guino
commented
1 year ago When you boot the device with the reset button pressed we activate a specific boot function that reads the ppsMmcTool.txt file from the SD card. We make that file with instructions for what the bootloader should do — in our case we request a firmware upgrade but we don’t actually do it, we just use the commands executed by the device (in the file we provide) to update boot settings on the device.
Our custom boot settings are picked up by one of the device’s boot scripts causing it to execute our initrun.sh file which starts custom.sh and our processes.
Which boot settings and what scripts are available vary by device, once we get a script to execute from the SD card it’s mostly the same for every device.
Figuring out the boot settings (or anything we can use to execute our script from the SD card) is usually the hardest part. For most devices it takes getting a firmware dump and reviewing it to see how it interacts with any files in the SD card OR how it may process some boot settings. Most devices have some sort of ‘development’ setting used by the manufacturer for testing changes before making a final firmware - if they leave some of that behind in the final firmware it’s usually something we can try to exploit.
I usually try to post information on steps I take to root the devices, but it sometimes can take a lot of hours looking at code in ghidra to find anything we can use. Rooting a device with a hardware programmer is usually simple but requires having the tools, opening the device and many times requires removing the flash chip from the board and soldering it back. Coming up with a process to root the device without opening it is usually much more involved.
MathisLec
Hi, I succeed to root the camera, big thanks for that. But there is something that I don't understand and I wanted an answer in order to make my school project's presentation interesting. I understood that custom initrun.sh in sdcard is certainly loaded in the camera memory (or the device boot from the sdcard?), then run custom.sh, then launch telnet server, httpd server ... But I am not able to understand what it is specifically done when we boot the camera while pressing reset button, is it turned into another mode that boot in the sdcard or something? Is it mentioned in flash dump? Sorry if my English sucks :/
Thanks in advance.