KitVision Rush HD100W
bgn (N150) | |
|---|---|
| Rush Action Camera HD100W | |
| 3rd Party Firmware | |
| dd-wrt | |
| OpenWrt |
Incompatible |
| Tomato any flavor |
Incompatible |
| Platform | |
| Brand • Model • Rev |
KitVision Rush HD100W |
| FCC ID |
none specified |
| Type |
action camera, sport camera |
| CPU1 | |
| CPU1 Type |
MIPS 24Kc |
| CPU1 Speed |
400 MHz |
| Flash1 Chip |
Brand? Model? |
| Flash1 Size |
4 MiB4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br /> |
| RAM1 Size |
16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> |
| RAM1 Chip |
Brand? Model? |
|
802dot11 OUI: D4:2C:3D | |
| Stock bootloader |
U-Boot 1.1.4 ap121 |
| Stock FW OS |
Linux 2.6.31 LSDK-9.2.0 |
| Expansion IF types |
microSD Card slot |
| SD/MMC Slots |
1 |
| Power |
? VDC, ? A |
|
Flags: HDMI out, microSD Card slot | |
| Other | |
|
Default SSID: ACTIONPLUS | |
| Retail | |
| (Est.) release date | August 2013 |
| EAN |
5030578879581 (UPC DB, On eBay) |
| ASIN |
B01N5EPNCQ  |
| Country of manuf | China |
| Radio 1 | |
| Chip1 | |
| Wireless interface OUI |
D4:2C:3D |
| Antenna Connector Type |
integrated |
| MIMO status |
1x1:1 |
| Wireless Standard |
IEEE 802.11b/g/n |
| 802.11n |
up to 150 Mbps |
| 802.11g |
up to 54 Mbps |
| 802.11b |
up to 11 Mbps |
| WiFi Operating Frequency |
2.4 GHz |
For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
- • 150 Mbps - 1SS 2.4GHz 802.11n (40MHz chan.) = N150 class
Overview
Specifications
- KitVision Rush HD100W
- Full HD 1080p (1920x1080)
- Photo mode: 5 MP (CMOS)
- Zoom: 10x (digital)
- Format: HD 720p, HD 1080p
- Video: 60fps (1280x720), 30fps (1920x1080)
- Interface: HDMI out, USB 2.0, Wi-Fi built-in
- Memory Card: microSD, microSDHC (32GB max)
- 170° Ultra wide angle lens
- Waterproof up to 10 metres
OUI: D4:2C:3D (Sky Light Digital Ltd.)
Appears as a clone of Polaroid XS100 and other brands of actioncams.
Flashing
 | NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power. |
Connection
Default Wi-Fi password for the ACTIONCAM SSID is 123456789 and can be changed via web-interface or mobile app. After connecting to its Wi-Fi hotspot telnet port 23 is open and logging in as root/root is possible into ash with very limited busybox. dd is not available on the default busybox 1.15 but the internal partitions of the firmware can be dumped when a microSD card is present by using
"cat /dev/mtd0 > /tmp/ftp/SDdisk/mtd0.img" for the u-boot and mtd1-mtd5 for the other partitions, or a mips-compiled binary e.g. from debian of full busybox can be simply copied to microSD card and run dd via this complete busybox with all commands.
Although FAT32, the system mounts the partition in such a way that all files on the microSD card appear as executable out of the box. FTP is also available via Wi-Fi, log in with user name "ap71". Makes accessible not just the microSD card with photos and videos, but whole filesystem which can be easily copied via any ftp client.
Firmware update feature is available but firmware files do not seem to be available anywhere publicly on the internet. Files with the firmware that the fw update script checks are burn.bin or W_D.bin, not sure which file is which.
Partition layout
# cat /proc/mtd: dev: size erasesize name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "u-boot-env" mtd2: 002b0000 00010000 "rootfs" mtd3: 000e0000 00010000 "uImage" mtd4: 00010000 00010000 "NVRAM" mtd5: 00010000 00010000 "ART"
Binwalks of mtd partitions
$ binwalk mtd0.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
13472 0x34A0 U-Boot version string, "U-Boot 1.1.4 (Mar 31 2012 - 15:19:16)"
13520 0x34D0 CRC32 polynomial table, big endian
14828 0x39EC uImage header, header size: 64 bytes, header CRC: 0xD013C522,
created: 2012-03-31 07:19:17, image size: 39693 bytes, Data Address: 0x80010000,
Entry Point: 0x80010000, data CRC: 0x546AF927, OS: Linux, CPU: MIPS, image type:
Firmware Image, compression type: lzma, image name: "u-boot image"
14892 0x3A2C LZMA compressed data, properties: 0x5D, dictionary size:
8388608 bytes, uncompressed size: 115920 bytes
$ binwalk mtd2.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 Squashfs filesystem, little endian, version 4.0, compression:lzma,
size: 2427493 bytes, 585 inodes, blocksize: 16384 bytes, created: 2013-08-14 03:35:05
$ binwalk mtd3.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x4D776142,
created: 2013-08-05 19:44:23, image size: 902415 bytes, Data Address: 0x80002000,
Entry Point: 0x801BFFD0, data CRC: 0x2AF16904, OS: Linux, CPU: MIPS, image type:
OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
64 0x40 LZMA compressed data, properties: 0x5D, dictionary size:
8388608 bytes, uncompressed size: 2544044 bytes
