7 ms·
Disassembling an Amazon Blink Mini camera
- pyrolistical 4y agopart 2: https://astrid.tech/2022/07/13/0/blink-mini-dumping/ https://astrid.tech/2022/07/13/0/blink-mini-dumping/ part 3: https://astrid.tech/2022/08/03/0/blink-mini-fw-analysis/ https://astrid.tech/2022/08/03/0/blink-mini-fw-analysis/ part 4: https://astrid.tech/2022/08/06/0/blink-mini-4/ https://astrid.tech/2022/08/06/0/blink-mini-4/
- xchip 4y agoThat's why HN rocks
- walterbell 4y agoBlink cameras can run on battery for a year! A worthy platform to be liberated from app/cloud. https://awesomeopensource.com/projects/camera/firmware https://awesomeopensource.com/projects/camera/firmware Thanks for the supply chain diagram: https://astrid.tech/_/2022/08/03/0/blink-companies.svg https://astrid.tech/_/2022/08/03/0/blink-companies.svg Microsoft's ThreadX RTOS was also used on RPi GPU, https://en.wikipedia.org/wiki/VideoCore#Linux_support https://en.wikipedia.org/wiki/VideoCore#Linux_support
- ilamont 4y agoThere are several security camera manufacturers making long battery life claims. I found Eufy's "6 month battery" claims to be grossly overstating the reality (1-2 months in normal conditions using various units) and would be suspicious of 365 day claims made by Eufy, Blink, and others.
- walterbell 4y agoBlink has custom silicon, which may be forcing competitors with generic SoCs to exaggerate. Blink's claims are precise, https://support.blinkforhome.com/en_US/f-a-q/how-long-do-the-indoor-and-xt-camera-batteries-last https://support.blinkforhome.com/en_US/f-a-q/how-long-do-the... > Blink Video Doorbell, Outdoor and Indoor (gen 2), and XT2 cameras can expect battery life of up to 2 years, based on 5,882 seconds of Live View, 43,200 seconds of motion-activated recording and 4,788 seconds of Live View with two-way talk. This is roughly 70 seconds per day. For the Indoor (gen 1) and XT cameras, 2 years of typical use is defined as 40,000 seconds of Motion Clips and Live View. This is approximately 50 seconds per day.
- NavinF 4y ago> 43,200 seconds of motion-activated recording Ahh 6 hours of continuous recording. That's a lot more reasonable. You could build something similar by combining a low power PIR sensor with a camera
- stu432 4y agoI have several Blink camera's, can attest they do indeed last more than a year. Front of house that gets more than usual traffic has lasted around 2 years between battery changes, back of house around 3 years so far. Using Duracell batteries if that makes a difference.
- ihaveajob 4y agoSame here. The squirrels in the backyard are definitely a drain on the batteries. Another reason to hate them (the main one is that they eat my nectarines).
- tmn007 4y agoI have a bunch in the roof cavity to monitor for roof rat incursion. They have been going for about 3 years now. I found the Blink camera was the best for a battery camera in terms of startup on PIR detection. In comparison my newer Eufy and Arlo cameras take a second or two (sometimes more) and have much less battery life. The downside on the Blink is that you have to buy high end lithium AA batteries
- runjake 4y agoIt depends on the level of activity. Some of my Blinks last over 1 year, and some last a couple months.
- fillskills 4y agoI use a Blink Camera in an semi active zone (backyard) and it lasted 1.5 years without battery change. Blew my mind since it offered almost the same functionality with better performance thank top of the market competitors.
- Calvin02 4y agoI hope the author will make the firmware available to others for research.
- glitchc 4y agoThe author hasn't been able to pull the firmware off, and it's unclear if they possess the technical ability to extract the firmware over SPI.
- bodangly 4y agoThe later posts show binwalk output and there are certs at the top of the binary. He’s never getting his own firmware to run. Fun hobby project for him I’m sure though.
- _whiteCaps_ 4y ago*she / her
- prattcmp 4y agoI don’t trust Amazon Alexa’s privacy standard, let alone a video camera.
- walterbell 4y agoAmazon's Blink motion-detecting cameras don't have a hardware power switch.. https://safetywish.com/how-to-disable-blink-cameras/ https://safetywish.com/how-to-disable-blink-cameras/
- asddubs 4y agoi mean that kind of makes sense for a security camera, right?
- walterbell 4y agoFor an indoor camera used by consumers? Perhaps they only want the security camera turned on when they are not at home. Is there any other camera without an off switch, consumer or enterprise?
- jibe 4y agoI have a bunch of different cameras, nest, Wyze, Amazon - none have on/off switches. Just plug in USB for power and they start up.
- walterbell 4y agoAt least they can be unplugged.
- prattcmp 4y agoSimplisafe cameras have a powered privacy cover that physically blocks the lens.
- formerly_proven 4y agoIf you get close enough to a CCTV camera that you can remove the panel covering the reset switch and network connection, you can just put tape over the lens.
- everyone 4y agoI really hate how no big tech company is just making excellent hardware/software that people buy cus it's excellent. Everything (by big tech) seems to be some sort of sleazy scam nowadays.
- walterbell 4y agoWhen the Linux port is ready, Apple M1 laptops will (relatively) qualify as excellent perf/watt and interop with non-Apple OS. There are cheap used HP/Dell thin clients based on the venerable AMD Puma SoC family found in the coreboot-based PC Engines APU2 (an excellent classic device which even has ECC memory). Hardkernel (small company from Korea) ODROID M1 is a capable Linux SBC /w NVME.
- everyone 4y agoIf you're a tech-nerd then of course you can use your expertise to cobble together something excellent in the current milieu. My point is that big tech FAANG-like corps never seem to sell anything nowadays that's just simply good out of the box without any sleazy scam-like caveats. That's a pretty sorry state of affairs. It feels like we've taken one step forwards, one step backwards. Like in 80's you could buy a C64 which was just pure excellent right out of the box, but you had to be a bit of a tech nerd to buy one in the 1st place. Nowadays if you're a regular person and buy some popular computer you're buying into some sort of scam. You need to be tech-nerd to avoid the scam and get something good. In 80's tech nerds had C64 and bbc micro and so on, and everyone else had nothing and just missed out competely on the magic of computing. Nowadays tech nerds have their own pc's and everyone else has iOS and Android and almost completely misses out on the magic of computing.
- walterbell 4y agoSadly, modern businesses are often selling services rather than hardware. > everyone else has iOS and Android and almost completely misses out on the magic of computing If some of the iOS/iPadOS/Android people bought a ~$100 used PC, RPi or Linux SBC, they could use it as a relatively libre home "server/cloud" for learning. With Ubuntu and search engines, it's still somewhat possible to take vacations from walled gardens to visit magic computing castles that are open to user mods.
- jacob019 4y agoWhat are the chances that the firmware is signed?
- bodangly 4y agoNear 100%. If you look at the binwalk output in his later posts you can clearly see certificates as one of the first things in the binary. I’ll be shocked if this guy ever actually gets his own firmware to run here.
- mgsk 4y agoHer.
- withinboredom 4y agoThe easiest thing would be to buy some flash, desolder the existing flash and install their own flash. Certs won’t matter then.
- no_time 4y agoFirmware signature verification is almost done in mask ROM exactly to prevent this.
- Namidairo 4y agoYou're assuming that flash storage is the only thing to be concerned about in a secure boot scenario. Assuming that the platform is even secure boot capable, you'd blow a fuse or similar at the factory to put it into production mode. However even then, secure boot isn't infallible. Either they're implemented shoddily, or you end up power glitching past verification. (I've seen a certain vendor who's name starts with Qualco... fail because they didn't remember that u-boot was... configurable.)
- Matthias247 4y agoIf some form of secure boot is used, then replacing the flash won't work either. There is one-time writable storage inside the SoC itself is used for verification. You won't be able to get it back into a state where it accepts non-signed firmware without also replacing the SoC.
- phh 4y agoNice write-up. Still a lot to go through, I hope the author have the will to continue further (they already put a lot of courage in it.) If I may, regarding the "BUND" magic. I'm sorry to disappoint, but it's likely just "fourcc" (as in, a stirng that fits in an int32) for "bundle".
- formerly_proven 4y agoNice blogpost not withstanding I dunno why anyone would bother with these, all consumer CCTV cameras are garbage as far as the hardware goes and that's what produces the image you presumably want to be using. A nice 1/1.8" or 1/1.2" Sony sensor costs some money, and a high resolution, achromatic (vis to ~1 µm) and fast lens does not stand up to the fractional-penny-shaving applied to consumer products. So you get shitty 1/3" or smaller sensors made by some backwater company with the cheapest lens someone could come up with.
- no_time 4y agoDoes it have some sort of "secure" boot? If it doesn't, I might pick up a few to try to de-amazon it. The hardware does indeed look pretty cool.
- mwint 4y agoI was hoping this was going to end with "look, it runs embedded linux and here's how to get root, on a $20 camera". That would solve this problem: Does anyone know of a good way to have a camera stream video over WiFi to my server, which can then forward it to the Internet, without passing through a third party? And, ideally, without opening ports. Burned too many times by buying cameras with streaming systems that are shut down two years later. I think if I could get root on embedded linux on a WiFi camera, I could set up an SSH tunnel and go from there. But with the current IP camera I wasn't smart enough to get root (or a shell at all, IIRC) and it wouldn't take firmware updates. So right now I have a terrible hacky solution where it FTPs an image to me every ten seconds, and then I put serve that... but a real stream would be way better.
- fimdomeio 4y agoThis might interest you. https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks https://github.com/EliasKotlyar/Xiaomi-Dafang-Hacks
- jtchang 4y agoI wrote this for Wyze v2 cameras: https://github.com/openmiko/openmiko https://github.com/openmiko/openmiko
- solardev 4y agoThis is awesome, thank you! I have a few Wyze cameras and their hardware and pricing are great, but their app is pretty bad. Would be lovely to be able to use them outside the app.
- blackfawn 4y agoThis looks quite nice, I will give it a try. I mostly have v3 cameras and unfortunately it looks like these are not supported?
- jsjohnst 4y agoWyze has an official RTSP firmware you can download from their support section for the v3. It’s beta, but has mostly worked for my needs.
- nonameking2026 4y agoTry duckduckgo or other search sites - google filters a lot of info.
- fullstop 4y agoIn part 4 they try to figure out what BUND means, and have some really odd thoughts. It's probably just Bundle.
- jgalt212 4y ago> visible and infrared light Can this render a nude body like Sony's did (by accident???) http://www.aparchive.com/metadata/youtube/ad99e1a3930185817a1275d284408e3b http://www.aparchive.com/metadata/youtube/ad99e1a3930185817a...
- lgats 4y agoInternal Photos from FCC ID, available without disassembly https://fccid.io/2AF77-H1931660/Internal-Photos/Exhibit-C-Internal-Photographs-per-2-1033-b7-4660032.pdf https://fccid.io/2AF77-H1931660/Internal-Photos/Exhibit-C-In...
- mrtweetyhack 4y ago
- sbf501 4y agoI have been working on small motion camera devices like this using off-the-shelf parts, and getting 1080p to stream over wifi with arducams is nontrivial. There's a lot of special MCU features you need or you're effed: enough GPIO for the camera and the SDCARD, h.264 acceleration, enough RAM to run the LWIP stack and TLS (or crypto accelerator), zero wait-state memory. Trying to get good battery life is a whole different ball of wax. Hats off the companies that finally nailed this. EDIT: Part 3 of this is truly impressive. OP decoded the IP used, and it came from freaking EVERYWHERE.
- pm2222 4y agoThe contents are gone. What happened?