Just for kicks I connected my scope using just the serial interface.
Let it boot all the way and then I seem to have access to all the Linux commands without having to enter a username or password.
Looks like I can copy the start.sh file to USB, edit it and then copy it back into the scope.
Trying to use VI in single line mode is a nightmare!!!
Can you replace /etc/passwd?
The password is stored in the ramdisk, which is part of the FIT image, so while you can change it, it is never saved to disk. Also even if we changed it, the hash of the initrd wouldn't mach of the FIT image anymore, so we'd have to update as well. Not impossible, not trivial either.
What is rather easy is modify the start.sh script once in, to change/wipe the password after startup
the start.sh is part of the app partition, which is a regular r/w mounted filesystem.