DIY project: recover AP9631 card with blank mac address, model number etc

[Arek]

This is DIY project for fun.

My AP9631 card has blank factory region which means blank mac address, blank model number and so on.

This card has Spansion S29JL064J55TFI00 64Mb parallel flash in TSOP48 package. Dumping it with programmer (used XGecu 76 + TSOP56 adapter, which also handles TSOP48 ) reveals that all factory data is in first few bytes. I'm trying to figure out meaning of these. Half guessed/half known information below:

Offs  Len   Raw bytes                                Meaning / notes
----  ---   ---------------------------------------  ------------------------------
0x00  1     01                                       Format major = 1 (?)
0x01  1     00                                       Format minor = 0 (?)
0x02  2     30 35                                    ASCII "05" → revision
0x04  2     00 00                                    Reserved / padding (?)
0x06  13    FF ... FF                                Erased flash padding
0x13  11    30 36 2F 32 34 2F 32 30 31 31            ASCII "06/24/2011" (build date)
0x1E  9     41 50 39 36 33 31 43 48 00               ASCII "AP9631CH" + NUL (model)
0x27  8     FF ... FF                                Padding
0x2F  13    35 41 31 31 32 36 54 31 30 00 00 00 00   ASCII "5A1126T10000" + NUL (serial)
0x3C  20    FF ... FF                                Padding
0x50  6     00 C0 B7 C4 00 00                        MAC address = 00:C0:B7:C4:00:00
0x56  2     00 01                                    Language = 1 (?)
0x58  2     00 01                                    International = 1 (?)
0x5A  1     00                                       Padding / align before checksum
0x5B  4     EF 7B 12 17                              Checksum / CRC (polynomial TBD)
0x5F  1     FF                                       Padding
0x60  4     FF FF FF FF                              Padding

and a lot of FF FF until actual firmware

(note; changed mac address and serial number in above by hand)

Cloning some other card makes my problematic card working but I don't want to do that. I want to restore proper MAC address, model name, serial number (all from stickers). Unfortunately changing only these will cause card to behave just like broken card - no mac, no model number.

The secret most likely hides in checksum. So far was unable to figure out algorithm used for that and create proper checksum for my mac, serial.

Does anyone have an idea how that checksum is calculated?

Also I'm interested in dumps from other AP963x cards, if anyone have a programmer and is able to do that give me a note.

[Arek]

It seems to be CRC-16/CCITT-FALSE. At least that worked for me and boot monitor shows "CRC = OK" now.

Card is fully recovered, has original model name, mac, serial, revision, date. I also was able to update to latest 7.2.0 firmware.

Only "EF 7B" is a checksum. "12 17" meaning is unknown.

https://github.com/arekm/ap9631-recovery