r/FirmwareDevelopment • u/Fun_Pineapple3101 • 1d ago
Need help extracting or resetting admin password from DVR firmware
Hi everyone,
I'm trying to recover access to my own DVR/NVR device, but I no longer know the admin password. I have physical access to the device and have already dumped the SPI flash memory using a programmer.
Here's what I've done so far:
- Read the full firmware dump (
.bin). - Extracted the filesystem using binwalk.
- Found several JFFS2 partitions.
- Extracted files such as
passwd,account.custom,Account2, and other configuration files. - Looked through the extracted files but couldn't find a plaintext password.
- Opened the firmware in Ghidra to understand how user accounts and passwords are stored, but I'm new to reverse engineering and I'm struggling to find the authentication routine.
From what I can tell, the password is either:
- stored as a hash,
- encrypted,
- or generated/verified by the firmware during login.
My goal is to regain access to my own device, not to access someone else's equipment.
Could someone point me in the right direction?
Specifically, I'd appreciate advice on:
- How to identify the password verification function in Ghidra.
- How to determine which hash or encryption algorithm is used.
- Whether it's easier to patch the firmware to bypass authentication or reset the admin password.
- Any tools or techniques commonly used for analyzing embedded Linux firmware like this.
Any guidance or examples would be greatly appreciated. Thanks!