############ Fritzbox 5530 Fiber = 41652371 bytes ############

Fixed size 128 bytes header

00000000  0d 00 ed fe 43 90 7b 02  ae 09 c2 cd 5b a7 6c b3  |....C.{.....[.l.|
00000010  64 38 fb ed 21 cc a4 e7  b0 94 84 c4 03 33 ac 46  |d8..!........3.F|
00000020  32 74 ff b1 3e 33 3c ad  9a 6d ab 80 30 f0 7c c1  |2t..>3<..m..0.|.|
00000030  d0 2f e7 89 ad 90 bf ad  7a 4d df 15 56 29 2f 7c  |./......zM..V)/||
00000040  73 3e 0d 8d 7f 68 7e 0c  d0 0d fe ed 02 7b 90 43  |s>...h~......{.C|
00000050  00 00 00 38 02 7b 8f 34  00 00 00 28 00 00 00 11  |...8.{.4...(....|
00000060  00 00 00 10 00 00 00 00  00 00 01 0f 02 7b 8e fc  |.............{..|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080

- 0x00 = FIT signature = '0d 00 ed fe'
- 0x04 = BE pointer to EOF
- 0x08-0x4C = hopefully no RSA signature - doesn't contain CRC32 or MD5 of 0x50+ or 0x80+
- 0x4C = LE pointer to EOF
- 0x50 = always 0x00000038
- 0x54 = LE pointer to todo (description - 0x42?)
- 0x58 = always 0x00000028
- 0x5C = always 0x00000011
- 0x60 = always 0x00000010
- 0x64 = always 0x00000000
- 0x68 = 0x0000010f (5530) or 0x0000011f (others)
- 0x6c = LE pointer to todo
- 0x70-0x80 = always 0x00000000

Variable size hunk structure


 - string ''
 - string 'FIT for HW0257' = info
 - word 0x5fa14b75 = timestamp
 - word 0x00014521 = avm,gu-version

 - string 'images'

 - string 'prxB_HW0257_kernel'
 - string 'Kernel for prxB_HW0257' = info
 - binary data = avm,variants
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0xb4761fdd  
 - string 'kernel' = type
 - string 'mips' = arch
 - string 'linux' = os
 - string 'lzma' = compression
 - word 0x88000000 = load
 - word 0x88298f10 = entry
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0xb4761fdd = value - MATCH

 - string 'avm,kallsyms'
 - string 'BE' = avm,endianess
 - word 0x88000000 = avm,kernel_text_start
 - word 0x882c8ec0
 - word 0x882e9830
 - word 0x882e9b90
 - word 0x882c8eb0
 - empty
 - word 0x882c8ea0
 - word 0x882bcc70

 - string 'prxB_HW0257_flat_dt_0'
 - string 'Device Tree for prxB_HW0257_0' = info
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0x3c53ca34  
 - string 'flat_dt' = type
 - string 'mips' = arch
 - string 'lzma' = compression
 - word 0x884e2000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x3c53ca34 = value - MATCH

 - string 'prxB_HW0257_ramdisk'
 - string 'Ramdisk for prxB_HW0257' = info
 - word 0x00000001 = #address-cells
 - gzip compressed data = data - CRC32: 0x0ef19ad8  
 - string 'ramdisk' = type
 - string 'mips' = arch
 - string 'linux' = os
 - string 'none' = compression
 - word 0x8b000000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x0ef19ad8 = value - MATCH

 - string 'prxI_HW257_kernel'
 - string 'Kernel for prxI_HW257' = info
 - string 'aon, pon' = avm,variants
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0xaa110233  
 - string 'kernel' = type
 - string 'mips' = arch
 - string 'linux' = os
 - string 'lzma' = compression
 - word 0x70000000 = load
 - word 0x7077a400 = entry
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0xaa110233 = value - MATCH

 - string 'avm,kallsyms'
 - string 'BE' = avm,endianess
 - word 0x70000000 = avm,kernel_text_start
 - word 0x70838590
 - word 0x70889d20
 - word 0x7088a060
 - word 0x70838580
 - empty
 - word 0x70838570
 - word 0x7081c620

 - string 'prxI_HW257_flat_dt_0_aon'
 - string 'Device Tree for prxI_HW257_0_aon' = info
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0xcf9e37b4  
 - string 'flat_dt' = type
 - string 'mips' = arch
 - string 'lzma' = compression
 - word 0x70fe4000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0xcf9e37b4 = value - MATCH

 - string 'prxI_HW257_flat_dt_0_pon'
 - string 'Device Tree for prxI_HW257_0_pon' = info
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0xb9298e1b  
 - string 'flat_dt' = type
 - string 'mips' = arch
 - string 'lzma' = compression
 - word 0x70fe4000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0xb9298e1b = value - MATCH

 - string 'prxI_HW257_ramdisk'
 - string 'Ramdisk for prxI_HW257' = info
 - word 0x00000001 = #address-cells
 - gzip compressed data = data - CRC32: 0x9b59e2d4  
 - string 'ramdisk' = type
 - string 'mips' = arch
 - string 'linux' = os
 - string 'none' = compression
 - word 0x90000000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x9b59e2d4 = value - MATCH

 - string 'configurations'

 - string 'prxB_HW0257_config_0'
 - string 'prxB_HW0257_kernel'
 - string 'prxB_HW0257_flat_dt_0'
 - string 'prxB_HW0257_ramdisk'

 - string 'prxI_HW257_config_0_aon'
 - string 'prxI_HW257_kernel'
 - string 'prxI_HW257_flat_dt_0_aon'
 - string 'prxI_HW257_ramdisk'

 - string 'prxI_HW257_config_0_pon'
 - string 'prxI_HW257_kernel'
 - string 'prxI_HW257_flat_dt_0_pon'
 - string 'prxI_HW257_ramdisk'

 - string 'description'
   |->  string 'timestamp'
   |->  string 'avm,gu-version'
   |->  string 'avm,variants'
   |->  string '#address-cells'
   |->  string 'data'
   |->  string 'type'
   |->  string 'arch'
   |->  string 'os'
   |->  string 'compression'
   |->  string 'load'
   |->  string 'entry'
   |->  string 'algo'
   |->  string 'value'
   |->  string 'avm,endianess'
   |->  string 'avm,kernel_text_start'
   |->  string 'avm,names'
   |->  string 'avm,token_table'
   |->  string 'avm,token_index'
   |->  string 'avm,num_syms'
   |->  string 'avm,addresses'
   |->  string 'avm,relative_base'
   |->  string 'avm,offsets'
   |->  string 'kernel'
   |->  string 'fdt'
   |->  string 'ramdisk'

############ Fritzbox 7530 AX = 34733863 bytes ############

Fixed size 128 bytes header

00000000  0d 00 ed fe d7 fe 11 02  be 12 05 bb 07 71 bf f8  |.............q..|
00000010  f8 86 87 b1 b7 63 ef dd  45 db 1e 26 0c a1 c8 3a  |.....c..E..&...:|
00000020  e6 0a 31 08 c5 6f f5 fe  ed af b5 35 fd 74 32 2b  |..1..o.....5.t2+|
00000030  dd 66 2c 18 7c 05 21 68  9e 3b a2 f9 81 d3 82 e6  |.f,.|.!h.;......|
00000040  be 45 7e 90 04 a4 7f 08  d0 0d fe ed 02 11 fe d7  |.E~.............|
00000050  00 00 00 38 02 11 fd a8  00 00 00 28 00 00 00 11  |...8.......(....|
00000060  00 00 00 10 00 00 00 00  00 00 01 2f 02 11 fd 70  |.........../...p|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080

- 0x00 = FIT signature = '0d 00 ed fe'
- 0x04 = BE pointer to EOF
- 0x08-0x4C = hopefully no RSA signature - doesn't contain CRC32 or MD5 of 0x50+ or 0x80+
- 0x4C = LE pointer to EOF
- 0x50 = always 0x00000038
- 0x54 = LE pointer to todo (description - 0x42?)
- 0x58 = always 0x00000028
- 0x5C = always 0x00000011
- 0x60 = always 0x00000010
- 0x64 = always 0x00000000
- 0x68 = 0x0000010f (5530) or 0x0000011f (others)
- 0x6c = LE pointer to todo
- 0x70-0x80 = always 0x00000000

Variable size hunk structure


 - string ''
 - string 'FIT for HW256' = info
 - word 0x5fa13e4a = timestamp
 - word 0x0001451a = avm,gu-version

 - string 'images'

 - string 'brcma9TZ_HW256_kernel'
 - string 'Kernel for brcma9TZ_HW256' = info
 - binary data = avm,variants
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0xf653ffe8  
 - string 'kernel' = type
 - string 'arm' = arch
 - string 'linux' = os
 - string 'lzma' = compression
 - word 0x10800000 = load
 - word 0x10800000 = entry
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0xf653ffe8 = value - MATCH

 - string 'brcma9TZ_HW256_flat_dt_0'
 - string 'Device Tree for brcma9TZ_HW256_0' = info
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0x2040d9dd  
 - string 'flat_dt' = type
 - string 'arm' = arch
 - string 'lzma' = compression
 - word 0x10000000 = load
 - binary data = avm,endianess
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x2040d9dd = value - MATCH

 - string 'brcma9_HW256_kernel'
 - string 'Kernel for brcma9_HW256' = info
 - binary data = avm,variants
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0x34ac9b5e  
 - string 'kernel' = type
 - string 'arm' = arch
 - string 'linux' = os
 - string 'lzma' = compression
 - word 0xc0008000 = load
 - word 0xc0008000 = entry
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x34ac9b5e = value - MATCH

 - string 'avm,kallsyms'
 - string 'LE' = avm,endianess
 - word 0xc0008000 = avm,kernel_text_start
 - word 0xc0520920
 - word 0xc058c9c0
 - word 0xc058cd40
 - word 0xc0520910
 - word 0xc04fb9d0
 - empty
 - empty

 - string 'brcma9_HW256_flat_dt_1'
 - string 'Device Tree for brcma9_HW256_1' = info
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0x5edb6c64  
 - string 'flat_dt' = type
 - string 'arm' = arch
 - string 'lzma' = compression
 - word 0xc07ab000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x5edb6c64 = value - MATCH

 - string 'brcma9_HW256_flat_dt_0'
 - string 'Device Tree for brcma9_HW256_0' = info
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0xa7ded150  
 - string 'flat_dt' = type
 - string 'arm' = arch
 - string 'lzma' = compression
 - word 0xc07ab000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0xa7ded150 = value - MATCH

 - string 'brcma9_HW256_squashFS_filesystem'
 - string 'squashFS for brcma9_HW256' = info
 - word 0x00000001 = #address-cells
 - word 0x00001000
 - squashfs image = data - CRC32: 0x29c318fc  
 - string 'filesystem' = type
 - string 'none' = compression
 - word 0x19c00000 = load
 - string 'mtdram=ram-filesystem,0x19c00000,0x1bb00000 mtdparts_ext=ram-filesystem:31858688@0x0(rootfs_ram)' = avm,endianess
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x29c318fc = value - MATCH

 - string 'configurations'

 - string 'brcma9TZ_HW256_config_0'
 - string 'brcma9TZ_HW256_kernel'
 - string 'brcma9TZ_HW256_flat_dt_0'

 - string 'brcma9_HW256_config_1'
 - string 'brcma9_HW256_kernel'
 - string 'brcma9_HW256_flat_dt_1'
 - string 'brcma9_HW256_squashFS_filesystem'

 - string 'brcma9_HW256_config_0'
 - string 'brcma9_HW256_kernel'
 - string 'brcma9_HW256_flat_dt_0'
 - string 'brcma9_HW256_squashFS_filesystem'

 - string 'description'
   |->  string 'timestamp'
   |->  string 'avm,gu-version'
   |->  string 'avm,variants'
   |->  string '#address-cells'
   |->  string 'data'
   |->  string 'type'
   |->  string 'arch'
   |->  string 'os'
   |->  string 'compression'
   |->  string 'load'
   |->  string 'entry'
   |->  string 'algo'
   |->  string 'value'
   |->  string 'avm,kernel-args'
   |->  string 'avm,endianess'
   |->  string 'avm,kernel_text_start'
   |->  string 'avm,names'
   |->  string 'avm,token_table'
   |->  string 'avm,token_index'
   |->  string 'avm,num_syms'
   |->  string 'avm,addresses'
   |->  string 'avm,relative_base'
   |->  string 'avm,offsets'
   |->  string 'avm,data-align'
   |->  string 'kernel'
   |->  string 'fdt'
   |->  string 'squashFS'

############ Repeater 6000 = 20083335 bytes ############

Fixed size 128 bytes header

00000000  0d 00 ed fe 37 72 32 01  f2 35 2b fd 6b 89 c9 75  |....7r2..5+.k..u|
00000010  80 51 35 10 e0 ed 0b e1  5b 75 06 65 6a 98 bc 82  |.Q5.....[u.ej...|
00000020  69 d6 05 fa 86 23 66 42  62 ff b1 c0 0e b3 ac 2c  |i....#fBb......,|
00000030  f4 71 6a 64 38 e2 4d 10  13 5e c0 40 26 5a c7 ac  |.qjd8.M..^.@&Z..|
00000040  28 f4 f1 6d 8e e8 38 0d  d0 0d fe ed 01 32 72 37  |(..m..8......2r7|
00000050  00 00 00 38 01 32 71 08  00 00 00 28 00 00 00 11  |...8.2q....(....|
00000060  00 00 00 10 00 00 00 00  00 00 01 2f 01 32 70 d0  |.........../.2p.|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080

- 0x00 = FIT signature = '0d 00 ed fe'
- 0x04 = BE pointer to EOF
- 0x08-0x4C = hopefully no RSA signature - doesn't contain CRC32 or MD5 of 0x50+ or 0x80+
- 0x4C = LE pointer to EOF
- 0x50 = always 0x00000038
- 0x54 = LE pointer to todo (description - 0x42?)
- 0x58 = always 0x00000028
- 0x5C = always 0x00000011
- 0x60 = always 0x00000010
- 0x64 = always 0x00000000
- 0x68 = 0x0000010f (5530) or 0x0000011f (others)
- 0x6c = LE pointer to todo
- 0x70-0x80 = always 0x00000000

Variable size hunk structure


 - string ''
 - string 'FIT for HW253' = info
 - word 0x5fd9e2d0 = timestamp
 - word 0x00014b47 = avm,gu-version

 - string 'images'

 - string 'qcaarmv8_HW253_kernel'
 - string 'Kernel for qcaarmv8_HW253' = info
 - binary data = avm,variants
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0x305c1622  
 - string 'kernel' = type
 - string 'arm' = arch
 - string 'linux' = os
 - string 'lzma' = compression
 - word 0x41208000 = load
 - word 0x41208000 = entry
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x305c1622 = value - MATCH

 - string 'avm,kallsyms'
 - string 'LE' = avm,endianess
 - word 0xc0208000 = avm,kernel_text_start
 - word 0xc080b490
 - word 0xc089ed90
 - word 0xc089f130
 - word 0xc080b480
 - word 0xc07d9700
 - empty
 - empty

 - string 'qcaarmv8_HW253_flat_dt_0'
 - string 'Device Tree for qcaarmv8_HW253_0' = info
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0x19dce80e  
 - string 'flat_dt' = type
 - string 'arm' = arch
 - string 'lzma' = compression
 - word 0x41c30000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x19dce80e = value - MATCH

 - string 'qcaarmv8_HW253_flat_dt_2'
 - string 'Device Tree for qcaarmv8_HW253_2' = info
 - word 0x00000001 = #address-cells
 - lzma compressed data = data - CRC32: 0x12fa7f09  
 - string 'flat_dt' = type
 - string 'arm' = arch
 - string 'lzma' = compression
 - word 0x41c30000 = load
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x12fa7f09 = value - MATCH

 - string 'qcaarmv8_HW253_squashFS_filesystem'
 - string 'squashFS for qcaarmv8_HW253' = info
 - word 0x00000001 = #address-cells
 - word 0x00001000
 - squashfs image = data - CRC32: 0x89107410  
 - string 'filesystem' = type
 - string 'none' = compression
 - word 0x43000000 = load
 - string 'mtdram=ram-filesystem,0x43000000,0x44100000 mtdparts_ext=ram-filesystem:16777216@0x0(rootfs_ram)' = avm,kernel-args
 - string 'hash_0'
 - string 'crc32' = algo
 - word 0x89107410 = value - MATCH

 - string 'configurations'

 - string 'qcaarmv8_HW253_config_0'
 - string 'qcaarmv8_HW253_kernel'
 - string 'qcaarmv8_HW253_flat_dt_0'
 - string 'qcaarmv8_HW253_squashFS_filesystem'

 - string 'qcaarmv8_HW253_config_2'
 - string 'qcaarmv8_HW253_kernel'
 - string 'qcaarmv8_HW253_flat_dt_2'
 - string 'qcaarmv8_HW253_squashFS_filesystem'

 - string 'description'
   |->  string 'timestamp'
   |->  string 'avm,gu-version'
   |->  string 'avm,variants'
   |->  string '#address-cells'
   |->  string 'data'
   |->  string 'type'
   |->  string 'arch'
   |->  string 'os'
   |->  string 'compression'
   |->  string 'load'
   |->  string 'entry'
   |->  string 'algo'
   |->  string 'value'
   |->  string 'avm,endianess'
   |->  string 'avm,kernel_text_start'
   |->  string 'avm,names'
   |->  string 'avm,token_table'
   |->  string 'avm,token_index'
   |->  string 'avm,num_syms'
   |->  string 'avm,addresses'
   |->  string 'avm,relative_base'
   |->  string 'avm,offsets'
   |->  string 'avm,data-align'
   |->  string 'avm,kernel-args'
   |->  string 'kernel'
   |->  string 'fdt'
   |->  string 'squashFS'