Okay, so I think I've figured out the checksum for the original, available-from-ftp.networkeverywhere.com firmware (NWR04Bv1.02D1220.dlf). First, the file has two parts: there's what I'm calling bootloader (probably a huge misnomer), and then there's a gzip archive file called archive.bin.gz. splitgzip.pl will pull out the latter; simple math and dd will extract the former. The length of application.bin.gz is 743898 bytes; in hex, that's 0x000b59da. The sum of all the bytes in application.bin.gz is 0x05fc5b7c Both of these numbers can be found (allowing for little-endianness) at 12 bytes and 8 bytes from the end of bootloader, respectively:
| 00004ed0 | 02 00 00 00 da 59 0b 00 | 7c 5b fc 05 20 03 00 00 | |.....Y..|[.. ...| |
So this works for the NE firmware. However, loading this has caused problems before, so I'm reluctant to use it as a basis for uploading new firmware. And the pattern does not seem to hold for the Runtop firmware I've used to resuscitate the dead router; I still have to figure out how they're doing it. Finally, even if I do figure out how to get the checksum working, will this let me boot Linux? Sure, I can upload a new filesystem, but how will I hand control to it? No idea. Still...fun puzzle!