New tf_recovery.img and surely the newest FW remove hack possibilty

[snoerenberg]

Hi,

UPDATE: the "new recovery image" was not for original mijia 1080p ... some other camera.

the new recovery image does not contain the "prikey.pem" any longer.

old image: http://www19.zippyshare.com/v/BmjL3z7c/file.html new image: https://uploadfiles.io/t1e1t

can be easily extracted both with binwalk.

[willthrom]

@snoerenberg what firmware version?

[willthrom]

From where did you get the new and the old recovery image?

[willthrom]

@snoerenberg

The old image is signed as:

NAME=Buildroot
VERSION=2016.02-git-gaa3ae34
ID=buildroot
VERSION_ID=2016.02-git
PRETTY_NAME="Buildroot 2016.02-git"
XIAOMI_VERSION=3.3.6_2017080313
XIAOMI_BUILDNO=120

Seems to be from August... but that is not the latest, I think that is a weird version.

I have mine camera updated and the Hack is still working....

[snoerenberg]

@willthrom good to know thats still working for you. I have not checked mine yet. I'll create a dump as well and compare.

Here is the old and new recovery image extracted: http://www43.zippyshare.com/v/NgfFX5ry/file.html

They changed a lot ... if this is really the tf_recovery.img for the original Mijia ...:

# Start all init scripts in /etc/init.d
# executing them in numerical order.
#
#for i in /etc/init.d/S??* ;do
for i in /mnt/data/imi/imi_init/S??* ;do
     # Ignore dangling symlinks (if any).
     [ ! -f "$i" ] && continue

     case "$i" in
    *.sh)
        # Source shell script for speed.
        (
        trap - INT QUIT TSTP
        set start
        . $i
        )
        ;;
    *)
        # No sh extension, so fork subprocess.
        $i start
        ;;
    esac
done

/mnt/data/test/boot.sh 

#!/bin/sh
sd_mountdir=/tmp/sdtest
magic_str="sdtest*dkiesied999320xxxerei28slo~@!"
test_file_name=test.bin
current_dir=`pwd`
mmc_device=""
if [ -b /dev/mmcblk0p1 ];then
mmc_device=/dev/mmcblk0p1
elif [ -b /dev/mmcblk0 ];then
mmc_device=/dev/mmcblk0
fi
if [ "$mmc_device" != "" ] ; then
    if [ -d $sd_mountdir ];then
        :
    else
        mkdir $sd_mountdir
    fi
    mount -t vfat $mmc_device $sd_mountdir > /dev/null
    if [ $? -eq 0 ];then
        :
    else
        echo "NG"
        exit
    fi
    if [ -f $sd_mountdir/$test_file_name ];then
        rm $sd_mountdir/$test_file_name
    fi
    echo $magic_str > $sd_mountdir/$test_file_name
    magic_read=`cat $sd_mountdir/$test_file_name`
    if [ "$magic_read" == "$magic_str" ];then
        echo "OK"
    else
        echo "NG"
    fi
    rm $sd_mountdir/$test_file_name
    umount $sd_mountdir
else
    echo "No card inserted"
fi
cd $current_dir

[snoerenberg]

@willthrom the new image was somewhere referenced in the old thread. It seems that the "new recovery image" belongs to another cam ...

[willthrom]

I have the latest version: 3.3.9_0137 and the OS file is:

NAME=Buildroot
VERSION=2016.02-git-00661-ga2928c5-dirty
ID=buildroot
VERSION_ID=2016.02-git
PRETTY_NAME="Buildroot 2016.02-git"
XIAOMI_VERSION=3.3.9_**0137**
XIAOMI_BUILDNO=406  

So yep.. I guess that is Firmware for another Camera... but it is not what my camera has after upgrading.