#!/bin/sh
# This is a simple 'split out some of the components' script based on a manual inspection
# of the original 3516CV300_IMX307_BASE_W_8.1.30.4.FLS firmware.
# It looks like the firmware is organised as a simple manifest front section, giving name,
# location and size for each component.
# The driver behind extracting the components is to gain telnet access to a root shell
# by circumventing the Lucky787 TelnetSwitch password and then the telnet password.
#
# It looks like HeroSpeed have closed off the 'window of opportunity' where telnet was
# initially active on bootup until TelnetSwitch was activated, which had briefly allowed
# telnet access to swap out TelnetSwitch and use a cracked telnet password.
#
#
dd if=orig_fw.FLS of=libHi3516CV300IspDev.so bs=1 skip=$((0x0C18)) count=$((0xD140))
dd if=orig_fw.FLS of=Device.ini bs=1 skip=$((0xdd58)) count=$((0x41))
dd if=orig_fw.FLS of=DeviceIdentify bs=1 skip=$((0xdd99)) count=$((0x8ec8))
dd if=orig_fw.FLS of=LongSeStart bs=1 skip=$((0x016c61)) count=$((0x06ec))
dd if=orig_fw.FLS of=sdcard_hotplug.sh bs=1 skip=$((0x01734d)) count=$((0x025e))
dd if=orig_fw.FLS of=startapp bs=1 skip=$((0x0175ab)) count=$((0x013a))
dd if=orig_fw.FLS of=passwd bs=1 skip=$((0x0176e5)) count=$((0x26))
dd if=orig_fw.FLS of=passwd- bs=1 skip=$((0x01770b)) count=$((0x26))
dd if=orig_fw.FLS of=Ver.ini bs=1 skip=$((0x017731)) count=$((0x2d))
dd if=orig_fw.FLS of=config.ini bs=1 skip=$((0x01775e)) count=$((0x0747))
dd if=orig_fw.FLS of=isp.ini bs=1 skip=$((0x017ea5)) count=$((0x87c6))
#
# This is actually the start of the app SQUASHFS partition.
dd if=orig_fw.FLS of=app.squashfs bs=1 skip=$((0x02066b))
# Which we can unpack into the default folder.
unsquashfs app.squashfs
# End
