KitVision Rush HD100W
KitVision Rush HD100W
Type: wireless camera, sport camera
Power: ? VDC, ? A
Connector type: Mini USB
CPU1: Atheros AR9331 (400 MHz)
FLA1: 4 MiB4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br /> (Brand? Model?)
RAM1: 16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (Brand? Model?)
Expansion IFs: none specified
WI1 chip1: Atheros AR9331
WI1 802dot11 protocols: bgn
WI1 MIMO config: 1x1:1
WI1 antenna connector: integrated
bgn
Stock bootloader: U-Boot 1.1.4 ap121
Stock FW OS: Linux 2.6.31 LSDK-9.2.0
Flags: HDMI out, microSD Card slot
Default SSID: ACTIONPLUS
Default IP address: 192.168.1.2
the IP 192.168.1.2 is used by 33 additional devices
of which 0 are KitVision devices
Default login user: root
Default login password: root
root:root credentials used by 26 additional devices
of which 0 are KitVision devices
802dot11 OUI: D4:2C:3D
For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
Rush Action Camera HD100W
- KitVision Rush HD100W
Specifications
- Full HD 1080p (1920x1080)
- Photo mode: 5 MP (CMOS)
- Zoom: 10x (digital)
- Format: HD 720p, HD 1080p
- Video: 60fps (1280x720), 30fps (1920x1080)
- Interface: HDMI out, USB 2.0, Wi-Fi built-in
- Memory Card: microSD, microSDHC (32GB max)
- 170° Ultra wide angle lens
- Waterproof up to 10 metres
OUI: D4:2C:3D (Sky Light Digital Ltd.)
Appears as a clone of Polaroid XS100 and other brands of actioncams.
Connection
Default Wi-Fi password for the ACTIONCAM SSID is 123456789
- and can be changed via web-interface or mobile app.
After connecting to its Wi-Fi hotspot telnet port 23 is open and logging in
- as root/root is possible into ash with very limited busybox.
dd is not available on the default busybox 1.15 but the internal partitions of
- the firmware can be dumped when a microSD card is present by using
"cat /dev/mtd0 > /tmp/ftp/SDdisk/mtd0.img"
for the u-boot and mtd1-mtd5 for the other partitions, or a mips-compiled
- binary e.g. from debian of full busybox can be simply copied to microSD
- card and run dd via this complete busybox with all commands.
Although FAT32, the system mounts the partition in such a way that
- all files on the microSD card appear as executable out of the box.
FTP is also available via Wi-Fi, log in with user name "ap71".
- Makes accessible not just the microSD card with photos and videos,
- but whole filesystem which can be easily copied via any ftp client.
Firmware update feature is available but firmware files do not seem
- to be available anywhere publicly on the internet.
Files with the firmware that the fw update script checks are burn.bin
- or W_D.bin, not sure which file is which.
Partition layout
# cat /proc/mtd: dev: size erasesize name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 002b0000 00010000 "rootfs" mtd3: 000e0000 00010000 "uImage" mtd4: 00010000 00010000 "NVRAM" mtd5: 00010000 00010000 "ART"
Binwalks of mtd partitions
$ binwalk mtd0.img DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 13472 0x34A0 U-Boot version string, "U-Boot 1.1.4 (Mar 31 2012 - 15:19:16)" 13520 0x34D0 CRC32 polynomial table, big endian 14828 0x39EC uImage header, header size: 64 bytes, header CRC: 0xD013C522, created: 2012-03-31 07:19:17, image size: 39693 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x546AF927, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image" 14892 0x3A2C LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 115920 bytes $ binwalk mtd2.img DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2427493 bytes, 585 inodes, blocksize: 16384 bytes, created: 2013-08-14 03:35:05 $ binwalk mtd3.img DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 uImage header, header size: 64 bytes, header CRC: 0x4D776142, created: 2013-08-05 19:44:23, image size: 902415 bytes, Data Address: 0x80002000, Entry Point: 0x801BFFD0, data CRC: 0x2AF16904, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image" 64 0x40 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2544044 bytes