Jimi IOT support

[Charmandrigo]

I am looking to access the video feed of this camera whose official app has several issues. Originally the app was called Tycam before being renamed to Jimi-IOT
The payload loads successfully and there's a telnet available, only port 23 is open however as no rtsp port seems to open.
Telnet is fully working, but there's no backup created, paths in the camera appear to be named differently.

Model is JH06N.
model might be sold under different brandings depending of the country, it's essentially the same camera

[code-explorer1234]

This looks like a Tuya based camera.

Could you provide a firmware dump and I can check it for you?

[Charmandrigo]

I am assuming the script should in theory make a automatic backup right? However on telnet there is no sd folder on tmp, so I will need a bit more of instructions to set up the backup manually on telnet.

This is a quick log from my telnet:

Connected to 192.168.31.87.
Escape character is '^]'.

(none) login: root
~ # ls -l
drwxr-xr-x    2 root     root           574 May  2  2018 bin
drwxrwxrwt    4 root     root          1440 Oct 24  1970 dev
drwxr-xr-x    5 root     root           430 Jul 19  2018 etc
lrwxrwxrwx    1 root     root             9 May  2  2018 init -> sbin/init
drwxr-xr-x    3 root     root          1037 May  2  2018 lib
lrwxrwxrwx    1 root     root            11 May  2  2018 linuxrc -> bin/busybox
drwxr-xr-x    2 root     root             3 May  2  2018 media
drwxr-xr-x    6 root     root            59 May  2  2018 mnt
drwxr-xr-x    4 root     root            36 May  2  2018 opt
drwxr-xr-x    2 root     root             3 May  2  2018 overlay
dr-xr-xr-x   59 root     root             0 Jan  1  1970 proc
drwxr-xr-x    2 root     root             3 May  2  2018 rom
drwxr-xr-x    2 root     root             3 May  2  2018 root
drwxr-xr-x    2 root     root           310 May  2  2018 sbin
dr-xr-xr-x   11 root     root             0 Jan  1  1970 sys
lrwxrwxrwx    1 root     root             8 May  2  2018 tmp -> /var/tmp
drwxr-xr-x    7 root     root            74 May 28  2018 usr
drwxrwxrwt    6 root     root           120 Oct 24  1970 var
~ # ls
bin      etc      lib      media    opt      proc     root     sys      usr
dev      init     linuxrc  mnt      overlay  rom      sbin     tmp      var
~ # mkdir -p /tmp/sd/backup
~ # cat /proc/mtd > /tmp/sd/backup/mtd.txt
~ # cd tmp
/var/tmp # ls
model_info  sd          sdcard      video
/var/tmp # dd if=/dev/mtdblock0 of=/tmp/sd/backup/mtdblock0.bin
32768+0 records in
32768+0 records out
16777216 bytes (16.0MB) copied, 6.090173 seconds, 2.6MB/s
/var/tmp # dd if=/dev/mtdblock1 of=/tmp/sd/backup/mtdblock1.bin
768+0 records in
768+0 records out
393216 bytes (384.0KB) copied, 0.128048 seconds, 2.9MB/s
/var/tmp # dd if=/dev/mtdblock2 of=/tmp/sd/backup/mtdblock2.bin
256+0 records in
256+0 records out
131072 bytes (128.0KB) copied, 0.058200 seconds, 2.1MB/s
/var/tmp # dd if=/dev/mtdblock3 of=/tmp/sd/backup/mtdblock3.bin
dd: writing '/tmp/sd/backup/mtdblock3.bin': No space left on device
2369+0 records in
2368+0 records out
1212416 bytes (1.2MB) copied, 0.425147 seconds, 2.7MB/s
/var/tmp # dd if=/dev/mtdblock4 of=/tmp/sd/backup/mtdblock4.bin
dd: writing '/tmp/sd/backup/mtdblock4.bin': No space left on device
1+0 records in
0+0 records out
0 bytes (0B) copied, 0.432524 seconds, 0B/s
/var/tmp # dd if=/dev/mtdblock5 of=/tmp/sd/backup/mtdblock5.bin
dd: writing '/tmp/sd/backup/mtdblock5.bin': No space left on device
1+0 records in
0+0 records out
0 bytes (0B) copied, 0.003992 seconds, 0B/s
/var/tmp # dd if=/dev/mtdblock6 of=/tmp/sd/backup/mtdblock6.bin
dd: writing '/tmp/sd/backup/mtdblock6.bin': No space left on device
9+0 records in
8+0 records out
4096 bytes (4.0KB) copied, 0.039459 seconds, 101.4KB/s
/var/tmp # dd if=/dev/mtdblock7 of=/tmp/sd/backup/mtdblock7.binConnection closed by foreign host.
drigo@Rodrigos-Mac-mini ~ % 

I need a way to findout a path of the sd card, it tried to write the backup to the flash memory and ran out of space before it could finish