Flucard hacking / reverse engineering

bootcoder · 05-25-2015, 08:21 AM

Originally posted by tempelorg

But that requires some hardware hacking

You could use TTL serial port <-> USB adapter which are very cheap.

Quote:

...and fine soldering skills.

From what I see on photo, soldering should be easy, because these are pads.

Originally posted by tempelorg

For now, I hope to find a working example by someone who has already done the wifi setup with a Flucard or similar card.

LOL but what is the hack then ?

Last edited by bootcoder; 05-25-2015 at 08:28 AM.

tempelorg · 05-25-2015, 08:36 AM

Originally posted by bootcoder

LOL but what is the hack then ?

I was hoping not having to do everything myself

bootcoder · 06-02-2015, 11:30 AM

If you use EyeFi card then you are able to connect to AP, but not possible with FluCard ?

UPDATE: Code below from K-S1 can "connect" to existing AP or "establish" a new AP...

tempelorg · 06-02-2015, 11:42 AM

I have no idea how the Eye-Fi system works internally. It's not even clear if it uses a similar Linux setup. All the articles that talk about the Linux on the Flucard and Transcend cards never mentions that this is similar to Eye-Fi, so I doubt I can get into the Eye-Fi system as easily as into the Flucard. They're obviously not sharing the same setup.

What does your code show? Is that from the camera side again? The strings suggest that it's probably not. So, did you disassemble the busybux of the Flucard here or what are we looking at?

bootcoder · 06-02-2015, 12:01 PM

Originally posted by tempelorg

I have no idea how the Eye-Fi system works internally.

Do you have EyeFi card ? Can it connect to existing AP ?

Quote:

What does your code show? Is that from the camera side again?

See my updated comment above. I suspect: camera decides if it makes new AP or not. Not a flucard.

Quote:

So, did you disassemble the busybux of the Flucard

Not yet.

tempelorg · 06-02-2015, 12:18 PM

Originally posted by bootcoder

Do you have EyeFi card ? Can it connect to existing AP ?

Yes and yes. But an Eye-Fi card does not communicate with Pentax cameras. It only provides a file server to the files it has stored on its Flash drive.

So I don't think it'll help us in any way.

I ran into a more serious problem with the Flucard, though. I modified only the startup script a little by turning off the buzzer. I don't believe I've made any changes to the network (wireless) setup scripts. Yet, after these changes, even though the Linux system comes up fine, the http server on the card doesn't work any more - but the WLAN hotspot still works, ie. I can connec to the card's Wifi network and get an IP via DHCP assigned, but connecting to the web server times out.

I wonder if Pentax has added a second hacking protection level there, checking if the initramfs or parts of it have been messed with. After all, the "code" subdir of the firmware update for the Flucard contains some cryptic files, and one of them ("version") kind of looks as if it contains a MD5 or SHA checksum: 76 CA C9 9B 96 ED 9B 9E 30 60 B8 81 13 C5 0C 18 2E 60 C8 71 03 06 8B 18 30

The code inside "index.html" is also encoded or encrypted, no idea yet how.

The file "html", also part of the firmware updater, is an ELF executable that contains a reference to the "/code/version" file, so I guess I'd have to look there to see what this file is about. But not anytime soon, got some other things on my mind right now.

bootcoder · 06-02-2015, 12:25 PM

Originally posted by tempelorg

But an Eye-Fi card does not communicate with Pentax cameras.

This is not correct. It is recognized in firmware and some special actions are done.

Quote:

I wonder if Pentax has added a second hacking protection level there

Do not think so.

kamayok3 · 08-12-2015, 08:02 PM

Hi all,

Can I know what is the command for the flucard to release the shutter?

Thanks.

kamayok3 · 08-23-2015, 07:28 PM

Nevermind, I already got all the commands how flucard control Pentax DSLR. Thanks.

patarok · 09-10-2015, 01:19 PM

IMHO you guys should be helping shodan with hacking PENTAX firmware instead of hacking around on an SD-Card... ts ts ts...

Quicksand · 09-10-2015, 03:08 PM

Well yeah, in a perfect world I would agree, but poking around with some http commands and Javascript in the SD card's WiFi API is a world away from making potentially damaging changes to assembly code in the camera's firmware!

I'll stick to what I can handle, TYVM.

patarok · 09-11-2015, 10:13 PM

Originally posted by Quicksand

Well yeah, in a perfect world I would agree, but poking around with some http commands and Javascript in the SD card's WiFi API is a world away from making potentially damaging changes to assembly code in the camera's firmware!

I'll stick to what I can handle, TYVM.

really?...

**geomez** · 09-12-2015, 01:35 AM

Originally posted by patarok

IMHO you guys should be helping shodan with hacking PENTAX firmware instead of hacking around on an SD-Card... ts ts ts...

I disagree. It's obvious people care about this just as the others care about custom firmware. Why not just encourage people to follow their hacking passions with the equipment they own. Shodan is working on a K-30 and these folks are working on a FLU card. Two very different pieces of equipment that not every hacker owns nor can afford.

---------- Post added 09-12-15 at 01:37 AM ----------

Besides, the more the merrier. What if Shodan hits a snag and there's a breakthrough with the card? Aren't we bystanders better off then?

patarok · 11-07-2015, 04:50 PM

Originally posted by Adam

Very interesting to be sure, but I would probably focus my efforts on reverse-engineering the K-S2's native wi-fi. That might be an easier (and more beneficial) starting point since there's currently no desktop support. Plus, the native wi-fi range is far greater than that of the flucard, which opens up more practical uses.

I wouldn't be surprised if the two were very similar in their implementation.

did you do?

---------- Post added 11-07-15 at 04:57 PM ----------

Originally posted by bootcoder

Not yet.

Is there any progress on your side with this flucard-hacking bootcoder?

tempelorg gave up... (At least he told me so via e-mail.)

derekkite · 11-08-2015, 10:29 AM

Originally posted by patarok

did you do?

---------- Post added 11-07-15 at 04:57 PM ----------

Is there any progress on your side with this flucard-hacking bootcoder?

tempelorg gave up... (At least he told me so via e-mail.)

The API is exposed in the html. It is reasonably simple to access. The challenge is writing something useful. I've had ideas and looked around a bit but got more interested in something else.

06-02-2015, 11:30 AM	#33
bootcoder Banned Join Date: Oct 2014 Posts: 93	If you use EyeFi card then you are able to connect to AP, but not possible with FluCard ? UPDATE: Code below from K-S1 can "connect" to existing AP or "establish" a new AP... Attached Images Last edited by bootcoder; 06-02-2015 at 11:57 AM.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Resurrecting Pentax firmware hacking	Shodan	Pentax DSLR Discussion	765	02-23-2019 05:24 AM
Spider Engineering	stubyles	Monthly Photo Contests	9	11-04-2014 04:16 AM
Latest Pentax hacking results	Shodan	General Photography	43	06-05-2014 10:07 AM
NY area SDM Hacking	dappercorpmonkey	Troubleshooting and Beginner Help	11	07-26-2013 04:15 PM
Chinese reverse engineering?	ve2vfd	General Talk	35	05-29-2009 05:41 AM

05-25-2015, 08:21 AM	#31
bootcoder Banned Join Date: Oct 2014 Posts: 93	Originally posted by tempelorg But that requires some hardware hacking You could use TTL serial port <-> USB adapter which are very cheap. Quote: ...and fine soldering skills. From what I see on photo, soldering should be easy, because these are pads. Originally posted by tempelorg For now, I hope to find a working example by someone who has already done the wifi setup with a Flucard or similar card. LOL but what is the hack then ? Last edited by bootcoder; 05-25-2015 at 08:28 AM.

05-25-2015, 08:36 AM	#32
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	Originally posted by bootcoder LOL but what is the hack then ? I was hoping not having to do everything myself

06-02-2015, 11:42 AM	#34
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	I have no idea how the Eye-Fi system works internally. It's not even clear if it uses a similar Linux setup. All the articles that talk about the Linux on the Flucard and Transcend cards never mentions that this is similar to Eye-Fi, so I doubt I can get into the Eye-Fi system as easily as into the Flucard. They're obviously not sharing the same setup. What does your code show? Is that from the camera side again? The strings suggest that it's probably not. So, did you disassemble the busybux of the Flucard here or what are we looking at?

06-02-2015, 12:01 PM	#35
bootcoder Banned Join Date: Oct 2014 Posts: 93	Originally posted by tempelorg I have no idea how the Eye-Fi system works internally. Do you have EyeFi card ? Can it connect to existing AP ? Quote: What does your code show? Is that from the camera side again? See my updated comment above. I suspect: camera decides if it makes new AP or not. Not a flucard. Quote: So, did you disassemble the busybux of the Flucard Not yet.

06-02-2015, 12:18 PM	#36
tempelorg Senior Member Join Date: Apr 2011 Location: Munich Photos: Gallery Posts: 203 Original Poster	Originally posted by bootcoder Do you have EyeFi card ? Can it connect to existing AP ? Yes and yes. But an Eye-Fi card does not communicate with Pentax cameras. It only provides a file server to the files it has stored on its Flash drive. So I don't think it'll help us in any way. I ran into a more serious problem with the Flucard, though. I modified only the startup script a little by turning off the buzzer. I don't believe I've made any changes to the network (wireless) setup scripts. Yet, after these changes, even though the Linux system comes up fine, the http server on the card doesn't work any more - but the WLAN hotspot still works, ie. I can connec to the card's Wifi network and get an IP via DHCP assigned, but connecting to the web server times out. I wonder if Pentax has added a second hacking protection level there, checking if the initramfs or parts of it have been messed with. After all, the "code" subdir of the firmware update for the Flucard contains some cryptic files, and one of them ("version") kind of looks as if it contains a MD5 or SHA checksum: 76 CA C9 9B 96 ED 9B 9E 30 60 B8 81 13 C5 0C 18 2E 60 C8 71 03 06 8B 18 30 The code inside "index.html" is also encoded or encrypted, no idea yet how. The file "html", also part of the firmware updater, is an ELF executable that contains a reference to the "/code/version" file, so I guess I'd have to look there to see what this file is about. But not anytime soon, got some other things on my mind right now.

06-02-2015, 12:25 PM	#37
bootcoder Banned Join Date: Oct 2014 Posts: 93	Originally posted by tempelorg But an Eye-Fi card does not communicate with Pentax cameras. This is not correct. It is recognized in firmware and some special actions are done. Quote: I wonder if Pentax has added a second hacking protection level there Do not think so.

08-12-2015, 08:02 PM	#38
kamayok3 Forum Member Join Date: Apr 2010 Posts: 90	Hi all, Can I know what is the command for the flucard to release the shutter? Thanks.

08-23-2015, 07:28 PM	#39
kamayok3 Forum Member Join Date: Apr 2010 Posts: 90	Nevermind, I already got all the commands how flucard control Pentax DSLR. Thanks.

09-10-2015, 01:19 PM	#40
patarok Veteran Member Join Date: Jul 2013 Photos: Gallery Posts: 389	IMHO you guys should be helping shodan with hacking PENTAX firmware instead of hacking around on an SD-Card... ts ts ts...

09-10-2015, 03:08 PM	#41
Quicksand Pentaxian Join Date: Apr 2008 Location: Central Ohio (formerly SF Bay Area) Posts: 1,519	Well yeah, in a perfect world I would agree, but poking around with some http commands and Javascript in the SD card's WiFi API is a world away from making potentially damaging changes to assembly code in the camera's firmware! I'll stick to what I can handle, TYVM.

09-11-2015, 10:13 PM	#42
patarok Veteran Member Join Date: Jul 2013 Photos: Gallery Posts: 389	Originally posted by Quicksand Well yeah, in a perfect world I would agree, but poking around with some http commands and Javascript in the SD card's WiFi API is a world away from making potentially damaging changes to assembly code in the camera's firmware! I'll stick to what I can handle, TYVM. really?...

09-12-2015, 01:35 AM	#43
geomez Site Supporter Join Date: Mar 2013 Location: Roanoke, Virginia, USA Photos: Gallery Posts: 1,760	Originally posted by patarok IMHO you guys should be helping shodan with hacking PENTAX firmware instead of hacking around on an SD-Card... ts ts ts... I disagree. It's obvious people care about this just as the others care about custom firmware. Why not just encourage people to follow their hacking passions with the equipment they own. Shodan is working on a K-30 and these folks are working on a FLU card. Two very different pieces of equipment that not every hacker owns nor can afford. ---------- Post added 09-12-15 at 01:37 AM ---------- Besides, the more the merrier. What if Shodan hits a snag and there's a breakthrough with the card? Aren't we bystanders better off then?

11-07-2015, 04:50 PM	#44
patarok Veteran Member Join Date: Jul 2013 Photos: Gallery Posts: 389	Originally posted by Adam Very interesting to be sure, but I would probably focus my efforts on reverse-engineering the K-S2's native wi-fi. That might be an easier (and more beneficial) starting point since there's currently no desktop support. Plus, the native wi-fi range is far greater than that of the flucard, which opens up more practical uses. I wouldn't be surprised if the two were very similar in their implementation. did you do? ---------- Post added 11-07-15 at 04:57 PM ---------- Originally posted by bootcoder Not yet. Is there any progress on your side with this flucard-hacking bootcoder? tempelorg gave up... (At least he told me so via e-mail.)

11-08-2015, 10:29 AM	#45
derekkite Pentaxian Join Date: Sep 2011 Location: Nelson B.C. Posts: 3,782	Originally posted by patarok did you do? ---------- Post added 11-07-15 at 04:57 PM ---------- Is there any progress on your side with this flucard-hacking bootcoder? tempelorg gave up... (At least he told me so via e-mail.) The API is exposed in the html. It is reasonably simple to access. The challenge is writing something useful. I've had ideas and looked around a bit but got more interested in something else.