USR 9105 hacking.

I've got to the point where I can unpack the firmware on my little-endian x86 box, add a file, repack it and then flash it to my USR 9105. I used the lzma decode from the USR kernel source to patch cramfsck to unpack the firmware. The lzma encode is from the C++ lzma source below. This is now compiled in to mkcramfs. Anyway use at your own risk.
patched cramfs tools and my firmware tools cramfs-rdb-0.97.tar.gz .
The lzma that mkcramfs uses came from lzma-0.01.tar.bz2 .
I have opened up my 9105. It is held together by a screw from underneath, the four visible clips and 4 clips underneath the feet. There are solder pads for a low voltage UART. Photos of the usr9106 look very similar. The most obvious difference being the mini-pci slot.
I have added a README.usr9105 file to the cramfs tar file where I explain how to use the tools. I've also tidied up a few bogus bits of code.
I have compiled in the lzma compression code and added flags to change the header strings like the model number. If the header file generated by decompose is present this will be used to extract default header strings.
I've added a patch from Felix Salfelder that changes the vendor on the command line.
I have not looked at the Broadcom ADSL routers for a while. I've moved on to using openwrt on Texas Instruments AR7 routers. These are easier to work with because we have source code for all the drivers. Recently I've been hacking on a Zyxel AR7 router when I can find the time.
If you have any comments then my disguised email address is below: