1

I've been trying to figure out how to modify the firmware on a DVR I bought for cheap recently. The built in software isn't great and doesn't offer any option for exporting video other than plugging a USB drive in and running an export through their UI. Ideally I'd like to modify it to export over FTP or NFS or something on a schedule.

You can upgrade the firmware on the device by putting the manufacturer provided upgrade image on a USB drive, plug it in, power on the device, then let it do it's thing to upgrade the firmware.

So I downloaded the firmware and ran binwalk on it. It was able to extract the roofs and I can see that it's running a flavor of embedded Linux. Here is the output that came with the files I extracted:


Scan Time:     2020-05-15 02:16:35
Target File:   /vagrant/rootfs-3531dv100
MD5 Checksum:  18a010179a1e5ae03c260ccc9609ddbc
Signatures:    404

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0xCB1642A1, created: 2019-09-26 01:53:07, image size: 9761796 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x35F26A52, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: "hirootfs"
64            0x40            JFFS2 filesystem, little endian

In the files on the rootfs I found the init scripts that get run. Funny enough there's a call in there to start telnetd that's commented out. There's also a password for the root user set in /etc/passwd.

My question is this: if I modify the init script to uncomment that line so it runs telnetd at boot and generate a new password hash for the root user in /etc/password, how do I package it back up into a bootable image that I can drop onto a USB drive? Will that even work?

Improve this question

1 Answer 1

Reset to default
2

Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to figure out how to unpack/pack the image manually (maybe the verbose option will provide more info on the steps taken). I realize this is a generic sounding answer, but without knowing the exact firmware structure it is difficult to speculate.

You'll also need to watch out for any checksums/hashes that will need to be modified if you change anything.

However, you could brick the device if you try to flash improper firmware. It may be a good idea to see if it supports any firmware recovery modes, or if there are hardware debug ports on the board to assist in recovery.

Improve this answer
2
  • I'm pretty new to reverse engineering in general, so forgive me if this is a naive question. There's an RS-485 port on the back of it. Is that a good candidate for a serial debugging port or should I be looking for something else?
    – jvergeldedios
    May 15, 2020 at 20:25
  • 1
    @jvergeldedios if the serial port lets you do anything during the boot process, that's a good sign. Although I'm not sure what RS-485 is used for. There's probably something better on the inside of the device. But that likely involves soldering and having the correct tools to interface
    – multithr3at3d
    May 16, 2020 at 2:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.