change pi password on img before first boot, ssh [duplicate]

Question

I want to be able to change the default pi:raspberry credentials on the image before first boot of a PiZero WH over the internet (phone hotspot, no home network). The default is a weak spot. I want to remove the vulnerability before the Pi hits the air (bad experience).

David Maitland's protocol to configure wifi networking and enable SSH works well for me.

However, I can't figure the password issue.

I've tried mounting with offsets and chroot into the rootfs, but:

x@flattest-clam:/media/x/ROOTFS$ chroot /media/x/ROOTFS passwd pi chroot: cannot change root directory to '/media/x/ROOTFS': Operation not permitted x@flattest-clam:/media/x/ROOTFS$ sudo chroot /media/x/ROOTFS passwd pi chroot: failed to run command ‘passwd’: Exec format error x@flattest-clam:/media/x/ROOTFS$ sudo chroot /media/x/ROOTFS /etc/passwd pi chroot: failed to run command ‘/etc/passwd’: Permission denied

Trying something similar with the image dd'd to SD card produced chroot: failed to run command ‘/bin/bash’: Exec format error

I've seen posts that say this indicates the environment is different between host and target, (not entirely sure what that means, specifically).

On the other hand, another post suggested that /bin/bash requires libraries to work that may not exist on the target filesystem, so I tried and failed (my noob mistake I think in typing the command) to cp /lib and /lib64 but it said it couldn't write and there was no space on the image (seemed odd).

I'm quite confused now - this is my first foray into chroot and I don't think I'm using it right. However, my objective is to change the password - that's the priority.

Is this a fool's quest? Is chroot the right way to go about it? Am I not setting permissions correctly (or at all, at the moment) - do I use my host or the Pi's credentials, btw?

Or does this all not work because /etc/passwd and its shadow are different and special?