ipcam APTI 201c4-2012WP two questions

[Tuffenuff]

Hello specs,

Two quick questions about this cam:
1. In config i set path to record on my hdd plugged to router and set ftp connect to send screenshots when movement detected. Both don't work but when i set ftp server on local pc and set path to record on local hdd it works. Whats wrong?

2. This cam have several ports open and i want to inspect linux system however i dont have telnet enabled.
I've checked that on port 787 there's telnet switch where you can enable telnet. But i dont have password to log in. Anybody knows how to get into linux system on this cam? Def ip 192.168.1.168
some specs of ipcam:
firmware: 3516EV100_F23_B1T0A1M0C0_W_[E00016732]_8.1.29.1
software version: 8.1.27.3
web version: 8.1.28.180712

 

[alastairstevenson]

I've checked that on port 787 there's telnet switch where you can enable telnet. But i dont have password to log in. Anybody knows how to get into linux system on this cam? Def ip 192.168.1.168

That sounds like HeroSpeed firmware and the Lucky787 TelnetSwitch logonID. The password is derived from the camera MAC address amongst other data from what I recall and coded a bit.

Without resorting to hooking up the serial console, and depending on what the firmware version is, there may be a couple of ways to enable telnet :
3518 Telnet Passwords

With the serial console you can ask the camera for the Luck787 password. That's lucky!

# /hisi/TelnetSwitch
[Trace]: main 117: SOFTVER_PATH /opt/app/config/Ver.ini
[Trace]: libTelnetSwitchInit 410: Ver 3516CV300_IMX307_B1T0A1M0C1_W_8.1.30.4 Mac 00:00:1B:25:52:14
libGetTelnetPasswd 129: Password 45808550697B
[Trace]: create tcp connect success 3,start listen...
[Trace]: SocketThread 342: fd = 3
^C
#

But on the last one I did, which had 3516CV300_IMX307_BASE_W_8.1.30.4 firmware, HeroSpeed have closed off the 'window of opportunity' (they obviously keep up to date with IPCamTalk !!) so I had to unpack the firmware, tweak the TelnetSwitch kill and mod the telnet password and update the camera with the modded firmware. Not as hard as it sounds.

 

[Tuffenuff]

So options i have is: connect by serial console or to unpack and mod a firmware,
how can i unpack/pack *.fls file? Also what does mean password is derived? Is mac id cipher by some des256 or sth?

 

[alastairstevenson]

Is mac id cipher by some des256 or sth?

To be honest I couldn't be bothered to map out the code they used to create the password - it wasn't any recognised standard, it was easier to just go past it.
It was a combination of the MAC address, the firmware version, and some "if this then that" byte shuffling.

If you have the .fls file you should be able to easily unpack it once you've inspected it for the boundaries between the files from the manifest.
But in reality you only need to do that to be sure where to patch, after that you can just hexedit the main firmware file.
These is my aide-memoire from the last one, where I'd bought 5 IMX307 low-light VF cameras to install at my local Men's Shed and didn't like that there was no telnet access :

It looks like HeroSpeed have removed the 'window of opportunity' that I
discovered could be used to shut down TelnetSwitch by having telnet enabled
for several seconds at bootup before TelnetSwitch became active and shut it down.
This allowed TelnetSwitch to be renamed, given the telnet root password.
So in this version of the firmware, I had to tweak the firmware and update with it
in order to enable telnet.

The changes made in the .FLS file were :

Uncomment "#telnetd &" in LongSeStart at 0x0171c6

touch /tmp/sddrives_ok
#telnetd &
ifconfig eth0 192.168.1.168 netmask 255.255.255.0

Comment out "/hisi/TelnetSwitch &" at 0x0176d0

sleep 1
/hisi/Main &
/hisi/TelnetSwitch &

Replace the root password hash in passwd and passwd- at 0x0176e5 and 0x01770b
with that for ls123 LHjQopX4yjf1Q

With no tamper checking, the firmware applies OK, and telnet is always available.
An easy change.

And here was the simple unpack script so I could inspect the contents :

#!/bin/sh
# This is a simple 'split out some of the components' script based on a manual inspection
# of the original 3516CV300_IMX307_BASE_W_8.1.30.4.FLS firmware.
# It looks like the firmware is organised as a simple manifest front section, giving name,
# location and size for each component.
# The driver behind extracting the components is to gain telnet access to a root shell
# by circumventing the Lucky787 TelnetSwitch password and then the telnet password.
#
# It looks like HeroSpeed have closed off the 'window of opportunity' where telnet was
# initially active on bootup until TelnetSwitch was activated, which had briefly  allowed
# telnet access to swap out TelnetSwitch and use a cracked telnet password.
#
#
dd if=orig_fw.FLS of=libHi3516CV300IspDev.so bs=1 skip=$((0x0C18)) count=$((0xD140))
dd if=orig_fw.FLS of=Device.ini bs=1 skip=$((0xdd58)) count=$((0x41))
dd if=orig_fw.FLS of=DeviceIdentify bs=1 skip=$((0xdd99)) count=$((0x8ec8))
dd if=orig_fw.FLS of=LongSeStart bs=1 skip=$((0x016c61)) count=$((0x06ec))
dd if=orig_fw.FLS of=sdcard_hotplug.sh bs=1 skip=$((0x01734d)) count=$((0x025e))
dd if=orig_fw.FLS of=startapp bs=1 skip=$((0x0175ab)) count=$((0x013a))
dd if=orig_fw.FLS of=passwd bs=1 skip=$((0x0176e5)) count=$((0x26))
dd if=orig_fw.FLS of=passwd- bs=1 skip=$((0x01770b)) count=$((0x26))
dd if=orig_fw.FLS of=Ver.ini bs=1 skip=$((0x017731)) count=$((0x2d))
dd if=orig_fw.FLS of=config.ini bs=1 skip=$((0x01775e)) count=$((0x0747))
dd if=orig_fw.FLS of=isp.ini bs=1 skip=$((0x017ea5)) count=$((0x87c6))
#
# This is actually the start of the app SQUASHFS partition.
dd if=orig_fw.FLS of=app.squashfs bs=1 skip=$((0x02066b))
# Which we can unpack into the default folder.
 unsquashfs app.squashfs
# End

Warning - please be aware that messing around with the internals like this does present the risk of bricking the camera.

 

[Tuffenuff]

Alright thanks for some info. I have firmware file from herospeed site but not 100% sure if it match my cams firmware. The last question is how to backup my original firmware from ipcam i assume without serial console connection it won't be easy? I see there will be a lot of work to do and to learn some coz i will be doing it for a first time

 

[alastairstevenson]

how to backup my original firmware from ipcam i assume without serial console connection it won't be easy?

You'd need telnet access ...

I see there will be a lot of work to do and to learn

As a starter, just use a hex editor (eg HxD) to look around the firmware file. They can easily do a search for specific text or bytes.
It will likely have the same items, but different places, as those I referenced above.

 

[Tuffenuff]

Yup i've installed and searched for bytes I do same descriptions but with changing bytes under editor i'm a lame;> So i need some advice in here what should i change coz those u mentioned are not found;(

 

[alastairstevenson]

those u mentioned are not found;

Your screenshot is of the 'manifest', the file list of the contents of the firmware.
If you scroll down a bit I'm pretty sure you will find the same references as in my aide-memoire.

How sure are you that the firmware you have is correct for the camera?

I'm not sure if this is from the same firmware as you have, but check these locations :
0x1C954 for #telnetd &
0x1CAE3 for /hisi/TelnetSwitch &
root passwords at
0x1CC31
0x1CC57

But if you are not sure, and how to recover if it breaks - maybe best to leave well alone.