Trying to customize h264dvr firmware with FMK

[noobsaibot]

Hi there, people.

Been trying to mod a default firmware just because if its splash screen logo, which is incredibly bright and almost blinds me everytime I turn it on at night.

I have tried to use the Firmware Mod Kit to extract the firmware from the binary file.
Instead of coming across a squash or cram filesystem, I ended up with some zip compressed files. Here's some output:

Scan Time:     2015-08-17 23:28:44
Signatures:    193
Target File:   /home/king/fmk/myfirmware.bin 
MD5 Checksum:  [omitted]

DECIMAL       HEX           DESCRIPTION
-------------------------------------------------------------------------------------------------------
0             0x0           Zip archive data, at least v2.0 to extract, compressed size: 2118527, uncompressed size: 2154560, name: "custom-x.cramfs.img"  
2118597       0x2053C5      Zip archive data, at least v2.0 to extract, compressed size: 2928495, uncompressed size: 2932800, name: "user-x.cramfs.img"  
5047160       0x4D0378      Zip archive data, at least v2.0 to extract, compressed size: 2424987, uncompressed size: 2445376, name: "romfs-x.cramfs.img"  
7472216       0x720458      Zip archive data, at least v2.0 to extract, compressed size: 18725, uncompressed size: 20544, name: "logo-x.cramfs.img"  
7491009       0x724DC1      Zip archive data, at least v2.0 to extract, compressed size: 141, uncompressed size: 354, name: "InstallDesc"  
7491611       0x72501B      End of Zip archive 

Extracting 0 bytes of zip header image at offset 0
ERROR: No supported file system found! Aborting...

If I unzip the binary file, I can get FMK to extract the only file I'd really like to change: logo-x.cramfs.img:


king@castle:~/fmk$ ./extract-firmware.sh logo-x.cramfs.img

Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake

Preparing tools ...
Scanning firmware...

Scan Time:     2015-08-18 00:19:50
Signatures:    193
Target File:   /home/king/fmk/logo-x.cramfs.img
MD5 Checksum:  7bdcd6c61944be8860b70f9f796b3fb7

DECIMAL       HEX           DESCRIPTION
-------------------------------------------------------------------------------------------------------
0             0x0           uImage header, header size: 64 bytes, header CRC: 0x94AD77F7, created: Sun May 26 23:46:43 2013, image size: 20480 bytes, Data Address: 0x10770000, Entry Point: 0x10780000, data CRC: 0x8EDB113D, OS: Linux, CPU: ARM, image type: Standalone Program, compression type: gzip, image name: "linux"
64            0x40          CramFS filesystem, little endian size 20480 version #2 sorted_dirs CRC 0xbda508c, edition 0, 5 blocks, 2 files  

Extracting 64 bytes of uimage header image at offset 0
Extracting cramfs file system at offset 64
Extracting CramFS file system...

Now I'm not sure how to proceed. build-firmware script won't mount it back to an .img file, and even if it does, I can't repack the initial binary as well because I had to manually extract it instead of doing via extract-firmware script.

Thoughts? I don't really want to brick my dvr, almost giving this up. Any helpful comments are largely appreciated.

Peace

 

[alastairstevenson]

It looks like you have multiple cramfs images zipped up into a .bin file in the firmware.
And you have extracted what looks like a very small bootable Linux image from the logo-x.cramfs.img
What files were extracted by FMK from that? Use 'file *' to guess what they are.

If you really do find and change a graphic logo image somewhere amongst the extracted contents of a cramfs, you should be able to re-assemble the cramfs with 'mkfs.cramfs -v input_folder_name output_name.img
Then presumably you can just zip up the components again into the .bin file.
But I'm not sure about the 64-byte header in the .img files that's mentioned - is that some sort of customised extra that's used by the firmware loader? You may need to keep that at the head of the new assembled cramfs.img

Having unzipped the original firmware files into multiple cramfs files - you should simply be able to mount them to see and extract the contents, without using FMK.
Unless you have to strip the 64-byte header first with your favourite hex editor.