KitVision Rush HD100W

From TechInfoDepot
Jump to navigationJump to search
bgn (N150)
Rush Action Camera HD100W
3rd Party Firmware
dd-wrt
OpenWrt
Incompatible
Tomato any flavor
Incompatible
Platform
BrandModelRev
KitVision Rush HD100W
FCC ID
none specified
Type
action camera, sport camera
CPU1
CPU1 Type
MIPS 24K (v7.4)
CPU1 Speed
400 MHz
Flash1 Chip
Brand? Model?
Flash1 Size
4 MiB4,194,304 B <br />32,768 Kib <br />4,096 KiB <br />32 Mib <br />0.00391 GiB <br />
RAM1 Size
16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Chip
Brand? Model?

802dot11 OUI: D4:2C:3D

Stock bootloader
U-Boot 1.1.4 ap121
Stock FW OS
Linux 2.6.31 LSDK-9.2.0
Expansion IF types
microSD Card slot
SD/MMC Slots
1
Power
? VDC, ? A
Flags:
HDMI out, microSD Card slot
Other

Default SSID: ACTIONPLUS
Default IP address: 192.168.1.2
the IP 192.168.1.2 is used by 32 additional devices
of which 0 are KitVision devices
Default login user: root
Default login password: root
root:root credentials used by 24 additional devices
of which 0 are KitVision devices

Retail
(Est.) release date August 2013
EAN 5030578879581
(UPC DB, On eBay)
ASIN B01N5EPNCQ Flag of the United States.svg
Country of manuf China
Radio 1
Chip1
Wireless interface OUI
D4:2C:3D
Antenna Connector Type
integrated
MIMO status
1x1:1
Wireless Standard
IEEE 802.11b/g/n
802.11n
up to 150 Mbps
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.

150 Mbps - 1SS 2.4GHz 802.11n (40MHz chan.) = N150 class

Overview

Specifications

KitVision Rush HD100W
  • Full HD 1080p (1920x1080)
  • Photo mode: 5 MP (CMOS)
  • Zoom: 10x (digital)
  • Format: HD 720p, HD 1080p
  • Video: 60fps (1280x720), 30fps (1920x1080)
  • Interface: HDMI out, USB 2.0, Wi-Fi built-in
  • Memory Card: microSD, microSDHC (32GB max)
  • 170° Ultra wide angle lens
  • Waterproof up to 10 metres

OUI: D4:2C:3D (Sky Light Digital Ltd.)

Appears as a clone of Polaroid XS100 and other brands of actioncams.

Flashing

Connection

Default Wi-Fi password for the ACTIONCAM SSID is 123456789 and can be changed via web-interface or mobile app. After connecting to its Wi-Fi hotspot telnet port 23 is open and logging in as root/root is possible into ash with very limited busybox. dd is not available on the default busybox 1.15 but the internal partitions of the firmware can be dumped when a microSD card is present by using

"cat /dev/mtd0 > /tmp/ftp/SDdisk/mtd0.img" for the u-boot and mtd1-mtd5 for the other partitions, or a mips-compiled binary e.g. from debian of full busybox can be simply copied to microSD card and run dd via this complete busybox with all commands. 

Although FAT32, the system mounts the partition in such a way that all files on the microSD card appear as executable out of the box. FTP is also available via Wi-Fi, log in with user name "ap71". Makes accessible not just the microSD card with photos and videos, but whole filesystem which can be easily copied via any ftp client.

Firmware update feature is available but firmware files do not seem to be available anywhere publicly on the internet. Files with the firmware that the fw update script checks are burn.bin or W_D.bin, not sure which file is which.

Partition layout

# cat /proc/mtd:
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 002b0000 00010000 "rootfs"
mtd3: 000e0000 00010000 "uImage"
mtd4: 00010000 00010000 "NVRAM"
mtd5: 00010000 00010000 "ART"

Binwalks of mtd partitions

$ binwalk mtd0.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
13472         0x34A0          U-Boot version string, "U-Boot 1.1.4 (Mar 31 2012 - 15:19:16)"
13520         0x34D0          CRC32 polynomial table, big endian
14828         0x39EC          uImage header, header size: 64 bytes, header CRC: 0xD013C522, 
           created: 2012-03-31 07:19:17, image size: 39693 bytes, Data Address: 0x80010000, 
           Entry Point: 0x80010000, data CRC: 0x546AF927, OS: Linux, CPU: MIPS, image type: 
           Firmware Image, compression type: lzma, image name: "u-boot image"
14892         0x3A2C          LZMA compressed data, properties: 0x5D, dictionary size: 
                              8388608 bytes, uncompressed size: 115920 bytes

$ binwalk mtd2.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, version 4.0, compression:lzma, 
           size: 2427493 bytes, 585 inodes, blocksize: 16384 bytes, created: 2013-08-14 03:35:05

$ binwalk mtd3.img

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x4D776142, 
          created: 2013-08-05 19:44:23, image size: 902415 bytes, Data Address: 0x80002000, 
          Entry Point: 0x801BFFD0, data CRC: 0x2AF16904, OS: Linux, CPU: MIPS, image type: 
          OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
64            0x40            LZMA compressed data, properties: 0x5D, dictionary size: 
                              8388608 bytes, uncompressed size: 2544044 bytes