Light L16 Firmware

[Sormaus]

Greetings! I recently rolled the dice on an eBay purchase for a Light L16 camera. The device appears to have had some serious OS problems/botched root/adb commands/I am honestly not quite sure what has gone wrong with it, but it is not even showing the OS as LightOS (the camera OS). I was wondering if any of you might have the firmware laying around somewhere, or any experience flashing these devices with AOSP/variants?

 

[BrailleCortex]

Mine still works with Lumen. The most important features released later are the ability to record video (1080p30fps) and install sideloaded apps. The patch notes page is still up here:

Light support - L16 Software Release Notes - Camera and Lumen | Light

Always improving Every week, we make the Light L16 a little better. That's the beauty of a camera built on software: the experience never stops improving.

support.light.co

 

[bperryvolatile]

Is the inability to side-load apps because you don't have root? I understand the firmware update may have added the ability to do so without needing root, but would root effectively let you side-load?

Has anyone tried finding a root exploit in the stock firmware?

 

[w2hef]

If anyone can get the latest firmware that would be awesome.. My light is coming got a smoking deal, but another boat anchor I don't need. We will see what firmware is on it when it arrives.

 

[bperryvolatile]

It's possible the features already exist on the phone and that root access can simply enable them, although they may not be as well-tested as the released version.

 

[w2hef]

It's possible the features already exist on the phone and that root access can simply enable them, although they may not be as well-tested as the released version.

Thanks. I hope so. We will see. It's just shipping. I have 2 of the LYTRO ILLUM and i love them.

 

[bperryvolatile]

Some things:

Swipe down from the main screen three times to bring down the system menu. You can click the settings gear in the top right to get to the device settings. You can enable Developer Mode from here the normal way.

Once enabled, you can log into the camera using 'adb shell' but you aren't root yet. This is such an old kernel, I'm sure there will be a kernel exploit that could give us root. Otherwise, they may have left an insecure script or another way to escalate your privs to root. I'm not a pro Android hacker.

 

[bperryvolatile]

Perhaps https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 would get root.

the IMAGE_CAPTURE intent works over adb but not the VIDEO_CAPTURE. That doesn't mean anything particularly bad though.

 

[bperryvolatile]

I was able to sideload the Google Play Services APK for Nougat last night without root. So with devmode enabled, you can perform some sideloading as long as the app doesn't require kernel permissions or access, or other elevated access such as high ports.

If you brick it, power it off. Hold the shutter button and then hold the power button until the Light logo appears. You can use the shutter button to navigate the boot menu and factory reset the camera. Press the power button to select the menu item.

 

[bperryvolatile]

Just FYI.

Linux localhost 3.18.20-perf-g6ec34d3 #1 SMP PREEMPT Fri Nov 24 11:49:25 PST 2017 aarch64

You may be able to sideload another camera app and have video recording at 1080p Just Work(tm). I'm not sure.

It should be possible to extract the file system and firmware with root. Then a package could be made containing the drivers and Camera app Light uses which captures and writes in the .lri format that the Lumen app uses.

Once the "special sauce" is separated from the basic OS, I would imagine (but perhaps not bet) that you could install whatever android you want on here, then load the drivers and Camera app from the OG firmware. Then you'd have a modern device with the same image capability, but with the extensibility of a DIY device.

 

[bperryvolatile]

I was also able to sideload without root the latest version of SimpleSSHD which allows remote access to the same shell that adb shell gives, but over the configured wifi interface.

 

[bperryvolatile]

I compiled and installed qu1ckr00t which implements the exploit I linked above to get root but unsurprisingly it didn't immediately work.

GitHub - grant-h/qu1ckr00t: A PoC application demonstrating the power of an Android kernel arbitrary R/W.

A PoC application demonstrating the power of an Android kernel arbitrary R/W. - GitHub - grant-h/qu1ckr00t: A PoC application demonstrating the power of an Android kernel arbitrary R/W.

github.com

 

[bperryvolatile]

I was also able to sideload without root the latest version of SimpleSSHD which allows remote access to the same shell that adb shell gives, but over the configured wifi interface.

This isn't 100% true. For instance, running the image capture intent over SSh does not work immediately, but does work over adb shell. I expect this is because sshd has not been granted access to the camera, though.

 

[bperryvolatile]

There is an issue installing Termux.

You need an older version of Termux, 0.73 is what I'm testing as it targets Android 6.0.1. Any Termux version after 73 will target android 7.0 and fail to install.

The older Termux installers bootstrap from the internet, and the termux app gets installed on the camera to a location Termux doesn't have write-access to. This causes bootstrapping to fail and termux to fail to start. Later Termux installers are offline.

"termux was unable to install the bootstrap packages" when I open Termux · Issue #1761 · termux/termux-packages

It happens all time when i try to open Termux highscreen pure android 5.0.2 with kernel 3.10.54

github.com

Building a new version of SimpleSSHD with a manifest that asks for CAMERA permission is also not being straightforward.

Root would be nice.

 

[bperryvolatile]

 

[bperryvolatile]

I'm close to having a root exploit. There's possibly an easier way through a kernel exploit so any thoughts are appreciated. I don't want to mess with kernel pointers unless I have to.

In /system/bin/fw_update.sh, there are some possible race conditions that can be performed to achieve root code execution. I expect it will require proxying the camera and returning a specific response to the firmware updates check.

 

[bperryvolatile]

Specifically:

cp /system/etc/prog_app_p2 $camera_directory/prog_app_p2 chmod 777 $camera_directory/prog_app_p2 cp /system/etc/lcc $camera_directory/lcc chmod 777 $camera_directory/lcc cp /system/etc/prog_app.config $camera_directory/prog_app.config chmod 777 $camera_directory/prog_app.config

If we can initiate fw_upgrade.sh, then we can overwrite one of the bin files (prog_app_p2 looks like best) and have it run as root.

It's difficult because there is SSL verification. Proxying the update check request fails without having a root cert installed.

 

[bperryvolatile]

If you run the following, you can begin proxying the firmware update requests.

am broadcast -a 'com.fihtdc.OTAUpdate.SET_SERVER_URL' -n 'com.fihtdc.OTAUpdate/.OTAReceiver' --es URL http://www.c2dms.com

 

[bperryvolatile]

There are two options so far in this route.

A) Basically create a new service that repros the firmware update responses until it wants to download a firmware that we control and have rooted somehow. Need a copy of a firmware to do this but it would be easier for others going forward I expect.

B) Go the route I was intending and try to initiate a firmware upgrade and exploit a race condition in fw_upgrade.sh to execute arbitrary code as root. There could be an intent I'm missing that would kick off the shell script without the HTTP nonsense. I'm also seeing if the script is kicked off with any regularity automatically.

B) may be required in order for A) to be possible.

 

[bperryvolatile]

This is a much easier method for root. I can confirm it works.

uid=0(root) gid=0(root) groups=0(root) context=u:r:qti_init_shell:s0

GitHub - hyln9/VIKIROOT: CVE-2016-5195 (Dirty COW) PoC for Android 6.0.1 Marshmallow

CVE-2016-5195 (Dirty COW) PoC for Android 6.0.1 Marshmallow - GitHub - hyln9/VIKIROOT: CVE-2016-5195 (Dirty COW) PoC for Android 6.0.1 Marshmallow

github.com

 

[helloavo]

This is very exciting! I will have to have a closer look through your posts when I find time. Thanks for your hard work and taking the time to post them.

I think many of us here were looking for the latest firmware in order to get the latest 'camera' app to unlock all of the photography features rather then your goal of a smart time lapse camera (I have only seen your YouTube video for now), while the root exploit would open up the device for users, without the Light Camera APK I am not sure anyone here would get anything out of root access.