Hacking in to my Y-CAM black, need help

[n1gp]

Thought I'd take apart my y-cam black today and see what makes it tick.

I found a 4 pin header that looked alot like a serial console connection.
Sure enough:

* +5
* out
* in
* GND

115200 8-1 baud

Wondering if anyone can help me with the login/password? I've tried the default
admin/1234, and various root/root, root/1234/ ....

BTW, since it's using linux isn't that company supposed to post the firmware source?

I see it boots linux and brings me to a login prompt, console dump to follow...

MyLoader version 2.1.1

Probe Flash Device: 00400000 at 80000000
Flash Device: Found 1 x16 devices at 0x0 in 16-bit mode
Amd/Fujitsu Extended Query Table v1.1 at 0x0040
number of CFI chips: 1



Load Firmware

Loading Firmware ... Done.

Uncompressing Linux......................................................................... done, booting the kernel.
Linux version 2.6.23.8 (hayden@hayden.orantek) (gcc version 3.4.6) #96 Thu Jan 1 03:11:24 CST 2009
CPU: FA526 [66015261] revision 1 (ARMv4), cr=0000397f
Machine: FIC8120
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 8192 bytes, associativity 2, 16 byte lines, 256 sets
CPU0: D cache: 8192 bytes, associativity 2, 16 byte lines, 256 sets
Built 1 zonelists in Zone order. Total pages: 8128
Kernel command line: console=ttyS0,115200n8 root=/dev/ram0 rw
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 32MB = 32MB total
Memory: 27552KB available (2036K code, 196K data, 92K init)
SLUB: Genslabs=22, HWalign=32, Order=0-1, MinObjects=4, CPUs=1, Nodes=1
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
Faraday FIC8120 AHB DMA driver v1.0
Faraday FIC8120 APB DMA driver v1.0
NET: Registered protocol family 16
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
checking if image is initramfs...it isn't (bad gzip magic numbers); looks like an initrd
Freeing initrd memory: 2568K
NetWinder Floating Point Emulator V0.97 (double precision)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
LED manager driver v1.0
Reset button driver v1.0
IRLED board driver v1.1
GPIO control driver v1.0
Faraday FIC8120 input OSD driver v1.00
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x98200000 (irq = 10) is a 16550A
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x98300000 (irq = 12) is a 16550A
serial8250.0: ttyS2 at MMIO 0x98900000 (irq = 23) is a 16550A
serial8250.0: ttyS3 at MMIO 0x99600000 (irq = 25) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: module loaded
Faraday FIC8120 JPEG/MJPEG encode driver v1.00
Faraday FIC8120 JPEG/MJPEG encode driver v1.00
Faraday FIC8120 motion detection driver v1.00
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Faraday FIC8120 EMAC ethernet driver v1.02
eth0: FIC8120 ethernet at 0x90900000, 00:80:48:01:23:45, IRQ 1
eth0: Realtek RTL8201(B)L PHY
Linux video capture interface: v2.00
Faraday FIC8120 v4l video grabber driver v1.00
fic8120-cap: at 0x96800000, IRQ 22
Philips SAA7113 video input processor driver v1.00
OmniVision OV7670 color CMOS sensor driver v1.0
OmniVision OV7720 color CMOS sensor driver v1.0
Micron MT9V135 color CMOS sensor driver v1.0
Parsing code for mylo Flash Image System (FIS) tables
physmap platform flash device: 00400000 at 80000000
physmap-flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
3 mylo partitions found on MTD device physmap-flash
Creating 3 MTD partitions on "physmap-flash":
0x00020000-0x003e0000 : "partition0"
0x003e0000-0x003f0000 : "partition1"
0x003f0000-0x00400000 : "partition2"
fic8120-ehci fic8120-ehci: FIC8120 EHCI
fic8120-ehci fic8120-ehci: new USB bus registered, assigned bus number 1
fic8120-ehci fic8120-ehci: irq 4, io mem 0x91300000
fic8120-ehci fic8120-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Faraday FIC8120 I2C bus driver (IO mode) v1.02
fic8120-i2c: at 0x98a00000
ov7720 0-0021: chip found
isl1208 0-006f: chip found, driver version 0.2
isl1208 0-006f: rtc core: registered isl1208 as rtc0
at24 0-0050: 256 byte 24c02 EEPROM (writable)
FIC8120 Watchdog Timer Driver v1.0 (2008-11-19) Luo Yi Ming
fic8120-wdt fic8120-wdt: at 0xf9850000 (auto started)
Faraday FIC8120 SD controller driver v1.00
fic8120-sdc: at 0x98e00000, IRQ 5
Advanced Linux Sound Architecture Driver Version 1.0.14 (Fri Jul 20 09:12:58 2007 UTC).
Faraday FIC8120 audio driver v1.00
fic8120-ssp: at 0x98b00000, IRQ 2
Wolfson WM8731 audio codec driver v1.01
wm8731 0-001a: chip found
ALSA device list:
#0: fic8120-ssp at 0x98b00000, IRQ 2
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
isl1208 0-006f: hctosys: invalid date/time
RAMDISK: cramfs filesystem found at block 0
RAMDISK: Loading 2568KiB [1 disk] into ram disk... done.
VFS: Mounted root (cramfs filesystem) readonly.
Freeing init memory: 92K
usb 1-1: new high speed USB device using fic8120-ehci and address 2
usb 1-1: configuration #1 chosen from 1 choice
init started: BusyBox v1.1.3 (2008.08.05-08:12+0000) multi-call binary
Mounting proc filesystem:
Mounting local filesystems:
Mounting sys filesystems:
Orantek OT825 Driver v1.0 (2006-11-22) Luo Yi Ming
ot825: 10 10
ot825: found chip.

_____ ____ _ ____
|__ / _| _ \ / \ / ___|
/ / | | | | | |/ _ \ \___ \
/ /| |_| | |_| / ___ \ ___) |
/____\__, |____/_/ \_\____/
|___/
ZD1211B - version 3.0.0.25
vendor_id = 0cde
product_id = 001a
USB 2.0 Host
Release Ver = 4810
EEPORM Ver = 4810
Finsih download Firmware. Ready to reboot
PA type: 0
PHYNEWLayout = 1
Airoha AL2230S_RF
AllowedChannel = 000107ff
Region:48
usbcore: registered new interface driver zd1211b
mtdcp: /dev/mtdcfg: file not exist
mtdcp: /dev/mtddef: file not exist
Start nvctl:
open unix socket /var/tmp/ipcamd_server error: No such file or directory
Start button:
Start led:
Start chkvsize:
Start localtime:
eth0: Setting MAC address to 00:19:70:0a:43:2c
eth0: link down
ifconfig eth0 hw ether 00:19:70:0a:43:2c
Start netif:
Start network:
Start loop:
Start ethernet:
eth0: Setting MAC address to 00:19:70:0a:43:2c
Start alarmd:
info, udhcpc (v0.9.9-pre) started
Start ftp:
Start smtpclient:
debug, Sending discover...
Start httpevent:
Start webs:
Start checketh:
Start upnpd:
Start videoset:
Start ipcamd:
Start ndcpd:
Start sched:
Start checkinternet:
Start procspy:

black login:

[obagi]

I downloaded the latest firmware - YCAM_BLACK_C_FIRMWARE_EN_V3.22B20090901 and the gzipped kernel is at offset 17320, the root file system - cramfs - is at offset 1135508. When I try to mount on i386 I get error:
# mount -o loop,offset=1135508 -t cramfs ./YCAM_BLACK_C_FIRMWARE_EN_V3.22B20090901.mfw /mnt/black

mount: wrong fs type, bad option, bad superblock on /dev/loop1
[793735.980106] cramfs: bad root offset 80

This probably has to do with different page size on ARM and i386. Might need to fire up qemu or try to mount it on chumby.

[robross0606]

I know this is an old post, but I'm desperately trying to find any firmware for a Y-Cam Black or Knight. If anyone has it, could they post it or DM me?

(there was a reply with an embedded link, deleted. mod)

[Turnix]

That firmware link would be lovely, is it not allowed to post firmwares on this forum?