Skip to content

Instantly share code, notes, and snippets.

@Informatic
Last active November 30, 2018 00:02
Show Gist options
  • Save Informatic/89ed76cc755eef3058f5bf18740f30b3 to your computer and use it in GitHub Desktop.
Save Informatic/89ed76cc755eef3058f5bf18740f30b3 to your computer and use it in GitHub Desktop.
Yi 2 Firmware reverse-engineering

Yes. It's real. These are just my notes after skimming through the firmware. (protip: update API)

Hardware revisions: 12L, 13L Internal version: z16 (it's all over the place)

Features

  • Running A9S, as everyone might've guessed
  • Seems to have EXFAT support in uITRON
  • SuperView
  • RTMP Streaming (Youtube Live)
  • USB serial / ether (will Linux get proper USB gadget?)
  • python2.7 on-board (will most probably be removed on production units but THAT'S FUN)
  • Has dbus. Really.
  • usr/lib/libical.so - not sure what they were smoking, but I like that.
  • 3.10.71 Kernel including USB host modules?
  • Confusing part: whole LTE setup script and stuff? (dank mr ambarella)

telnetd

It's still there, just create empty z16_rtos_console_enable.script file on SD card.

autoexec.ash

Nope, sadly nothing like that, only some random hooks to sdcard/MISC/lte_hook.sh in linux during LTE init. (still giggling about that)

@mobalized
Copy link

I'd like to reverse engineer the Yi Dome Cam since no one else seems to have taken the initiative. Only problem is I have no experience reverse engineering and tried but failed at using binwalk on it. Can you by chance point me in the right direction on how to get to the root file system?

@xamica
Copy link

xamica commented Dec 20, 2016

It's still there, just create empty z16_rtos_console_enable.script file on SD card.

Which firmware version you have? I checked this string in my firmware, but found only:
c:\disable_remove_fw_file.script
c:\check_firmware.script
firmware file c:\check_firmware.script doesn't exist!
c:\save_log_enable.script
c:\console_enable.script

Actually, c:\console_enable.script enables telnetd, but in Linux environment, not in RTOS. I checked very old version (1.0.7). available from Yi, but strings are same.

@xamica
Copy link

xamica commented Dec 28, 2016

Nobody here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment