{"id":1226,"date":"2019-01-20T20:16:45","date_gmt":"2019-01-21T02:16:45","guid":{"rendered":"http:\/\/www.jedge.com\/wordpress\/?p=1226"},"modified":"2019-01-20T23:13:16","modified_gmt":"2019-01-21T05:13:16","slug":"sricam-ap001-uart","status":"publish","type":"post","link":"https:\/\/www.jedge.com\/wordpress\/2019\/01\/sricam-ap001-uart\/","title":{"rendered":"SRICAM AP001 &#8211; UART"},"content":{"rendered":"<p>Please see the original post on <a href=\"http:\/\/www.jedge.com\/wordpress\/2018\/11\/ip-camera-security\/\" rel=\"noopener\" target=\"_blank\">IP Camera Security<\/a> before reading the rest of this post.<\/p>\n<p>Based on <a target=\"_blank\" href=\"http:\/\/www.jedge.com\/wordpress\/2018\/11\/ip-camera-security\/#comments\">comment #2<\/a> by Carlo UART has been identified for my SRICAM AP001. Carlo stated that the board looks very similar to the <a href=\"http:\/\/nixcores.com\/\" rel=\"noopener\" target=\"_blank\">NixCore <\/a>and this is correct.  I was not able to identify UART with JTAGulator because I never soldered any wires to pins 39 and 40!<br \/>\n<!--more--><br \/>\n<a href=\"http:\/\/www.jedge.com\/images\/nixcore_x1_header.jpg\"><img loading=\"lazy\" decoding=\"async\"  width=\"400\" src=\"http:\/\/www.jedge.com\/images\/nixcore_x1_header.jpg\" width=\"1000\" height=\"655\" class=\"aligncenter size-full\" \/><\/a><br \/>\nI soldered wires to RX2 (pin 39), TX2 (pin 40), and GND (pin 37) and connected them to a UART to USB adapter.  Fired up minicom at 57600 8n1 and we have access!<\/p>\n<p><a href=\"http:\/\/www.jedge.com\/cpg15x\/displayimage.php?pid=142&#038;fullsize=1\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/www.jedge.com\/cpg15x\/albums\/IP_Cameras\/normal_IMG_20190120_1439198.jpg\" width=\"300\" height=\"400\" class=\"aligncenter size-full\" \/><\/a><pre><code>\nU-Boot 1.1.3 (Dec 26 2012 - 17:31:39)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n\nBoard: Ralink APSoC DRAM:&nbsp;&nbsp;32 MB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \nrelocate_code Pointer at: 81fb4000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nsysctl:40200300&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \nspi_wait_nsec: 42&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \nspi device id: ef 40 17 0 0 (40170000)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nfind flash: W25Q64BV&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nraspi_read: from:30000 len:1000&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \n.raspi_read: from:30000 len:1000 \n.============================================ \nRalink UBoot Version: 3.5.3.0\n--------------------------------------------&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nASIC 5350_MP (Port5&lt;-&gt;None)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \nDRAM_CONF_FROM: Boot-Strapping&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nDRAM_TYPE: SDRAM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nDRAM_SIZE: 256 Mbits&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nDRAM_WIDTH: 16 bits&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \nDRAM_TOTAL_WIDTH: 16 bits&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; \nTOTAL_MEMORY_SIZE: 32 MBytes&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nFlash component: SPI Flash&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\nDate:Dec 26 2012&nbsp;&nbsp;Time:17:31:39&nbsp;&nbsp;\n. . . SNIP . . .<\/code><\/pre><\/p>\n<p>You can get the complete boot log <a href=\"http:\/\/www.jedge.com\/code\/SRICAM_AP001_IP_camera_boot_log.txt\" rel=\"noopener\" target=\"_blank\">here<\/a>. Looking at <kbd>\/etc\/passwd<\/kbd> shows a DES encrypted hash where the plaintext is &#8220;123456&#8221;.  <pre><code># cat \/etc\/passwd\nroot:LSiuY7pOmZG2s:0:0:Adminstrator:\/:\/bin\/sh# <\/code><\/pre>Doing a Google search for the unsalted hash reveals <a href=\"https:\/\/www.pentestpartners.com\/security-blog\/hacking-the-ip-camera-part-1\/\" rel=\"noopener\" target=\"_blank\">another site<\/a> about IP Camera security. These things are just too fun to crack open. The boot log shows the flash is W25Q64BV (<a href=\"http:\/\/www.jedge.com\/docs\/W25Q64BVSFIG-Winbond.pdf\" rel=\"noopener\" target=\"_blank\">datasheet<\/a>).<\/p>\n<p>In researching the NixCore I also came across a <a href=\"https:\/\/jelmertiete.com\/2016\/03\/14\/IoT-IP-camera-teardown-and-getting-root-password\/\" rel=\"noopener\" target=\"_blank\">blog post<\/a> from almost three (3) years ago the delves into an almost identical camera.<\/p>\n<p>Looking at the PINOUT of the NixCore I&#8217;m going to see if this camera has JTAG enabled.  BACK TO THE JTAGULATOR! Note that <a href=\"http:\/\/liken.otsoa.net\/blog\/?x=entry:entry140322-183809\" rel=\"noopener\" target=\"_blank\">another site<\/a> from the Google search of the unsalted hash shows that they were able to identify JTAG&#8230;but this board, while similar to the NixCore, is not the same as the AP001.<\/p>\n<p>Okay I couldn&#8217;t wait and soldered up pins 1,2,3,5,6 and connected them to my BusBlaster v4 according to the NixCore documentation. No need for JTAGulator as the pinout was already documented.<\/p>\n<p><a href=\"http:\/\/www.jedge.com\/cpg15x\/displayimage.php?pid=143&#038;fullsize=1\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/www.jedge.com\/cpg15x\/albums\/IP_Cameras\/normal_IMG_20190120_2242249.jpg\" width=\"400\" height=\"300\" class=\"aligncenter size-full\" \/><\/a><\/p>\n<p>So JTAG exists right when the device boots but then the GPIOs are reassigned.  I assume to drive the motors to move the camera.  I didn&#8217;t delve that far into it as i was only curious as to the existence of JTAG. The resources below include links to documentation on the Ralink RT5350 (<a href=\"http:\/\/www.jedge.com\/docs\/RT5350.pdf\" rel=\"noopener\" target=\"_blank\">datasheet<\/a>) and configuration for OpenOCD.  Maybe we can reach out to the creators of NixCore for an OpenOCD configuration file.<\/p>\n<p><pre><code>root@KALI:~# openocd -f \/usr\/share\/openocd\/scripts\/interface\/ftdi\/dp_busblaster.cfg -c &quot;adapter_khz 100; transport select jtag&quot;\nOpen On-Chip Debugger 0.10.0+dev-00622-g322d2fa1 (2018-12-17-06:47)\nLicensed under GNU GPL v2\nFor bug reports, read\n&nbsp;&nbsp;http:\/\/openocd.org\/doc\/doxygen\/bugs.html\nInfo : If you need SWD support, flash KT-Link buffer from https:\/\/github.com\/bharrisau\/busblaster\nand use dp_busblaster_kt-link.cfg instead\nadapter speed: 100 kHz\njtag\nInfo : Listening on port 6666 for tcl connections\nInfo : Listening on port 4444 for telnet connections\nInfo : clock speed 100 kHz\nWarn : There are no enabled taps.&nbsp;&nbsp;AUTO PROBING MIGHT NOT WORK!!\nInfo : JTAG tap: auto0.tap tap\/device found: 0x1535024f (mfg: 0x127 (MIPS Technologies), part: 0x5350, ver: 0x1)\nWarn : AUTO auto0.tap - use &quot;jtag newtap auto0 tap -irlen 5 -expected-id 0x1535024f&quot;\nWarn : gdb services need one or more targets defined<\/code><\/pre><\/p>\n<p><strong>Resources<\/strong><br \/>\n<a target=\"_blank\" href=\"http:\/\/linuxgizmos.com\/tiny-30-wifi-enabled-openwrt-module-runs-on-1-watt\/\">http:\/\/linuxgizmos.com\/tiny-30-wifi-enabled-openwrt-module-runs-on-1-watt\/<\/a><br \/>\n<a target=\"_blank\" href=\"http:\/\/nixcores.com\/\"<http:\/\/nixcores.com\/<\/a><br \/>\n<a target=\"_blank\" href=\"https:\/\/jelmertiete.com\/2016\/03\/14\/IoT-IP-camera-teardown-and-getting-root-password\/\">https:\/\/jelmertiete.com\/2016\/03\/14\/IoT-IP-camera-teardown-and-getting-root-password\/<\/a><br \/>\n<a target=\"_blank\" href=\"https:\/\/blog.tho.ms\/hacks\/2016\/08\/28\/openwrt-on-logilink-wc0030a.html\">https:\/\/blog.tho.ms\/hacks\/2016\/08\/28\/openwrt-on-logilink-wc0030a.html<\/a><br \/>\n<a target=\"_blank\" href=\"https:\/\/www.pentestpartners.com\/security-blog\/hacking-the-ip-camera-part-1\/\">https:\/\/www.pentestpartners.com\/security-blog\/hacking-the-ip-camera-part-1\/<\/a><br \/>\n<a target=\"_blank\" href=\"https:\/\/www.pentestpartners.com\/security-blog\/hacking-the-ip-camera-part-1\/\">https:\/\/www.pentestpartners.com\/security-blog\/hacking-the-ip-camera-part-1\/<\/a><br \/>\n<a target=\"_blank\" href=\"http:\/\/liken.otsoa.net\/blog\/?x=entry:entry140322-183809\">http:\/\/liken.otsoa.net\/blog\/?x=entry:entry140322-183809<\/a><br \/>\n<a target=\"_blank\" href=\"https:\/\/wikidevi.com\/wiki\/Ralink_RT5350\">https:\/\/wikidevi.com\/wiki\/Ralink_RT5350<\/a><br \/>\n<a target=\"_blank\" href=\"https:\/\/openwrt-devel.openwrt.narkive.com\/e5kS1C19\/openocd-and-rt3050-5350\">https:\/\/openwrt-devel.openwrt.narkive.com\/e5kS1C19\/openocd-and-rt3050-5350<\/a><br \/>\n<a target=\"_blank\" href=\"http:\/\/www.jedge.com\/docs\/W25Q64BVSFIG-Winbond.pdf\">http:\/\/www.jedge.com\/docs\/W25Q64BVSFIG-Winbond.pdf<\/a><br \/>\n<a target=\"_blank\" href=\"http:\/\/www.jedge.com\/docs\/RT5350.pdf\">http:\/\/www.jedge.com\/docs\/RT5350.pdf<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Please see the original post on IP Camera Security before reading the rest of this post. Based on comment #2 by Carlo UART has been identified for my SRICAM AP001. Carlo stated that the board looks very similar to the NixCore and this is correct. I was not able to identify UART with JTAGulator because [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[114],"tags":[],"class_list":["post-1226","post","type-post","status-publish","format-standard","hentry","category-hardware-hacking"],"_links":{"self":[{"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/posts\/1226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/comments?post=1226"}],"version-history":[{"count":11,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/posts\/1226\/revisions"}],"predecessor-version":[{"id":1238,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/posts\/1226\/revisions\/1238"}],"wp:attachment":[{"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/media?parent=1226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/categories?post=1226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jedge.com\/wordpress\/wp-json\/wp\/v2\/tags?post=1226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}