Or is it impossible, in principle?
From just starting with the firmware update file, I'd guess it's not possible.
It's guesswork what the .bin file holds.
It may be a whole flash image, for example, in which case it would need data that does not exist in that firmware update file such as the bootloader, the kernel, ptb etc.
Or the .bin file may be something quite different.
I've not looked at the specific firmware you've quoted above, but as an example of what's likely to be in the .fls file see below which I used on a recent hack of some IMX307-based cameras :
Code:
#!/bin/sh
# This is a simple 'split out some of the components' script based on a manual inspection
# of the original 3516CV300_IMX307_BASE_W_8.1.30.4.FLS firmware.
# It looks like the firmware is organised as a simple manifest front section, giving name,
# location and size for each component.
# The driver behind extracting the components is to gain telnet access to a root shell
# by circumventing the Lucky787 TelnetSwitch password and then the telnet password.
#
# It looks like HeroSpeed have closed off the 'window of opportunity' where telnet was
# initially active on bootup until TelnetSwitch was activated, which had briefly allowed
# telnet access to swap out TelnetSwitch and use a cracked telnet password.
#
#
dd if=orig_fw.FLS of=libHi3516CV300IspDev.so bs=1 skip=$((0x0C18)) count=$((0xD140))
dd if=orig_fw.FLS of=Device.ini bs=1 skip=$((0xdd58)) count=$((0x41))
dd if=orig_fw.FLS of=DeviceIdentify bs=1 skip=$((0xdd99)) count=$((0x8ec8))
dd if=orig_fw.FLS of=LongSeStart bs=1 skip=$((0x016c61)) count=$((0x06ec))
dd if=orig_fw.FLS of=sdcard_hotplug.sh bs=1 skip=$((0x01734d)) count=$((0x025e))
dd if=orig_fw.FLS of=startapp bs=1 skip=$((0x0175ab)) count=$((0x013a))
dd if=orig_fw.FLS of=passwd bs=1 skip=$((0x0176e5)) count=$((0x26))
dd if=orig_fw.FLS of=passwd- bs=1 skip=$((0x01770b)) count=$((0x26))
dd if=orig_fw.FLS of=Ver.ini bs=1 skip=$((0x017731)) count=$((0x2d))
dd if=orig_fw.FLS of=config.ini bs=1 skip=$((0x01775e)) count=$((0x0747))
dd if=orig_fw.FLS of=isp.ini bs=1 skip=$((0x017ea5)) count=$((0x87c6))
#
# This is actually the start of the app SQUASHFS partition.
dd if=orig_fw.FLS of=app.squashfs bs=1 skip=$((0x02066b))
# Which we can unpack into the default folder.
unsquashfs app.squashfs
# End
