Trying to root a LSC rotatable camera

[rrouviere]

Hi,

I am trying to hack a LSC rotatable camera.

Version:

• Main module: V3.1.43 (It seems that it's an uncommon major version, but no updates are available in the app)
• MCU module: V3.1.43

nmap:

PORT     STATE SERVICE
21/tcp   open  ftp
23/tcp   open  telnet
6668/tcp open  irc

What I've tried:

ppsFactoryTool

• Using a 64Gb samsung EVO plus:
  • Formatted in exFAT using windows
  • Formatted via the tuya app.
  • Formatted using mkfs.Vfat
  • Using fdisk w/ DOS partition table and a single 4G primary partition formatted with mkfs.fat

No port 80 or 8090, nor any change on nmap

Telnet root / root, admin / admin, admin / 1234 admin / 123456, anyka / gxkaifa and permutations thereof

No luck.

Blind ToRoot + ToHack + changing root password in passwd file

No change in telnet

• Also tried to use https://github.com/guino/Merkury720 -> no change.
  • Using fatload mmc -> no change
  • Using separately downloaded busybox -> still nothing.

Soldering RX pin

I use wires shoved in the power connector for GND and 5V as the pads are a nightmare to solder (they reject solder something fierce).

I am using an arduino nano as a serial-usb adapter.
No luck using realterm with any baudrate that I could find (there isn't even garbage on the screen).

However, the RX led is blinking, so something is obviously happening, as evidenced by the voltage tracer:

Ideas:

Dumping the flash

• Might be possible using this method
  • Getting nothing recognizable according to binwalk using the ppsMmcTool (gunzip'ed size: 17k).
  • Replacing 42000000 with 81000000 -> Still nothing)
• Or with an arduino (how ?) ?

Any idea of what to do next ?
Thanks.

[orrionis]

have you got it ?