TL;DR

1. Connect to WiFi
2. http://10.168.168.1:8080/goform/Setcardworkmode?workmode=0
3. Copy SD100-update.tar.gz to .update on SMB/Windows Share
4. http://10.168.168.1:8080/goform/upFirmWare
5. … PROFIT!

Many interesting features are available on http://10.168.168.1:8080/ which is served by /var/webs/webs binary, for instance http://10.168.168.1:8080/goform/Setcardworkmode (connects card reader to AR9331 SoC) or http://10.168.168.1:8080/goform/upFirmWare.

/goform/upFirmWare reads update tarball from .update/ directory on microSD card. (/etc/disk/.update) Sadly that directory is removed on mount by /sbin/lbd_mount, thus it has to be uploaded using SMB/Windows Network Shares. /goform/upFirmWare handler is at .text:0x00405E04 address in /var/webs/webs binary. It does multiple checks and then executes /etc/ath/update.sh which handles all the actual update. After that device is rebooted.

Expected update file format is:

SD100-whatevername.tar.gz    # SD100 has to match /etc/producttype
├── md5                      # md5sum of following tarball
└── intermediate-v1.1.tar.gz # v1.1 has to be greater than value in /etc/ver (1.0 in stock)
    ├── config
    ├── updated_file
    └── another_updated_file

config file format read by update.sh is as follows:

$filename:$work:$path

Where:
  $work == U - mkdir -p $path ; cp -f $filename $path
  $work == D - rm -rf $path/$filename
  $work == S - mtd_write $filename $path
  
Lines starting with # are ignored.

Example:
  testfile:U:/etc          # Copies testfile to /etc
  openwrt.bin:S:/dev/mtd3  # Flashes partition

upFirmWare response status codes: