KitVision Rush HD100W

Specifications

 * KitVision Rush HD100W
 * Full HD 1080p (1920x1080)
 * Photo mode: 5 MP (CMOS)
 * Zoom: 10x (digital)
 * Format: HD 720p, HD 1080p
 * Video: 60fps (1280x720), 30fps (1920x1080)
 * Interface: HDMI out, USB 2.0, Wi-Fi built-in
 * Memory Card: microSD, microSDHC (32GB max)
 * 170° Ultra wide angle lens
 * Waterproof up to 10 metres

OUI: D4:2C:3D (Sky Light Digital Ltd.)

Appears as a clone of Polaroid XS100 and other brands of actioncams.

Connection
Default Wi-Fi password for the ACTIONCAM SSID is 123456789 and can be changed via web-interface or mobile app. After connecting to its Wi-Fi hotspot telnet port 23 is open and logging in as root/root is possible into ash with very limited busybox. dd is not available on the default busybox 1.15 but the internal partitions of the firmware can be dumped when a microSD card is present by using "cat /dev/mtd0 > /tmp/ftp/SDdisk/mtd0.img" for the u-boot and mtd1-mtd5 for the other partitions, or a mips-compiled binary e.g. from debian of full busybox can be simply copied to microSD card and run dd via this complete busybox with all commands.

Although FAT32, the system mounts the partition in such a way that all files on the microSD card appear as executable out of the box. FTP is also available via Wi-Fi, log in with user name "ap71". Makes accessible not just the microSD card with photos and videos, but whole filesystem which can be easily copied via any ftp client.

Firmware update feature is available but firmware files do not seem to be available anywhere publicly on the internet. Files with the firmware that the fw update script checks are burn.bin or W_D.bin, not sure which file is which.

Partition layout
dev:   size   erasesize  name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 002b0000 00010000 "rootfs" mtd3: 000e0000 00010000 "uImage" mtd4: 00010000 00010000 "NVRAM" mtd5: 00010000 00010000 "ART"
 * 1) cat /proc/mtd:

Binwalks of mtd partitions
$ binwalk mtd0.img

DECIMAL      HEXADECIMAL     DESCRIPTION

13472        0x34A0          U-Boot version string, "U-Boot 1.1.4 (Mar 31 2012 - 15:19:16)" 13520        0x34D0          CRC32 polynomial table, big endian 14828        0x39EC          uImage header, header size: 64 bytes, header CRC: 0xD013C522, created: 2012-03-31 07:19:17, image size: 39693 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x546AF927, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image" 14892        0x3A2C          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 115920 bytes

$ binwalk mtd2.img

DECIMAL      HEXADECIMAL     DESCRIPTION

0            0x0             Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2427493 bytes, 585 inodes, blocksize: 16384 bytes, created: 2013-08-14 03:35:05

$ binwalk mtd3.img

DECIMAL      HEXADECIMAL     DESCRIPTION

0            0x0             uImage header, header size: 64 bytes, header CRC: 0x4D776142, created: 2013-08-05 19:44:23, image size: 902415 bytes, Data Address: 0x80002000, Entry Point: 0x801BFFD0, data CRC: 0x2AF16904, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image" 64           0x40            LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2544044 bytes