KitVision Rush HD100W


 * KitVision Rush HD100W

Specifications

 * Full HD 1080p (1920x1080)
 * Photo mode: 5 MP (CMOS)
 * Zoom: 10x (digital)
 * Format: HD 720p, HD 1080p
 * Video: 60fps (1280x720), 30fps (1920x1080)
 * Interface: HDMI out, USB 2.0, Wi-Fi built-in
 * Memory Card: microSD, microSDHC (32GB max)
 * 170° Ultra wide angle lens
 * Waterproof up to 10 metres

OUI: D4:2C:3D (Sky Light Digital Ltd.)

Appears as a clone of Polaroid XS100 and other brands of actioncams.

Connection
Default Wi-Fi password for the ACTIONCAM SSID is 123456789
 * and can be changed via web-interface or mobile app.

After connecting to its Wi-Fi hotspot telnet port 23 is open and logging in
 * as root/root is possible into ash with very limited busybox.

dd is not available on the default busybox 1.15 but the internal partitions of
 * the firmware can be dumped when a microSD card is present by using

"cat /dev/mtd0 > /tmp/ftp/SDdisk/mtd0.img" for the u-boot and mtd1-mtd5 for the other partitions, or a mips-compiled
 * binary e.g. from debian of full busybox can be simply copied to microSD
 * card and run dd via this complete busybox with all commands.

Although FAT32, the system mounts the partition in such a way that
 * all files on the microSD card appear as executable out of the box.

FTP is also available via Wi-Fi, log in with user name "ap71".
 * Makes accessible not just the microSD card with photos and videos,
 * but whole filesystem which can be easily copied via any ftp client.

Firmware update feature is available but firmware files do not seem
 * to be available anywhere publicly on the internet.

Files with the firmware that the fw update script checks are burn.bin
 * or W_D.bin, not sure which file is which.

Partition layout
dev:   size   erasesize  name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 002b0000 00010000 "rootfs" mtd3: 000e0000 00010000 "uImage" mtd4: 00010000 00010000 "NVRAM" mtd5: 00010000 00010000 "ART"
 * 1) cat /proc/mtd:

Binwalks of mtd partitions
$ binwalk mtd0.img

DECIMAL      HEXADECIMAL     DESCRIPTION

13472        0x34A0          U-Boot version string, "U-Boot 1.1.4 (Mar 31 2012 - 15:19:16)" 13520        0x34D0          CRC32 polynomial table, big endian 14828        0x39EC          uImage header, header size: 64 bytes, header CRC: 0xD013C522, created: 2012-03-31 07:19:17, image size: 39693 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x546AF927, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image" 14892        0x3A2C          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 115920 bytes

$ binwalk mtd2.img

DECIMAL      HEXADECIMAL     DESCRIPTION

0            0x0             Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2427493 bytes, 585 inodes, blocksize: 16384 bytes, created: 2013-08-14 03:35:05

$ binwalk mtd3.img

DECIMAL      HEXADECIMAL     DESCRIPTION

0            0x0             uImage header, header size: 64 bytes, header CRC: 0x4D776142, created: 2013-08-05 19:44:23, image size: 902415 bytes, Data Address: 0x80002000, Entry Point: 0x801BFFD0, data CRC: 0x2AF16904, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image" 64           0x40            LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2544044 bytes