I was recently introduced to FON and decided to buy a La Fonea to get in the mode. After getting the device I promptly opened it and looked inside. The core of the unit is a MIPS (Atheros SOC) processor with 16MB ram and 8MB flash. As expected, it has both ethernet and a dual-antenna wifi front-end. The FON network is a pretty good attempt at creating a world-wide wifi community, so I fully support their cause. The only thing is that with so much storage space, maybe I can add some useful features to their firmware, since it does run Linux (OpenWrt).
The first step was to download the firmware from the FON website. Luckily, Stefans Datenbruch already had a FON and analyzed the firmware. The first four bytes are “FON#” where # is either 3 meaning a firmware upgrade or 4 meaning a “hotfix”. The next four bytes are hypothesized to contain the length of the header or crypto key according to Datenbruch. Skipping 520 bytes, everything else is a gzip of a tar archive containing the files: upgrade, rootfs.squashfs, kernel.lzma and hotfix. Upgrade is a shell script, rootfs and kernel are what their names imply and hotfix is a text file that seems to list some version information.
The “easy” way to look at the file structure of this upgrade would be to install the squashfs userland on your Linux distribution and then apply the lzma patches and then upgrade your kernel to 2.6.x and then install the squashfs drivers/userland and then install the lzma and then recompile squashfs etc etc etc. The easier method is just to install a rs232 transciever on the machine and upload all of the files to another host. The memory management or spc on the unit is flaky, so it’s best to compress each root directory into a tar file on /tmp and upload those. An archive of the filesystem is at the bottom along with a boot log.
NB: The zip file below is the extracted filesystem, not the flash image!