Success on hacking, extracting, modifying (Translating) and repacking BREED Bootloader!

First of all, this is ethical hacking, not trying to violate any copyright or should be considered disrespectful to @hackpascal, the recovery is great, but he chose to not disclose the source code, that's not really a problem until you realize the web interface is in Chinese and you can do nothing about it.

My only intention with this was to find out how to translate the interface of this great bootloader, not to steal any intellectual property!

The space is not really problem, the're only a few strings, would need 1-2KB more at most for english translation.

After a looooong day I fully translated it for an old MR-3220v1 (AR7241 SoC).

It has some checks but are easy to bypass.
The recovery is actually a two-stage loader, the first stage checks and unpacks the LZMA-compressed data to the RAM, then boots it, and that's the actual code running the recovery.

Previous steps:

- Run binwalk on it, keep an eye for lzma compressed data, note down the decimal offset:

# binwalk breed-ar724x-reset11.bin 

21640         0x5488          Copyright string: "Copyright (C) 2021 HackPascal <>"
22056         0x5628          LZMA compressed data, properties: 0x6C, dictionary size: 33554432 bytes, uncompressed size: 308884 bytes

- Split the files:

Note down the packed data size! (87868 bytes)

# dd if=breed_bootloader of=boot bs=1 count=22056
22056 bytes (22 kB, 22 KiB) copied, 0.0505826 s, 436 kB/s

# dd if=breed_bootloader of=packed_data.lzma bs=1 skip=22056
87868 bytes (88 kB, 86 KiB) copied, 0.209102 s, 420 kB/s

- Check the current compresion settings, note down the dictionary size, lc, lp and pb:

# lzmainfo packed_data.lzma 

Uncompressed size:             0 MB (308884 bytes)
Dictionary size:               32 MB (2^25 bytes)
Literal context bits (lc):     0
Literal pos bits (lp):         2
Number of pos bits (pb):       2

- Unpack the data

# lzma -v -d packed_data.lzma -c >> unpacked_data
packed_data.lzma (1/1)
  100 %        85.2 KiB / 301.6 KiB = 0.282 

- Edit the data

The data is now extracted, there're no checksums for the html, open the file unpacked_data with any editor.
You'll see the HTML code everywhere at about 3/4th of the file, can me modified pretty much as needed as long as the sections positions are kept.
Remember to set encoding as UTF-8 or the chinese chars will look like garbage data.

Each code section starts with a NULL char and '<'(<div>, <html>, etc ) , so if you search the hex 00 ·3C you'll find them quick.
You must ensure the NULL char stays in the same place, so after modifying each section adjust by adding/removing spaces.

The easy way is to only modify one section at a time, save the file and compare the bytes, removing or adding the said spaces until it matches the original size.

Then there's a harder section with constants and strings, some parts of the web interface use it.<br
It's more tedious because they can't extended easily, you must modify them carefully to avoid causing havoc.

They're single strings separated by null chars, so you can slightly extend them if there's at least a null char between the next string.
Because the original text is Chinese, it uses UTF-8, it takes 2-3 bytes per character, so you have a lot of space when writing normal ASCII, most of the time you'll have so much space left that part of the old string remains, fill with null chars (00) until reaching the next existing null char in the string table.

HxD doesn't support UTF-8, so I opened the file in Notepad++ to find the sections easier, but modified in the hex editor:

- Repack the data.

Remember to use the SDK version, normal version lacks these switches.
Get the parameters you got from lzmainfo, we'll use them to repack the file.
The -d option is the number of bits (32MB = 2^25, so -d 25)
Note down the output size!

# lzma e unpacked_data packed_data_new -d25 -lc0 -lp2 -pb2
LZMA 22.01 (x86) : Igor Pavlov : Public domain : 2022-07-15

Input size:  308884 (0 MiB)
Output size: 87207 (0 MiB)

- Build the image

# cat boot  packed_data_new > breed_mod.bin

- Final step

Convert the original data size (87868) to hex (1573C).
Convert the new lzma output size (87207) to hex (154A7).
Open breed_mod.bin with a hex editor, go to the data offset (0x5628), few bytes upper (12 ?) you'll find the original data size.

Modify these bytes to match the new data and save the file.
Wrong data size will cause the bootloader to complain with "Bootloader data is corrupted!" error.

Upload the image and done!

This is not translated by google!

Now the details are known, it shouldn't be hard for the community to modify the bootloaders, perhabs making a github project with them.


Pages are almost identical, I translated Breed for AR9331 in 2 hours.

It's definitely much easier to edit with Notepad++, but be careful!

  • Open the file, select UTF-8 encoding, don't select UTF-8 conversion!
  • Don't save the file while in UTF-8 mode, it'll mess everything up, return to ANSI encoding first.
  • If you already messed up, don't worry, change the encoding to ANSI and save again.
  • Avoid modifying chars nearby non-printable chars (Those appearing in BLACK with NUL and other symbols)
  • I repeat, only modify a section at a time, those between 00 3C (NULL and '<'), save the file, then pad with spaces until matching the original file size, repeat for each section, otherwise you'll missalign the sections and break it.
  • Finally open original and modded unpacked files and ensure those 00 3C between HTML code are in the same place, re-adjust if necesary by adding/removing spaces.

Attached the files for AR7241 and AR9331 here
(Spam / bot protection: Copy the URL and remove the extra 'E' from 'drivee').

BTW I compiled Openwrt 22.03 for MR3220v1 (AR7241) and WR740Nv4 (AR9331), both modded to 64/16M, they're doing really well for their age! :grinning:


What's this utter crap forum system? I can't edit the first post anymore after a while?
So how am I'm going to edit small bugs or updating the links?
Yeah, keep adding messages, the people will read the first post and keep reading when something breaks or doesn't work :face_with_peeking_eye:

Does answering lock the messages? I tried to delete the messages but they're still in the history, not liking this privacy assault, I should have rights to fullt remove a message I made!
I'm starting to hate this modern forum system...

Well, anyways.
The lzma size isn't critical, as long as it's higher than the original value it will work!
Also the ar9331 build doesn't work with large openwrt builds, I guess something is being overlapped in memory.
For those with this same issue, use breed-ar9331-wr710n_wr720n, works well, I also translated it and it's in the Drive folder.
Edit: Breed for ar9331 breaks large Openwrt images no matter de what, it booted but then Openwrt wqs missing a lot of files and not working correctly.
Not a bug caused by me, unmodified boot does the same.
When flashing pepe2k it worked, flashing breed broke it, the firmware partition where unaffected si It must be a issue with hardware configuration or crashing (overlapping)memory zones, use pepe2k!
However it's doing great with the AR7241.

@tmomas Can you help out here?

PM sent.

1 Like