Most idiot-proof method of entry to Reverse Engineer Visual/Control feed for security camera

Question

I am looking to reverse engineer a construction security camera. I am a self-learner, and have a very general grasp on electrical engineering and coding - so I'm not entirely 'out of my element' - but I understand this is a big challenge that requires a lot of work. I am looking to eventually create an interface that will let see what the camera sees, as well as utilize its PTZ functions. What would be the most idiot proof method of entry to figure out the interface?

The camera (or camera package I guess) in question is an Axis PTZ camera, which is connected to an Axis DC PoE midspan. The midspan directly plugs into a Raspberry Pi 3 Model B that bootloads directly from a micro-SD card (to me that was rather surprising). The pi then has three USB cables, two of which run to a proprietary board (which will be described and pictured below), and the third which plugs into a Sierra Wireless AirLink RV50 for transmission via wireless carrier network.

The proprietary board has two JTAG ports, a ten-pin port that connects to an Adesto SPI flash, and a 20 pin JTAG that connects to a Lattice Semi ICE40 HX8X FPGA chip. The only other chips of notable manufacture is a SILabs CP2102, and a TI CMOS sensor ADC. The board also houses the power transformer and directs power to all the components.

There are a few points of access I could try to get access to the control system, but i am curious about all y'alls opinion.

TL;DR What would be more forgiving of novice blunders? Would it be better if I were to try to change any programming on the card? Is it better to try to decode the data as it is sent to the WIFI access point? Just curious what the best method of entry/analysis should be. Everything I have seen on the internet involves some sort of IP sniffing, but when the camera has its own unique network system via cellular carrier, and I don't know what it is transmitting... Better to not.

Hoping for the best, and excited to hear any tips you all might have.

Cheers! Photovoltaeic

Answer 1

I think I'd start with the Raspberry Pi. The reason is that among the pieces you've listed, it's probably the one that has the most available documentation.

“The first rule of intelligent tinkering is to save all the pieces.” -- Aldo Leopold

Because the Raspberry Pi boots from a MicroSD card, the first thing I'd do would be to make a copy of that card and preserve the original. Because it's probably running Raspberry Pi OS (a Linux derivative), it would be easiest to dissect the contents of that card under Linux. Here's a bash script to mount the two partitions of the standard format Pi image:

#!/bin/bash
# Automatically mount a Raspberry Pi image 

if [[ ! $(whoami) =~ "root" ]]; then
    echo ""
    echo "**********************************"
    echo "*** This should be run as root ***"
    echo "**********************************"
    echo ""
    exit
fi

if [[ -z $1 ]]; then
    echo "Usage: ./mountimg.sh my-favorite-pi.img"
    exit
fi

if [[ ! -e $1 ]]; then
    echo "Error : Not an image file, or file doesn't exist"
    exit
fi

fatoffset=`parted -m $1 unit B print |sed -e 'y/B/ /'|grep fat|awk -F: '{print $2}'`
fatlimit=`parted -m $1 unit B print |sed -e 'y/B/ /'|grep fat|awk -F: '{print $4}'`
extoffset=`parted -m $1 unit B print |sed -e 'y/B/ /'|grep ext4|awk -F: '{print $2}'`
extlimit=`parted -m $1 unit B print |sed -e 'y/B/ /'|grep ext4|awk -F: '{print $4}'`
echo "fatoffset = ${fatoffset}."
echo "fatlimit = ${fatlimit}."
echo "exttoffset = ${extoffset}."
echo "exttlimit = ${extlimit}."

mkdir img1 img2
echo mount -t vfat -o loop,offset=${fatoffset},sizelimit=${fatlimit} "$1" img1
echo mount -t ext4 -o loop,offset=${extoffset},sizelimit=${extlimit} "$1" img2

Once the copy is mounted, I'd start by looking at its boot sequence.

What software does it load?

Study the boot sequence of the Pi from the copy of the SD card. Generally, the interesting bits are likely to have configuration items in /etc and /boot. The startup sequence is well documented so you might find it useful to start there. I have even sometimes seen source code left on a device, so you could get very lucky that way.

What users exist on the system?

Custom software for Raspberry Pi-based systems is often installed as either root or as another user. If it's under another user, it could be the default pi user or it could be some newly created user. By examining /etc/passwd you can see which users and systems are provisioned on the machine and get some clues as to what is running. For example, if it has mysql and mosquitto as users, you can conclude that is has both a database and an MQTT broker which suggest further avenues for exploration.

Try running the software

A Raspberry Pi is a pretty inexpensive device. I'd suggest getting one, if you don't already have one, and booting it up with your cloned SD card but no peripherals attached. Make a note of what processes are running and look for their binary files on the SD card.