Flucard hacking / reverse engineering

bootcoder · 05-20-2015, 06:59 PM - **1 Like**

live-view-restart command resumes LiveView after live-view-pause

tempelorg · 05-21-2015, 01:56 AM

Originally posted by bootcoder

live-view-restart command resumes LiveView after live-view-pause

Thanks, I've updated my article.

How did you know? You don't have a Flucard, do you?

bootcoder · 05-21-2015, 02:19 AM

Originally posted by tempelorg

How did you know? You don't have a Flucard, do you?

No. Also be aware of set-camera-config action.

tempelorg · 05-21-2015, 06:14 PM

Is that code from the busybox in the card or from the firmware on the camera?

**geomez** · 05-22-2015, 01:26 AM

I will be bookmarking this thread. Hopefully I'll learn enough to fix my dead FLU card

bootcoder · 05-22-2015, 05:18 AM

Originally posted by tempelorg

Is that code from the busybox in the card or from the firmware on the camera?

This comes from k-s1.

tempelorg · 05-22-2015, 06:39 AM

Originally posted by bootcoder

This comes from k-s1.

Does the S1's firmware contain the actual C++ symbol names such as HttpRequestCapture:...? That's ultra cool. I have to get my hands on that... I wonder if the K-3's has the same symbols. Will check over the weekend.

bootcoder · 05-22-2015, 02:56 PM

Originally posted by tempelorg

Does the S1's firmware contain the actual C++ symbol names such as HttpRequestCapture:...?

This was name of source file in error message. No symbol names, no debug information are present.

tempelorg · 05-24-2015, 01:20 PM - **2 Likes**

Today I've tried to modify the "rcS" startup script (inside /etc/init.d/), removing the excessive buzzing and disabling the deletion of the autorun.sh file.

I even wrote a GUI app that takes care of unpacking and repacking the initramfs.gz, preserving all files that I didn't modify. However, this didn't work.

The firmware updaters started doing its work (with a lot of noise from the buzzer), but in the end I had still the same old firmware installed on it, with the same buzzer tones.

I wonder if I need to update more than just the initramfs3.gz file. For instance, there's a "version" file inside the "code" dir, which contains 25 bytes. But I cannot make any sense of them, there's no clear version code or file length in it that might relate to my changes. But it would make sense that the updater code first checks if it has already installed the same version, and then skips installation.

I guess that at this point I'd have to look into the executables to figure out what's happening. Not going to happen soon, though.

Anyone have any input on this? All the other hacks on linux-based Wifi cards to not mention changing anything besides the initramfs as far as I can tell.

---------- Post added 24th May 2015 at 22:54 ----------

Good news! Now it works. I had to add padding to the end of the initramfs file (I pad to a full 512 block size now).
I can now replace the Linux files and store them permanently on the Flucard.

Next would be to make it log in to an existing Wifi Access Point. Is someone here with Linux Skills who can help me with that? For a start, I'd like to set it up so that it first looks for a specific AP and tries to log in to it (with a WPA2 pw), and if that doesn't work, it reverts back to its default mode where it offers its own AP. I have no idea how to do that, and it may also be that this crippled Linux doesn't even contain all the necessary libs for it yet.

anemone · 05-24-2015, 02:10 PM

You might want to modify rootfs also. initramfs is filesystem which is mounted first during bootup and then later the real filesystem is mounted. You propably want to edit the filesystem contest to get access to everything...

If you can get data out, start with /etc/fstab and find the mount points and copy system for better viewing...

https://en.wikipedia.org/wiki/Initramfs

tempelorg · 05-24-2015, 02:27 PM

@anemone - that may be so for full-fledged Linux system, but this tiny Linux does not use a secondary rootfs. It runs entirely and constantly from the system inside initramfs. I have been looking around with Telnet on the running system, believe me

anemone · 05-24-2015, 11:31 PM

OK. I don't have flucard, so I can't test and I take your word on it. I just gave my best guess when system doesn't respond to change in filesystem

But if you are telnetting to it you are already pwning the device

Total control isn't that far away.

You might want to search hacks from hackaday.com, there are some rooting processes for trancient and eyefi cards. So there might be some gold nugget for your system.

I wonder if it has kernel modules or programs for pentax which could be RE'ed to control the system...

tempelorg · 05-25-2015, 03:56 AM

I dug around a little to figure out how to connect to an existing Wifi AP. Found out that there are quite a few wifi related scripts left on the card (called, w1, w2, ... w6) but I cannot figure out how to use them (see my article). Instructions how to set this up on a Linux system, like this one (PQI_Air_Card - PQI Air Card????????????????????? - Qiita) do not even work because the card's file system has no egrep nor perl installed. The other problem is that I can do this only blindly - once I try to get it to connect to an AP, I lose my current Wifi connection of course, and so I cannot see any output or enter new commands. Darn.

bootcoder · 05-25-2015, 07:26 AM

So you need another connection to the card: COM port telnet or with USB. Is there any information about interfacing such cards on USB ?

tempelorg · 05-25-2015, 08:11 AM

The thread at Openwrt shows hwo one can hook into the card's serial port. But that requires some hardware hacking and fine soldering skills. I am not ready for that yet. For now, I hope to find a working example by someone who has already done the wifi setup with a Flucard or similar card.

05-21-2015, 02:19 AM	#18
bootcoder Banned Join Date: Oct 2014 Posts: 93	Originally posted by tempelorg How did you know? You don't have a Flucard, do you? No. Also be aware of set-camera-config action. Attached Images Last edited by bootcoder; 05-21-2015 at 04:40 PM.

05-22-2015, 02:56 PM	#23
bootcoder Banned Join Date: Oct 2014 Posts: 93	Originally posted by tempelorg Does the S1's firmware contain the actual C++ symbol names such as HttpRequestCapture:...? This was name of source file in error message. No symbol names, no debug information are present. Last edited by bootcoder; 05-22-2015 at 04:42 PM.

05-25-2015, 07:26 AM	#29
bootcoder Banned Join Date: Oct 2014 Posts: 93	So you need another connection to the card: COM port telnet or with USB. Is there any information about interfacing such cards on USB ? Last edited by bootcoder; 05-25-2015 at 07:38 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Resurrecting Pentax firmware hacking	Shodan	Pentax DSLR Discussion	765	02-23-2019 05:24 AM
Spider Engineering	stubyles	Monthly Photo Contests	9	11-04-2014 04:16 AM
Latest Pentax hacking results	Shodan	General Photography	43	06-05-2014 10:07 AM
NY area SDM Hacking	dappercorpmonkey	Troubleshooting and Beginner Help	11	07-26-2013 04:15 PM
Chinese reverse engineering?	ve2vfd	General Talk	35	05-29-2009 05:41 AM

05-20-2015, 06:59 PM - 1 Like	#16
bootcoder Banned Join Date: Oct 2014 Posts: 93	live-view-restart command resumes LiveView after live-view-pause

05-21-2015, 01:56 AM	#17
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	Originally posted by bootcoder live-view-restart command resumes LiveView after live-view-pause Thanks, I've updated my article. How did you know? You don't have a Flucard, do you?

05-21-2015, 06:14 PM	#19
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	Is that code from the busybox in the card or from the firmware on the camera?

05-22-2015, 01:26 AM	#20
geomez Site Supporter Join Date: Mar 2013 Location: Roanoke, Virginia, USA Photos: Gallery Posts: 1,760	I will be bookmarking this thread. Hopefully I'll learn enough to fix my dead FLU card

05-22-2015, 05:18 AM	#21
bootcoder Banned Join Date: Oct 2014 Posts: 93	Originally posted by tempelorg Is that code from the busybox in the card or from the firmware on the camera? This comes from k-s1.

05-22-2015, 06:39 AM	#22
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	Originally posted by bootcoder This comes from k-s1. Does the S1's firmware contain the actual C++ symbol names such as HttpRequestCapture:...? That's ultra cool. I have to get my hands on that... I wonder if the K-3's has the same symbols. Will check over the weekend.

05-24-2015, 01:20 PM - 2 Likes	#24
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	Today I've tried to modify the "rcS" startup script (inside /etc/init.d/), removing the excessive buzzing and disabling the deletion of the autorun.sh file. I even wrote a GUI app that takes care of unpacking and repacking the initramfs.gz, preserving all files that I didn't modify. However, this didn't work. The firmware updaters started doing its work (with a lot of noise from the buzzer), but in the end I had still the same old firmware installed on it, with the same buzzer tones. I wonder if I need to update more than just the initramfs3.gz file. For instance, there's a "version" file inside the "code" dir, which contains 25 bytes. But I cannot make any sense of them, there's no clear version code or file length in it that might relate to my changes. But it would make sense that the updater code first checks if it has already installed the same version, and then skips installation. I guess that at this point I'd have to look into the executables to figure out what's happening. Not going to happen soon, though. Anyone have any input on this? All the other hacks on linux-based Wifi cards to not mention changing anything besides the initramfs as far as I can tell. ---------- Post added 24th May 2015 at 22:54 ---------- Good news! Now it works. I had to add padding to the end of the initramfs file (I pad to a full 512 block size now). I can now replace the Linux files and store them permanently on the Flucard. Next would be to make it log in to an existing Wifi Access Point. Is someone here with Linux Skills who can help me with that? For a start, I'd like to set it up so that it first looks for a specific AP and tries to log in to it (with a WPA2 pw), and if that doesn't work, it reverts back to its default mode where it offers its own AP. I have no idea how to do that, and it may also be that this crippled Linux doesn't even contain all the necessary libs for it yet.

05-24-2015, 02:10 PM	#25
anemone Senior Member Join Date: Jun 2014 Posts: 165	You might want to modify rootfs also. initramfs is filesystem which is mounted first during bootup and then later the real filesystem is mounted. You propably want to edit the filesystem contest to get access to everything... If you can get data out, start with /etc/fstab and find the mount points and copy system for better viewing... https://en.wikipedia.org/wiki/Initramfs

05-24-2015, 02:27 PM	#26
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	@anemone - that may be so for full-fledged Linux system, but this tiny Linux does not use a secondary rootfs. It runs entirely and constantly from the system inside initramfs. I have been looking around with Telnet on the running system, believe me

05-24-2015, 11:31 PM	#27
anemone Senior Member Join Date: Jun 2014 Posts: 165	OK. I don't have flucard, so I can't test and I take your word on it. I just gave my best guess when system doesn't respond to change in filesystem But if you are telnetting to it you are already pwning the device Total control isn't that far away. You might want to search hacks from hackaday.com, there are some rooting processes for trancient and eyefi cards. So there might be some gold nugget for your system. I wonder if it has kernel modules or programs for pentax which could be RE'ed to control the system...

05-25-2015, 03:56 AM	#28
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	I dug around a little to figure out how to connect to an existing Wifi AP. Found out that there are quite a few wifi related scripts left on the card (called, w1, w2, ... w6) but I cannot figure out how to use them (see my article). Instructions how to set this up on a Linux system, like this one (PQI_Air_Card - PQI Air Card????????????????????? - Qiita) do not even work because the card's file system has no egrep nor perl installed. The other problem is that I can do this only blindly - once I try to get it to connect to an AP, I lose my current Wifi connection of course, and so I cannot see any output or enter new commands. Darn.

05-25-2015, 08:11 AM	#30
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	The thread at Openwrt shows hwo one can hook into the card's serial port. But that requires some hardware hacking and fine soldering skills. I am not ready for that yet. For now, I hope to find a working example by someone who has already done the wifi setup with a Flucard or similar card.