0

I'm trying to reverse engineer an appliance based on RPI2, and I would like to get a root shell on the system.

After dumping the SD I noticed that there's no rootfs partition (it exists but it's empty), and a all the needed files are stored ramdisk inside the boot image.

There's no SSH, UART and not even video console. My idea was to unpack, patch and repack the ramdisk, but it appears to be more difficult than expected: the cpio/gz archives, once repacked (even w/o modifications), have not the same size of the original ones and putting the pieces together results in an unbootable image.

I tried forcing kernel to use an external ramdisk (througth cmdline.txt and config.txt), but it ignores it and keeps using the embedded one.

Suggestions?

  • Welcome to Raspberry Pi SE. Be sure to take the tour to see how this works and to earn a badge: raspberrypi.stackexchange.com/Tour – SDsolar Apr 29 '17 at 8:20
  • What filesystems are used on the image? Are they compressed? A Raspberry Pi usually boot from a fat filesystem that must be the first partition. Do you see that? – Ingo May 28 at 16:43
0

If you are unable to get even an unmodified, but repacked initramfs file to boot, and considering there does not appear to be console output (if I understand your question), you may be dealing with a developer very determined not to let you in:

  • The initramfs may need to be digitally signed, or at least the hash is recorded and verified, or even as simple as the timestamp. No match, no boot.
  • The kernel can easily be instructed to ignore any parameters from cmdline.txt, meaning you can't drop in another initramfs.
  • If you can't get this thing to boot with only minor changes, but it boots without them, it may be you're trying to break into a system you shouldn't be trying to break into.

Have you contacted the developer, and are you actually authorised to do what you're trying to do?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.