[Wolf-HRB]

Well, under my testing, you can't. Since the firmware decryption key is different, you need to decrypt the UPX, first, then unpack payload.bin, and play with the imgs from the payload