I have an ActiveON LX action camera i.e. a GoPro ersatz. It comes with an Android app to control it, and it does so by running its own WiFi AP for the phone to connect. Once the phone connects, it commands the camera over HTTP using a variety of endpoints.
It uses an Ambarella SoC with running buildroot.
I port scanned the camera: it has a telnet server running on tcp/23 and a webserver (Cherokee) on tcp/80. It also has some kind of Java RPC server on tcp/7878 but I don't know much about Java or how to use it.
$ nmap -A -T4 192.168.42.1 -p 1-65535
Starting Nmap 7.12 ( https://nmap.org ) at 2016-07-15 22:02 EDT
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
stty: stdin isn't a terminal
stty: stdin isn't a terminal
Nmap scan report for 192.168.42.1
Host is up (0.0041s latency).
Not shown: 65530 closed ports
PORT STATE SERVICE VERSION
23/tcp open telnet BusyBox telnetd
53/tcp open domain dnsmasq 2.59
| dns-nsid:
|_ bind.version: dnsmasq-2.59
80/tcp open http Cherokee httpd 1.2.101b141103_
|_http-server-header: Cherokee/1.2.101b141103_ (UNIX)
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
7877/tcp open tcpwrapped
7878/tcp open unknown
Service Info: Host: buildroot; OS: Unix
I'm trying to get into it via the telnet server but I don't know the user/password. They changed the default root password, using root with a blank password doesn't let me in.
I was hoping the Android app would make use of the telnet connection so I sniffed the traffic between the app and the camera but it's all HTTP only.
So I thought I would poke around the firmware updates.
I am looking at these two binaries: http://www.activeon.com/wp/adm_product/firmware_file/lx/V3.2.0/R2_v320_150212.UGF and http://www.activeon.com/wp/wp-content/uploads/2014/12/LX_v3.15.UGF
Both files have the exact same length of 45,281,280 bytes but different contents (verified with sha1sum).
Binwalk seems to think there are lots of files in these firmware updates (unless I'm mis-reading the output):
$ binwalk /Downloads/R2_v320_150212.UGF
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
121908 0x1DC34 CRC32 polynomial table, little endian
127773 0x1F31D Copyright string: "Copyright (C) 2004-2007"
1223000 0x12A958 CRC32 polynomial table, little endian
1271084 0x13652C Copyright string: "Copyright (C) 2004-2007"
1273818 0x136FDA Unix path: /../../sv/a5s/image/ambhal.bin"
1273861 0x137005 Unix path: /../../sv/a5s/image/ambhal.info"
1274105 0x1370F9 Unix path: /../../../boss_sdk/output.oem/images/Image"
1274166 0x137136 Unix path: /../../src/linuxinfo/kernel.info"
1274419 0x137233 Unix path: /../../gui/boss_dv/romfs/a5s_ft_parallel.romfs"
1274480 0x137270 Unix path: /../../gui/boss_dv/romfs/romfs.info"
1274813 0x1373BD Unix path: /../../../boss_sdk/output.oem/images/rootfs.ubi"
1274873 0x1373F9 Unix path: /../../src/linuxinfo/ubifs.info"
1274960 0x137450 Unix path: /../../src/linuxinfo/ambernation.img"
1275009 0x137481 Unix path: /../../src/linuxinfo/ambernation.info"
1307492 0x13F364 Unix path: /usr/local/share/script/wowlan.sh
2218252 0x21D90C Unix path: /usr/local/share/script/wifi_start.sh
2323638 0x2374B6 Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_DEC/ARM_9
2326438 0x237FA6 Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_DEC/ARM_9
2326806 0x238116 Unix path: /ambtwsvn2/svn/audio/trunk/CAVLC/ARM_11
2644236 0x28590C LZMA compressed data, properties: 0x64, dictionary size: 33554432 bytes, uncompressed size: 512 bytes
3574898 0x368C72 Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_ENC/ARM_9
3577214 0x36957E Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_ENC/ARM_9
4148260 0x3F4C24 Neighborly text, "neighbor point left:ing calibration map..."
4148284 0x3F4C3C Neighborly text, "neighbor point right:"
4398826 0x431EEA Executable script, shebang: "/bin/sh' > /tmp/ap_start.sh"
4399322 0x4320DA Unix path: /usr/local/share/script/load.sh' >> /tmp/ap_start.sh
4399714 0x432262 Executable script, shebang: "/bin/sh' > /tmp/ap_stop.sh"
4536526 0x4538CE Unix path: /ambtwsvn2/svn/audio/trunk/CAVLD/ARM_11
5391847 0x5245E7 Unix path: /a/s/d/i]=%d/%d/%d/%d/%d
5460823 0x535357 LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5460975 0x5353EF LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5461035 0x53542B LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5461095 0x535467 LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5699789 0x56F8CD LZMA compressed data, properties: 0x88, dictionary size: 65536 bytes, uncompressed size: 196608 bytes
5708635 0x571B5B LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 256 bytes
6431706 0x6223DA LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 62464 bytes
6431754 0x62240A LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 59904 bytes
6431802 0x62243A LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 58880 bytes
6431850 0x62246A LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes
6431898 0x62249A LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes
6461019 0x62965B LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 200 bytes
6513410 0x636302 LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 65538 bytes
6564456 0x642A68 YAFFS filesystem
6697660 0x6632BC ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
6697776 0x663330 ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
6697900 0x6633AC ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
6698016 0x663420 ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
8732501 0x853F55 Certificate in DER format (x509 v3), header length: 4, sequence length: 1284
10055769 0x997059 Certificate in DER format (x509 v3), header length: 4, sequence length: 1328
10055773 0x99705D Certificate in DER format (x509 v3), header length: 4, sequence length: 1292
10055777 0x997061 Certificate in DER format (x509 v3), header length: 4, sequence length: 1312
10209925 0x9BCA85 Certificate in DER format (x509 v3), header length: 4, sequence length: 1464
10379388 0x9E607C Linux kernel version "2.6.38.8 (kjp@ntek-linux-server) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-67) ) #1 PREEMPT Mon Nov 3 21:17:07 KST 2014"
10409076 0x9ED474 gzip compressed data, maximum compression, from Unix, last modified: 2014-11-03 12:16:24
10506132 0xA04F94 LZO compressed data
10512276 0xA06794 CRC32 polynomial table, little endian
10525445 0xA09B05 LZMA compressed data, properties: 0x65, dictionary size: 8388608 bytes, uncompressed size: 1048576 bytes
10948832 0xA710E0 Unix path: /arm/plat-ambarella/boss/../generic/adc.c
10950128 0xA715F0 Unix path: /arm/plat-ambarella/boss/../generic/gpio.c
10950456 0xA71738 Unix path: /arm/plat-ambarella/boss/init.c
10951032 0xA71978 Unix path: /arm/plat-ambarella/boss/irq.c
10952360 0xA71EA8 Unix path: /arm/plat-ambarella/boss/pm.c
10953952 0xA724E0 Unix path: /arm/plat-ambarella/boss/../generic/rct/a5s.c
10954212 0xA725E4 Unix path: /arm/plat-ambarella/boss/../generic/rtc.c
10954344 0xA72668 Unix path: /arm/plat-ambarella/boss/../generic/sd.c
10954600 0xA72768 Unix path: /arm/plat-ambarella/boss/boss.c
10954944 0xA728C0 Unix path: /arm/plat-ambarella/misc/ambfb.c
10955756 0xA72BEC Unix path: /arm/plat-ambarella/misc/atag.c
11032304 0xA856F0 Unix path: /proc/fs/cifs/SecurityFlags
11032717 0xA8588D Unix path: /proc/fs/cifs/SecurityFlags.
11040658 0xA87792 Unix path: /proc/fs/cifs/LookupCacheEnabled to 0
11100704 0xA96220 xz compressed data
11168736 0xAA6BE0 Unix path: /arm/plat-ambarella/include/mach/io.h
12475632 0xBE5CF0 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: MD5 hash
13826304 0xD2F900 JPEG image data, JFIF standard 1.01
13871360 0xD3A900 JPEG image data, JFIF standard 1.01
13885696 0xD3E100 JPEG image data, JFIF standard 1.02
13889792 0xD3F100 JPEG image data, JFIF standard 1.02
13891840 0xD3F900 JPEG image data, JFIF standard 1.02
14108844 0xD748AC Certificate in DER format (x509 v3), header length: 4, sequence length: 576
14109424 0xD74AF0 Certificate in DER format (x509 v3), header length: 4, sequence length: 704
14110132 0xD74DB4 Certificate in DER format (x509 v3), header length: 4, sequence length: 717
14110853 0xD75085 Certificate in DER format (x509 v3), header length: 4, sequence length: 2228
14111022 0xD7512E Digi International firmware, load address: 0x204D6963, entry point: 0x66742053,
14112181 0xD755B5 Copyright string: "Copyright (c)1996 VeriSign, Inc. All Rights Reserved. CERTAIN"
15629693 0xEE7D7D MySQL MISAM compressed data file Version 5
15629905 0xEE7E51 MySQL MISAM compressed data file Version 9
15650089 0xEECD29 MySQL MISAM compressed data file Version 4
15696517 0xEF8285 MySQL MISAM compressed data file Version 4
15696541 0xEF829D MySQL MISAM compressed data file Version 4
15696597 0xEF82D5 MySQL MISAM compressed data file Version 4
16615436 0xFD880C LZMA compressed data, properties: 0x9A, dictionary size: 262144 bytes, uncompressed size: 299111512 bytes
17325931 0x1085F6B Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17326177 0x1086061 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17331807 0x108765F Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17332115 0x1087793 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17332605 0x108797D Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17333091 0x1087B63 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17333728 0x1087DE0 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17334022 0x1087F06 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17343657 0x108A4A9 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17343817 0x108A549 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17344031 0x108A61F Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17345518 0x108ABEE Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17345965 0x108ADAD Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346442 0x108AF8A Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346547 0x108AFF3 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346825 0x108B109 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17347072 0x108B200 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17347811 0x108B4E3 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17348053 0x108B5D5 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17348232 0x108B688 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17350016 0x108BD80 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17350253 0x108BE6D Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351220 0x108C234 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351648 0x108C3E0 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351968 0x108C520 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17352747 0x108C82B Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17353891 0x108CCA3 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17354102 0x108CD76 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17357134 0x108D94E Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17360809 0x108E7A9 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17371600 0x10911D0 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17372514 0x1091562 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17372819 0x1091693 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17374604 0x1091D8C Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17374934 0x1091ED6 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17375922 0x10922B2 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17376322 0x1092442 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17379091 0x1092F13 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17379478 0x1093096 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17380115 0x1093313 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17380498 0x1093492 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17380775 0x10935A7 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17381548 0x10938AC Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17381725 0x109395D Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382031 0x1093A8F Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382208 0x1093B40 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382380 0x1093BEC Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382555 0x1093C9B Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382722 0x1093D42 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17386590 0x1094C5E Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_postp.c:%d failed.
17388309 0x1095315 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17388520 0x10953E8 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17396295 0x1097247 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17397243 0x10975FB Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17397895 0x1097887 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17400332 0x109820C Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.
17400594 0x1098312 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.
17400906 0x109844A Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jenc.c:%d failed.
17405011 0x1099453 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_parset.c:%d failed.
17406360 0x1099998 Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.
17408094 0x109A05E Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.
17412604 0x109B1FC Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mixer.c:%d failed.
18014464 0x112E100 UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x200, data offset: 0x800
The other file has a similar binwalk output but I can't put it here because of the message length limit.
I tried running binwalk with the -e option to extract the files. I'm getting lots of files with names that seem to be hex addresses but they don't match the binwalk output. Most of the files are mis-identified, 7z files can't be unzipped because they're corrupt, crt files aren't valid either. The 34.9MB file 9ED474.gz extracts to a 46KB file...
$ ll _R2_v320_150212.UGF.extracted/
total 2057240
drwxr-xr-x 34 me staff 1156 Jul 15 21:44 .
drwxr-xr-x 276 me staff 9384 Jul 15 21:43 ..
-rw-r--r--@ 1 me staff 6148 Jul 15 21:44 .DS_Store
-rw-r--r-- 1 me staff 27266816 Jul 15 21:44 112E100.ubi
-rw-r--r-- 1 me staff 42637044 Jul 15 21:43 28590C.7z
-rw-r--r-- 1 me staff 39820457 Jul 15 21:43 535357.7z
-rw-r--r-- 1 me staff 39820305 Jul 15 21:43 5353EF.7z
-rw-r--r-- 1 me staff 39820245 Jul 15 21:43 53542B.7z
-rw-r--r-- 1 me staff 39820185 Jul 15 21:43 535467.7z
-rw-r--r-- 1 me staff 39581491 Jul 15 21:43 56F8CD.7z
-rw-r--r-- 1 me staff 39572645 Jul 15 21:43 571B5B.7z
-rw-r--r-- 1 me staff 38849574 Jul 15 21:43 6223DA.7z
-rw-r--r-- 1 me staff 38849526 Jul 15 21:43 62240A.7z
-rw-r--r-- 1 me staff 38849478 Jul 15 21:43 62243A.7z
-rw-r--r-- 1 me staff 38849430 Jul 15 21:43 62246A.7z
-rw-r--r-- 1 me staff 38849382 Jul 15 21:43 62249A.7z
-rw-r--r-- 1 me staff 38820261 Jul 15 21:43 62965B.7z
-rw-r--r-- 1 me staff 38767870 Jul 15 21:43 636302.7z
-rw-r--r-- 1 me staff 38583620 Jul 15 21:43 6632BC.cpio
-rw-r--r-- 1 me staff 36548779 Jul 15 21:43 853F55.crt
-rw-r--r-- 1 me staff 35225511 Jul 15 21:43 997059.crt
-rw-r--r-- 1 me staff 35225507 Jul 15 21:43 99705D.crt
-rw-r--r-- 1 me staff 35225503 Jul 15 21:43 997061.crt
-rw-r--r-- 1 me staff 35071355 Jul 15 21:43 9BCA85.crt
-rw-r--r-- 1 me staff 40960 Jul 15 21:43 9ED474
-rw-r--r-- 1 me staff 34872204 Jul 15 21:43 9ED474.gz
-rw-r--r-- 1 me staff 34755835 Jul 15 21:43 A09B05.7z
-rw-r--r-- 1 me staff 34180576 Jul 15 21:43 A96220.xz
-rw-r--r-- 1 me staff 31172436 Jul 15 21:43 D748AC.crt
-rw-r--r-- 1 me staff 31171856 Jul 15 21:44 D74AF0.crt
-rw-r--r-- 1 me staff 31171148 Jul 15 21:44 D74DB4.crt
-rw-r--r-- 1 me staff 31170427 Jul 15 21:44 D75085.crt
-rw-r--r-- 1 me staff 28665844 Jul 15 21:44 FD880C.7z
drwxr-xr-x 2 me staff 68 Jul 15 21:43 cpio-root
Are the binary firmware updates patches or is it the full image?
What's my next move?
There seem to be some python files in the firmware (as observed by dumping the contents using strings) so maybe I could modify one of the files to give me access to /?
Or maybe I could craft my own firmware update file and run a bash script to append a custom user & password to /etc/passwd?
There is probably a JTAG connector inside the camera but I'd rather not take it apart.
I'm new to this, but I find it very exciting. I'm hoping someone with more experience can point me in the right direction :)
Thanks!
R2_v320_150212.UGF: Applesoft BASIC program data, thecpio_rootdir is empty.