So I took the camera apart and took a high-res picture of the PCB. The wifi sub-board is soldered on so I won't remove it yet to expose the ARM CPU. That being said, maybe there's a clue on here for how to mount and write to the flash memory:
I screwed up.
I finally did it, I figured out the commands to do a custom firmware, and I tried to flash it...now the camera is UNRESPONSIVE. It boots, but no network, the LED is on, can't talk to it, nada. I'm working on my backout plan now :) Hey, that's the price of hacking. Nevertheless, I've learned a TON which is worth sharing.
Below is the set of commands I used to generate my custom firmware. The original firmware is a tar.gz, which contains conprog.bin and rootfs.bin.gz, then rootfs.bin.gz unpacks into rootfs.bin which can be mounted with:
sudo mount -t romfs -o loop rootfs.bin /mnt/rootfsSo, baby was born, meaning not much time for hacking. Hooray though! Lucas Alexander Gullo, 9/8/2014, 6 lb 9 oz, 19 inches. Hooray!
I haven't had a ton of time to work on things, but there is some progress. Motorola got back to me, though not completely. They've given me a link to a repo with their modified cambozola, which is here: https://github.com/nikhilvs/cambozola-bms I'm still waiting on the source for mjpeg-streamer, and some guidance on the parameters to make the romfs image. I contacted gpl-violations.org and they are also trying to press on the fact that the GPL should have been included since it has embedded linux
I did something kind of interesting hardware wise though. Theory is, wouldn't it be neat to be able to move the camera, say if wife wants to monitor him napping downstairs for a while? So I figured out a way to provide stop-gap portable power for the monitor, so it can be moved around. Best yet, I did it without actually modifying what comes in the box, it all taps onto the exterior. Take a look:
Basically, I got a high current portable USB battery which charges off a micro USB, then made a converter for the power brick it comes with to go to micro USB, and then built a USB to barrel plug cable. Here's my parts list:
Pretty simple solder job, just cut the USB cable in half and strip the wires, bam. I've only tested it briefly, but in about 5 hours on the battery it dropped from 100%->88% so I imagine it'll run for a VERY long time.
Hopefully I'll get to dig through the source a bit more in upcoming weeks, but feel free to use these findings in your own hacking.
Related Posts:
So, I was able to acquire the actual ROM image for the firmware. Here's a dump of the file structure. I found a few gems:
The contents of /etc/passwd:
root:x:0:0:root:/:/bin/sh
nobody:x:99:99:Nobody:/:/sbin/nologin
ftp:x:501:0:ftp:/var:/bin/sh
usb:x:504:100::/usb:Also, this appears to be an init script mounting a bunch of things:
Read more »