Firmware mod CN to US - GL.iNet Beryl 7
Published June 11, 2026 • Updated June 11, 2026
The GL-MT3600BE router is available in CN and global markets. The CN version is about half the price, but has certain features blocked. For example, the VPN features are blocked on the CN version. These can be unblocked by modifying the firmware.
(11/06/2026, Amazon UK €135 vs 淘寶 TaoBao €55)
If done correctly the process does not take long. The device will be functionally the exact same as the global version. There is a small risk of damaging the device from user error during this process.
Steps to modify and write firmware
The process involves connecting to the router over ssh, making a bin of the factory mtd, copying this back to your laptop, make the modification, copy the modified bin back to the router and then write it to the mtd. After a reboot, configuration that relies on this marker will read US instead of CN.
To begin, in a web browser navigate to the router page http://192.168.8.1 Login and in the Security > Admin Access, enable ssh. Open terminal or powershell and continue:
ssh root@192.168.8.1
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
root@GL-MT3600BE:~#
cat /proc/mtd
Identify the partition named "Factory",
on this device it was mtd3
copy the content of mtd3 to a bin file
dd if=/dev/mtd3 of=/tmp/factory.bin
8192+0 records in
8192+0 records out
transfer file to laptop
use the compatible -O flag as router does not have sftp
ash: /usr/libexec/sftp-server: not found
or install openssh sftp
scp -O root@192.168.8.1:/tmp/factory.bin .
md5sum factory.bin
9352af94d1ec6fd012b22a3259fc5a8e
now search for the marker we want to modify
grep -oba 'CN' factory.bin
The output was 16520,
search around that value to confirm it is the correct marker
xxd -s 16496 -l 48 factory.bin
00004080: ffff ffff ffff ffff 434E ffff ffff ffff ........CN......
xxd -s 23199 -l 48 factory.bin
This was unrelated data that happened to contain CN
make a backup
cp factory.bin factory.bin.orig
modify CN to US:
printf 'US' | dd of=factory.bin bs=1 seek=16520 conv=notrunc
Confirm write success:
xxd -s 16512 -l 16 factory.bin
00004080: ffff ffff ffff ffff 5553 ffff ffff ffff ........US......
md5sum factory.bin
ad406453d33fa680c7f7343b357ba49e
Copy the modified image back to the router.
scp -O factory.bin root@192.168.8.1:/tmp/
ssh into the router and write the image
mtd write /tmp/factory.bin Factory
Reboot and the router is now in US (global) mode.
Enabling unlocked features
With the router now in global mode, a flash of the router image will enable all features. Download it from the GL.iNet site, grab the latest beta or stable image. Flash whichever one you prefer by going to:
System > Upgrade > Firmware Local Upgrade
After the flash all router functionality is working.
You may also wish to go to the openwrt page and download the latest supported image. As of writing GL.iNet ships images with openwrt version 21. The latest supported openwrt version for the beryl7 is 25. The process to flash is the same. I recommend doing this as version 21 is EOL. It does mean that GL.iNets UI will be replaced by openwrts LuCI.
Links
When buying a router, check that it is compatible with OpenWrt to keep it updated and secure. https://toh.openwrt.org/?view=normal https://openwrt.org/toh/gl.inet/gl-mt3600be
Merge of 25.12 is pending for MediaTek chip GL-MT3600BE (as of 11/06/2026) https://github.com/openwrt/openwrt/pull/23368 Going to wait for release instead of compiling OpenWrt with the patch applied.
Background info on router design
The GL-MT3600BE device follows a standard modern embedded router architecture based on a MediaTek SoC paired with large capacity NAND flash. The persistent storage is not treated as a single filesystem like a PC disk. Instead it is a structured flash layout exposed through the Linux MTD subsystem. The underlying storage is SPI-NAND flash 512mb, much larger than earlier router generations that used 4–16 MB SPI NOR flash.
At the lowest level, the flash chip is divided into MTD partitions defined by the bootloader and device tree. These partitions represent fixed functional regions rather than flexible filesystems. These include bootloader stages (BL2, FIP, U-Boot), a factory/ calibration region, and a large firmware region. The factory partition is used to store immutable data like MAC addresses, wireless calibration values, and regulatory identifiers. This avoids duplicating data inside firmware images and allows it to persist across firmware upgrades.
The main firmware area is implemented using UBI (Unsorted Block Images), which is a flash translation layer designed for NAND. NAND flash requires block erasure and has bad-block management, so raw filesystems are not suitable. UBI abstracts these details and allows logical volumes to be created on top of the raw flash partition. Inside the UBI, OpenWrt creates two logical volumes: a read-only squashfs root filesystem and a writable data volume.
The read-only portion, often mounted as /rom, contains the compressed base system image. This is the actual OpenWrt firmware image provided by the vendor or build system. It includes the kernel, base utilities, init system, and default configuration templates. This image is immutable at runtime and is effectively what would be considered the “factory firmware” in traditional embedded systems. The writable overlay filesystem is mounted on /overlay using overlayfs, which merges changes on top of the read-only base system. This design allows package installation, configuration changes, and system modifications without altering the underlying firmware image.
This layered filesystem approach is common for OpenWrt devices and many Linux embedded systems. It differs from simpler router designs where firmware is a single squashfs partition with minimal or no overlay separation. In more constrained legacy devices, updates often replaced the entire flash region or used dual partition A/B schemes. UBI based OpenWrt systems provide greater flexibility, wear leveling, and resilience against power loss during writes.