did you know: IP cameras have non-standardized board-to-cable connectors which you sometimes have to build cables for yourself. this makes it easy to swap the polarity by accident
did you know: IP cameras can survive reverse polarity +12V@2A to the input (apparently)
did you know: IP cameras that work properly make terrifyingly loud clicking noises on startup (it's the IR cut filter solenoid)

anyway i have my aliexpress camera devkit booting :3

this camera, purchased a week ago. runs linux 4.9.37 (from 2017). where do they even get these vintage builds. like you'd have to go out of your way to ship a decade old firmware today i think

@whitequark “apparently” 😂

@malwareminigun i was disappointed with myself for swapping two power pins (i did check for this! not well enough apparently) but because of the way CMOS electronics is built (where every FET has a body diode), it often survives reverse polarity to power pins provided the die can dissipate whatever you're dumping into it

@whitequark nah that's not so old 2017 is only like four y-- oh

@iximeow my thoughts exactly

@iximeow i was like "hey, it's not 2.4 at least... wait. shit"

@whitequark SoC vendors really hate upstreaming and Linux isn’t easy to keep up with so I think most of the time the Linux version that silicon vendors provide is basically from the day that they started building drivers for it

@ignaloidas yeah i think you're right. but i thought this SoC is newer

@whitequark probably a low cost allwinner or whatever SoC that shipped with that linux kernel version in the SDK when it launched and has never been updated

@azonenberg it's not allwinner, it's GK7205V300

oh hey the vendor (not for this specific devkit but it's a very similar one) directly advertises openipc support

@whitequark It’s an A7, this screams pre-2020 to me

@ignaloidas the u-boot build is from 2024

@whitequark cortex-a7 and ddr3l? Sounds about the right age to have launched with that kernel

@azonenberg hm. point

@whitequark It’s remarkable how electronics can survive serious abuse. On one of the first chips I ever worked on, the metal cap on the package was rotate 90 degrees, so I inserted one of the handful of our first samples wrong into the socket. High current, chip was cooking and I was sweating, but it worked just fine after rotating it.
(See also: 7V on 5V 74HC chips…)

@tom_verbeure you can run atmegas on 12V apparently

beautiful guide

success

why does this camera have a mac address starting with 00:12:34 lol

i have a tingling suspicion that this isn't a real Ethernet OUI

ok, the linux part of the camera works. the sensor part of the camera absolutely does not

okay, what the fuck is going on

the aliexpress listing claims the camera uses imx335. and that the resolution is 6 MP. one of those things has got to be wrong

well, this answers the question of "which sensor it is" at least

imx307 is a 1080p sensor!! this isn't a 6 MP board

also why does it have encrypted jsons. cursed

fucking camera vendors. i knew this would be a massive pain for no reason. it has a camera, so it must be miserable

i guess i'm going to reverse-engineer their homegrown json encryption scheme

i like it when vendors slap some sort of homegrown encryption on top of configuration files and then, conveniently, put it into a shared library under an appropriate, easily visible name

i also like it when they leave verbose logging in :)

@whitequark what reversing tool is that?

here's the memecrypto

@hailey https://binary.ninja, it's basically the best you can get today imo

and decrypted

hey, do you think i'd do well at a CTF contest?

@whitequark frighteningly well, I imagine

@whitequark they’re software-scaling the JPEG output to 6MP, which reflects the marketing claim?!

@jpm incredible

this isn't even fucking... json

it has trailing commas

@whitequark incredible how they felt that they needed to encypt 3 numbers all less than 10 as if you couldn’t brute-force that if you were building a driver or sth similar.

@ignaloidas there's like ten more of these JSON files

@foone @whitequark run away with the entire flag factory, probably

@SnoopJ @foone i always thought that a CTF would be too hard so i never even tried

oh hey, now that i can decrypt the stock config i know which GPIOs it's using

@whitequark json5?

the weird shit at the beginning, though...

@solonovamax that's just their memecrypto that i forgot to trim

looked up the passwords from /etc/passwd and turns out the original firmware is vulnerable to Mirai. great

i was going to try and log into it but it doesn't seem to present a getty on a serial terminal and also doesn't have dropbear

hm. i might have to repackage the squashfs to add a ssh/telnet server to it or something

@whitequark what font is this, it's rather nice

@jcoglan Inter

@whitequark is this a jebani dostawcy moment?

@vmp_ this is extremely a jebani dostawcy moment

okay so for some goddamn reason i don't understand, their kernel doesn't print anything to the serial console and doesn't present a prompt. i think this is an anti-RE measure, but i am not going to bother confirming it

right now i think my main option (without having to binary patch the kernel uImage) is to put a script to /mnt/custom which runs telnetd

of course the existing busybox doesn't have a telnetd. and the prebuilts i can find can't fit into the 0.5MB custom partition even post-squashfs

so now i'm building busybox just to be able to grab logs from the camera

jebani dostawcy.

@whitequark lol but it literally has a ‘jsons’ folder?

@zbrown yes

@whitequark funfuckingtastic!

@kkarhan tbf after double checking, i think they "fixed" it by removing shell access

@whitequark consider #toybox if it has what you need.

https://landley.net/toybox

• Granted it doesn't have #telnet and the head maintainer @landley explicitly endorsed #dropbear (a lightweight #SSH server & client) instead, but in my experiements ( @OS1337, based off @w84death 's #Floppinux ) allowed me to quickly cobble together a <1.440kB boot image (incl. >200kB for #ISOLINUX alone!) that does an 80×25 MDA console both on VGA & Serial (@ 9600/8/N1)…

I hope that helps you...

@kkarhan it was quite easy to build busybox

@whitequark does it have netcat or socat? Maybe you can use your script to start a bind shell or reverse shell instead of having to get telnet on there? Or if the shell has special files like bash /dev/tcp/192.268.x.x/1337

@rickoooooo nope and nope

it took me an embarrassingly long time (i spent half a hour trying to get an x86_64 busybox to work on armv7 because i picked the wrong cross compiler. oops) but here we go

it took me some more time to figure out why the telnetd is crashing (remember, i have no terminal output) but it turns out that i used make allnoconfig on busybox and didn't add back Unix98 PTY support (why can you even turn that off?!)

i have root!

i've confirmed via dmesg that the vendor is lying and this is an imx307 camera

==== online_flag=0, cmos_yuv_flag=0, sensor=imx307, chip=gk7205v300, board=demo, sensor_remux=0====

i also confirmed that the camera does work with the stock firmware (it... it has a hardcoded password, admin:tlJwpbo6, because of course anybody on the internet who knows this combination of letters should be able to view your streams). so it's not a hardware issue. it's just fucking cursed

and yes, it upscales an image from a 2MP sensor to 3072x2048 (6MP).

@whitequark good product placement lol

@nanographs literally using it to poke at the camera

@whitequark

@0xabad1dea i feel like the stuff i encounter is just not sophisticated enough to give me the right skillset for CTFs

@whitequark inter has a monospace version?

@jcoglan errrr sorry

Monaspace Neon Light is the mono

i think the bit that i find particularly insulting is that the sensor the vendor claims to be using (imx335) isn't even a 6MP sensor, it's a 5MP one. so even if they were telling the truth about the sensor they'd still be lying about the resolution (by upscaling the images)

fucking slitears.

@pe4wj oh, i was looking at my power supply and clocked it drawing two amps at 1.5V or something. very much not

i got aliexpress to issue me a refund on the basis of "the vendor is a liar" and, because i never learn, i bought another IP camera devkit

i'd say "wish me luck" but where we're going there is no such thing as luck.

at least this on advertises openipc compatibility (does this mean anything? ehhhh)

@whitequark Amazing. You have singlehandedly convinced me to never ever buy an IP camera

@krans wise choice tbh

@whitequark easy root! you can use pwnkit :)

@pollyglot it doesn't have non-root processes anyway

@whitequark lmao

@pollyglot i mean what do you expect? it's an embedded linux device. most of them are like this, regardless of date

@whitequark i'm too CTF pilled, I haven't spent enough time touching real systems to build proper intuition ig

@pollyglot oh

yeah uh. the bad security measures are "literally nothing and the password is hardcoded". the good security measures are "it doesn't listen on port 23 and maybe not on 22" (everything still runs as root)

i cannot recall a single embedded device i've examined which makes any meaningful use of Unix accounts

@pollyglot well, i think some applications drop to nobody:nobody, but due to space constraints vendors usually make one giant C++ binary that does Everything and so it needs CAP_SYS_ADMIN and more, at which point there's not much you can do

@whitequark 😻What tool is this? Doesn't look like Ghidra to me.

@vvv https://binary.ninja, it is exemplary

@whitequark awesome for hackers

@pollyglot you'd think so, but i spent a while trawling through up-to-date ip camera firmware and looking for obvious bugs and i found nothing after a few dozen hours spent looking

@whitequark be honest, you actually buy these things so you can reverse some memecrypto, as a treat :3

(jokes aside i do think having some reversing challenges thrown at you in the middle of bringup is pretty fun even though given the choice i would always pick "it just works and i can go read a book instead" instead)

@dojoe it's... it used to genuinely scare me into giving up. these days i just go "Ah well here we go again" and open binja, there are very few RE challenges out in the wild at this point that faze me at all

@whitequark Look on the bright side -- at least it's not a printer.

@darkling i wish it was a printer.

@whitequark

@josyb congrats on missing the point entirely

@whitequark
this point?

@josyb @whitequark I doubt a random chinese camera vendor has anything to do with a small swiss company that builds measurement and monitoring equipment for the electric grid

@charlotte @whitequark
Yes, he Chinese camera vendor just 'borrowed' the OUI

@josyb sigh the reason it can't be 01-23-45 is because that'd make it a multicast address

@whitequark you might want to take a look at Radaxa Cubie A5E.

Radaxa makes compatible PoE and Camera Huts: https://radxa.com/products/accessories#audio-&-video

A bit more expensive, but no fuckery with reversing cursed vendor linux boards, so that’s a win I suppose?

@alex i've seen how camera bringup on an rpi looks like and it's almost as bad as on the ip cameras proper (still takes days and some awful blobs) but now it's also expensive

@josyb @whitequark it’s obviously a dummy value and nothing is being “borrowed”. OUI is not real in this context even if you can misinterpret it as belonging to some random small company

@whitequark Got it; it is long time since I did something with OUI (year 2000 or so)

@josyb i had a misfortune of writing a TCP/IP stack a few years ago

@charlotte @whitequark As it is an IP camera, the MAC address is not a dummy at all; so the Chinese camera vendor obviously 'borrowed' it. And the owner itself is not 'some random small company' at all.

@whitequark for some reason i thought ali refunds are like “you can try but 99% you won’t succeed”

@lina
So far, I had 100% success in my handful of ali refund attempts, including a 3€ 2TB USB flash, that, as a surprise to absolutely nobody, turned out to be a half broken 16GB chip!
@whitequark

@ge0rg @lina theres a sketchy russian website that lets you reflash the thumbdrives to their real size btw

@whitequark huh, that bad nowadays?

Last time I had to deal with camera on rpi zero w was like 7 (?!) years ago. I remeber eating bag of dicks to get opencv work on armhf, but don’t remember having issues with camera. It was their “offical” camera module, with OV5647, if I’m not mistaken. Likely that raspbian had all the things already wired for it.

I still have few cameras abd rpis somewhere in a drawer. I can mail them if they are any use to you

@alex i think it was a third party device

@kkarhan @whitequark @landley @OS1337

Interesting but too big. i486 binary is 750KiB or 500KiB after upx.
My custom busybox is now 137KiB

@w84death @whitequark @landley granted the 1440kB is the entire boot image for @OS1337 and the #linux #kernel + #initramfs with #toybox comes out to ~ 700kB.

@kkarhan @whitequark @landley @OS1337 ah, so you can also customize it. I will take a closer look ;)