# Unpacking, modifying, repacking and flashing a firmware

I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a USB drive in and running an export through their UI. Ideally I'd like to modify it to export over FTP or NFS or something on a schedule.

You can upgrade the firmware on the device by putting the manufacturer provided upgrade image on a USB drive, plug it in, power on the device, then let it do it's thing to upgrade the firmware.

So I downloaded the firmware and ran binwalk on it. It was able to extract the roofs and I can see that it's running a flavor of embedded Linux. Here is the output that came with the files I extracted:


Scan Time:     2020-05-15 02:16:35
Target File:   /vagrant/rootfs-3531dv100
MD5 Checksum:  18a010179a1e5ae03c260ccc9609ddbc
Signatures:    404

--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0xCB1642A1, created: 2019-09-26 01:53:07, image size: 9761796 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x35F26A52, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: "hirootfs"
64            0x40            JFFS2 filesystem, little endian


In the files on the rootfs I found the init scripts that get run. Funny enough there's a call in there to start telnetd that's commented out. There's also a password for the root user set in /etc/passwd.

My question is this: if I modify the init script to uncomment that line so it runs telnetd at boot and generate a new password hash for the root user in /etc/password, how do I package it back up into a bootable image that I can drop onto a USB drive? Will that even work?

Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to figure out how to unpack/pack the image manually (maybe the verbose option will provide more info on the steps taken). I realize this is a generic sounding answer, but without knowing the exact firmware structure it is difficult to speculate.