Kenny aSmig

Rooting K9608-2W

Let's say you have one of these and you want shell access for some reason, like setting the date & time programatically. By adding a couple magic files to a USB mass storage device, connecting it to your NVR and rebooting, you will be able to login via telnet.

How to know this will work for you

Login to the web user interface of your NVR, go to Settings (wrench and screwdriver icon). If you see the following info listed in the DevInfo tab, then these instructions should work for you. This may work with other software versions too but no promises.

	#!/usr/bin/python
	# Use YardStick One and RfCat to transmit a fan remote control signal as
	# observed by int10h here: https://i.imgur.com/JZ3pdF1.png
	import bitstring
	from rflib import *

	device = RfCat()
	device.setMdmModulation(MOD_ASK_OOK)
	device.setFreq(433e6)
	device.setMdmSyncMode(0x00)

	#!/usr/bin/env python
	# encoding: utf-8
	"""
	Copyright 2011 Kenny McElroy <[email protected]>
	Based on the I2C testscript from Peter Huewe

	This program is free software: you can redistribute it and/or modify
	it under the terms of the GNU General Public License as published by
	the Free Software Foundation, either version 3 of the License, or
	(at your option) any later version.

	#!/usr/bin/python

	# Thanks to "Very simple serial terminal" by Chris Liechti <[email protected]>
	import sys, re, serial, threading, datetime, time
	try:
	from serial.tools.list_ports import comports
	except ImportError:
	comports = None

	#WHEN_TO_PRINT = '' # NOW

	# auto_o.py by Kenny @octosavvi
	# IDA Pro should treat immediate operands as offsets whenever possible.
	#
	# To use, create a system alias which adds -S"auto_o.py" to your ida
	# commandline. Place this file anywhere your idapythonrc.py path allows.

	Message("Loading auto_o\n")

	def auto_o():
	Wait()