Yi 2 Firmware reverse-engineering

README.md

Yes. It's real. These are just my notes after skimming through the firmware. (protip: update API)

Hardware revisions: 12L, 13L Internal version: z16 (it's all over the place)

Features

• Running A9S, as everyone might've guessed
• Seems to have EXFAT support in uITRON
• SuperView
• RTMP Streaming (Youtube Live)
• USB serial / ether (will Linux get proper USB gadget?)
• python2.7 on-board (will most probably be removed on production units but THAT'S FUN)
• Has dbus. Really.
• usr/lib/libical.so - not sure what they were smoking, but I like that.
• 3.10.71 Kernel including USB host modules?
• Confusing part: whole LTE setup script and stuff? (dank mr ambarella)

telnetd

It's still there, just create empty z16_rtos_console_enable.script file on SD card.

autoexec.ash

Nope, sadly nothing like that, only some random hooks to sdcard/MISC/lte_hook.sh in linux during LTE init. (still giggling about that)

I'd like to reverse engineer the Yi Dome Cam since no one else seems to have taken the initiative. Only problem is I have no experience reverse engineering and tried but failed at using binwalk on it. Can you by chance point me in the right direction on how to get to the root file system?

It's still there, just create empty z16_rtos_console_enable.script file on SD card.

Which firmware version you have? I checked this string in my firmware, but found only:
c:\disable_remove_fw_file.script
c:\check_firmware.script
firmware file c:\check_firmware.script doesn't exist!
c:\save_log_enable.script
c:\console_enable.script

Actually, c:\console_enable.script enables telnetd, but in Linux environment, not in RTOS. I checked very old version (1.0.7). available from Yi, but strings are same.

Nobody here?