rev-ng
/
Actionpro
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Reverse Engineering the USB protocol of the EOL'd ACTIONPRO X7 camera to configure the WiFi access point settings and time synchronization via PC.
8 Commits 1 Branch 0 Tags 40 KiB
C 93.8%
Makefile 6.2%
Go to file
jpk 1509ed93aa Documented time sync message 2021-08-12 08:14:53 +02:00
.gitignore Added .cache/ to ignored files/dirs 2021-08-11 10:57:28 +02:00
Makefile Initial commit 2021-08-10 15:21:40 +02:00
README.md Documented time sync message 2021-08-12 08:14:53 +02:00
config.def.h Initial commit 2021-08-10 15:21:40 +02:00
config.mk Initial commit 2021-08-10 15:21:40 +02:00
main.c commented code blocks 2021-08-12 07:58:03 +02:00

README.md

ACTIONPRO X7

Research

Hardware

  • SOC: Ambarella, A7L-B1-RH, A1402, N6T96-AN8, 1N1
  • WiFi: Atheros AR6103G-BM2D, P0BV68.2BE5, P0BV68.2B, 1441
  • Flash: ATO, 1440N, MST5F08G16G, NH-2106, 5FGHG46V17W

USB Details

Bus 005 Device 017: ID 4255:1000 GoPro 9FF2 [Digital Photo Display]

Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x4255 GoPro
  idProduct          0x1000 9FF2 [Digital Photo Display]
  bcdDevice            0.00
  iManufacturer           1 AMON
  iProduct                2 MST-X7
  iSerial                 3 123456789ABC
  bNumConfigurations      2
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0020
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0020
    bNumInterfaces          1
    bConfigurationValue     2
    iConfiguration          0 
    bmAttributes         0xc0
      Self Powered
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0

Research: File/Drive Access by Action Manager 1.3

Opening Drive/Device:

CreateFile():
Desired Access:	Generic Read/Write
Disposition:	Open
Options:	Synchronous IO Non-Alert, Non-Directory File
Attributes:	n/a
ShareMode:	Read, Write
AllocationSize:	n/a
OpenResult:	Opened

Sending Command: Windows Application sends IOCTL_SCSI_PASS_THROUGH with DeviceIoControl().

Research: Access Point

After connecting to the access point (AP), it is possible to connect to the camera via telnet.

  • Host: 192.168.42.1
  • Username: root
  • Password: no password required
$ telnet 192.168.42.1
Trying 192.168.42.1...
Connected to 192.168.42.1.
Escape character is '^]'.

buildroot login: root
# uname -a
Linux buildroot 2.6.38.8 #1 PREEMPT Mon Dec 15 21:04:04 KST 2014 armv6l GNU/Linux
# ps
PID   USER     TIME   COMMAND
    1 root       0:02 init
    2 root       0:00 [kthreadd]
    3 root       0:00 [ksoftirqd/0]
    4 root       0:00 [kworker/0:0]
    5 root       0:00 [kworker/u:0]
    6 root       0:00 [khelper]
  351 root       0:00 [sync_supers]
  353 root       0:00 [bdi-default]
  355 root       0:00 [kblockd]
  356 root       0:00 [ipc_bh 0]
  357 root       0:00 [ipc_bh 1]
  448 root       0:00 [kworker/u:2]
  452 root       0:00 [rpciod]
  453 root       0:01 [kworker/0:1]
  462 root       0:00 [kswapd0]
  463 root       0:00 [fsnotify_mark]
  464 root       0:00 [aio]
  465 root       0:00 [nfsiod]
  468 root       0:00 [crypto]
  512 root       0:00 [mtdblock0]
  519 root       0:00 [mtdblock1]
  524 root       0:00 [mtdblock2]
  529 root       0:00 [mtdblock3]
  534 root       0:00 [mtdblock4]
  539 root       0:00 [mtdblock5]
  544 root       0:00 [mtdblock6]
  549 root       0:00 [mtdblock7]
  554 root       0:00 [mtdblock8]
  559 root       0:00 [mtdblock9]
  564 root       0:00 [mtdblock10]
  569 root       0:00 [mtdblock11]
  574 root       0:00 [mtdblock12]
  579 root       0:00 [mtdblock13]
  584 root       0:00 [mtdblock14]
  593 root       0:00 [ubi_bgt0d]
  597 root       0:00 [mmcqd/0]
  604 root       0:00 [lkvfs_bh 0]
  609 root       0:00 {rcS} /bin/sh /etc/init.d/rcS
  617 root       0:00 [ubifs_bgt0_1]
  636 dbus       0:00 dbus-daemon --system
  648 root       0:00 {S50service} /bin/sh /etc/init.d/S50service start
  656 root       0:06 vffs /tmp/fuse_a -l a -C 1 -o big_writes -s
  659 root       0:00 vffs /tmp/fuse_d -l d -C 1 -o big_writes -s
  662 root       0:00 vffs /tmp/fuse -l f -s
  674 root       0:00 ombra
  677 root       0:00 dvf2web --daemon
  678 root       0:00 /usr/bin/AmbaStreamSVC
  680 root       0:00 amba_mq_handler
  683 root       0:00 network_message_daemon
  691 root       0:00 /usr/bin/lu_lnxfio_stream
  703 root       0:15 [AR6K Async]
  711 root       0:18 [ksdioirqd/mmc1]
  780 nobody     0:00 dnsmasq --nodns -5 -K -R -n --dhcp-range=192.168.42.2,192.168.42.6,infinite
  814 root       0:05 hostapd -B /tmp/hostapd.conf
  829 root       0:00 telnetd
  842 root       0:00 cherokee-worker -a -C /etc/cherokee.conf -j -s -d
  848 root       0:00 cgiBridge
  854 root       0:00 remote_ctrl
 1493 root       0:00 -sh
 1498 root       0:00 ps
# mount
rootfs on / type rootfs (rw)
ubi0:linux on / type ubifs (ro,relatime)
devtmpfs on /dev type devtmpfs (rw,relatime,size=18668k,nr_inodes=4667,mode=755)
none on /dev type tmpfs (rw,relatime)
proc on /proc type proc (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw,relatime,mode=777)
tmpfs on /tmp type tmpfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
ubi0:pref on /pref type ubifs (rw,sync,relatime)
1 on /tmp/fuse_a type fuse.1 (rw,nosuid,nodev,relatime,user_id=0,group_id=0)
1 on /tmp/fuse_d type fuse.1 (rw,nosuid,nodev,relatime,user_id=0,group_id=0)
f on /tmp/fuse type fuse.f (rw,nosuid,nodev,relatime,user_id=0,group_id=0)
f on /var/www/shutter type fuse.f (rw,nosuid,nodev,relatime,user_id=0,group_id=0)
tmpfs on /var/www/live type tmpfs (rw,relatime)
1 on /var/www/pref type fuse.1 (rw,nosuid,nodev,relatime,user_id=0,group_id=0)
tmpfs on /var/www/mjpeg type tmpfs (rw,relatime)
# lsmod
ar6000 370159 0 - Live 0x7f000000
# ifconfig 
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:295 errors:0 dropped:0 overruns:0 frame:0
          TX packets:295 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:15356 (14.9 KiB)  TX bytes:15356 (14.9 KiB)

wlan0     Link encap:Ethernet  HWaddr 1C:4A:F7:00:6F:E4  
          inet addr:192.168.42.1  Bcast:192.168.42.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:38148 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3815 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:15639749 (14.9 MiB)  TX bytes:632131 (617.3 KiB)

# iwconfig 
lo        no wireless extensions.

wlan0     AR6000 802.11ng  ESSID:"X7APP"  Nickname:""
          NWID:off/any  Mode:Master  Frequency:2.462 GHz  
          Access Point: 1C:4A:F7:00:6F:E4   Bit Rate:52 Mb/s   Tx-Power=15 dBm   
          Sensitivity=0/3  
          RTS thr=0 B   Fragment thr=0 B   
          Encryption key:00   Security mode:open
          Power Management:on
          Link Quality:95  Signal level:0  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

#

Research: Code Snippets using ioctl()

Trying to reproduce IOCTL_SCSI_PASS_THROUGH with Linux.

Cancled, way to complicated, the USB massstorage interface is an easier target.

Research: USB data transfer

Is it possible to just write to the usb interface instead?

USBPcap: Linux Host and Windows Guest

Identify the bus where the camera is connected to:

Bus 005 Device 017: ID 4255:1000 GoPro 9FF2 [Digital Photo Display]

Load usbmon to capture usb traffic with Wireshark:

modprobe usbmon

With Wireshark the usbmon<busid> (e.g. usbmon5) is selected as packet capture source.

After filtering the following filter rule will only display relevant packets:

(usb.device_address == 17 ) && (scsi.spc.opcode == 0xfd || scsi.spc.opcode == 0xfe || scsi.spc.opcode == 0xff)

Vendor specific commands:

  • 0xfd: set AP ssid
  • 0xfe: set AP passphrase
  • 0xff: syncronize time

Example packets:

0xfd:

0000   fd 00 58 37 41 50 50 00 00 00 00 00 00 00 00 00   ..X7APP.........

0xfe:

0000   fe 00 58 37 41 50 50 41 53 53 00 00 00 00 00 00   ..X7APPASS......

Synchrize time 0xff:

0000   ff 00 07 e5 08 0a 0b 24 00 00 00 00 00 00 00 00   .......$........
             ────┐ ─┐ ─┐ ─┐ ─┐ ─┐
                 │  │  │  │  │  │
                 │  │  │  │  │  └─ Seconds
                 │  │  │  │  └──── Minutes
                 │  │  │  └─────── Hour
                 │  │  └────────── Day
                 │  └───────────── Month
                 └──────────────── Year

Current challange After requesting the sense and Direct Access the correct data is not sent.