KitVision Rush HD100W

KitVision Rush HD100W

(Est.) release date: August 2013
EAN: 5030578879581 (UPC DB, On eBay)
Country of manuf.: China

Amazon image

ASIN
B01N5EPNCQ (, On Amazon, On CCC)

Type: wireless camera, sport camera

Power: ? VDC, ? A
Connector type: Mini USB

CPU1: Atheros AR9331 (400 MHz)
FLA1: 4 MiB4,194,304 B 32,768 Kib 4,096 KiB 32 Mib 0.00391 GiB  (Brand? Model?)
RAM1: 16 MiB16,777,216 B 131,072 Kib 16,384 KiB 128 Mib 0.0156 GiB  (Brand? Model?)

Expansion IFs: none specified

WI1 chip1: Atheros AR9331
WI1 802dot11 protocols: bgn
WI1 MIMO config: 1x1:1
WI1 antenna connector: integrated

bgn

Stock bootloader: U-Boot 1.1.4 ap121

Stock FW OS: Linux 2.6.31 LSDK-9.2.0

Flags: HDMI out, microSD Card slot

Default SSID: ACTIONPLUS
Default IP address: 192.168.1.2
the IP 192.168.1.2 is used by 33 additional devices
of which 0 are KitVision devices
Default login user: root
Default login password: root
root:root credentials used by 24 additional devices
of which 0 are KitVision devices

802dot11 OUI: D4:2C:3D

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.

Rush Action Camera HD100W

KitVision Rush HD100W

Specifications

Full HD 1080p (1920x1080)
Photo mode: 5 MP (CMOS)
Zoom: 10x (digital)
Format: HD 720p, HD 1080p
Video: 60fps (1280x720), 30fps (1920x1080)
Interface: HDMI out, USB 2.0, Wi-Fi built-in
Memory Card: microSD, microSDHC (32GB max)
170° Ultra wide angle lens
Waterproof up to 10 metres

OUI: D4:2C:3D (Sky Light Digital Ltd.)

Appears as a clone of Polaroid XS100 and other brands of actioncams.

Connection

Default Wi-Fi password for the ACTIONCAM SSID is 123456789

and can be changed via web-interface or mobile app.

After connecting to its Wi-Fi hotspot telnet port 23 is open and logging in

as root/root is possible into ash with very limited busybox.

dd is not available on the default busybox 1.15 but the internal partitions of

the firmware can be dumped when a microSD card is present by using

"cat /dev/mtd0 > /tmp/ftp/SDdisk/mtd0.img"

for the u-boot and mtd1-mtd5 for the other partitions, or a mips-compiled

binary e.g. from debian of full busybox can be simply copied to microSD

card and run dd via this complete busybox with all commands.

Although FAT32, the system mounts the partition in such a way that

all files on the microSD card appear as executable out of the box.

FTP is also available via Wi-Fi, log in with user name "ap71".

Makes accessible not just the microSD card with photos and videos,

but whole filesystem which can be easily copied via any ftp client.

Firmware update feature is available but firmware files do not seem

to be available anywhere publicly on the internet.

Files with the firmware that the fw update script checks are burn.bin

or W_D.bin, not sure which file is which.

Partition layout

# cat /proc/mtd:
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 002b0000 00010000 "rootfs"
mtd3: 000e0000 00010000 "uImage"
mtd4: 00010000 00010000 "NVRAM"
mtd5: 00010000 00010000 "ART"

Binwalks of mtd partitions

$ binwalk mtd0.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
13472         0x34A0          U-Boot version string, "U-Boot 1.1.4 (Mar 31 2012 - 15:19:16)"
13520         0x34D0          CRC32 polynomial table, big endian
14828         0x39EC          uImage header, header size: 64 bytes, header CRC: 0xD013C522, 
           created: 2012-03-31 07:19:17, image size: 39693 bytes, Data Address: 0x80010000, 
           Entry Point: 0x80010000, data CRC: 0x546AF927, OS: Linux, CPU: MIPS, image type: 
           Firmware Image, compression type: lzma, image name: "u-boot image"
14892         0x3A2C          LZMA compressed data, properties: 0x5D, dictionary size: 
                              8388608 bytes, uncompressed size: 115920 bytes

$ binwalk mtd2.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:lzma, 
           size: 2427493 bytes, 585 inodes, blocksize: 16384 bytes, created: 2013-08-14 03:35:05

$ binwalk mtd3.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x4D776142, 
          created: 2013-08-05 19:44:23, image size: 902415 bytes, Data Address: 0x80002000, 
          Entry Point: 0x801BFFD0, data CRC: 0x2AF16904, OS: Linux, CPU: MIPS, image type: 
          OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
64            0x40            LZMA compressed data, properties: 0x5D, dictionary size: 
                              8388608 bytes, uncompressed size: 2544044 bytes