cjj25
Jimi IOT support
I am looking to access the video feed of this camera whose official app has several issues. Originally the app was called Tycam before being renamed to Jimi-IOT
The payload loads successfully and there's a telnet available, only port 23 is open however as no rtsp port seems to open.
Telnet is fully working, but there's no backup created, paths in the camera appear to be named differently.
Model is JH06N.
model might be sold under different brandings depending of the country, it's essentially the same camera
This looks like a Tuya based camera.
Could you provide a firmware dump and I can check it for you?
I am assuming the script should in theory make a automatic backup right? However on telnet there is no sd folder on tmp, so I will need a bit more of instructions to set up the backup manually on telnet.
This is a quick log from my telnet:
Connected to 192.168.31.87.
Escape character is '^]'.
(none) login: root
~ # ls -l
drwxr-xr-x 2 root root 574 May 2 2018 bin
drwxrwxrwt 4 root root 1440 Oct 24 1970 dev
drwxr-xr-x 5 root root 430 Jul 19 2018 etc
lrwxrwxrwx 1 root root 9 May 2 2018 init -> sbin/init
drwxr-xr-x 3 root root 1037 May 2 2018 lib
lrwxrwxrwx 1 root root 11 May 2 2018 linuxrc -> bin/busybox
drwxr-xr-x 2 root root 3 May 2 2018 media
drwxr-xr-x 6 root root 59 May 2 2018 mnt
drwxr-xr-x 4 root root 36 May 2 2018 opt
drwxr-xr-x 2 root root 3 May 2 2018 overlay
dr-xr-xr-x 59 root root 0 Jan 1 1970 proc
drwxr-xr-x 2 root root 3 May 2 2018 rom
drwxr-xr-x 2 root root 3 May 2 2018 root
drwxr-xr-x 2 root root 310 May 2 2018 sbin
dr-xr-xr-x 11 root root 0 Jan 1 1970 sys
lrwxrwxrwx 1 root root 8 May 2 2018 tmp -> /var/tmp
drwxr-xr-x 7 root root 74 May 28 2018 usr
drwxrwxrwt 6 root root 120 Oct 24 1970 var
~ # ls
bin etc lib media opt proc root sys usr
dev init linuxrc mnt overlay rom sbin tmp var
~ # mkdir -p /tmp/sd/backup
~ # cat /proc/mtd > /tmp/sd/backup/mtd.txt
~ # cd tmp
/var/tmp # ls
model_info sd sdcard video
/var/tmp # dd if=/dev/mtdblock0 of=/tmp/sd/backup/mtdblock0.bin
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 6.090173 seconds, 2.6MB/s
/var/tmp # dd if=/dev/mtdblock1 of=/tmp/sd/backup/mtdblock1.bin
768+0 records in
768+0 records out
393216 bytes (384.0KB) copied, 0.128048 seconds, 2.9MB/s
/var/tmp # dd if=/dev/mtdblock2 of=/tmp/sd/backup/mtdblock2.bin
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.058200 seconds, 2.1MB/s
/var/tmp # dd if=/dev/mtdblock3 of=/tmp/sd/backup/mtdblock3.bin
dd: writing '/tmp/sd/backup/mtdblock3.bin': No space left on device
2369+0 records in
2368+0 records out
1212416 bytes (1.2MB) copied, 0.425147 seconds, 2.7MB/s
/var/tmp # dd if=/dev/mtdblock4 of=/tmp/sd/backup/mtdblock4.bin
dd: writing '/tmp/sd/backup/mtdblock4.bin': No space left on device
1+0 records in
0+0 records out
0 bytes (0B) copied, 0.432524 seconds, 0B/s
/var/tmp # dd if=/dev/mtdblock5 of=/tmp/sd/backup/mtdblock5.bin
dd: writing '/tmp/sd/backup/mtdblock5.bin': No space left on device
1+0 records in
0+0 records out
0 bytes (0B) copied, 0.003992 seconds, 0B/s
/var/tmp # dd if=/dev/mtdblock6 of=/tmp/sd/backup/mtdblock6.bin
dd: writing '/tmp/sd/backup/mtdblock6.bin': No space left on device
9+0 records in
8+0 records out
4096 bytes (4.0KB) copied, 0.039459 seconds, 101.4KB/s
/var/tmp # dd if=/dev/mtdblock7 of=/tmp/sd/backup/mtdblock7.binConnection closed by foreign host.
drigo@Rodrigos-Mac-mini ~ %
I need a way to findout a path of the sd card, it tried to write the backup to the flash memory and ran out of space before it could finish