Improving the Motorola Blink Baby Monitor/Camera (Part 2)
So, I was able to acquire the actual ROM image for the firmware. Here's a dump of the file structure. I found a few gems:
The contents of /etc/passwd:
root:x:0:0:root:/:/bin/sh
nobody:x:99:99:Nobody:/:/sbin/nologin
ftp:x:501:0:ftp:/var:/bin/sh
usb:x:504:100::/usb:Also, this appears to be an init script mounting a bunch of things:
#!/bin/sh
/bin/mount -t proc none /proc
/bin/mount -t sysfs none /sys
/bin/mount -t ramfs none /dev
/bin/tar xzf /dev.tar.gz -C /
/bin/mount -t devpts none /dev/pts
/bin/mount -t ramfs none /dev/shmHere's another one called initscript.sh:
#!/bin/sh
SOURCE_FOLDER=/mlsrb_src
DEST_FOLDER=/mlsrb
DEST2_FOLDER=mlswwwn
DEST3_FOLDER=cgi-bin
#extra folder needed
mkdir /var/run
mkdir /var/log
mkdir $DEST_FOLDER
mkdir $DEST_FOLDER/$DEST2_FOLDER
mkdir $DEST_FOLDER/$DEST2_FOLDER/$DEST3_FOLDER
for i in $SOURCE_FOLDER/* ; do
name=${i##*/}
ln -s $SOURCE_FOLDER/$name $DEST_FOLDER/$name
done
for i in $SOURCE_FOLDER/$DEST2_FOLDER/* ; do
name=${i##*/}
ln -s $SOURCE_FOLDER/$DEST2_FOLDER/$name $DEST_FOLDER/$DEST2_FOLDER/$name
done
for i in $SOURCE_FOLDER/$DEST2_FOLDER/$DEST3_FOLDER/* ; do
name=${i##*/}
ln -s $SOURCE_FOLDER/$DEST2_FOLDER/$DEST3_FOLDER/$name
$DEST_FOLDER/$DEST2_FOLDER/$DEST3_FOLDER/$name
done
#any extra thing need to do?????
cp /RT2870AP.dat /tmp/RT2870AP.dat
cp /RT2870STA.dat /tmp/RT2870STA.dat
/bin/pcd -c
/sbin/syslogd -S -s1024 -l7
#/mlsrb/iperf -s -D &
#/usr/sbin/telnetd -l /bin/sh
#remember to put any read/write file to this scriptNow, getting access to the web server, I can see some new pages:
- http://IP/BadPage.html
- http://IP/OkPage.html
- http://IP/test.html
- http://IP/test.bk.html
Test introduces some new commands...some of which are very important!
- move_backward_cont1.0 - Pan the camera backwards continuously until the limit of movement
- move_left_cont1.0 - Pan the camera left continuously until the limit of movement
- move_right_cont1.0 - Pan the camera right continuously until the limit of movement
- move_forward_cont1.0 - Pan the camera forward continuously until the limit of movement
- melodystop - Stop a looping lullaby
- melody1 - Play lullaby 1 in a loop
- melody2 - Play lullaby 1 in a loop
- melody3 - Play lullaby 1 in a loop
- melody4 - Play lullaby 1 in a loop
- melody5 - Play lullaby 1 in a loop
Related Posts:
- Improving the Motorola Blink Baby Monitor/Camera
- Improving the Motorola Blink Baby Monitor/Camera (Part 3)
- Improving the Motorola Blink Baby Monitor/Camera (Part 4)
- Improving the Motorola Blink Baby Monitor/Camera (Part 5)
driver for wireless
./romfs/etc/Wireless/RT2870AP:
the driver files indicate a Ralink USB 802.11 draft-n wireless LAN chipsets RT2870AP, Ralink (MediaTek) dual-band Wi-Fi adapte
so it could do ABGN if the OS was configured for for it.
http://loganet1.com/descargas/wi-fi/RT2070_3070%20%20Driver/Linux/2009_0416_RT2070_Linux_STA_v2.1.0.0_ReleaseNote_ASEC.pdf
yet more untapped HW resources
I attempted to connect via SSH and telnet looks like the servces are off. same for FTP.
This is original HW. I do know there is a forum in China with lot’s of threads amd some linux for it. I do not know yet will it run or not, as I’m waiting for other camera and than will hack this crap.
720p… seems the CMOS itself is unable to pass this res.