Hey,
I stumbled across this thread while poking my W6. Hope it's not too old
I found a way to gain root access on the console:
GitHub - R1N4x/Wansview_Root: Gain root access on Wansview W6 camera
Simply place a file "facDiag" on a SD card and boot the cam with it.
The cam will execute whatever you put in this file.
you need to put line 108 in "facDiag" - or the camera will not continue to initialize its functionality.
Reason why is the "ipc_start.sh" (line 100):
Bash:
mdev -s
mkdir -p /var/tmp/
cp -rp /etc/* /var/tmp/
busybox mount -t tmpfs -o mode=0755 tmpfs /etc
cp -rp /var/tmp/* /etc/
mkdir -p /var/etc/
mkdir -p /var/net/
mkdir -p /var/spool/
mkdir -p /var/spool/boa/
touch /var/spool/boa/dircache
if [ ! -p /var/sycfg/conf.d ];then
mkdir -p /var/syscfg/conf.d
fi
if [ ! -f /var/syscfg/conf.d/mime.types ];then
touch /var/syscfg/conf.d/mime.types
fi
size=$(stat -c %s /var/syscfg/syscfg.ini)
if [ $size = "0" ]; then
echo "syscfg.ini size:$size"
cp /var/syscfg/def_syscfg.ini /var/syscfg/syscfg.ini
fi
if [ -f /var/sysbak/ircutOppsite ]; then
insmod /mnt/mtd/module/peripher_drv.ko ircut_opposite=1
else
insmod /mnt/mtd/module/peripher_drv.ko ircut_opposite=0
fi
insmod /mnt/mtd/module/tx-isp-t21.ko
insmod /mnt/mtd/module/audio.ko sign_mode=1
/sbin/insmod /lib/modules/mt7601Usta.ko
ip link set dev wlan0 name ra0
insmod /mnt/mtd/module/reset_drv.ko
insmod /mnt/mtd/module/NetLED_drv.ko
key=hw_func_params
bSyncEeprom=0
if [ -f /var/sysbak/faccfg_eeprom ];then
read eepromVal < /var/sysbak/faccfg_eeprom
echo $eepromVal
if [ $eepromVal = 1 ];then
bSyncEeprom=1
fi
fi
while read line
do
k=${line%=*}
v=${line#*=}
if [ "$k" == "$key" ];then
echo "$k : $v"
if [ ${v:10:1} = 1 ] && [ "$bSyncEeprom" != "1" ];then
echo "insmod eeprom.ko"
insmod /mnt/mtd/module/eeprom_drv.ko retry_num=2
fi
break
fi
done < /var/sysbak/faccfg.ini
ifconfig lo 127.0.0.1
ifconfig eth0 0.0.0.0
ifconfig ra0 0.0.0.0
export LD_LIBRARY_PATH=/mnt/mtd/lib:/lib
export PATH=/gm/bin:/bin:/sbin:/usr/bin:/usr/sbin:$PATH
echo 512 > /proc/sys/vm/min_free_kbytes
sh /memmonitor.sh &
sh /run_cmd.sh &
while true;do
if [ -f /var/cloud/firmware.bin ];then
cp /mnt/mtd/app/initApp /var/cloud/initApp
/var/cloud/initApp
elif [ -f /mnt/mmc/facDiag ];then
touch /mnt/mmc/diagLog.txt
/mnt/mmc/facDiag &> /mnt/mmc/diagLog.txt
elif [ -f /mnt/mmc/testMode ] || [ -f /var/syscfg/testMode ];then
if [ -f /mnt/mmc/testApp_t21 ];then
/mnt/mmc/testApp_t21
else
/mnt/mtd/app/testApp_t21
fi
else
/mnt/mtd/app/initApp
OPID=`ps |grep net_run.sh|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep udhcpc|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep wpa_supplicant|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep group-calendar|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep group-list|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep lan-probe|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep media|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep remove-groups|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep snap|grep -v 'grep'|awk '{print $1}'`
kill $OPID
OPID=`ps |grep boa|grep -v 'grep'|awk '{print $1}'`
kill $OPID
fi
sleep 2
echo 3 > /proc/sys/vm/drop_caches
sleep 3
done
Cheers
EDIT: tested on Firmware 07.26100.07.12
EDIT 2 UPDATE:
I poked around in the Firmware and found more interesting things.
The firmware executes some boot scripts and looks for additional scripts.
Most interesting find IMHO: ipc_start.sh (in the root) looks for a ipc_after.sh in /var/syscfg/ wich is mounted rw by ipc_start.sh.
I placed a chpasswd script in there. This is persistent, even after "factory reset" (via button hold).
The camera will also update the syscfg.ini on every boot if there is an syscfg.ini on the sd-card. Place a [Telnet] enable=1 in there and you got Telnet access.
I found the best way to do so is grabbing the existing syscfg.ini from the cam, so you don't loose all other settings like ONVIF etc.
Something I haven't figured out yet is the setup process.
If you reset the camera via button hold it wipes a few files like "register.ini" and "wpa_supplicant.conf".
Cloning those files didn't work, the "initApp" (compiled binary that does all the camera magic) misses something and does not start properly. If you place a QR-Code in front of the camera it decodes it. I prepared a code like the app generates, the cam will then connect to the provided wifi but after reboot its gone again.
I need to poke around more, somehow it has to be possible to set it up without the dang app...
I'm also pretty astonished that I can't find any more projects or details about this camera online, it's dead cheap (37€) and actually pretty good IMHO. Just the whole cloud thing is very annoying.
EDIT 3 UPDATE:
Got a second camera and it got the firmware 05.16 - I've updated my repo with an example.
This "older" firmware looks a lot cleaner, but is still flawed and easy to break in...
I got it working via ethernet completely without the app or cloud connection.
Only downside so far: I'm unable to change the default credentials for ONVIF and RTSP. I can add new users via ONVIF Device Manager but not delete users. (I'm okay-ish with that, since the camera is locked in its own network...)
