So I took the camera apart and took a high-res picture of the PCB. The wifi sub-board is soldered on so I won't remove it yet to expose the ARM CPU. That being said, maybe there's a clue on here for how to mount and write to the flash memory:Read more »
I screwed up.
I finally did it, I figured out the commands to do a custom firmware, and I tried to flash it...now the camera is UNRESPONSIVE. It boots, but no network, the LED is on, can't talk to it, nada. I'm working on my backout plan now :) Hey, that's the price of hacking. Nevertheless, I've learned a TON which is worth sharing.
Below is the set of commands I used to generate my custom firmware. The original firmware is a tar.gz, which contains conprog.bin and rootfs.bin.gz, then rootfs.bin.gz unpacks into rootfs.bin which can be mounted with:
sudo mount -t romfs -o loop rootfs.bin /mnt/rootfs
Read more »
So, baby was born, meaning not much time for hacking. Hooray though! Lucas Alexander Gullo, 9/8/2014, 6 lb 9 oz, 19 inches. Hooray!
I haven't had a ton of time to work on things, but there is some progress. Motorola got back to me, though not completely. They've given me a link to a repo with their modified cambozola, which is here: https://github.com/nikhilvs/cambozola-bms I'm still waiting on the source for mjpeg-streamer, and some guidance on the parameters to make the romfs image. I contacted gpl-violations.org and they are also trying to press on the fact that the GPL should have been included since it has embedded linux
I did something kind of interesting hardware wise though. Theory is, wouldn't it be neat to be able to move the camera, say if wife wants to monitor him napping downstairs for a while? So I figured out a way to provide stop-gap portable power for the monitor, so it can be moved around. Best yet, I did it without actually modifying what comes in the box, it all taps onto the exterior. Take a look:
Basically, I got a high current portable USB battery which charges off a micro USB, then made a converter for the power brick it comes with to go to micro USB, and then built a USB to barrel plug cable. Here's my parts list:
- Intocircuit Power Castle 11200mAh Heavy Duty 5V 2A/1A Dual USB Ports External Battery Pack Charger
- CABLE USB-A TO MICRO USB-B 0.5M
- CONN JACK 1.32MM X 3.6MM
- Size H Coaxial DC Power Plug (2-Pack)
Pretty simple solder job, just cut the USB cable in half and strip the wires, bam. I've only tested it briefly, but in about 5 hours on the battery it dropped from 100%->88% so I imagine it'll run for a VERY long time.
Hopefully I'll get to dig through the source a bit more in upcoming weeks, but feel free to use these findings in your own hacking.
- Improving the Motorola Blink Baby Monitor/Camera
- Improving the Motorola Blink Baby Monitor/Camera (Part 2)
- Improving the Motorola Blink Baby Monitor/Camera (Part 4)
- Improving the Motorola Blink Baby Monitor/Camera (Part 5)
So, I was able to acquire the actual ROM image for the firmware. Here's a dump of the file structure. I found a few gems:
The contents of /etc/passwd:
Also, this appears to be an init script mounting a bunch of things:Read more »
So we recently purchased the Motorola Blink1 Wifi Baby Monitor (Is this the first blog post acknowledging the baby? He's due any day!) and it's neat hardware with SHIT software. Straight up, it doesn't do most things you would want. I'm working to reverse engineer this and make it workable...particularly on linux.
Before I start...MAD PROPS to Simon Aldrich, whose article laid the foundation to what I'm trying to do here. This got me started: Hacking the Motorola Blink 1 Baby Monitor (Part 1) and Hacking the Motorola Blink 1 Baby Monitor (Part 2)Read more »