{"id":5979,"date":"2025-05-29T12:33:22","date_gmt":"2025-05-29T17:33:22","guid":{"rendered":"https:\/\/www.incredigeek.com\/home\/?p=5979"},"modified":"2025-05-29T12:42:41","modified_gmt":"2025-05-29T17:42:41","slug":"how-to-flash-unsigned-firmware-on-ubiquiti-airmax-radio","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/how-to-flash-unsigned-firmware-on-ubiquiti-airmax-radio\/","title":{"rendered":"How to flash unsigned firmware on a Ubiquiti Airmax Radio"},"content":{"rendered":"\n

Here are some notes on downgrading a Ubiquiti Airmax radio so it can run unsigned firmware.<\/p>\n\n\n\n

Disclaimer, the following steps are potentially dangerous. Proceed with caution.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Ubiquiti introduced signed firmware around version 5.12. After that, you couldn’t flash unsigned firmware if a device already had signed firmware. You also couldn’t downgrade below 5.12.<\/p>\n\n\n\n

Ubiquiti uses the update utility to enforce only flashing signed firmware. So what happens if you swap out the update utility with one from an unsigned firmware version?<\/p>\n\n\n\n

This is the hack we’ll explore. <\/p>\n\n\n\n

Here is a quick overview.<\/p>\n\n\n\n

    \n
  1. Download firmware.<\/li>\n\n\n\n
  2. Extract ubntbox out of the unsigned firmware.<\/li>\n\n\n\n
  3. Move files (ubntbox, and unsigned firmware) to target radio.<\/li>\n\n\n\n
  4. Modify libevent<\/code> versions in ubntbox<\/code> to match the current signed firmware. Should only be needed if firmware version number is different.<\/li>\n\n\n\n
  5. Upgrade! “Downgrade”…<\/li>\n<\/ol>\n\n\n\n

    <\/p>\n\n\n\n

    Downloading firmware<\/h2>\n\n\n\n

    You can download unsigned firmware from Ubiquiti. https:\/\/ui.com\/download<\/a> <\/p>\n\n\n\n

    Here is a link for the PowerBeam firmware. https:\/\/ui.com\/download\/software\/nbe-m5-400<\/a><\/p>\n\n\n\n

    \u2139\ufe0fPro tip, you should be able to wget the firmware directly to a radio with wget http:\/\/dl.ubnt.com\/firmwares\/XW-fw\/v5.6.15\/XW.v5.6.15-sign.31612.170908.1440.bin<\/code><\/a>
    Note the http. No https. The wget version in older firmware has issues with SSL\/TLS.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Extract ubntbox from the Unsigned Firmware<\/h2>\n\n\n\n

    For this step we need binwalk. <\/p>\n\n\n\n

    sudo apt install binwalk<\/code><\/pre>\n\n\n\n
    Next, extract the firmware with binwalk.<\/p>\n\n\n\n
    binwalk -e .\/XW.v5.6.3.bin<\/code><\/pre>\n\n\n\n
    It will extract the firmware to a folder named _XW.v5.6.3.28591.151130.1735.bin.extracted<\/code><\/p>\n\n\n\n
    We want the ubntbox<\/code> binary which is at the following location.<\/p>\n\n\n\n
    _XW.v5.6.3.28591.151130.1735.bin.extracted\/squashfs-root\/bin\/ubntbox<\/code><\/pre>\n\n\n\n
    <\/p>\n\n\n\n
    Move files (ubntbox, and unsigned firmware) to target radio<\/h2>\n\n\n\n
    \u2139\ufe0fscp and sftp most likely will not work. To get around this, you can set up a local web server like apache to serve the files, move the files into the \/var\/www\/html<\/code> directory and download to the radio with wget.  You may not be able to download executable files.  You can work around this by running chmod 644 ubntbox<\/code>, download with wget, then chmod +x ubntbox<\/code> to make it executable again.<\/p>\n\n\n\n
    On our computer, install and start the apache webserver<\/p>\n\n\n\n
    sudo apt install apache2\nsudo systemctl start apache2<\/code><\/pre>\n\n\n\n
    Next, copy ubntbox<\/code> and firmware files to \/var\/www\/html\/<\/code>. Replace the firmware name if different.<\/p>\n\n\n\n
    cp .\/ubntbox \/var\/www\/html\/\ncp .\/XW.v5.6.3.bin \/var\/www\/html\/<\/code><\/pre>\n\n\n\n
    On the radio, cd<\/code> to the \/tmp<\/code> directory.  Download ubntbox <\/code>and the firmware from your computer. Change the IP address to your webserver IP.<\/p>\n\n\n\n
    wget http:\/\/192.168.1.2\/ubntbox\nwget http:\/\/192.168.1.2\/XW.v5.6.3.bin<\/code><\/pre>\n\n\n\n
    Rename firmware to fwupdate.bin<\/code><\/p>\n\n\n\n
    mv XW.v5.6.3.bin fwupdate.bin<\/code><\/pre>\n\n\n\n
    Ensure ubntbox is executable.<\/p>\n\n\n\n
    chmod +x ubntbox<\/code><\/code><\/pre>\n\n\n\n
    <\/p>\n\n\n\n
    Upgrade “Downgrade” radio<\/h2>\n\n\n\n
    We are ready to update the radio.  <\/p>\n\n\n\n
    .\/ubntbox fwupdate.real -m<\/code><\/pre>\n\n\n\n
    You may encounter the following error.<\/p>\n\n\n\n
    .\/ubntbox: can't load library 'libevent_core-2.0.so.5'<\/code><\/pre>\n\n\n\n
    Since ubntbox is a dynamically linked binary, we may need to change the libevent library references to match the libevent libraries on the system.  You can find the current libevent libraries with find \/ | grep libevent<\/code><\/p>\n\n\n\n
    Example output.<\/p>\n\n\n\n
    XW.v5.6.15-sign.31612.170908.1440# find \/ | grep libevent\n\/lib\/libevent-2.1.so.6\n\/lib\/libevent-2.1.so.6.0.2\n\/lib\/libevent_core-2.1.so.6\n\/lib\/libevent_core-2.1.so.6.0.2\n\/lib\/libevent_extra-2.1.so.6\n\/lib\/libevent_extra-2.1.so.6.0.2\n\/lib\/libevent_openssl-2.1.so.6\n\/lib\/libevent_openssl-2.1.so.6.0.2<\/code><\/pre>\n\n\n\n
    Replace all libevent<\/code> references in ubntbox<\/code> with the correct versions on the current firmware.<\/p>\n\n\n\n
    You should now be able to downgrade to an unsigned firmware version.<\/p>\n\n\n\n
    <\/p>\n\n\n\n
    A few interesting notes.<\/p>\n\n\n\n