Categories
Wifi Spy Camera

Wifi-Camera Firmware

Start of Flash memory dump, showing SOC name

Firmware extracted successfully from the SPI chip using a TNM5000 flash programmer, and also using a CH341 clone. Chip was also successfully re-written using the TNM5000 (after a config change with the Android App rendered the device inoperable).
It is noted that the SPI flash chip is rated at 3.3v, but running the chip reader at 3.3v provides adequate power to activate the SOC. It was found (by accident) that applying 1.8v is adequate to read/write the SPI with the SOC remaining inactive.
The Nantronics N25S80 profile in Linux flashrom was found to be adequate to read the chip with the CH341 (although required the –force parameter to override parameter checking, hence programming is not possible).
$ flashrom –programmer ch341a_spi -c N25S80 -r firmwarefile.bin -f

Flash appears to have three blocks – the first two have remained static across reads/testing, the third appears to contain config. Blocks are padded with repeating 0xFF.

Start AddressEnd AddressContent Guess?
0x000000x416EKernel/Bootloader?
Has an ASCII string near the start (AC791N_STORY) (that corresponds to a SOC with the same physical characteristics and manufacturer as the SOC onboard)

The block appears to end with a list of hardware parameters (in ASCII).
0x50000xC29C6Unclear – no obvious ASCII Strings – Suspect Main Program code
0xC5000 then later  0xC3000VariableConfig block with identifiable parameters in ASCII including known passwords in clear text
Wifi SSID (Video0_ZT953K)
Device ID (ZT953KTTYHST3W1L111A)
Device Password (hk123456)

Config Block

The base addresses shifted (0xC5000 initially, 0xC3000 later) after setting a device password using the mobile app.
It is also observed that “Saving” config sometimes appends a new section, rather than overwriting – hence the user set password (fixthispass1) was still observed after resetting it to default – highlighted section is the block below is the config following resetting the password using the mobile ap – also note at 0xC3F42 the ss1 after the default password which appears to be the over-run of the custom password (suggesting fixed buffers allocated and over-written in RAM, then copied to flash).

SOC identification

Searching for the string AC791BN_STORY provides links to the JieliTech github site which details their AC79 series IoT chips (although much of the documentation is in Chinese – google translate works to a degree).

Referring to this data sheet, and following circuit traces shows reasonable correlation between the pinout and connected devices (inc. USB, Antenna, VCC/GND, Mic) with the AC7911B data sheet linked above. Company Logo also matches the logo screen-printed on the chip (although printed chip ID doesn’t match datasheet).