Eventually I decided to do the sensible thing of having a play with the software already installed on the device and found a firmware update function. It doesn't take arbitrary files though - it will only download files from Telstra. I guess 1.15.C is the latest version, as this function refuses to do anything.

Reluctantly, I troop off to Cashies again and grab another two devices. One appears to have a dead touchscreen, so I put that to the side for now (You'll see more of it later, it turned out to be the biggest curveball I'd seen in this little exercise). The other has an old version of the firmware installed. Bingo.

I hook up a USB wireless dongle to my laptop and route the traffic across the two interfaces, then set up Wireshark. WS shows me that the device is talking to a TR69 server, designed to push down settings for things like routers automatically, without having to get the user involved. TR69 tells my device to download and flash a file located on one of Telstra's servers. I rip the cable out to stop the process, then have a look myself. Five minutes later I am the proud owner of one 001.015.003.bin file fresh from the oven.

Next up, disassembling our firmware package.