Help editing & repacking (repackaging) .img wi-fi camera firmware

Question

I've been playing around with a cheapish ($15 on sale @ Wal-Mart) WiFi camera. It has a UART port which drops me into a shell from which I can launch telnetd and login easily. However, even though the filesystem is mounted readwrite, when I edit anything (i.e. init.d) and then reboot, the filesystem goes back to its previous state and telnetd doesn't run. :(

My long term goal is to figure out how to replace or edit the camera's streaming binary files so that it's not dependent upon a hosted cloud server to store and stream videos. (Currently to stream from outside my house, the video bounces off their cloud server; and I must use their proprietary app!) My short term (current) goal is to figure out how to repack the firmware and rewrite to the camera.

I was able to sniff a firmware update, and the firmware file is found at:

https://app.isecurityplus.com/seedonk/firmware/minions/A356_upgrade_00.10.008_20161107.img

and

$ file A356_upgrade_00.10.008_20161107.img 
A356_upgrade_00.10.008_20161107.img: u-boot legacy uImage, Imogen-X860-I, Linux/ARM, OS Kernel Image (Not compressed), 6709304 bytes, Mon Nov  7 02:33:58 2016, Load Address: 0x80008000, Entry Point: 0x80008000, Header CRC: 0x37467C4E, Data CRC: 0x93CBB08E

binwalk shows:

$ binwalk -Me A356_upgrade_00.10.008_20161107.img 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x37467C4E, created: 2016-11-07 02:33:58, image size: 6709304 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0x93CBB08E, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Imogen-X860-I"
10063         0x274F          xz compressed data
10284         0x282C          xz compressed data

<etc..snip.. eventually it creates a 0.cpio file>

$ cpio -idv < 0.cpio 
$ ls
0.cpio      dev     init        lib32       media       package     run  system     var
bin     etc     ko      libexec     mnt     proc        sbin        tmp
cpio-root   home        lib     linuxrc     opt     root        sys     usr

This community has been amazing and I've learned so much about RE. I've found a few posts on here about repackaging this sort of thing but I still have enough knowledge gap to fall short on knowing where my next step would be. Any guidance?

Many thanks!

Answer 1

However, even though the filesystem is mounted readwrite, when I edit anything (i.e. init.d) and then reboot, the filesystem goes back to its previous state and telnetd doesn't run.

It sounds like in this case in order for modifications to the file system to persist across device reboots, changes must be made to the firmware image itself and the modified image must then be written to memory using the "upgrade" facility provided by the device. Here is the general workflow according to the firmware mod kit archive page at Google Code:

1. Extract a firmware image into its component parts User makes desired
2. modification to the firmware's file system or web UI (webif)
3. Rebuild firmware
4. Flash modified firmware onto device and brick it (ha)

Since extraction does not seem to be a problem and since the file system format is cpio and not something more exotic, you may be able to use the GNU cpio utility and not need any special tools to modify the file system and then re-compress it.

The modified file system will likely need to be located at the offset in the rebuilt firmware image the bootloader expects it to be. For reference, devttys0 has a full walk-through in his article Firmware Patching: Fixing the TEW-632BRP.

Additional resources:

Firmware Modification Kit - Giving YOU the power to customize your firmware

bitsum forum

How to View, Modify and Recreate initrd.img.