TransWikia.com

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

Reverse Engineering Asked on October 16, 2020

I’ve got a cloud-based battery powered camera which I’m really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!).

I’ve managed to get a .bin file. Binwalk allowed me to get an .img file, and there are many interesting strings from this file. It appears to at least have a filesystem of sorts:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
3213849       0x310A19        Certificate in DER format (x509 v3), header length: 4, sequence length: 5380
4199041       0x401281        Certificate in DER format (x509 v3), header length: 4, sequence length: 13692
5097905       0x4DC9B1        Certificate in DER format (x509 v3), header length: 4, sequence length: 5380
5184988       0x4F1DDC        Base64 standard index table
5191688       0x4F3808        Unix path: /home/sound/warning.wav
5195472       0x4F46D0        Unix path: /home/sound/login.wav
5196188       0x4F499C        Unix path: /home/sound/restart.wav
5213511       0x4F8D47        HTML document header
5213544       0x4F8D68        HTML document footer
5213635       0x4F8DC3        HTML document header
5213676       0x4F8DEC        HTML document footer
5213811       0x4F8E73        HTML document header
5213995       0x4F8F2B        HTML document footer
5217731       0x4F9DC3        HTML document header
5217938       0x4F9E92        HTML document footer
5218791       0x4FA1E7        HTML document header
5219471       0x4FA48F        HTML document footer
5220243       0x4FA793        HTML document header
5220367       0x4FA80F        HTML document footer
5221348       0x4FABE4        XML document, version: "1.0"
5242268       0x4FFD9C        SHA256 hash constants, little endian
5264636       0x5054FC        SHA256 hash constants, little endian
5275136       0x507E00        PEM certificate
5280492       0x5092EC        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/core/los_task.c
5283112       0x509D28        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/mem/mem_bestfit/los_memory.c
5284576       0x50A2E0        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/ipc/los_mux.c
5292128       0x50C060        Unix path: /usr/local/etc/zoneinfo
5292980       0x50C3B4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/lib/libc/src/time/time64.c
5294084       0x50C804        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/compat/posix/src/pthread_mutex.c
5294948       0x50CB64        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/inode/fs_inode.c
5295300       0x50CCC4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/driver/fs_blockproxy.c
5298224       0x50D830        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/bch/src/bchlib_sem.c
5482780       0x53A91C        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/fs.c
5483508       0x53ABF4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/readinode.c
5486632       0x53B828        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/write.c
5487060       0x53B9D4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/include/debug.h
5487516       0x53BB9C        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/nodelist.c
5489184       0x53C220        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/scan.c
5490792       0x53C868        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/nodemgmt.c
5491300       0x53CA64        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/gc.c
5505972       0x5403B4        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/i2c.h
5520924       0x543E1C        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/spi.h
5521580       0x5440AC        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/uart.h
5533124       0x546DC4        eCos RTOS string reference: "ECOST  CPUUSE   CPUUSE10s   CPUUSE1s   mode"
5617488       0x55B750        Unix path: /home/cfg/random_para.txt
5668808       0x567FC8        CRC32 polynomial table, little endian
6026720       0x5BF5E0        CRC32 polynomial table, little endian
6077286       0x5CBB66        TIFF image data, big-endian, offset of first image directory: 8
6078744       0x5CC118        TIFF image data, big-endian, offset of first image directory: 8
6086620       0x5CDFDC        CRC32 polynomial table, little endian
6122272       0x5D6B20        Unix path: /home/nie/pro/v103/trunk/libAACenc/src/aacenc_lib.cpp
6125288       0x5D76E8        Unix path: /home/nie/pro/v103/trunk/libMpegTPEnc/src/tpenc_lib.cpp
6125413       0x5D7765        Copyright string: "copyright law and international treaties."
6136076       0x5DA10C        Unix path: /home/nie/pro/v103/trunk/libFDK/include/fixpoint_math.h
6136840       0x5DA408        Unix path: /home/nie/pro/v103/trunk/libAACenc/src/quantize.cpp
6139780       0x5DAF84        Unix path: /home/nie/pro/v103/trunk/libAACenc/src/transform.cpp
6151760       0x5DDE50        Unix path: /home/nie/pro/v103/trunk/libFDK/src/FDK_tools_rom.cpp
6168775       0x5E20C7        Copyright string: "copyright holder(s) nor the"
6169280       0x5E22C0        Copyright string: "copyright"
6169415       0x5E2347        Copyright string: "copyright"
6169908       0x5E2534        Copyright string: "Copyright (c) 2003-2014, Jouni Malinen <[email protected]> and contributors"
6230532       0x5F1204        Neighborly text, "Neighboring BSS: freq=%dd"
6238636       0x5F31AC        Neighborly text, "neighboring BSSes ret=%d (%s) - try to scan again (attempt %d)"
6239601       0x5F3571        Neighborly text, "neighboring BSSes prior to enabling 40 MHz channelquest a scan of neighboring BSSes ret=%d (%s) - try to scan again"
6239680       0x5F35C0        Neighborly text, "neighboring BSSes ret=%d (%s) - try to scan againequest a scan of neighboring BSSes ret=%d (%s)"
6239760       0x5F3610        Neighborly text, "neighboring BSSes ret=%d (%s)rdware channel/rate support not supported."
6240780       0x5F3A0C        Neighborly text, "Neighboring BSS: %02x:%02x:%02x:%02x:%02x:%02x freq=%d pri=%d sec=%dec=%d"
6287708       0x5FF15C        SHA256 hash constants, little endian
6295380       0x600F54        Base64 standard index table
6302508       0x602B2C        Unix path: /home/ywx389445/z_ss/a_spc010/c_sdk/source/wifi_project/drv/sdio_hi1131sv100/hi1131_driver/driver/platform/inc/oal/liteos/arch/o
6302796       0x602C4C        Unix path: /home/ywx389445/z_ss/a_spc010/c_sdk/source/wifi_project/drv/sdio_hi1131sv100/hi1131_driver/driver/platform/inc/oal/liteos/arch/o
6435024       0x6230D0        CRC32 polynomial table, little endian
6439120       0x6240D0        CRC32 polynomial table, big endian
6448960       0x626740        CRC32 polynomial table, little endian
6450040       0x626B78        Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/compat/linux/src/completion.c

Here is the file:
https://drive.google.com/file/d/1mtbAi90BkNAlZ1O501q4dSIY4sRY7xP9/view?usp=sharing

Any ideas?

One Answer

Really need more info from you to be useful. What's the camera? What's the larger bin file that app.img came from? How did you extract app.img from that bin file with binwalk?

That said, I took a brief look. app.img is ARM little endian, probably v7, and you can load it into Ghidra. I'm not sure what the base address is. From googling an identifying string in the binary (hi3518ev300), I came across some links that may prove useful.

Answered by hairlessbear on October 16, 2020

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP