and copy all required modules into the rootfs**
4. Get D-Links SDK, we need some of its tools: (DIR300 users might need a different sdk, though I doubt it)
5. Unpack it somewhere (I did to ~/ddwrt/sdk/)

Ok, small bridge: Until now we have a rootfs, a kernel and the SDK. There is no real documentation on what we need to do know, but the SDK contains several build scripts, the most important one located at boards/wrgn22/
I extracted the steps done there and created my own, simplified bash script to build a factory image for use with the emergency room tool (I will tell you how to get there, in case you don't know yet Wink), though I recommend you do the steps in that script at least once by hand, so you know what it does and maybe find my error!

Another important thing is signing: As you can see in the script, you need a signature to sign the image with. For DIR 615 Rev D this is "wrgn22_dlwbr_dir615", or if your not on DIR615, it is {$BOARD_NAME}_{$BRAND_NAME}_{$MODEL_NAME} - the variables can be found in configs/defconfig/{$BOARD_NAME}_{$BRAND_NAME}_{$MODEL_NAME}.config Very Happy
If in doubt, just do a fgrep -r [variable name]\= * in the SDK folder.

6. Get my script (read until the end of this post) and put it into the BUILD folder.
7. Edit it and set the variables (in my case SDK=/root/ddwrt/sdk/)
7a. Somehow I'm to stupid to get working pipes with awk, so you have to get the kernel entry point by hand (and you need to check it every time you build a new kernel!)
7b. See script how to do that
7c. Tell me how to fix it so I can update the script Razz
8. just ./
9. Flash your custom image

** The wireless drivers seem to be binary blobs, at least I can't seem to find them in the linux/rt2880 SVN!

Ok, and this is how you upload the image (aka 30/30/30 reset)
1. Plug PC in to WAN port
2. While device is powered on, press reset button & hold it for 30 seconds
3. Unplug the device while still pressing reset (for another 30 seconds)
4. Still press reset and plugin the device again, wait for 30 seconds
5. Set your PCs IP to 192.168.0.[not 1]
6. Open and do what the website tells you to do
7. In case of my images watch your router do an infinite reboot loop and go back to step 1 of emergency room :P

The 30 seconds are way to much, I usually do 15 (until it starts to flash)/5/10 and it works quite nice ;)

Mirror v0.1:

Have fun Wink
DD-WRT Novice

Joined: 13 Aug 2010
Posts: 8

PostPosted: Fri Aug 13, 2010 11:53    Post subject: Reply with quote
Probably we will not be able to compile ralink source because kernel tree is incomplete
My post..
I will be more that happy if someone from dd-wrt dev team enlighten us how do they build ralink fw with published kernel source..
DD-WRT Novice

Joined: 28 Jul 2010
Posts: 49

PostPosted: Sat Aug 14, 2010 13:33    Post subject: Reply with quote
they have SVN access with ralink

can BS comment on this please id really love ipv6.

can we just take the wireless hotspot things out in a sept build..
DD-WRT Novice

Joined: 13 Aug 2010
Posts: 8

PostPosted: Sat Aug 14, 2010 16:00    Post subject: Reply with quote
Nice suggestion,
The only thing which i am for is everybody here to be able to build ralink FW and make his own mods when needed. That is the strength of the open source after all! Let us hope that dd-wrt dev guy's are going to sync out kernel source soon..
DD-WRT Novice

Joined: 28 Jul 2010
Posts: 49

PostPosted: Sun Aug 15, 2010 1:02    Post subject: Reply with quote
i agree hopefully Bs will help us out i really want ipv6 Smile
DD-WRT Novice

Joined: 16 Aug 2010
Posts: 21
Location: Italy

PostPosted: Mon Aug 16, 2010 16:20    Post subject: Reply with quote
Hi! Today I've unpacked the dd-wrt firmware of DIR-300 B1, after 2 hours of testing! Thanks for your posts, they was very helpful :)

If someone want to unpack the firmware of 300b1, can follow this steps:
0- The firmware that I've used is:
1- create a directory (mkdir tmp)
2- use untrx: untrx dir300b-revb-ddwrt-webflash.bin tmp/
3- cd tmp
4- dd if=segment1 of=squashfs.img bs=16 skip=54272 conv=notrunc
5- unsquashfs-lzma squashfs.img
[I've used unquashfs-lzma from the firmware-mod-kit-read-only in the dir squashfs-3.0-lzma-damn-small-variant]
Now you've the rootfs
I've used to find the start of squashfs the same method of archimedes. Really thanks! :)

Now I'm trying to edit something, create squashfs and pack again. Very Happy
DD-WRT Novice

Joined: 28 Jul 2010
Posts: 49

PostPosted: Tue Aug 17, 2010 1:41    Post subject: Reply with quote
hi dude can you build with latest firmware that has better wireless :)

and please share with me '' :)
DD-WRT Novice

Joined: 16 Aug 2010
Posts: 21
Location: Italy

PostPosted: Tue Aug 17, 2010 10:15    Post subject: Reply with quote
Yeah! I'm very happy :)

After several times and tries I've succeeded to repack a new filesystem of dir 300b1 and upload it in emergency room! All work perfectly!!

This is the method:
1- have squashfs-root directory in your current dir
2- have untrx
3- have mkshashfs-lzma (from the firmware-mod-kit-read-only in the dir squashfs-3.0-lzma-damn-small-varian)
4- have v2image from dir300b toolkit (downloadable from dlink website)

I use the original firmware, untrx it and replace in the segment1 the 2nd part (where is the squashfs)

1- untrx original_firmware_for_dir300b1.bin
2- mkshashfs-lzma squashfs-root/ squashfs_new.img -lc 1 -lp 2 -pb 2 -all-root -noappend
3- dd if=squashfs_new.img of=segment1 bs=16 seek=54272
4- v2image -v -i segment1 -o dir300b1-new-fw.bin -d /dev/mtdblock/2 -s wrgn23_dlwbr_dir300b

Now we can upgrade the firmware from the emergency room of dir 300b1 :)

PS: Valthos now I'm editing the latest firmware, when the release is good, i will share with you :)

PPS: Here there are all my scripts and tools that i've used Smile / mirror:
DD-WRT Novice

Joined: 28 Jul 2010
Posts: 49

PostPosted: Tue Aug 17, 2010 13:45    Post subject: Reply with quote
you legend Smile
DD-WRT Novice

Joined: 16 Aug 2010
Posts: 21
Location: Italy

PostPosted: Tue Aug 17, 2010 20:19    Post subject: Reply with quote
hi at all! I've compiled some apps for dir300b1 with success, I will explain my method :)

0- Need tools to build apps, I've tried to use DD WRT toolchains but they've very lot of problems (with all version in the package). To compile without problems, use OpenWrt-SDK-Linux-i686-1 downloadable here:
1- Extract it where you want
2- To compile a C app (4example):
~/openwrt_path/staging_dir_mipsel/bin/mipsel-linux-gcc -I ~/openwrt_path/staging_dir_mipsel/include/ -I ~/openwrt_path/staging_dir_mipsel/usr/include/ input.c -o output
If you need to link some libs use -L/path/of/your/libs or if you need to build something statically use gcc options like -static or -static-libgcc (more info here

To try the app without rebuild and upload the new firmware, copy it in the /tmp/ directory!
If you need to try new libs and don't wont to rebuild kernel every time, mount a new directory in tmp to the /lib/ for example, like this:
0- mkdir -p /tmp/lib
1- cp -rv /lib/* /tmp/lib/
2- cp -rv your_new_libs /tmp/lib/
3- mount -o bind /tmp/lib /lib
4- your /lib/ if now writable (in RAM)

I hope that this infos will be helpful ^^'

I will update you when a my firmware cook is ready.

PS: for the ipv6, I've tried to add modules but there's no sufficient space to add all necessary dependencies of ipv6.ko :S If the size of the firmware is > of 3,76MB, the router go spontaneously in the redboot mode and I must reload a new kernel.
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Ralink SoC based Hardware All times are GMT


Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum