This is an old revision of the document!
Below is a way to get an console access to a denon prime unit ( dont work with prime 4+ cause fw is now encrypted).
Be careful to what you do and changing FW may void your warranty.
Get the latest firmware for your unit : In my example i will use 3.4.0 version.
To make the custom image you will need :
- a raspberry pi ( or a device with linux & arm cpu).
- mpcimg from tkg website ( mpcimg )
- update image (usb) from denon prime ( DenonPrime Fw )
- static telnetd daemon ( telnetd )
On your raspberry, make mpcimg executable ( chmod +x ) and then run the following command to get information about the current file: ! Important ! note the compatible string (inmusic,jp11) and the device hex value (0x15e4d00c) and the version (3.4.0) – its needed for the repack
./mpcimg info PRIMEGO-3.4.0-Update.img
then to extract rootfs img to the following command :
./mpcimg extract PRIMEGO-3.4.0-Update.img PRIMEGO-3.4.0-Update_uncomp.img
Take a cofee …
Once done, you'll have the rootfs file.
While extracting, i have grab static telnetd, and now make a folder to mount the extracted rootfs file , and mount it (as root (sudo su))
mkdir mountprime mount rootfs_PRIMEGO-3.4.0-Update_uncomp.img.img mountprime
now you have the content of the prime in folder mountprime
copy telnet daemon to your mounted image,
cp telnetd-static mountprime/home
then try to chroot in your mounted folder with command
chroot mountprime
on my raspberry i get this error :
so to fix it i have to copy /bin/bash to my mounted dir ( /home/osmc/Prime/mountprime/bin ) and to copy its lib depency otherwise you'll get
so I did :
cp /bin/bash /home/osmc/Prime/mountprime/bin/ and cp /lib/arm-linux-gnueabihf/libtinfo.so.6 /home/osmc/Prime/mountprime/lib/
now i can chroot.
First, copy the telnetd daemon to /usr/Engine/scripts. As you are chrooted folder /home/osmc/Prime/mountprime/ is now your / .So you'll find the static telnet daemond file in /home To copy it do :
cp /home/telnetd-static /usr/Engine/Scripts/ # and go to /usr/Engine/Scripts/ cd /usr/Engine/Scripts/ # and make telnetd runnable chmod +x telnetd-static
Then to make it simple, when you poweron your prime, it launch the engine.service. This one launch the script /usr/Engine/Script/runengine. To launch the telnet daemon automatically we will add it to this script.
So edit the file with vi
vi runengine
and add the lines :
/usr/sbin/iptables -F /usr/Engine/Scripts/telnetd-static -p230
vi/vim quick memo: press escape 2 or 3 times to be in neutral mode press i to insert characters press u to undo what you did use keyboard arrow to navigate in neutral mode ( escape escape escape ) : press :w to write the file press :wq! to write the file and exit without confirmation press :q! to quit without saving and without confirmation
iptables -F will flush all iptable rules ( firewall rules )
telnetd-static -p230 will launch a telnetd server listening on port TCP/230
check that your path is good for the telnet daemon with
ls -l /usr/Engine/Scripts/telnetd-static
Okay that's for the backdoor. Then to be able to login it's needed to change root password.
always in chrooted mode, check that you are root with whoami command and change your password with passwd. i've put “prime” in my image.
# to check that your are user root : whoami # to change password : passwd
now exit the chroot mode, with exit command :
you're now back to your raspberry prompt/tree. if you want to be clean, remove bash binary from /home/osmc/Prime/mountprime/bin, and libtinfo.so.6 from /home/osmc/Prime/mountprime/lib (adapt with your path)
on my side i will let it there to see what's happen.
Next, unmount the mounted image file :
To see what is mounted you can do :
mount # or mount | grep PRI # change folder to be outside of the mount cd /home/osmc/Prime # unmount img file : umount /home/osmc/Prime/rootfs_PRIMEGO-3.4.0-Update_uncomp.img.img
Now it's time to repack image file.
Copy the binary/script “mpcimg” to a copy named “mpcimg_prime”.
root@osmc:/home/osmc/Prime# cp mpcimg mpcimg_prime
Change headers in the copied binary/script mpcimg_prime_ at line 161.
For prime JP11 ( prime GO ) change the lines
if mpc == "make-force":
print("Force image maker.")
tmpl_header = tmpl_header + "description = \"Akai Professional FORCE upgrade image\";\n"
tmpl_header = tmpl_header + "compatible = \"inmusic,ada2\";\n"
tmpl_header = tmpl_header + "inmusic,devices = <0x9e84040>;\n"
with
if mpc == "make-force":
print("Prime image maker.")
tmpl_header = tmpl_header + "description = \"Denon PRIME upgrade image\";\n"
tmpl_header = tmpl_header + "compatible = \"inmusic,jp11\";\n"
tmpl_header = tmpl_header + "inmusic,devices = <0x15e4d00c>;\n"
NB : you can put what you want in description, important thing is compatible and inmusic,devices
NB : compatible and devices are the string we had when getting info on the original file upper
Once done, repack the firwmare with command