That works, thanks.
Can I decrypt start.sh, modify it to enable ssh/disable psh, recrypt (using hikpack) and reassemble an upgrade file, or will my NVR (3.4.62) reject it as not beeing encrypted/signed with the correct key?
I put a serial cable on it hoping to get a full uboot console access...