Lost password of wifi endoscope cam - Page 1
Forum section: electronics / projects

author: diy3d
author_rank: Newbie
timestamp: September 07, 2017, 09:59:08 pm
content: Hi,I bought myself a Wifi endoscope camera. The main module is a Wi-Fi accesspoint and with an App, the images can be received on your phone. I was satisfied this device was working well until I changed the default wifi password. Yes I lost it, I can not remember it anymore. I tried to reset the device so I could use the default 12345678 password...but no wayI asked the the supplier, searched the internet, tried the reset button in all possible combination with the powerbutton, I tried make a USB connect with Putty, I removed the wifi and memory module from the power pcb .. no success.I guess the Wi-Fi configuration and password stored in the program memory of the Ralink RT5350.So the big question, how do I reset the device?Therefore, I decided to investigate the device further.Wifi Endoscoop Module: ZCF99Os: Linux 2.6.32Port: 23 tcp open telnet BusyBox telnetdWiFi module: Ralink RT5350Memory module: Etrontech EM63A165TS-6G 16M X 16 Bit Synchronous DRAM (SDRAM)Serial interface: Macronix MX25L3206EAttached pictures show the various components.Kind Regards

author: RobertHolcombe
author_rank: Frequent Contributor
timestamp: September 07, 2017, 10:17:27 pm
content: How did you change the password originally?

author: joao2004
author_rank: Contributor
timestamp: September 07, 2017, 10:41:16 pm
content: Have you tried password 88888888 ?

author: alexanderbrevig
author_rank: Frequent Contributor
timestamp: September 07, 2017, 10:46:02 pm
content: Take a deep look inside yourself and ask if maybe it's worth it just to get a new one...? Yes, there's a joke there somewhere.

author: cstratton
author_rank: Regular Contributor
timestamp: September 08, 2017, 04:36:15 am
content: With a RT5350, what you have is basically a little router that think's it's a camera.Compare something like this:https://wiki.openwrt.org/toh/hootoo/tripmate-nanoPassword will be in the SPI flash, yes. But likely holding down the reset button for a while will get it to wipe the writable overlay partition and revert to the underlying read only state - typically that's a jffs2 near the end that mounts over the top of a squashfs filling the middle of the chip.Or look for a UART hearder and see if you can get into U-Boot.Or hold the CPU in reset and have at the flash with some other access device and micrograbber leads - though do pay attention to the designed voltage.

author: diy3d
author_rank: Newbie
timestamp: September 08, 2017, 08:15:20 am
content: Quote from: RobertHolcombe on September 07, 2017, 10:17:27 pmThere is an APP called WiFi_View, you can configure the the resolution, SSID, clear or modify password etc.Quote from: joao2004 on September 07, 2017, 10:41:16 pmSure, no resultsQuote from: alexanderbrevig on September 07, 2017, 10:46:02 pmDo you mean the price is a jokeI agree@cstratton, thanks for the advice

author: polli
author_rank: Contributor
timestamp: September 08, 2017, 08:47:05 am
content: Since you own this thing, I think this tool should be legal to use for you:https://www.aircrack-ng.org/I never actually had to use it, but I think that if your password is really basic (like just numbers or just lowercase digits) and you use the appropriate options, you should be able to find it fairly quickly.Again, I never used this so I can't give you a command ready to execute, but you should be able to find something in the docs or on a tutorial.

author: diy3d
author_rank: Newbie
timestamp: September 08, 2017, 09:57:56 am
content: Hi thank you, that is an interesting tool.

author: Mechatrommer
author_rank: Super Contributor
timestamp: September 08, 2017, 12:29:05 pm
content: Quote from: diy3d on September 08, 2017, 08:15:20 amdont change default password if there is no good reason. and dont forget your password. those are among the jokes... if its easy to reset your device, it will be equally easy to reset other people's device.

author: NiHaoMike
author_rank: Super Contributor
timestamp: September 08, 2017, 02:18:06 pm
content: Quote from: Mechatrommer on September 08, 2017, 12:29:05 pmI think the intent of the password is to prevent hackers from breaking into the connection, not to render a stolen device unusable.

author: polli
author_rank: Contributor
timestamp: September 08, 2017, 03:27:20 pm
content: Quote from: Mechatrommer on September 08, 2017, 12:29:05 pmthis is not correct, because when resetting your device you usually have physical access. There are devices where security is an issue in case of physical access from an attacker, but this is not such a device. If you have physical access to a laptop, even if it was encrypted correctly, you can just "reset" it by booting from an usb drive and installing a fresh OS. If you steal a phone you can still wipe it and use it with your stuff.

author: KingVidiot
author_rank: Contributor
timestamp: February 06, 2019, 07:13:40 am
content: Quote from: joao2004 on September 07, 2017, 10:41:16 pmthanks, worked perfectly for me on my XJ_wifibox :-)I should have guessed that since the Chinese really love the number 8

author: soldar
author_rank: Super Contributor
timestamp: February 06, 2019, 09:36:41 am
content: Quote from: polli on September 08, 2017, 08:47:05 amI do not think that will help. I think the way it works is that you need to have a valid handshake from someone who logged in with the correct password. Then aircrack tries whatever passwords you tell it to try and it will see if one matches the existing handshake.In other words, you cannot do anything unless you have a valid handshake.

author: n8henrie
author_rank: Newbie
timestamp: February 11, 2019, 06:48:20 pm
content: I ran into this same issue with a similar endoscope and did a writeup of how I figured out the WiFi password, the telnet account and password, and how to configure the endoscope by sending some UDP packets.The writeup begins here:https://n8henrie.com/2019/02/reverse-engineering-my-wifi-endoscope-part-1/The short answer is that you'll need to connect to the TX2 and RX2 serial debug ports at 57600 baud, it will print out your WiFi password. (Without that, unfortunately you obviously wouldn't be able to connect by telnet or send any commands over UDP.)Ran into this post while I was googling for an answer, so thought I'd register to post my solution!