No NPC directory on FW version 3.1.1.0908

[jumblies]

Successfully connected using UART serial. As stated, root user is present over serial. Can activate telnet and attempt to log in as root, but blank password doesn't work.

Can change password but is not persistent. Can telnet in under new password and have full root priv.

So for temp access:
boot it, and issue commands over serial

passwd -a 2

/bin/busybox telnetd

This changes root password (you'll be prompted)

on reboot, back to stock.

No NPC directory to copy files to. Any suggestions? Can provide serial dump if needed.

tree isn't there but df yields

# df
Filesystem                Size      Used Available Use% Mounted on
tmpfs                    17.6M         0     17.6M   0% /dev
tmpfs                    17.6M      5.2M     12.3M  30% /tmp
/dev/mtdblock2           13.3M      5.7M      7.6M  43% /home

[jumblies]

For record: I feel like a moron:

The newer camera version instructions are here with a root password.

https://github.com/reedcrif/DG-M1Q

login: root
password: cxlinux

Following up on this. While no NPC directory is present, /home seems to persist. I was able to alter the wpa_supplicant.conf and start.sh and have it persist over reboots.

I was able to stick /bin/busybox telnetd at the beginning of start.sh and it works. Working on persistent root next.

Failing at persistent root. I'm trying to stuff

echo -e "PASSWORD\nPASSWORD" | passwd -a 2

Into the start.sh and it does persist in the file but it doesnt change anything on reboot