firmware-utils, branch master

mkbossimg: add tool for Bintec BOSS firmware images

2026-10-20T22:56:17Z

The bootmonitor of Bintec elmeg RS-series routers (RS123, RS230, RS353) expects a 52-byte BOSS header in front of a gzip-compressed image: a 23-byte magic string identifying the board family, followed by fw_version, image_type, image_version, image_length, a CRC32 over the payload and two vendor fields, all big-endian. No existing tool produces this. mkbrnimg, from which this is derived, writes a 12-byte trailing footer plus a signature string instead. The input is expected to carry a 52-byte placeholder header so the payload stays aligned to the flash sector size; it is skipped, and length and CRC are computed over the remainder. The CRC is the plain zlib CRC32. Output was verified byte-for-byte against the original implementation from armSeb/openwrt-RS353, and the header layout was cross-checked against a genuine vendor firmware image. Signed-off-by: Simon Wunderlich Link: https://github.com/openwrt/firmware-utils/pull/78 Signed-off-by: Jonas Jelonek

mkhsfls: add tool for Herospeed camera firmware

2026-10-12T09:46:10Z

The web interface of Herospeed and Longse RV1126 IP cameras accepts a .FLS container, which the firmware writes to the inactive A/B slot. It has a 24 byte header with SoC and sensor name, the file size and the entry count, followed by one 256 byte record per entry and the entry data. Add a tool that packs boot, system and the other entry types the firmware understands into such a container. The output is identical to the container of a stock RV1126 firmware rebuilt from its entries. Signed-off-by: Daniel Golle

mkrkboot: add tool for Rockchip Android boot images

2026-10-12T09:45:54Z

Rockchip's U-Boot on the RV11xx camera SoCs boots an Android boot image with a Rockchip resource image in the second stage slot, which carries the device tree as rk-kernel.dtb. Add a tool that builds both from a kernel image and a device tree, with optional extra resource entries. The boot image header is the Android v0 header including the SHA-1 id, and the resource image has the index table with a SHA-1 per entry. The output is identical to the boot image of a stock RV1126 firmware. Signed-off-by: Daniel Golle

dlink-sge-image: initialize the signature length

2026-09-30T18:15:08Z

EVP_PKEY_sign() takes the size of the signature buffer in *siglen and fails if it is too small. siglen is not initialized, so the result depends on whatever the stack holds: with some builds both signatures are written, with others signing fails and the image carries 1024 zero bytes instead. The same firmware thus differs between build hosts. Set siglen to the size of the buffer before each call. The signatures are deterministic PKCS#1 v1.5 signatures, so they match the ones of images built where signing happened to work. Signed-off-by: Paul Spooren

zyimage: make output byte order explicit

2026-09-23T21:53:02Z

device_id and crc32 were written in native host byte order, with no byte-swap calls at all, so the on-disk output was only correct on little-endian build hosts. Make the existing little-endian behavior explicit with htole32() and document the byte layout, so a porter reading the vendor's CONFIG_TARGET_DEVICE_ID can map it to the equivalent OpenWrt ZYIMAGE_ID. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin Link: https://github.com/openwrt/firmware-utils/pull/75 Signed-off-by: Jonas Jelonek

asusuimage: fix fs_offset extraction in show_info

2026-09-23T21:30:04Z

This code was apparently intended to look for FS_OFFSET_PREFIX and then read the big-endian 24-bit value just after it. Instead, it did always read the value from a fixed offset. This fixes using bogus (or zero) values of `fs_offset` when analysing TRXv2 images for Asus RT-AX53U. Now the values agree with what the `binwalk` tool prints. This patch modifies the show_info() function, which is used only for firmware analysis and not in an OpenWRT build. Signed-off-by: Mateusz Jończyk Link: https://github.com/openwrt/firmware-utils/pull/66 Signed-off-by: Jonas Jelonek

mksenaofw: warn instead of erroring on plain type-0 images

2026-09-23T21:25:26Z

firmware_type 0 ("combo") is currently a fatal error unless a capwap header is supplied. Some rebranded Senao devices ship a plain type-0 header with no capwap section -- notably the Netgear WAX214 and WAX218 (vendor_id 0x231), whose stock web-UI updater accepts the bare 0x60 img_header + magic-XOR'd payload. Downgrade that case to a non-fatal warning. Capwap encodes always set a datecode (-c), so this only affects a type-0 encode with no capwap arguments; encode_image() already omits the capwap section and computes the checksum over the 0x60 header alone when no capwap header is supplied, so a plain image is produced correctly. Signed-off-by: Misha Hawthorn Link: https://github.com/openwrt/firmware-utils/pull/76 Signed-off-by: Jonas Jelonek

mkzynfw: align RTL_OTTO_BOARD definitions

2026-09-23T21:22:31Z

Align the RTL_OTTO_BOARD definitions internally, adding spaces to the different parameters to have a cleaner and easier to read table. Link: https://github.com/openwrt/firmware-utils/pull/77 Signed-off-by: Jonas Jelonek

mkzynfw: add board profiles for Zyxel XGS2220 series

2026-09-23T21:22:31Z

Add board profiles for Zyxel XGS2220 switches, a series of 6 switches based on RTL931x platform. The profiles have been extracted from stock firmware. Link: https://github.com/openwrt/firmware-utils/pull/77 Signed-off-by: Jonas Jelonek

uimage_padhdr: add options to insert data into padding area

2026-07-30T06:53:14Z

Add two new command-line options, both repeatable, to write arbitrary data at specific byte offsets within the zero-filled padding area that is appended after the uImage header: -x offset:hexstring Insert raw bytes specified as a hex string -s offset:string Insert an ASCII string (without NUL terminator, since the padding is already zero-filled) Offsets are relative to the start of the padding area and accept both decimal and hexadecimal (0x-prefixed) notation. Validate that every patch fits within the configured padding before modifying the image, preventing silent data corruption. Patches are applied to the buffer before the header CRC is recalculated, so the checksum correctly covers the inserted content. Signed-off-by: Luiz Angelo Daros de Luca Link: https://github.com/openwrt/firmware-utils/pull/71 Signed-off-by: Jonas Jelonek