1

I have an ActiveON LX action camera i.e. a GoPro ersatz. It comes with an Android app to control it, and it does so by running its own WiFi AP for the phone to connect. Once the phone connects, it commands the camera over HTTP using a variety of endpoints.

It uses an Ambarella SoC with running buildroot.

I port scanned the camera: it has a telnet server running on tcp/23 and a webserver (Cherokee) on tcp/80. It also has some kind of Java RPC server on tcp/7878 but I don't know much about Java or how to use it.

$ nmap -A -T4 192.168.42.1 -p 1-65535

Starting Nmap 7.12 ( https://nmap.org ) at 2016-07-15 22:02 EDT
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
stty: stdin isn't a terminal
stty: stdin isn't a terminal
Nmap scan report for 192.168.42.1
Host is up (0.0041s latency).
Not shown: 65530 closed ports
PORT     STATE SERVICE    VERSION
23/tcp   open  telnet     BusyBox telnetd
53/tcp   open  domain     dnsmasq 2.59
| dns-nsid:
|_  bind.version: dnsmasq-2.59
80/tcp   open  http       Cherokee httpd 1.2.101b141103_
|_http-server-header: Cherokee/1.2.101b141103_ (UNIX)
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
7877/tcp open  tcpwrapped
7878/tcp open  unknown
Service Info: Host: buildroot; OS: Unix

I'm trying to get into it via the telnet server but I don't know the user/password. They changed the default root password, using root with a blank password doesn't let me in.

I was hoping the Android app would make use of the telnet connection so I sniffed the traffic between the app and the camera but it's all HTTP only.

So I thought I would poke around the firmware updates.

I am looking at these two binaries: http://www.activeon.com/wp/adm_product/firmware_file/lx/V3.2.0/R2_v320_150212.UGF and http://www.activeon.com/wp/wp-content/uploads/2014/12/LX_v3.15.UGF

Both files have the exact same length of 45,281,280 bytes but different contents (verified with sha1sum).

Binwalk seems to think there are lots of files in these firmware updates (unless I'm mis-reading the output):

$ binwalk /Downloads/R2_v320_150212.UGF

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
121908        0x1DC34         CRC32 polynomial table, little endian
127773        0x1F31D         Copyright string: "Copyright (C) 2004-2007"
1223000       0x12A958        CRC32 polynomial table, little endian
1271084       0x13652C        Copyright string: "Copyright (C) 2004-2007"
1273818       0x136FDA        Unix path: /../../sv/a5s/image/ambhal.bin"
1273861       0x137005        Unix path: /../../sv/a5s/image/ambhal.info"
1274105       0x1370F9        Unix path: /../../../boss_sdk/output.oem/images/Image"
1274166       0x137136        Unix path: /../../src/linuxinfo/kernel.info"
1274419       0x137233        Unix path: /../../gui/boss_dv/romfs/a5s_ft_parallel.romfs"
1274480       0x137270        Unix path: /../../gui/boss_dv/romfs/romfs.info"
1274813       0x1373BD        Unix path: /../../../boss_sdk/output.oem/images/rootfs.ubi"
1274873       0x1373F9        Unix path: /../../src/linuxinfo/ubifs.info"
1274960       0x137450        Unix path: /../../src/linuxinfo/ambernation.img"
1275009       0x137481        Unix path: /../../src/linuxinfo/ambernation.info"
1307492       0x13F364        Unix path: /usr/local/share/script/wowlan.sh
2218252       0x21D90C        Unix path: /usr/local/share/script/wifi_start.sh
2323638       0x2374B6        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_DEC/ARM_9
2326438       0x237FA6        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_DEC/ARM_9
2326806       0x238116        Unix path: /ambtwsvn2/svn/audio/trunk/CAVLC/ARM_11
2644236       0x28590C        LZMA compressed data, properties: 0x64, dictionary size: 33554432 bytes, uncompressed size: 512 bytes
3574898       0x368C72        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_ENC/ARM_9
3577214       0x36957E        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_ENC/ARM_9
4148260       0x3F4C24        Neighborly text, "neighbor point left:ing calibration map..."
4148284       0x3F4C3C        Neighborly text, "neighbor point right:"
4398826       0x431EEA        Executable script, shebang: "/bin/sh' > /tmp/ap_start.sh"
4399322       0x4320DA        Unix path: /usr/local/share/script/load.sh' >> /tmp/ap_start.sh
4399714       0x432262        Executable script, shebang: "/bin/sh' > /tmp/ap_stop.sh"
4536526       0x4538CE        Unix path: /ambtwsvn2/svn/audio/trunk/CAVLD/ARM_11
5391847       0x5245E7        Unix path: /a/s/d/i]=%d/%d/%d/%d/%d
5460823       0x535357        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5460975       0x5353EF        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5461035       0x53542B        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5461095       0x535467        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5699789       0x56F8CD        LZMA compressed data, properties: 0x88, dictionary size: 65536 bytes, uncompressed size: 196608 bytes
5708635       0x571B5B        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 256 bytes
6431706       0x6223DA        LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 62464 bytes
6431754       0x62240A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 59904 bytes
6431802       0x62243A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 58880 bytes
6431850       0x62246A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes
6431898       0x62249A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes
6461019       0x62965B        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 200 bytes
6513410       0x636302        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 65538 bytes
6564456       0x642A68        YAFFS filesystem
6697660       0x6632BC        ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
6697776       0x663330        ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
6697900       0x6633AC        ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
6698016       0x663420        ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
8732501       0x853F55        Certificate in DER format (x509 v3), header length: 4, sequence length: 1284
10055769      0x997059        Certificate in DER format (x509 v3), header length: 4, sequence length: 1328
10055773      0x99705D        Certificate in DER format (x509 v3), header length: 4, sequence length: 1292
10055777      0x997061        Certificate in DER format (x509 v3), header length: 4, sequence length: 1312
10209925      0x9BCA85        Certificate in DER format (x509 v3), header length: 4, sequence length: 1464
10379388      0x9E607C        Linux kernel version "2.6.38.8 (kjp@ntek-linux-server) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-67) ) #1 PREEMPT Mon Nov 3 21:17:07 KST 2014"
10409076      0x9ED474        gzip compressed data, maximum compression, from Unix, last modified: 2014-11-03 12:16:24
10506132      0xA04F94        LZO compressed data
10512276      0xA06794        CRC32 polynomial table, little endian
10525445      0xA09B05        LZMA compressed data, properties: 0x65, dictionary size: 8388608 bytes, uncompressed size: 1048576 bytes
10948832      0xA710E0        Unix path: /arm/plat-ambarella/boss/../generic/adc.c
10950128      0xA715F0        Unix path: /arm/plat-ambarella/boss/../generic/gpio.c
10950456      0xA71738        Unix path: /arm/plat-ambarella/boss/init.c
10951032      0xA71978        Unix path: /arm/plat-ambarella/boss/irq.c
10952360      0xA71EA8        Unix path: /arm/plat-ambarella/boss/pm.c
10953952      0xA724E0        Unix path: /arm/plat-ambarella/boss/../generic/rct/a5s.c
10954212      0xA725E4        Unix path: /arm/plat-ambarella/boss/../generic/rtc.c
10954344      0xA72668        Unix path: /arm/plat-ambarella/boss/../generic/sd.c
10954600      0xA72768        Unix path: /arm/plat-ambarella/boss/boss.c
10954944      0xA728C0        Unix path: /arm/plat-ambarella/misc/ambfb.c
10955756      0xA72BEC        Unix path: /arm/plat-ambarella/misc/atag.c
11032304      0xA856F0        Unix path: /proc/fs/cifs/SecurityFlags
11032717      0xA8588D        Unix path: /proc/fs/cifs/SecurityFlags.
11040658      0xA87792        Unix path: /proc/fs/cifs/LookupCacheEnabled to 0
11100704      0xA96220        xz compressed data
11168736      0xAA6BE0        Unix path: /arm/plat-ambarella/include/mach/io.h
12475632      0xBE5CF0        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: MD5 hash
13826304      0xD2F900        JPEG image data, JFIF standard 1.01
13871360      0xD3A900        JPEG image data, JFIF standard 1.01
13885696      0xD3E100        JPEG image data, JFIF standard 1.02
13889792      0xD3F100        JPEG image data, JFIF standard 1.02
13891840      0xD3F900        JPEG image data, JFIF standard 1.02
14108844      0xD748AC        Certificate in DER format (x509 v3), header length: 4, sequence length: 576
14109424      0xD74AF0        Certificate in DER format (x509 v3), header length: 4, sequence length: 704
14110132      0xD74DB4        Certificate in DER format (x509 v3), header length: 4, sequence length: 717
14110853      0xD75085        Certificate in DER format (x509 v3), header length: 4, sequence length: 2228
14111022      0xD7512E        Digi International firmware, load address: 0x204D6963, entry point: 0x66742053,
14112181      0xD755B5        Copyright string: "Copyright (c)1996 VeriSign, Inc.  All Rights Reserved. CERTAIN"
15629693      0xEE7D7D        MySQL MISAM compressed data file Version 5
15629905      0xEE7E51        MySQL MISAM compressed data file Version 9
15650089      0xEECD29        MySQL MISAM compressed data file Version 4
15696517      0xEF8285        MySQL MISAM compressed data file Version 4
15696541      0xEF829D        MySQL MISAM compressed data file Version 4
15696597      0xEF82D5        MySQL MISAM compressed data file Version 4
16615436      0xFD880C        LZMA compressed data, properties: 0x9A, dictionary size: 262144 bytes, uncompressed size: 299111512 bytes
17325931      0x1085F6B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17326177      0x1086061       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17331807      0x108765F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17332115      0x1087793       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17332605      0x108797D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17333091      0x1087B63       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17333728      0x1087DE0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17334022      0x1087F06       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17343657      0x108A4A9       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17343817      0x108A549       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17344031      0x108A61F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17345518      0x108ABEE       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17345965      0x108ADAD       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346442      0x108AF8A       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346547      0x108AFF3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346825      0x108B109       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17347072      0x108B200       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17347811      0x108B4E3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17348053      0x108B5D5       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17348232      0x108B688       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17350016      0x108BD80       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17350253      0x108BE6D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351220      0x108C234       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351648      0x108C3E0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351968      0x108C520       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17352747      0x108C82B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17353891      0x108CCA3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17354102      0x108CD76       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17357134      0x108D94E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17360809      0x108E7A9       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17371600      0x10911D0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17372514      0x1091562       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17372819      0x1091693       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17374604      0x1091D8C       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17374934      0x1091ED6       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17375922      0x10922B2       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17376322      0x1092442       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17379091      0x1092F13       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17379478      0x1093096       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17380115      0x1093313       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17380498      0x1093492       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17380775      0x10935A7       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17381548      0x10938AC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17381725      0x109395D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382031      0x1093A8F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382208      0x1093B40       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382380      0x1093BEC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382555      0x1093C9B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382722      0x1093D42       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17386590      0x1094C5E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_postp.c:%d failed.
17388309      0x1095315       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17388520      0x10953E8       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17396295      0x1097247       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17397243      0x10975FB       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17397895      0x1097887       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17400332      0x109820C       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.
17400594      0x1098312       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.
17400906      0x109844A       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jenc.c:%d failed.
17405011      0x1099453       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_parset.c:%d failed.
17406360      0x1099998       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.
17408094      0x109A05E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.
17412604      0x109B1FC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mixer.c:%d failed.
18014464      0x112E100       UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x200, data offset: 0x800

The other file has a similar binwalk output but I can't put it here because of the message length limit.

I tried running binwalk with the -e option to extract the files. I'm getting lots of files with names that seem to be hex addresses but they don't match the binwalk output. Most of the files are mis-identified, 7z files can't be unzipped because they're corrupt, crt files aren't valid either. The 34.9MB file 9ED474.gz extracts to a 46KB file...

$ ll _R2_v320_150212.UGF.extracted/
total 2057240
drwxr-xr-x   34 me  staff      1156 Jul 15 21:44 .
drwxr-xr-x  276 me  staff      9384 Jul 15 21:43 ..
-rw-r--r--@   1 me  staff      6148 Jul 15 21:44 .DS_Store
-rw-r--r--    1 me  staff  27266816 Jul 15 21:44 112E100.ubi
-rw-r--r--    1 me  staff  42637044 Jul 15 21:43 28590C.7z
-rw-r--r--    1 me  staff  39820457 Jul 15 21:43 535357.7z
-rw-r--r--    1 me  staff  39820305 Jul 15 21:43 5353EF.7z
-rw-r--r--    1 me  staff  39820245 Jul 15 21:43 53542B.7z
-rw-r--r--    1 me  staff  39820185 Jul 15 21:43 535467.7z
-rw-r--r--    1 me  staff  39581491 Jul 15 21:43 56F8CD.7z
-rw-r--r--    1 me  staff  39572645 Jul 15 21:43 571B5B.7z
-rw-r--r--    1 me  staff  38849574 Jul 15 21:43 6223DA.7z
-rw-r--r--    1 me  staff  38849526 Jul 15 21:43 62240A.7z
-rw-r--r--    1 me  staff  38849478 Jul 15 21:43 62243A.7z
-rw-r--r--    1 me  staff  38849430 Jul 15 21:43 62246A.7z
-rw-r--r--    1 me  staff  38849382 Jul 15 21:43 62249A.7z
-rw-r--r--    1 me  staff  38820261 Jul 15 21:43 62965B.7z
-rw-r--r--    1 me  staff  38767870 Jul 15 21:43 636302.7z
-rw-r--r--    1 me  staff  38583620 Jul 15 21:43 6632BC.cpio
-rw-r--r--    1 me  staff  36548779 Jul 15 21:43 853F55.crt
-rw-r--r--    1 me  staff  35225511 Jul 15 21:43 997059.crt
-rw-r--r--    1 me  staff  35225507 Jul 15 21:43 99705D.crt
-rw-r--r--    1 me  staff  35225503 Jul 15 21:43 997061.crt
-rw-r--r--    1 me  staff  35071355 Jul 15 21:43 9BCA85.crt
-rw-r--r--    1 me  staff     40960 Jul 15 21:43 9ED474
-rw-r--r--    1 me  staff  34872204 Jul 15 21:43 9ED474.gz
-rw-r--r--    1 me  staff  34755835 Jul 15 21:43 A09B05.7z
-rw-r--r--    1 me  staff  34180576 Jul 15 21:43 A96220.xz
-rw-r--r--    1 me  staff  31172436 Jul 15 21:43 D748AC.crt
-rw-r--r--    1 me  staff  31171856 Jul 15 21:44 D74AF0.crt
-rw-r--r--    1 me  staff  31171148 Jul 15 21:44 D74DB4.crt
-rw-r--r--    1 me  staff  31170427 Jul 15 21:44 D75085.crt
-rw-r--r--    1 me  staff  28665844 Jul 15 21:44 FD880C.7z
drwxr-xr-x    2 me  staff        68 Jul 15 21:43 cpio-root

Are the binary firmware updates patches or is it the full image? What's my next move? There seem to be some python files in the firmware (as observed by dumping the contents using strings) so maybe I could modify one of the files to give me access to /? Or maybe I could craft my own firmware update file and run a bash script to append a custom user & password to /etc/passwd?

There is probably a JTAG connector inside the camera but I'd rather not take it apart.

I'm new to this, but I find it very exciting. I'm hoping someone with more experience can point me in the right direction :)

Thanks!

2
  • What file utility says about these (.UGF) files ? Is there any content in cpio_root folder ?
    – w s
    Jul 19, 2016 at 15:05
  • file says R2_v320_150212.UGF: Applesoft BASIC program data, the cpio_root dir is empty. Jul 20, 2016 at 22:42

1 Answer 1

1

Try this: Create a network near the device called:

`echo a::0:0::/:/bin/sh>>/etc/passwd`

alternative might work better:

`echo$IFSa::0:0::/:/bin/sh>>/etc/passwd`

or instead of using ` on either side, you could do something like this:

$(echo$IFSa::0:0::/:/bin/sh>>/etc/passwd)

After forming the network name, try to get your device to join this network. If it's a real network (i.e. use a real router) then you can see if the device joins the network. If it does, try logging in with login 'a' and no password. IF it doesn't work then rejoin the setup network i.e. ActiveON_SETUP123 or whatever and then see if you can login now. If it doesn't work, then try the next command, etc.

Explanation: With any luck, your device is running a shell command to join a network. We can hopefully exploit the `shell_command` and $(shell_command) nature of bash to make it do what we want!

The $IFS part is used in case it parses out spaces or just chokes on spaces for no good reason. Often $IFS will be expanded into a space. :)

1
  • Any updates? Please vote if my answer worked.
    – justin
    Mar 20, 2017 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.