Like this:
hash = sha1 applied recursively 4071 times ( password . salt ) . salt
Serious question. Don't just say religiously, "just use bcrypt". Tell me what is really wrong. What attacks will succeed today? Any crypto enthusiasts in the audience?
And from a purely pragmatic perspective, why even consider it? You have a bcrypt/scrypt library, writing your own code is harder and almost certainly worse, so there is literally no reason to spend even a second thinking about it.
There is a reason why Apple makes every app implement its own receipt validation scheme. So a dedicated attacker can't crack all apps at once. Same here.
The reason you want to use HMAC is the same as always, it provides better security against a number of attacks that could recover the secret, https://en.wikipedia.org/wiki/Hash-based_message_authenticat...
That being said, if you wanted to build your own _for fun_, do it! You will learn a lot in the process. Just don't expect your project to be over any time soon.
It will also (likely) have been designed and/or checked by people with domain knowledge, and so is more likely to avoid subtle attacks - just repeating a hash function n times might not offer the security you expect (e.g. 2DES is barely any stronger than a single DES pass - you need 3DES to make much of a difference).