Patch a RPI image to get a root shell

Question

I'm trying to reverse engineer an appliance based on RPI2, and I would like to get a root shell on the system.

After dumping the SD I noticed that there's no rootfs partition (it exists but it's empty), and a all the needed files are stored ramdisk inside the boot image.

There's no SSH, UART and not even video console. My idea was to unpack, patch and repack the ramdisk, but it appears to be more difficult than expected: the cpio/gz archives, once repacked (even w/o modifications), have not the same size of the original ones and putting the pieces together results in an unbootable image.

I tried forcing kernel to use an external ramdisk (througth cmdline.txt and config.txt), but it ignores it and keeps using the embedded one.

Suggestions?

Answer 1

If you are unable to get even an unmodified, but repacked initramfs file to boot, and considering there does not appear to be console output (if I understand your question), you may be dealing with a developer very determined not to let you in:

• The initramfs may need to be digitally signed, or at least the hash is recorded and verified, or even as simple as the timestamp. No match, no boot.
• The kernel can easily be instructed to ignore any parameters from cmdline.txt, meaning you can't drop in another initramfs.
• If you can't get this thing to boot with only minor changes, but it boots without them, it may be you're trying to break into a system you shouldn't be trying to break into.

Have you contacted the developer, and are you actually authorised to do what you're trying to do?