GL-MG1300 region-switching script — GitHub Gist.

I bought a GL.iNet Mango 2 (GL-MG1300) travel router, started setting it up, and noticed a CN badge in the interface. It turned out to be a unit for the Chinese market, with regional restrictions. That hadn’t been part of the plan.

I looked into how people had handled this on other GL.iNet routers. There were examples of changing the country code in the factory flash partition. That gave me somewhere to start beyond the settings page or firmware image.

I didn’t copy the commands straight across. Those instructions were for different models, and their layouts differ. The factory partition also holds device-specific factory data. Writing to the wrong offset is a good way to turn a small annoyance into a broken router.

Finding CN

On my MG1300 running firmware 4.10.1, factory was /dev/mtd2, a 64 KiB partition. I made a full backup and copied it to my computer:

dd if=/dev/mtd2 of=/tmp/mg1300-factory-backup.bin bs=65536 count=1

That device path matches my partition layout. Check /proc/mtd before repeating it. Also, copy the backup off the router: anything in /tmp disappears on reboot.

There was no country string in the first 256 bytes. Searching the whole partition found a standalone CN at 0x4088:

00004080  00 00 00 00 00 00 00 00  43 4e 00 00 00 00 00 00
                                      C  N

There were other matches inside longer strings. A global search-and-replace would have been a terrible idea.

Checking the offset

Two familiar letters in a dump weren’t enough. I checked how the firmware reads the country. In /lib/functions/gl_util.sh, I found:

get_country_code() {
    uci -q get board_special.hardware.country_code ||
        cat /proc/gl-hw-info/country_code
}

My router had no configuration override. /proc/gl-hw-info/country_code returned CN.

The direct confirmation came from the device tree. This property:

/sys/firmware/devicetree/base/gl_hw/factory_data/country_code

contained two null-separated strings:

factory
0x4088

The firmware itself specified the partition and offset used to read the country. That was enough to prepare the change. There is a separate firmware_type field nearby, at 0x4090; I left it alone.

Writing the change

I made a patched copy of the partition and checked that exactly two bytes differed: 0x4088 and 0x4089. The remaining 65,534 bytes were unchanged.

Then I wrote the image, read the entire partition back, and compared it with the prepared file. It matched. After a reboot, the CN badge disappeared and the features I needed worked.

While looking through the readable firmware scripts, I found several explicit checks for CN, with a shared branch for other countries. One example selects the Chinese or international server for diagnostic log uploads. Finding that code doesn’t mean the router continuously uploads logs; I hadn’t checked what triggers the upload.

It also doesn’t prove that any two letters will enable every feature of the international version. Some of the relevant logic is compiled, and I didn’t reverse-engineer all of it.

The script

I put the steps into a GL-MG1300 shell script on GitHub Gist. Run it on the router:

sh mg1300-region.sh             # show the current region
sh mg1300-region.sh --list      # list potential country codes
sh mg1300-region.sh DE          # dry-run a change to DE
sh mg1300-region.sh DE --write  # apply it

DE is an example, not a recommendation to select Germany wherever you use the router. The country code can affect Wi-Fi channels and transmit power.

Before writing, the script checks the model, the device-tree declaration of the offset, and the partition size. It saves a backup, then reads back and compares the entire partition after the write. Rebooting is manual.

The candidate list comes from the router’s Wi-Fi regulatory database. It isn’t a list of tested unlocks: a regulatory entry doesn’t guarantee that every firmware component handles that country the same way. There is no EU entry; European countries have individual codes.

If you try this, save your own factory backup on another computer first. Don’t substitute someone else’s dump. Don’t publish yours either: mine contained certificates and device data.

Reports about other GL.iNet models gave me a useful starting point. But I verified 0x4088 on a GL-MG1300 running firmware 4.10.1. For another model, start by checking its layout and how the firmware reads the country.