Реверс инженеринг Xiaomi Mi Camera 2K (Magnetic Mount)

 binwalkv3 ./EN25QH128@SOP8afterupdate.BIN

                                                                                               /mnt/d/Seafile/Cloud/Devices/MiCameraMagneticMount/EN25QH128@SOP8afterupdate.BIN
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
DECIMAL                            HEXADECIMAL                        DESCRIPTION
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
208236                             0x32D6C                            CRC32 polynomial table, little endian
216084                             0x34C14                            Android boot image, kernel size: 0 bytes, kernel load address: 0x70657250, ramdisk size: 543519329 bytes, ramdisk load address: 0x6E72656B
236804                             0x39D04                            U-Boot version string: 2013.07-g8581847-dirty (Aug 09 2021 - 18:07:12)
262144                             0x40000                            uImage firmware image, header size: 64 bytes, data size: 1590203 bytes, compression: lzma, CPU: MIPS32, OS: Linux, image type: OS Kernel Image, load address: 0x80010000, entry point: 0x80367840,
                                                                      creation time: 2021-07-11 18:42:35, image name: "Linux-3.10.14__isvp_swan_1.0__"
2293760                            0x230000                           SquashFS file system, little endian, version: 4.0, compression: xz, inode count: 433, block size: 131072, image size: 3976360 bytes, created: 2021-11-03 10:37:54
6291456                            0x600000                           SquashFS file system, little endian, version: 4.0, compression: xz, inode count: 106, block size: 131072, image size: 3835466 bytes, created: 2022-08-23 05:20:36
10289152                           0x9D0000                           SquashFS file system, little endian, version: 4.0, compression: xz, inode count: 3, block size: 131072, image size: 1038613 bytes, created: 2021-11-03 10:37:55
12320768                           0xBC0000                           SquashFS file system, little endian, version: 4.0, compression: xz, inode count: 106, block size: 131072, image size: 3835466 bytes, created: 2022-08-23 05:20:36
16318464                           0xF90000                           JFFS2 filesystem, little endian, nodes: 96, total size: 361368 bytes
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

root@RfMainPc:/mnt/d/Seafile/Cloud/Devices/MiCameraMagneticMount# /usr/bin/binwalk --signature --term EN25QH128@SOP8afterupdate.BIN

DECIMAL       HEXADECIMAL     DESCRIPTION
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
208236        0x32D6C         CRC32 polynomial table, little endian
212616        0x33E88         LZO compressed data
216084        0x34C14         Android bootimg, kernel size: 0 bytes, kernel addr: 0x70657250, ramdisk size: 543519329 bytes, ramdisk addr: 0x6E72656B, product name: "mem boot start"
262144        0x40000         uImage header, header size: 64 bytes, header CRC: 0x58AB0988, created: 2021-07-11 18:42:35, image size: 1590203 bytes, Data Address: 0x80010000, Entry Point: 0x80367840, data CRC: 0xB7D95A14, OS: Linux, CPU: MIPS, image type: OS Kernel
                              Image, compression type: lzma, image name: "Linux-3.10.14__isvp_swan_1.0__"
262208        0x40040         LZMA compressed data, properties: 0x5D, dictionary size: 67108864 bytes, uncompressed size: -1 bytes
2293760       0x230000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3976360 bytes, 433 inodes, blocksize: 131072 bytes, created: 2021-11-03 10:37:54
6291456       0x600000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3835466 bytes, 106 inodes, blocksize: 131072 bytes, created: 2022-08-23 05:20:36
10289152      0x9D0000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 1038613 bytes, 3 inodes, blocksize: 131072 bytes, created: 2021-11-03 10:37:55
12320768      0xBC0000        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3835466 bytes, 106 inodes, blocksize: 131072 bytes, created: 2022-08-23 05:20:36
16318464      0xF90000        JFFS2 filesystem, little endian
16318600      0xF90088        Zlib compressed data, compressed
16318844      0xF9017C        JFFS2 filesystem, little endian

root@RfMainPc:/mnt/d/Seafile/Cloud/Devices/MiCameraMagneticMount# strings EN25QH128@SOP8afterupdate.BIN | grep bootcmd -b1
-bootargs=console=ttyS1,115200n8 mem=42M@0x0 rmem=22M@0x2A00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256K(boot),1984K(kernel),3904K(rootfs),3904K(app),1984K(kback),3904K(aback),384K(cfg),64K(para)
bootcmd=mw 0xb0011134 0x300 1;sdstart;sdupdate;sf probe;sf read 0x80600000 0x40000 0x1F0000; bootm 0x80600000

-bootargs=console=ttyS1,115200n8 mem=42M@0x0 rmem=22M@0x2A00000 init=/linuxrc rootfstype=squashfs root=/dev/mtdblock2 rw mtdparts=jz_sfc:256K(boot),1984K(kernel),3904K(rootfs),3904K(app),1984K(kback),3904K(aback),384K(cfg),64K(para)

dd if=EN25QH128@SOP8afterupdate.BIN of=boot.bin bs=1 skip=0 count=262144

dd if=EN25QH128@SOP8afterupdate.BIN of=rootfs.bin bs=1 skip=2293760 count=3997696
dd if=EN25QH128@SOP8afterupdate.BIN of=cfg.bin bs=1 skip=16310272 count=393216
dd if=EN25QH128@SOP8afterupdate.BIN of=para.bin bs=1 skip=16703488 count=65536

ls -la ./EN25QH128@SOP8afterupdate.BIN.extracted/230000/squashfs-root/linuxrc
lrwxrwxrwx 1 root root 11 Nov  2  2021 ./EN25QH128@SOP8afterupdate.BIN.extracted/230000/squashfs-root/linuxrc -> bin/busybox

/mnt/d/Seafile/Cloud/Devices/MiCameraMagneticMount/extractions# cat ./EN25QH128@SOP8afterupdate.BIN.extracted/230000/squashfs-root/etc/inittab
# /etc/inittab
#
# Copyright (C) 2001 Erik Andersen <andersen@codepoet.org>
#
# Note: BusyBox init doesn't support runlevels.  The runlevels field is
# completely ignored by BusyBox init. If you want runlevels, use
# sysvinit.
#
# Format for each entry: <id>:<runlevels>:<action>:<process>
#
# id        == tty to run on, or empty for /dev/console
# runlevels == ignored
# action    == one of sysinit, respawn, askfirst, wait, and once
# process   == program to run

# Startup the system
::sysinit:/sbin/swapoff -a
::sysinit:/bin/mount -t tmpfs tmpfs /dev
::sysinit:/bin/mkdir -p /dev/pts
::sysinit:/bin/mkdir -p /dev/shm
::sysinit:/bin/mount -a
::sysinit:/bin/hostname -F /etc/hostname

# now run any rc scripts
::sysinit:/etc/init.d/rcS

# Put a getty on the serial port
#去除控制台
#console::respawn:/sbin/getty -L console 115200 vt100 # GENERIC_SERIAL

# Stuff to do for the 3-finger salute
#::ctrlaltdel:/sbin/reboot

# Stuff to do before rebooting
::shutdown:/bin/umount -a -r

cat ./EN25QH128@SOP8afterupdate.BIN.extracted/230000/squashfs-root/etc/init.d/rcS
#!/bin/sh

#/bin/mount -a

#echo " __________________________________
#|                                  |
#|                                  |
#|                                  |
#|                                  |
#| _   _             _           _  |
#|| | | |_   _  __ _| |     __ _(_) |
#|| |_| | | | |/ _| | |  _ / _| | | |
#||  _  | |_| | (_| | |_| | (_| | | |
#||_| |_|\__,_|\__,_|_____|\__,_|_| |
#|                                  |
#|                                  |
#|___________________HuaLai_Fw...___|
#"

#for initscript in /etc/init.d/S[0-9][0-9]*
#do
#     if [ -x $initscript ] ;
#     then
#       echo "[RCS]: $initscript"
#       $initscript
#     fi
#done

echo /sbin/mdev > /proc/sys/kernel/hotplug
/sbin/mdev -s && echo "mdev is ok......"

#echo "Start mount rootfs..."
#echo "mount -t squashfs /dev/mtdblock3 /usr/app"
mount -t squashfs /dev/mtdblock3 /system/
#echo "mount -t squashfs /dev/mtdblock4 /backk"
mount -t squashfs /dev/mtdblock4 /kback
#echo "mount -t squashfs /dev/mtdblock5 /backa"
mount -t squashfs /dev/mtdblock5 /aback
#echo "mount -t jffs2 /dev/mtdblock6 /configs"
mount -t jffs2 /dev/mtdblock6 /configs

#echo "LD_LIBRARY_PATH=/lib:/usr/lib:/usr/app/lib"
LD_LIBRARY_PATH=/lib:/usr/lib:/system/lib
#echo "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/app/bin:/usr/app/sbin"
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/system/bin:/system/sbin
#echo "export LD_LIBRARY_PATH=/thirdlib:$LD_LIBRARY_PATH"
export LD_LIBRARY_PATH=/thirdlib:$LD_LIBRARY_PATH
#echo "export LD_LIBRARY_PATH PATH"
export LD_LIBRARY_PATH PATH


#echo "/usr/app/bin/init_app.sh"
/system/bin/init_app.sh

#禁用内核打印
#echo 0 > /proc/sys/kernel/printk

cat ./EN25QH128@SOP8afterupdate.BIN.extracted/600000/squashfs-root/bin/init_app.sh
#!/bin/sh

mkdir -p /tmp/modules/3.10.14__isvp_swan_1.0__

#insmod /system/driver/tx-isp-t31.ko isp_clk=150000000
insmod /system/driver/exfat.ko
insmod /system/driver/audio.ko spk_gpio=-1
insmod /system/driver/sinfo.ko
insmod /system/driver/speaker_ctl.ko
insmod /system/driver/sample_pwm_core.ko
insmod /system/driver/sample_pwm_hal.ko

MOTOR_FLAG=/system/driver/motor_flag


if [ -f "$MOTOR_FLAG" ];then
      insmod /system/driver/atbm603x_wifi_sdio_24M.ko
      insmod /system/driver/sample_motor.ko
else
      insmod /system/driver/rtl8189ftv.ko
fi

#insmod /system/driver/avpu.ko  avpu_clk=600000000
insmod /system/driver/avpu.ko  avpu_clk=500000000
insmod /system/driver/tx-isp-t31.ko   isp_ch0_pre_dequeue_time=14 isp_ch0_pre_dequeue_interrupt_process=0 isp_ch0_pre_dequeue_valid_lines=540 isp_memopt=1
#insmod /system/driver/tx-isp-t31.ko isp_memopt=1 isp_clk=150000000
#enable zram swap
echo 16777216 > /sys/block/zram0/disksize
mkswap /dev/zram0
swapon /dev/zram0
echo 100 > /proc/sys/vm/swappiness


#清掉对PB04的驱动能力设置（最低驱动能力）
#devmem 0x10011138 32 0x300
#设置PB04的驱动能力(4mA)
devmem 0x10011138 32 0xfff
devmem 0x10011134 32 0x100

#设置PA15的2mA驱动能力
devmem 0x10010138 32 0xc0000000
devmem 0x10010134 32 0x00000000

#4mA
#devmem 0x10010138 32 0xc0000000
#devmem 0x10010134 32 0x40000000

#wifi mmc1中的PB10默认是下拉的状态，需要将它设置成高阻态
devmem 0x10011128 32 0x400
#wifi mmc1 clk驱动能力改到8mA
devmem 0x10011134 32 0x20000

touch /tmp/resolv.conf


################## Up wifi lo port at first ##################
#echo "ifconfig lo up"
ifconfig lo up > /dev/null

##################### Run app process (1) ####################
#telnetd
/system/bin/ver-comp > /dev/null

############## Select user mode or factroy mode ##############
FACTORY_TEST='/configs/.factory_flag'
DEBUG_STATUS='/configs/.debug_flag'

MOTOR_STATUS='/configs/.motor_flag'

#小米安全芯片
echo 10 > /sys/class/gpio/export
echo out > /sys/class/gpio/gpio10/direction


#EN LANGUAGE
#touch /configs/.EN

if [ ! -f $DEBUG_STATUS ]; then
      if [ ! -f $FACTORY_TEST ]; then
        #echo "#######################"
        #echo "#   IS USER PROCESS   #"
        #echo "#######################"
        #/usr/app/bin/assis > /dev/null &
        /system/init/factory.sh &
        /system/bin/factorycheck

      if [ -f /tmp/factory ]; then
        exit
      fi
      /system/bin/assis &
      #ulimit -c unlimited
      #mount /dev/mmcblk0p1 /mnt
      #echo "/mnt/core-%e-%p-%t" > /proc/sys/kernel/core_pattern
      #/mnt/iCamera_app &
      /system/bin/iCamera_app &
      #telnetd
      else
        echo "#######################"
        echo "#   IS TEST PROCESS   #"
        echo "#######################"
        /backk/singleBoadTest
        /backk/factoryTest &
      fi
else
      echo "#######################"
      echo "#   IS DEBUG STATUS   #"
      echo "#######################"
fi

#touch /configs/.motor_flag
#if [ -f $MOTOR_STATUS ]; then
      #/system/bin/motortest &
#fi

#rm /mnt/logcat.log
#rm /mnt/dmeg.log
#mount /dev/mmcblk0p1 /mnt
#logcat > /mnt/logcat.log &
#dmesg  > /mnt/dmeg.log &

dd if=EN25QH128@SOP8afterupdate.BIN of=rootfs.bin bs=1 skip=2293760 count=3997696

binwalk ./rootfs.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:xz, size: 3976360 bytes, 433 inodes, blocksize: 131072 bytes, created: 2021-11-03 10:37:54

unsquashfs ./rootfs.bin

nano ./squashfs-root/etc/inittab

mksquashfs ./squashfs-root/ newrootfs.bin
mksquashfs ./squashfs-root/ newrootfs.bin -comp xz


cp moddelay.BIN moddelayandconsole.bin
dd if=newrootfs.bin of=moddelayandconsole.bin bs=1 seek=2293760 conv=notrunc

isvp_t31# mmc rescan

isvp_t31# mmc list
msc: 0

isvp_t31# mmc dev 0
mmc0(part 0) is current device

isvp_t31# fatls mmc 0:1
            system volume information/
  3977216   newrootfs.bin
 16777216   moddelayandconsole.bin

# 0x80600000 адрес в памяти куда грузим
fatload mmc 0:1 0x80600000 rootfs.bin
sf probe 
#3D0000 это старый размер из dd 3997696
sf erase 0x230000 0x3D0000
# 0x230000 смещение как в dd 2293760, 0x3CB000 - новый размер 3977216
sf write 0x80600000 0x230000 0x3CB000
reset