Xiaomi console access

[zachnfine]

Some more interesting Ambarella info:
https://www.defcon.org/images/defco...N-21-Manning-Lanier-GoPro-or-GTFO-Updated.pdf

Maybe it's not useful for me to post links to every bit of Ambarella info I find in here. I'm just hoping that somewhere in all this info is the key to find a way to interactively run the kind of commands that would normally live in autoexec.ash, and to try the manual exposure commands that were listed in an extract from the firmware.

 

[Andy_S]

Zach, there IS a serial console and i will investigate where is it going, if amba rtos or (hopefuly) busybox.

 

[Spix]

SOLVED: in short you need to create a file named "enable_info_display.script" in the root directory of the SD card.

Is this no longer working with V1.2.0? Telnet reports: unable to connect with remote host; connection refused.

 

[Andy_S]

it does - verified &used

 

[Spix]

@Andy_S Thanks for your reassurance. Silly me, I created a folder; not a file.

 

[Andy_S]

Happens

When in doubt, C4

 

[zachnfine]

Zach, there IS a serial console and i will investigate where is it going, if amba rtos or (hopefuly) busybox.

My Yi arrived and I'm in via telnet. Poked around a bit to see if I could find ambsh.

 

[Andy_S]

telnet != serial console. But i managed to do what i needed without it, so i don't know what it is. Telnet is of course running in busybox.

 

[_b_]

telnet != serial console. But i managed to do what i needed without it, so i don't know what it is. Telnet is of course running in busybox.

ambsh is accessible if you take apart the camera, solder on some wires to the TX/RX pins on the PCB, and then boot it up. I have verified that this works. FYI console gives access to Ambarella's RTOS, but using their ipc tool you should theoretically be able to exec commands on linux just like many do with autoexec.sh

Any luck on tweaking wifi.conf or running shell scripts to switch to STA mode for wifi?

 

[jessej]

these of any use to anyone?

https://github.com/pengdu/bbam - seems like the source code for a5s

http://spritesmods.com/?art=zx3hack&page=3 - running custom code on ambarella

 

[huhu2207]

these of any use to anyone?

https://github.com/pengdu/bbam - seems like the source code for a5s

http://spritesmods.com/?art=zx3hack&page=3 - running custom code on ambarella

OMG!! It seems useful for researching!
But these code is protected by Amberlla's private licence, it would be illegal to upload to the GitHub, right?

 

[Andy_S]

Any luck on tweaking wifi.conf or running shell scripts to switch to STA mode for wifi?

what about sticky thread https://dashcamtalk.com/forum/threads/camera-wifi-in-client-mode-working-ash-script-inside.12239/ ?

 

[_b_]

what about sticky thread https://dashcamtalk.com/forum/threads/camera-wifi-in-client-mode-working-ash-script-inside.12239/ ?

excellent... thank you. very nice work.

 

[kromond]

Can you give an example script? Usleep doesn't work for me.

it just outputs

-ambsh: usleep: command not found!

how do you see that output from ambsh?

 

[funnel]

how do you see that output from ambsh?

I output it to a file.

help > output.txt

 

[Hombré]

Go the old text file........... Who'd of thought

I get great pleasure out of converting something that's readable

 

[kromond]

I output it to a file.

help > output.txt

I am not getting anything in the file. I tried as above and also creating the file first and putting the full path. is there more to it?

sleep 9
#
lu_util exec 'if [ ! -f /tmp/fuse_d/out.txt ]; then touch /tmp/fuse_d/out.txt; fi'

sleep 2
help > /tmp/fuse_d/out.txt

 

[luckylz]

in autoexec.ash, you can't use /tmp/fuse_d
try:

help > d:/out.txt

because:

d: == /tmp/fuse_d
a: == /tmp/fuse_a

 

[Delphir]

Does anyone know how to connect directly to ambsh serial console on camera`s pcb?

 

[renzo201]

I know this is an old thread, but does anyone still have a copy of that github repo?