Server:Server Status
« Improving the Motorola Blink Baby Monitor/Camera
Improving the Motorola Blink Baby Monitor/Camera (Part 3) »

Improving the Motorola Blink Baby Monitor/Camera (Part 2)

So, I was able to acquire the actual ROM image for the firmware. Here's a dump of the file structure. I found a few gems:

The contents of /etc/passwd:


root:x:0:0:root:/:/bin/sh
nobody:x:99:99:Nobody:/:/sbin/nologin
ftp:x:501:0:ftp:/var:/bin/sh
usb:x:504:100::/usb:

Also, this appears to be an init script mounting a bunch of things:


#!/bin/sh
/bin/mount -t proc none /proc
/bin/mount -t sysfs none /sys
/bin/mount -t ramfs none /dev
/bin/tar xzf /dev.tar.gz -C /
/bin/mount -t devpts none /dev/pts
/bin/mount -t ramfs none /dev/shm

Here's another one called initscript.sh:


#!/bin/sh
SOURCE_FOLDER=/mlsrb_src
DEST_FOLDER=/mlsrb
DEST2_FOLDER=mlswwwn
DEST3_FOLDER=cgi-bin
#extra folder needed
mkdir /var/run
mkdir /var/log
mkdir $DEST_FOLDER
mkdir $DEST_FOLDER/$DEST2_FOLDER
mkdir $DEST_FOLDER/$DEST2_FOLDER/$DEST3_FOLDER
for i in $SOURCE_FOLDER/* ; do
 name=${i##*/}
 ln -s $SOURCE_FOLDER/$name $DEST_FOLDER/$name
done
for i in $SOURCE_FOLDER/$DEST2_FOLDER/* ; do
 name=${i##*/}
 ln -s $SOURCE_FOLDER/$DEST2_FOLDER/$name $DEST_FOLDER/$DEST2_FOLDER/$name
done
for i in $SOURCE_FOLDER/$DEST2_FOLDER/$DEST3_FOLDER/* ; do
 name=${i##*/}
 ln -s $SOURCE_FOLDER/$DEST2_FOLDER/$DEST3_FOLDER/$name
$DEST_FOLDER/$DEST2_FOLDER/$DEST3_FOLDER/$name
done
#any extra thing need to do?????
cp /RT2870AP.dat /tmp/RT2870AP.dat
cp /RT2870STA.dat /tmp/RT2870STA.dat
/bin/pcd -c
/sbin/syslogd -S -s1024 -l7
#/mlsrb/iperf -s -D &
#/usr/sbin/telnetd -l /bin/sh
#remember to put any read/write file to this script

Now, getting access to the web server, I can see some new pages:

  • http://IP/BadPage.html
  • http://IP/OkPage.html
  • http://IP/test.html
  • http://IP/test.bk.html

Test introduces some new commands...some of which are very important!

  • move_backward_cont1.0 - Pan the camera backwards continuously until the limit of movement
  • move_left_cont1.0 - Pan the camera left continuously until the limit of movement
  • move_right_cont1.0 - Pan the camera right continuously until the limit of movement
  • move_forward_cont1.0 - Pan the camera forward continuously until the limit of movement
  • melodystop - Stop a looping lullaby
  • melody1 - Play lullaby 1 in a loop
  • melody2 - Play lullaby 1 in a loop
  • melody3 - Play lullaby 1 in a loop
  • melody4 - Play lullaby 1 in a loop
  • melody5 - Play lullaby 1 in a loop

Related Posts:


This entry was posted on Friday, August 29th, 2014 at 7:54 am and is filed under Geek, Projects.

2 Responses to “Improving the Motorola Blink Baby Monitor/Camera (Part 2)”

  1. baker Says:
    September 9th, 2014 at 10:15 pm

    driver for wireless
    ./romfs/etc/Wireless/RT2870AP:

    the driver files indicate a Ralink USB 802.11 draft-n wireless LAN chipsets RT2870AP, Ralink (MediaTek) dual-band Wi-Fi adapte
    so it could do ABGN if the OS was configured for for it.
    http://loganet1.com/descargas/wi-fi/RT2070_3070%20%20Driver/Linux/2009_0416_RT2070_Linux_STA_v2.1.0.0_ReleaseNote_ASEC.pdf

    yet more untapped HW resources

    I attempted to connect via SSH and telnet looks like the servces are off. same for FTP.

  2. kaim Says:
    November 7th, 2015 at 12:20 pm

    This is original HW. I do know there is a forum in China with lot’s of threads amd some linux for it. I do not know yet will it run or not, as I’m waiting for other camera and than will hack this crap.
    720p… seems the CMOS itself is unable to pass this res.

Leave a Reply