Below is a way to get an console access to a denon prime unit ( dont work with prime 4+ cause fw is now encrypted).
Be careful to what you do and changing FW may void your warranty.
Get the latest firmware for your unit : In my example i will use 3.4.0 version.
To make the custom image you will need :
- a raspberry pi ( or a device with linux & arm cpu).
- mpcimg from tkg website ( mpcimg )
- update image (usb) from denon prime ( DenonPrime Fw )
- static telnetd daemon ( telnetd )
On your raspberry, make mpcimg executable ( chmod +x ) and then run the following command to get information about the current file: ! Important ! note the compatible string (inmusic,jp11) and the device hex value (0x15e4d00c) and the version (3.4.0) – its needed for the repack
./mpcimg info PRIMEGO-3.4.0-Update.img
then to extract rootfs img to the following command :
./mpcimg extract PRIMEGO-3.4.0-Update.img PRIMEGO-3.4.0-Update_uncomp.img
Take a cofee …
Once done, you'll have the rootfs file.
While extracting, i have grab static telnetd, and now make a folder to mount the extracted rootfs file , and mount it (as root (sudo su))
mkdir mountprime mount rootfs_PRIMEGO-3.4.0-Update_uncomp.img.img mountprime
now you have the content of the prime in folder mountprime
copy telnet daemon to your mounted image,
cp telnetd-static mountprime/home
then try to chroot in your mounted folder with command
chroot mountprime
on my raspberry i get this error :
so to fix it i have to copy /bin/bash to my mounted dir ( /home/osmc/Prime/mountprime/bin ) and to copy its lib depency otherwise you'll get
so I did :
cp /bin/bash /home/osmc/Prime/mountprime/bin/ and cp /lib/arm-linux-gnueabihf/libtinfo.so.6 /home/osmc/Prime/mountprime/lib/
now i can chroot.
First, copy the telnetd daemon to /usr/Engine/scripts. As you are chrooted folder /home/osmc/Prime/mountprime/ is now your / .So you'll find the static telnet daemond file in /home To copy it do :
cp /home/telnetd-static /usr/Engine/Scripts/ # and go to /usr/Engine/Scripts/ cd /usr/Engine/Scripts/ # and make telnetd runnable chmod +x telnetd-static
Then to make it simple, when you poweron your prime, it launch the engine.service. This one launch the script /usr/Engine/Script/runengine. To launch the telnet daemon automatically we will add it to this script.
So edit the file with vi
vi runengine
and add the lines :
/usr/sbin/iptables -F /usr/Engine/Scripts/telnetd-static -p230
vi/vim quick memo: press escape 2 or 3 times to be in neutral mode press i to insert characters press u to undo what you did use keyboard arrow to navigate in neutral mode ( escape escape escape ) : press :w to write the file press :wq! to write the file and exit without confirmation press :q! to quit without saving and without confirmation
iptables -F will flush all iptable rules ( firewall rules )
telnetd-static -p230 will launch a telnetd server listening on port TCP/230
check that your path is good for the telnet daemon with
ls -l /usr/Engine/Scripts/telnetd-static
Okay that's for the backdoor. Then to be able to login it's needed to change root password.
always in chrooted mode, check that you are root with whoami command and change your password with passwd. i've put “prime” in my image.
# to check that your are user root : whoami # to change password : passwd
now exit the chroot mode, with exit command :
you're now back to your raspberry prompt/tree. if you want to be clean, remove bash binary from /home/osmc/Prime/mountprime/bin, and libtinfo.so.6 from /home/osmc/Prime/mountprime/lib (adapt with your path)
on my side i will let it there to see what's happen.
Next, unmount the mounted image file :
To see what is mounted you can do :
mount # or mount | grep PRI # change folder to be outside of the mount cd /home/osmc/Prime # unmount img file : umount /home/osmc/Prime/rootfs_PRIMEGO-3.4.0-Update_uncomp.img.img
Now it's time to repack image file.
Copy the binary/script “mpcimg” to a copy named “mpcimg_prime”.
root@osmc:/home/osmc/Prime# cp mpcimg mpcimg_prime
Change headers in the copied binary/script mpcimg_prime_ at line 161.
For prime JP11 ( prime GO ) change the lines
if mpc == "make-force":
print("Force image maker.")
tmpl_header = tmpl_header + "description = \"Akai Professional FORCE upgrade image\";\n"
tmpl_header = tmpl_header + "compatible = \"inmusic,ada2\";\n"
tmpl_header = tmpl_header + "inmusic,devices = <0x9e84040>;\n"
with
if mpc == "make-force":
print("Prime image maker.")
tmpl_header = tmpl_header + "description = \"Denon PRIME upgrade image\";\n"
tmpl_header = tmpl_header + "compatible = \"inmusic,jp11\";\n"
tmpl_header = tmpl_header + "inmusic,devices = <0x15e4d00c>;\n"
NB : you can put what you want in description, important thing is compatible and inmusic,devices
NB : compatible and devices are the string we had when getting info on the original file upper
Once done, repack the firwmare with command
./mpcimg_prime make-force rootfs_PRIMEGO-3.4.0-Update_uncomp.img.img rootfs_PRIMEGO-3.4.0-UpdateTLN 3.4.0
Take another coffee ! it may be longer to repack, depending of the performance of your arm chip.
New image is there, ready to be uploaded on Hardware.
Download it on your computer, put you prime in update mode.
Take the Windows Setup Upgrade image from denon on their site (Prime+GO+3.4.0+Updater.exe). open it with 7zip, and extract all the files except update.img to a dedicated folder. in this folder put your new created file file rootfs_PRIMEGO-3.4.0-UpdateTLN and rename it to update.img.
Like below :
Connect Prime to your computer via USB, and launch FirmwareUpdater.exe, then if your prime is detected you can run update.
Once update done, PrimeGo reboot with new version.
Now launch a putty, put ip of the prime with port 230.
login with root / pwd : prime
Tadaaaa your in !
To finish, i tried to enable sshd to be run at the startup in the firmware but each times i tried , it failed. I should ask on AkaiF/MPC Moddings Groups how it's done, however with telnet it's working well. Of course after the telnet connection you can launch ssh
## edit /etc/ssh/shd_config ## put PasswordAuthentication yes ## put PermitRootLogin yes ## and then launch ssh daemon systemctl start sshd
As we put telnet in the prime service, if you restart or stop prime service it will kill your telnetd. So launch an ssh session before restarting/stopping engine.service via systemctl otherwise you'll loose control of the beast.
If needed here is my img file , tested on my prime go and working, however use it at your own risk i cannot be responsible for bad usage. http://dnttalo.cluster029.hosting.ovh.net/Akai/PrimeGOTln/