Below is a way to get an console access to a denon prime unit ( dont work with prime 4+ cause fw is now encrypted).

Be careful to what you do and changing FW may void your warranty. 

Get the latest firmware for your unit :
In my example i will use 3.4.0 version. 

To make the custom image you will need : 

  - a raspberry pi ( or a device with linux & arm cpu). 
  - mpcimg from tkg website ( [[https://github.com/TheKikGen/MPC-LiveXplore/tree/master/imgmaker|mpcimg]] ) 
  - update image (usb) from denon prime ( [[https://enginedj.com/downloads|DenonPrime Fw]] ) 
  - static telnetd daemon ( [[https://github.com/therealsaumil/static-arm-bins/blob/master/telnetd-static|telnetd]] ) 




{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_1.JPG}}

On your raspberry, make mpcimg executable ( chmod +x ) and then run the following command to get information about the current file: 
**! Important ! note the compatible string (inmusic,jp11)  and the device hex value (0x15e4d00c) and the version (3.4.0) -- its needed for the repack ** 

<code>
./mpcimg info PRIMEGO-3.4.0-Update.img
</code>

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_2.JPG}}




then to extract rootfs img to the following command : 
<code>
./mpcimg extract PRIMEGO-3.4.0-Update.img PRIMEGO-3.4.0-Update_uncomp.img
</code>

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_3.JPG}}

Take a cofee ... 
 
Once done, you'll have the rootfs file. 

While extracting, i have grab static telnetd, and now make a folder to mount the extracted rootfs file , and mount it (as root (sudo su)) 

<code>
mkdir mountprime
mount rootfs_PRIMEGO-3.4.0-Update_uncomp.img.img mountprime
</code>

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_4.JPG}}

now you have the content of the prime in folder mountprime

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_5.JPG}}

copy telnet daemon to your mounted image, 
<code>
cp telnetd-static mountprime/home
</code>

then try to chroot in your mounted folder with command
<code>
chroot mountprime
</code>

on my raspberry i get this error :

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_6.JPG}}

so to fix it i have to copy /bin/bash to my mounted dir ( /home/osmc/Prime/mountprime/bin ) 
and to copy its lib depency otherwise you'll get

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_7.JPG}}

so I did : 
<code>
cp /bin/bash /home/osmc/Prime/mountprime/bin/
and
cp /lib/arm-linux-gnueabihf/libtinfo.so.6 /home/osmc/Prime/mountprime/lib/
</code>

now i can chroot. 

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_8.JPG}}


First, copy the telnetd daemon to /usr/Engine/scripts.
As you are chrooted folder /home/osmc/Prime/mountprime/ is now your / .So you'll find the static telnet daemond file in /home  
To copy it do : 

<code>
cp /home/telnetd-static /usr/Engine/Scripts/
# and go to /usr/Engine/Scripts/
cd /usr/Engine/Scripts/
# and make telnetd runnable
chmod +x telnetd-static
</code>

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_9.JPG}}

Then to make it simple, when you poweron your prime, it launch the engine.service.
This one launch the script /usr/Engine/Script/runengine. 
To launch the telnet daemon automatically we will add it to this script. 

So edit the file with vi

<code>
vi runengine
</code>

and add the lines : 
<code>
/usr/sbin/iptables -F
/usr/Engine/Scripts/telnetd-static -p230
</code>

<code>
vi/vim quick memo: 
press escape 2 or 3 times to be in neutral mode
press i to insert characters
press u to undo what you did 
use keyboard arrow to navigate

in neutral mode ( escape escape escape ) :
press :w to write the file 
press :wq! to write the file and exit without confirmation
press :q! to quit without saving and without confirmation
</code>
 

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_10.JPG}}


iptables -F will flush all iptable rules ( firewall rules ) 

telnetd-static -p230 will launch a telnetd server listening on port TCP/230

check that your path is good for the telnet daemon with 

<code>
ls -l /usr/Engine/Scripts/telnetd-static
</code>

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_11.JPG}}

Okay that's for the backdoor. 
Then to be able to login it's needed to change root password.

always in chrooted mode, check that you are root with whoami command and change your password with passwd.
i've put "prime" in my image. 

<code>
# to check that your are user root : 
whoami
# to change password : 
passwd
</code>

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_12.JPG}}

now exit the chroot mode, with exit command : 

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_13.JPG}}

you're now back to your raspberry prompt/tree.
if you want to be clean, remove bash binary from /home/osmc/Prime/mountprime/bin, and libtinfo.so.6 from /home/osmc/Prime/mountprime/lib
(adapt with your path) 

on my side i will let it there to see what's happen.

Next, unmount the mounted image file : 

To see what is mounted you can do : 
<code>
mount
# or 
mount | grep PRI
# change folder to be outside of the mount
cd /home/osmc/Prime
# unmount img file :
umount /home/osmc/Prime/rootfs_PRIMEGO-3.4.0-Update_uncomp.img.img
</code>

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_14.JPG}}

Now it's time to repack image file.

Copy the binary/script "mpcimg" to a copy named "mpcimg_prime".
<code>
root@osmc:/home/osmc/Prime# cp mpcimg mpcimg_prime
</code>

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_15.JPG}}



Change headers in the copied binary/script mpcimg_prime_ at line 161. 

For prime JP11 ( prime GO ) change the lines
<code>
    if mpc == "make-force":
        print("Force image maker.")
        tmpl_header = tmpl_header + "description = \"Akai Professional FORCE upgrade image\";\n"
        tmpl_header = tmpl_header + "compatible = \"inmusic,ada2\";\n"
        tmpl_header = tmpl_header + "inmusic,devices = <0x9e84040>;\n"
</code>

with

<code>
    if mpc == "make-force":
        print("Prime image maker.")
        tmpl_header = tmpl_header + "description = \"Denon PRIME upgrade image\";\n"
        tmpl_header = tmpl_header + "compatible = \"inmusic,jp11\";\n"
        tmpl_header = tmpl_header + "inmusic,devices = <0x15e4d00c>;\n"
</code>

**NB : you can put what you want in description, important thing is compatible and inmusic,devices**

**NB : __compatible and devices__ are the string we had when getting info on the original file upper**


Once done, repack the firwmare with command 

<code>
./mpcimg_prime make-force rootfs_PRIMEGO-3.4.0-Update_uncomp.img.img rootfs_PRIMEGO-3.4.0-UpdateTLN 3.4.0
</code>


{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_16.JPG}}

Take another coffee ! it may be longer to repack, depending of the performance of your arm chip. 

   
New image is there, ready to be uploaded on Hardware.
{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_17.JPG}}

Download it on your computer, put you prime in update mode. 

Take the Windows Setup Upgrade image from denon on their site (Prime+GO+3.4.0+Updater.exe).
open it with 7zip, and extract all the files **except update.img** to a dedicated folder.
in this folder put your new created file file rootfs_PRIMEGO-3.4.0-UpdateTLN and rename it to update.img.

Like below :



Connect Prime to your computer via USB, and launch FirmwareUpdater.exe, then if your prime is detected you can run update.

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_19.JPG}}
{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_20.JPG}}

Once update done, PrimeGo reboot with new version.


Now launch a putty, put ip of the prime with port 230. 

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_21.JPG}}

login with root / pwd : prime 

Tadaaaa your in ! 

{{http://dnttalo.cluster029.hosting.ovh.net/Pictures/PrimeGo_Console_22.JPG}}


To finish, i tried to enable sshd to be run at the startup in the firmware but each times i tried , it failed.
I should ask on AkaiF/MPC Moddings Groups how it's done, however with telnet it's working well.
Of course after the telnet connection you can launch ssh 

<code>
## edit /etc/ssh/shd_config 
## put PasswordAuthentication yes 
## put PermitRootLogin yes
## and then launch ssh daemon
systemctl start sshd
</code>

As we put telnet in the prime service, if you restart or stop prime service it will kill your telnetd.
So launch an ssh session before restarting/stopping engine.service via systemctl otherwise you'll loose control of the beast.
 

If needed here is my img file , tested on my prime go and working, however use it at your own risk i cannot be responsible for bad usage.
[[http://dnttalo.cluster029.hosting.ovh.net/Akai/PrimeGOTln/]]