V3 firmware file format

Source: firmware file, bootloader output, in-device filesystem.

Firmware file consists of blocks. Every block is 1 megabyte (2²⁰ bytes) in size. If actual data is shorter than block size, block tail is filled with 0xFF bytes.

block 0

0x00-0x47       text header
0x48-0x4b       number of blocks in firmware,big endian, 4 bytes -- 0x36
0x4c-0x5b       MD5 of block01
0x5c-0x6b       MD5 of block02
0x4c+(0x10*(N-1))   MD5 of block N
...
0x4c+(0x10*N)   MD5 sum of piece from beginning of block to last "data block" MD5 sum inclusive.

block 1

kernel

blocks 2-7

cramfs (rootfs)

blocks 8-51

cramfs (/root and /usr/lib)

block 52

startup and shutdown logo.

Logos are uncompressed headerless 2-bit gray 800x600 images.

Every byte contains values for 4 consecutive pixels. Images are stored line-by-line from left to right inside line, from top to bottom.

blocks 53-54

jffs2 (/home)