Pauldy’s House of Geek

Well today I was bored of trying to find a site that took care of hacking the Airlink101 so I set out to see if I had what it took to do it myself.  After researching all over I could find nothing so I began to try and get into the device various ways.  I found an open ftp port with a file called DEVICEID.DAT inside it contained the vendor name cellvision and the model cas-200.  I began searching all over the net for more info on this device only to come up with the fact that cellvision does oem devices.   After some more digging I found the docs on their site that referred to the device as being 11mb only.  I got the screwdriver out and discovered nice silk screening that read cas330w which was listed on their website and they had full documentation.

So what does it say about this device. It is a RDC 2880 with 8MB ram 2MB flash rom running RTOS.  There are lots of these cameras floating around there now most at about the 100 dollar price point making them relatively cheap secure wireless cameras.  After spending a bit of time using one I can say they are every bit as good as the entry level axis cams at 1/4 the price.  The next step would be to get some better interface features which is what prompted me to spend so much time with this device.  Making any changes to the device and then you wait for it to reboot.  I would love to replace the RTOS with linux but it may not be possible.  I know nothing about RTOS so if anyone has any suggestions feel free to drop me a line.  I have included my notes from tonights little venture into the device and I might put up some pictures of its internals later but there is really nothing special inside.
{mospagebreak}
Here are my notes from a quick run through on a firmware image I found.  There are some interesting URLs but most of it is rather useless.  The biggest things I noticed are the ability to easily get config settings from the device without parsing a bunch of html code and the streaming technologies used for video and images.  This may be what makes the IPViewProgram unbearably slow when it comes to viewing multiple video sources i.e.>8.  I will continue to play with this project as I have time and may even dedicate a portion of the site soley to this topic as I know the device has a lot of capabilities after taking it apart.  Specifically jp1 and jp2 are free and have an inordinate amount of pins for simple pan/tilt

Mobile Phone Mode
Imode.HTM
IMODE

picture.html

CGIVERSION.CGI
IOCONTROL.CGI
CONFIG.CFG – downloads the config file
IMAGE.JPG – just an image
IACTIVEUSER.CGI – gives info about current user session

VIDEO.CGI
MJPEG.CGI
PANTILTCONTROL.CGI

unsecured
DEVINFO.CGI

EAsy to find urls
/
top.htm
Home.htm – javascript redirects to top.htm with time attached as arg to prevent caching I suppose

Aview.htm – Video ActiveX Mode
xplugLiteAL.cab – Activex Viewer

Jview.htm – Video Java Mode
xplug.class – Java Viewer

Content.htm – System Administration Frame
Title.htm – The top bar with menu

Contnt11.htm – Basic Status (Management)
StsSys.htm – Above sans menu
index11.htm – menu for above
Contnt12.htm – Video Status (Management)
StsVdo.htm – Above sans menu
index12.htm – menu for above
Contnt13.htm – Wireless Status (Management)
StsWlan.htm – Above sans menu
index13.htm – menu for above
Contnt14.htm – Network Status (Management)
StsNet.htm – Above sans menu
index14.htm – menu for above
Contnt15.htm – User Status (Management)
StsUser.htm – Above sans menu
index15.htm – menu for above

Contnt21.htm – System Settings (Configuration)
index21.htm – menu for above
SYSTEM.HTM – Above sans menu
Contnt22.htm – Video Setting (Configuration)
index22.htm – menu for above
VIDEO.HTM – Above sans menu
Contnt23.htm – Wireless Interface (Configuration)
index23.htm – menu for above
WIRELESS.HTM – Above sans menu
Contnt24.htm – TCP/IP (Configuration)
index24.htm – menu for above
NETWORK.HTM – Above sans menu
Contnt25.htm – User Access Control (Configuration)
index25.htm – menu for above
USER.HTM – Above sans menu
Contnt26.htm – Date & Time Setting (Configuration)
index26.htm – menu for above
DATETIME.HTM – Above sans menu
Contnt27.htm – FTP Server (Configuration)
index27.htm – menu for above
UPLOAD.HTM – Above sans menu
Contnt28.htm – E-mail Account (Configuration)
index28.htm – menu for above
EMAIL.HTM – Above sans menu
APLIST.HTM – lists available access points

Contnt30.htm – Test FTP Server (Tools)
index30.htm – menu for above
FTPTest.htm – Above sans menu
Contnt31.htm – Test E-mail Account (Tools)
index31.htm – menu for above
EMTest.htm – Above sans menu
Contnt32.htm – Reset Device (Tools)
index32.htm – menu for above
Reset.htm – Above sans menu
Contnt33.htm – Factory Reset (Tools)
index33.htm – menu for above
Factory.htm – Above sans menu
Contnt34.htm – Firmware Upgrade (Tools)
index34.htm – menu for above
Upgrade.htm – Above sans menu
Contnt35.htm – Backup Device Config (Tools)
index35.htm – menu for above
Backup.htm – Above sans menu

Reply.htm – repply to forms

Contnt41.htm (Help)
index41.htm – menu for above
About.htm – About the cam sans menu

banner.jpg – big banner across the top of the page
REPLYK.HTM – ok reply to firmware upgrade
REPLYU.HTM – refreshes to above on meta refresh of 0 secs
DLOADBAR.GIF- animated downloading gif

SYSTEM.CGI – reports back info on the system in a nice nonurl encoded query string
IMAGE.CGI – reports back on video capture information
WIRELESS.CGI – returns wireless configuration settings
NETWORK.CGI – returns network configuration settings
USER.CGI – returns access control on/off info
USERLIST.CGI – returns a user list sans admin
DATETIME.CGI – returns current data/time info plus settings
UPLOAD.CGI – returns information about ftp uplaods
EMAIL.CGI – returns e-mail uplaod info
ISYSTEM.CGI – returns basic system info
IIMAGE.CGI – returns basic image capture info
IWLAN.CGI – returns basic wireless lan config info
INETWORK.CGI – returns basic netowrk config info
IUSER.CGI – returns ?
CGIVER.CGI – returns cgi version
CGIVERSION.CGI – same as above
MVIEW2.JAR – mobile phone viewer?
MVIEW2.JAD – file describing above like meta inf file
MESSAGE.CGI – forbiden?
MPICTURE.JPG – broken image/no image