xcray
commented
7 years ago Restore the flash with dd could be help if the camera fall into continues reboot.
After inspection in the home filesystem, I'd made another progress: there is an init.sh file under /home (the root of home file system), it will call _/home/app/script/factorytest.sh,and _/home/app/script/factorytest.sh will check if there is the file _/tmp/sd/test/factorytest.sh, if yes then load it and follows sleep 1000.
Unfortunately, the busybox come with the camera doesn't have telnetd included:
Currently defined functions: add-shell, addgroup, adduser, arp, arping, ash, awk, bootchartd, cat, chmod, chown, chpasswd, cp, cryptpw, cttyhack, cut, date, dd, delgroup, deluser, depmod, df, du, echo, egrep, fdisk, fgrep, find, flash_eraseall, flashcp, free, fsync, getty, grep, halt, hd, hexdump, hush, ifconfig, init, insmod, iostat, kill, killall, killall5, linuxrc, ln, login, logname, ls, lsmod, lsof, lsusb, lzcat, lzma, md5sum, mesg, mkdir, mknod, mkpasswd, modinfo, modprobe, more, mount, mpstat, mv, netstat, passwd, ping, poweroff, ps, pwd, reboot, remove-shell, rm, rmdir, rmmod, route, sed, sh, sleep, su, sulogin, sync, sysctl, tail, tar, top, tr, udhcpc, umount, unlzma, usleep, vi, vlock, xargs
atmirr
TommyChausson
xmflsct
junhau89
I've got a xiaoyi 1080p webcam (CN version), it's upgrade of version 1 (not version 2!), looks very same as the 720p type (version 1) and with the price of only RMB169. This is the international version (or same as CN version?): https://www.yitechnology.com/yi-1080p-home-camera
The progress now: After check inside, it's based on Hi3518 chip, almost the same as 720p version, even the linux kernels they used are quite same. With a TTL cable, it can be logged in as root without password automatically. From the bootlogs and /proc/mtd, we're sure that:
the 16MB flash is splitted to 8 partations as follow:
the hashed password is :$1$$qRPK7m23GJusamGpoGLby/, anyone could help to make a brute force? - the rootfs partition is quite limited, there is no telnetd and very poor left space.
the firmware (upgrade file of home partition, named home_y20m) is encrypted.
- at the beginning of boot, it will looks sd card for updates of uboot, env, conf, kernel, rootfs and home, i.e. this is one possible hacking method.
- the timer of "Hit any key to stop autoboot:" is set to 0, i.e. we can't goto the uboot interface. Is there a simple way to modify it?
- nfs is not enabled, while cifs is available to backup onto xiaomi routers.
Target: - the root password (only can be set to blank via TTL interface now); - properly compiled telnetd or busybox & the methed to load it during boot automatically; - rtsp, nfs, record to xiaomi routers just after motion detected, and so on;
could anyone give some help or hints? thanks