Here it is folks! Unlocked BT Voyager 2091 Firmware!

Big thanks to Alessio for his fine work in figuring this out, and to Paulo
for putting this firmware together, and being the first to give it the AOK.
[using XVI32 <http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm>]

This has been tried and tested and works, though please understand, if you
upload this firmware to your 2091, you do so completely at your own risk. This
firmware comes with no warrantees whatsoever, certainly not from its original
creators.

have fun!

;o)
(or

@ corz.org SUNDAY May 21, 2006

original info..
[from: http://corz.org/network/routers/Voyager/other.bt.voyager.routers.php]

Hi,
I tried to put the Dynalink 1050W <http://www.dynalink.com.au/firmware.htm?prod=RTA1025W>
firmware in my BT voyager 2091 Wireless router - they both use the BCM6348 Chipset (check
the brochure http://www.dynalink.com.au/modemsadsl_cur.htm?prod=RTA1025W).

I did this pretty much what I found on http://skaya.enix.org/wiki/FirmwareFormat:

From the Voyager2091 - cfe-voyager2091_btr-v301m-a2pb018c1 I took from the very beginning
of the file

36 00 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 56 32 30 39 31 5F 42 42 00 00 00 00 00 00 00 00 31 00

and copied into cfe-rta1025wnz-v328q_a2pb01. The first section of the firmware contains
data about the vendor: now the Dynalink 1050w "sounds" like a Voyager 2091.

In the modified Dynalink 1050W firmware, I was not keen on touching the following section
which contains size/address of loader/rootfs (this could make your router unusable!)
I calculated the checksum with flipped bits:

bytes 236-239: contains the checksum from byte 0 to byte 255 - the checksum is 43 6C F1 22

byte 216-219: contains the checksum from byte 256 to the end of file - the checksum is 82 12 7F 96

Then I saved the firmware and uploaded to the Voyager via web interface, the upload went
fine and the Voyager rebooted, it went up without any problem