1

I am trying to get to the root file system of a Yi Dome Camera and I haven't done this before. Can anyone point me in the right direction? I ran binwalk on the firmware which showed:

    DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

1904862       0x1D10DE        MySQL MISAM compressed data file Version 9

Then:

binwalk -D '.sql:myd.myisamchk' 1.9.1.0E_201608251601home_v200m

drwxr-xr-x 2 root root       4096 Dec  5 21:43 _1.9.1.0E_201608251601home_v200m.extracted

The extracted directory has:

-rw-r--r-- 1 root root 38712 Dec  5 21:43 1D10DE.myd.myisamchk

root@kali:~/Downloads/_1.9.1.0E_201608251601home_v200m.extracted# `myisamchk 1D10DE.myd.myisamchk`
myisamchk: error: '1D10DE.myd.myisamchk' is not a MyISAM-table
Improve this question
2
  • 3
    This looks very much like a false positive. Especially when binwalk finds nothing else, I'd assume the firmware is encrypted, and some of the encrypted bytes happen to match the MySQL signature. Why should a camera firmware use mysql at all, and why should it have a mysql data file and nothing else?
    – Guntram Blohm
    Dec 6, 2016 at 7:18
  • Makes sense, is it possible to access it without a key? I know people have done it for other Yi camera firmwares somehow.
    – Mobalized
    Dec 6, 2016 at 13:22

1 Answer 1

Reset to default
2

The firmware for YI home cameras is available at https://www.yitechnology.com/yi-1080p-dome-firmware.

The firmware for version 1.9.1.0H_201706221046home_v200m is probably encrypted. Here is the entropy plot:

1.9.1.0H

There does not even seem to be a header structure:

00000000  31 2e 39 2e 31 2e 30 48  5f 32 30 31 37 30 36 32  |1.9.1.0H_2017062|
00000010  32 31 30 34 36 0a 0e 11  0f 1e 3a ef fa 57 21 4a  |21046.....:..W!J|
00000020  7e 48 38 36 79 04 01 98  6e 86 03 6e 0c 00 e2 0e  |~H86y...n..n....|
00000030  4b 42 8a c0 81 fd b1 58  63 5e 8c 26 38 23 98 15  |KB.....Xc^.&8#..|
00000040  29 d3 a8 ee 24 17 f3 8c  7c f2 f2 c7 6d 33 1c 59  |)...$...|...m3.Y|
00000050  6b 97 a3 da d1 4d b9 66  88 69 6c 0d 82 f0 b1 c2  |k....M.f.il.....|
00000060  ec ba db f5 6a 75 c2 ce  1c 7c b9 d0 bd e8 57 62  |....ju...|....Wb|
00000070  bf 2c 63 57 98 dc 9e cb  84 63 70 c2 9e 0c 90 ef  |.,cW.....cp.....|
00000080  e7 68 a0 ab f4 ae 58 22  7c 6c 2d f3 b3 8d ac 49  |.h....X"|l-....I|

The reason that others have had success acquiring the root file systems of other camera models is likely due to the fact that the firmware binaries of some other models are not encrypted. For example, the firmware for "YI Home Camera", 1.8.7.0A_201702081101home, is simply compressed:

YI Home camera firmware entropy plot

$ binwalk 1.8.7.0A_201702081101home

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0xC7CDCF8F, created: 2017-02-08 03:24:11, image size: 8402648 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0xCAD09C83, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: "7518-hi3518-home"
64            0x40            JFFS2 filesystem, little endian

The JFFS2 file system can be extracted with the jefferson plugin for binwalk:

_1.8.7.0A_201702081101home.extracted $ ll
total 8228
drwxr-xr-x 3 user01 user01    4096 Jun 22 14:31 ./
drwxr-xr-x 3 user01 user01    4096 Jun 22 14:31 ../
-rw-r--r-- 1 user01 user01 8402648 Jun 22 14:31 40.jffs2
drwxr-xr-x 2 user01 user01    4096 Jun 22 14:31 jffs2-root/

/_1.8.7.0A_201702081101home.extracted $ file 40.jffs2 
40.jffs2: Linux jffs2 filesystem data little endian

The same cannot be done with "YI Dome Camera" firmware due to encryption of the entire file.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.