As a decent helicopter parent I recently bought a LogiLink WC0030A IP camera to watch my one-year old during her sleep (just kidding). Jelmer Tiete showed in his excellent blog article that it’s very easy to hack the WC0030A (serial console on the chip, telnet access with default root password). I wanted to improve the security of the device, so I continued where Jelmer left off and ported OpenWRT to the camera.

Jelmer already found out that the camera’s SoC is very similar to the NixCore X1. And indeed, all I did was a little modification of the patch that added OpenWRT support for the X1. I adapted the flash layout (uboot size is a bit smaller than on the X1), changed the name of the board, and it compiled without problems. The resulting sysupgrade image can then be flashed via uboot. Here’s all the details:

What works?

  • Ethernet
  • Wifi
  • Camera
  • Brightness-controlled infrared lighting (this seems to be realized in hardware, not software)
  • MJPEG stream (via mjpeg-streamer)
  • Reset button (Update 2016-08-29)
  • Front LED (Update 2016-08-29)
  • I/O alarm connectors (Update 2016-08-29)

What doesn’t work?

  • Flashing through the original Web UI. Sorry folks, TFTP only. The original firmware seems to require some kind of header, I didn’t figure that one out (and probably won’t)
  • Motors (I still have to figure out how to drive them via GPIO (Update 2016-08-29: see below)
  • Sound (I don’t need it, so I probably won’t try to figure it out in the future)

The next step is to get OpenWRT mainline support for the camera. I want to have at least the correct GPIO layout and maybe working motors before I submit the patch, so please give it some time. Until then, have fun with your upgraded camera!

Update 2016-08-29

I traced some of the internal GPIOs and found out how to drive the motors (in theory). Here’s an overview of all the GPIOs I found:

GPIO number Function
GPIO 0 Reset button
GPIO 12 Front LED (white)
GPIO 17 Stepper motor end stop UP
GPIO 18 Stepper motor end stop DOWN
GPIO 19 Stepper motor end stop RIGHT
GPIO 20 Stepper motor end stop LEFT
GPIO 21 I/O alarm pin 3 (input, active-high)
GPIO 22 Stepper motor latch A0
GPIO 23 Stepper motor latch A1
GPIO 24 Stepper motor latch A2
GPIO 26 Stepper motor latch D
GPIO 27 I/O alarm pin 2 (output, active-low)

Regarding camera movement: The camera contains two stepper motors for each axis (horizontal and vertical). Each stepper motor has a connector with five pins (5V + 4x input), so both motors could be driven by using eight GPIO pins.

To reduce the number of required pins the device uses a so-called “adressable latch” (an NXP 74HC259D). The latch allows to address one of the eight motor input pins (by setting the address bits A0-A3) and set it high (D=1) or low (D=0). Inputs need to be pulled high in a moving fashion to drive the motor, see this thread for an explanation. This was probably implemented as a userspace application in the original firmware, and I haven’t found an easy way yet to do this in OpenWRT. Stay tuned…