{"id":90,"date":"2014-01-26T00:26:35","date_gmt":"2014-01-26T00:26:35","guid":{"rendered":"http:\/\/simon.aldrich.eu\/blog\/?p=90"},"modified":"2014-01-27T12:40:28","modified_gmt":"2014-01-27T12:40:28","slug":"hacking-the-motorola-blink-1-baby-monitor-part-2","status":"publish","type":"post","link":"https:\/\/simon.aldrich.cc\/blog\/2014\/01\/hacking-the-motorola-blink-1-baby-monitor-part-2\/","title":{"rendered":"Hacking the Motorola Blink 1 Baby Monitor (Part 2)"},"content":{"rendered":"

Ok, so it’s been quite some time since I posted my first efforts at “hacking” the Motorola Blink 1 Baby Monitor. Suffice to say we’ve been quite busy for a while & I’ve only just gotten around to actually plugging it in again now that our son is with us & at an age where we’re starting to think about being able to put him down in his crib & go into another room.<\/p>\n

Anyway, I powered it on for the first time since August today and it asked to perform a firmware upgrade. I though ‘Aha! I’ll capture what it’s up to and see if I can work out where it downloads new firmware from’ but I inadvertently messed-up my tcpdump session & didn’t actually capture anything while it was upgrading. Furthermore, as I should have known from reading the comments here it seems that Motorola have disabled the landing page for the onboard web-server in the new firmware version (08-050) and it now just gives you a 404.<\/p>\n

Well obviously this couldn’t be allowed to stand. Suffice to say if you capture all network traffic from the Blink when it powers on you’ll see it makes some web requests to a Monitor Everywhere ‘OTA’ server. It seems this is how it determines if there’s a firmware upgrade to be downloaded & with a bit of jiggery-pokery you too can download bmfwromfs_08_050.tar.gz which contains the latest firmware.<\/p>\n

Unpacking the gzip’d tarball you’ll see there is a binary file ‘conprog.bin’ which I’m pretty sure is the kernel image\u00a0 (2.6.17.14 since you ask) and a file ‘rootfs.bin’ which is a romfs<\/a> image file containing the root file system for the camera.<\/p>\n

You can mount this under Linux using the command:<\/p>\n

mount -t romfs -o loop <path to rootfs.bin> <mount-point><\/pre>\n
I’ve only just got this going tonight so I’ve yet to have a real poke around in there but for everyone who’s looking for the web interface point your brower at:<\/p>\n
http:\/\/<camera-ip>\/blinkhome.html<\/pre>\n
– or –<\/p>\n
http:\/\/<camera-ip>\/index2.html<\/pre>\n
to get it back. Incidentally the pages aren’t quite the same, so worth looking at both!<\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
Ok, so it’s been quite some time since I posted my first efforts at “hacking” the Motorola Blink 1 Baby Monitor. Suffice to say we’ve been quite busy for a while & I’ve only just gotten around to actually plugging it in again now that our son is with us & at an age where […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[20,19],"tags":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p2Rw4E-1s","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/posts\/90"}],"collection":[{"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/comments?post=90"}],"version-history":[{"count":4,"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/posts\/90\/revisions"}],"predecessor-version":[{"id":94,"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/posts\/90\/revisions\/94"}],"wp:attachment":[{"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/media?parent=90"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/categories?post=90"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/simon.aldrich.cc\/blog\/wp-json\/wp\/v2\/tags?post=90"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}