Belkin F6D4630-4 v1xxx

Specs
Platform Serial Num. = ? FCC ID = K7SF6D6230V1 CPU Type = Broadcom BCM4718A1KFBG MIPS Rev = ? CPU Speed = ? Bus = ? Flash Type = Parallel Flash Chip = MXIC S091941 MX29lV640EBTI-70G 3A936206 Flash Size = 8MB Max Firmware Size = ? RAM Size = 32MB RAM Chip = Winbond W9751G6IB-25 998541340002 847A99 nvram Size = ? Switch = Broadcom BCM53115SKFBG Port-based vlan = ? 802.1q vlan = ? Ethernet Port Count = 1-10/100/1000-WAN 4-10/100/1000-LAN Wired Standard = IEEE 802.3? boot_wait = ? bootloader = CFE Flash Card Socket/Type = No SD/MMC Mod Support = No MiniPCI slots = ? PoE = No Power = ? Color of LEDs = ? Size = ? USB = USB 2.0A Serial Port = ? JTAG Port = ? Supported by TJTAG/Version = ? Special Features = ? Radio (wl0) Wireless Radio = Broadcom BCM4718A1KFBG (SoC) WLAN DSP processor = ? Antenna Connector Type = Fixed Wireless Standard = IEEE 802.11b/g/n WiFi Operating Frequency = 2.4Ghz Bandwidth = 20 MHz & 20/40 MHz auto 802.11n = up to 300Mbps 802.11g = 6, 9, 12, 18, 24, 36, 48, 54Mbps 802.11b = 1, 2, 5.5, 11Mbps Radio cor_rev = ? Radio Capabilities = ? Radio (wl1) Wireless Radio = Broadcom BCM43224KMLG WLAN DSP processor = ? Antenna Connector Type = Fixed Wireless Standard = IEEE 802.11a/n WiFi Operating Frequency = 5Ghz Bandwidth = 20 MHz & 20/40 MHz auto 802.11n = up to 300Mbps 802.11a = 6, 9, 12, 18, 24, 36, 48, 54Mbps Radio cor_rev = ? Radio Capabilities = ? Other Default IP address = ? Default login user = ? Default login password = ? Default SSID = ? OEM = ? 3rd Party Firmware Support = ?

Flashing
Firmware header looks like this: 0000 0000: 16 81 01 00 00 10 66 00 8E 4A 0A DC 00 00 01 00  ......f. .J......   0000 0010: 1C 00 00 00 0C 80 18 00  00 00 00 00 5D 00 00 01  ........ ....]...   0000 0020: 00 10 AF 3F 00 00 00 00  00 00 00 1C 02 AD F5 3C  ...?.... .......<  0000 0030: 7A 84 F2 DF 11 14 2C 44  EC 69 C1 0A 73 BB F5 6A  z.....,D .i..s..j

Using this as a guide: http://www.midnightcode.org/papers/OpenWRT%20on%20the%20Belkin%20F5D7230-4.pdf 00: 16 81 01 00 - belkin magic 04: 00 10 66 00 - length. size of whole file including magic (i.e. ls -la) 0x661000 08: CRC32 from 0xC (32bit LE inverted) Doesn't seem to match... 0C: 00 00 01 00 - Version 0x100000 (1.0?) 10: 1C 00 00 00 - offset of some sort to next section? 14: 0C 80 18 00 - = 0x18800C - where mtdblock2 starts (around 6.5M - rootfs) 18: 00 00 00 00 - ? 1C: 5D 00 00 01 - = 0x100005D 20: 00 10 AF 3F - 24: 00 00 00 00 - 28: 00 00 00 1C - 2C: 02 AD F5 3C

Reverting
One way is using the Broadcom CFE (accessed via the internal serial port 115200 baud, and pressing SPACE when directed).

The default ip address can be overriden, e.g. ifconfig eth0 -addr=192.168.2.243 -mask=255.255.255.0 -gw=192.168.2.1 -dns=192.168.2.1 Then at f6d6230-4v1000_ww_1.00.19.bin can be uploaded via the web console: http://192.168.2.243 (from the example above).

Pictures