In my constant search of rootable devices I came across an indoor nest camera. Personally I think the cameras have good quality and nice features, but my problem with them is that they will only work through google’s servers. So I cracked one open to see what I could find inside.
Make sure to check out the references and resources at the bottom of the page for a lot more information on this camera.
Hardware pics
Main PCB
WiFi Chip: Qualcomm Atheros AR6233X-AM2D
And a chip that says g1 810 03003r
Wolfson wm89746
Small chip is maybe flash?
Bluetooth controller? Skyworks SKY66117-11
[
CPU: Ambarella A5s66-CO-RH
528MHz ARM11
Ram: CHIPSIP CT49248DD486C1
UART
I tested for UART which I was successful with. Here is the location and pinout:
You may use any of the outside connectors for ground including the USB port. The UART runs at 115200 baud.
After the device boots you get a login prompt. I tried a few passwords, but none worked. Unfortunately the bootloader doesn’t even output to the UART so you can’t change any boot options. It seems that the first line outputted is about linux and not the bootloader also it has a delay after plugging in which shouldn’t happen to the bootloader. The bootloader starts immediately.
I tried different pins for another UART to no avail. If anyone could find the password or other UART to unlock the bootloader please let me know.
Hopefully this post sheds a little light on this device’s inner workings.
References and Resources
FCC info: https://fccid.io/ZQANC11
Teardown instructions: https://www.ifixit.com/Device/Nest_Cam
Reversing the dropcam, great blog posts about rooting dropcams (before Nest) :
https://blog.includesecurity.com/2014/04/reversing-the-dropcam-part-2-rooting-your-dropcam/
Dropcam rooting for defcon: https://www.slideshare.net/cisoplatform7/defcon-22colbymoorepatrickwardlesynackdrop-cam
UART log:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2022.05.20 18:28:20 =~=~=~=~=~=~=~=~=~=~=~=
[ 0.000000] Linux version 2.6.38.8 (jenkins@dropcam-build.local) (gcc version 4.5.2 (Sourcery G++ Lite 2011.03-41) ) #81 PREEMPT Tue Apr 2 18:49:38 UTC 2019
[ 0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[ 0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[ 0.000000] Machine: Coconut
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB = 0x60000000[0xf0000000],0x01000000 0
[ 0.000000] Ambarella: APB = 0x70000000[0xf1000000],0x01000000 0
[ 0.000000] Ambarella: PPM = 0xc0000000[0xe0000000],0x00200000 9
[ 0.000000] Ambarella: BSB = 0xc8c00000[0xe8c00000],0x00400000 9
[ 0.000000] Ambarella: DSP = 0xc9000000[0xe9000000],0x07000000 9
[ 0.000000] Ambarella: HAL = 0xc00a0000[0xfee00000],0x0000e708 9
[ 0.000000] bootmem_init: high_memory = 0xc8a00000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 35052
[ 0.000000] Kernel command line: console=ttyS0 ubi.mtd=bak root=ubi0:rootfs rw rootfstype=ubifs rootflags=sync init=/linuxrc hw_rev_adc_val=
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Memory: 138MB = 138MB total
[ 0.000000] Memory: 135156k/135156k available, 6156k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] DMA : 0xfe600000 - 0xfee00000 ( 8 MB)
[ 0.000000] vmalloc : 0xc9000000 - 0xe0000000 ( 368 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xc8a00000 ( 138 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .init : 0xc0008000 - 0xc002a000 ( 136 kB)
[ 0.000000] .text : 0xc002a000 - 0xc045e000 (4304 kB)
[ 0.000000] .data : 0xc045e000 - 0xc048e418 ( 194 kB)
[ 0.000000] Preemptable hierarchical RCU implementation.
[ 0.000000] RCU-based detection of stalled CPUs is disabled.
[ 0.000000] Verbose stalled-CPUs detection is disabled.
[ 0.000000] NR_IRQS:224
[ 0.000000] sched_clock: 32 bits at 60MHz, resolution 16ns, wraps every 71582ms
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [ttyS0] enabled
[ 0.227682] Calibrating delay loop... 478.41 BogoMIPS (lpj=2392064)
[ 0.482911] pid_max: default: 32768 minimum: 301
[ 0.488131] Mount-cache hash table entries: 512
[ 0.493703] CPU: Testing write buffer coherency: ok
[ 0.506690] Enabling TPS3813 HW WDT
[ 0.511239] NET: Registered protocol family 16
[ 0.522753] Ambarella Dropcam:
[ 0.525959] chip id: 5100
[ 0.528864] board type: 4
[ 0.532067] board revision: 3
[ 0.535341] chip name: a5m
[ 0.538344] HAL version: 176869
[ 0.541947] reference clock: 24000000
[ 0.545856] system configuration: 0x0400046a
[ 0.550487] boot type: 0x00000002
[ 0.554122] hif type: 0x00000000
[ 0.560748] Initializing Quartz Dropcam board (revision 3)
[ 2.648489] bio: create slab <bio-0> at 0
[ 2.663507] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
[ 2.674468] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
[ 2.685221] i2c i2c-0: Added multiplexed i2c bus 2
[ 2.690495] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
[ 2.701653] Advanced Linux Sound Architecture Driver Version 1.0.23.
[ 2.711906] Switching to clocksource ambarella-cs-timer
[ 2.720150] Switched to NOHz mode on CPU #0
[ 2.789905] ambarella-sd ambarella-sd.0: Slot0 use bounce buffer[0xc8960000<->0xc8b60000]
[ 2.798717] ambarella-sd ambarella-sd.0: Slot0 req_size=0x00020000, segs=32, seg_size=0x00020000
[ 2.808224] ambarella-sd ambarella-sd.0: Slot1 use bounce buffer[0xc8800000<->0xc8a00000]
[ 2.816741] ambarella-sd ambarella-sd.0: Slot1 req_size=0x00020000, segs=32, seg_size=0x00020000
[ 2.857569] ambarella-sd ambarella-sd.0: Ambarella SD/MMC[0] has 2 slots @ 25263157Hz, [0x09e130b0:0x00000000]
[ 2.868939] NET: Registered protocol family 2
[ 2.873870] IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 2.882215] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
[ 2.890034] TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
[ 2.896932] TCP: Hash tables configured (established 8192 bind 8192)
[ 2.903639] TCP reno registered
[ 2.906937] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 2.913120] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 2.920342] NET: Registered protocol family 1
[ 2.925684] RPC: Registered udp transport module.
[ 2.930747] RPC: Registered tcp transport module.
[ 2.935651] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 2.956565] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 2.963845] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[ 2.971873] msgmni has been set to 263
[ 2.980904] io scheduler noop registered
[ 2.985010] io scheduler deadline registered
[ 2.989903] io scheduler cfq registered (default)
[ 2.996655] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
[ 3.037582] ambarella-uart.1: ttyS1 at MMIO 0x7001f000 (irq = 25) is a ambuart
[ 3.081017] brd: module loaded
[ 3.100098] loop: module loaded
[ 3.106869] NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
[ 3.116060] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
[ 3.123835] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
[ 3.132837] Creating 10 MTD partitions on "ambnand":
[ 3.138153] 0x000000000000-0x000000020000 : "bst"
[ 3.147201] 0x000000020000-0x000000520000 : "ptb"
[ 3.156371] 0x000000520000-0x000000a20000 : "bld"
[ 3.165726] 0x000000a20000-0x000000f20000 : "hal"
[ 3.175062] 0x000000f20000-0x000001520000 : "pri"
[ 3.184569] 0x000001520000-0x000001b20000 : "sec"
[ 3.194024] 0x000001b20000-0x000004620000 : "bak"
[ 3.203327] 0x000004620000-0x000004920000 : "dsp"
[ 3.212699] 0x000004920000-0x000007420000 : "lnx"
[ 3.222139] 0x000007420000-0x000007c20000 : "adc"
[ 3.233754] UBI: attaching mtd6 to ubi0
[ 3.238081] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 3.244594] UBI: logical eraseblock size: 126976 bytes
[ 3.250407] UBI: smallest flash I/O unit: 2048
[ 3.255299] UBI: VID header offset: 2048 (aligned 2048)
[ 3.261736] UBI: data offset: 4096
[ 3.469342] UBI: max. sequence number: 41883
[ 3.485481] UBI: attached mtd6 to ubi0
[ 3.489536] UBI: MTD device name: "bak"
[ 3.494525] UBI: MTD device size: 43 MiB
[ 3.499718] UBI: number of good PEBs: 344
[ 3.504532] UBI: number of bad PEBs: 0
[ 3.509225] UBI: number of corrupted PEBs: 0
[ 3.513841] UBI: max. allowed volumes: 128
[ 3.518708] UBI: wear-leveling threshold: 4096
[ 3.523607] UBI: number of internal volumes: 1
[ 3.528275] UBI: number of user volumes: 1
[ 3.532889] UBI: available PEBs: 0
[ 3.537577] UBI: total number of reserved PEBs: 344
[ 3.542649] UBI: number of PEBs reserved for bad PEB handling: 3
[ 3.548941] UBI: max/mean erase counter: 417/125
[ 3.553750] UBI: image sequence number: 1815888556
[ 3.558909] UBI: background thread "ubi_bgt0d" started, PID 671
[ 3.565305] console [netcon0] enabled
[ 3.569199] netconsole: network logging started
[ 3.575511] mousedev: PS/2 mouse device common for all mice
[ 3.584917] using rtc device, ambarella-rtc, for alarms
[ 3.590525] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[ 3.601062] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
[ 3.614741] lp5521 0-0035: lp5521 programmable led chip found
[ 3.632729] ambarella-i2c ambarella-i2c.0: ambarella_i2c_stop[1] from 7 to 9
[ 3.640175] ambarella-i2c ambarella-i2c.0: ambarella_i2c_irq in wrong state[0x9]
[ 3.647874] ambarella-i2c ambarella-i2c.0: status_reg[0x40]
[ 3.653667] ambarella-i2c ambarella-i2c.0: control_reg[0x3]
[ 4.627506] ambarella-i2c ambarella-i2c.0: No ACK from address 0x66, 0:1!
[ 4.634589] ambarella-i2c ambarella-i2c.0: I2C state 0x9, please check address 0x66!
[ 4.663639] lp5523 0-0033: LP5523 Programmable led chip found
[ 4.673821] LP5523 status:
[ 4.677114] LP5523_REG_ENABLE: 0x6a
[ 4.681406] LP5523_REG_CONFIG: 0x7e
[ 4.685597] LP5523_REG_OP_MODE: 0x0
[ 4.689883] LP5523_REG_ENABLE_LEDS_MSB: 0x0
[ 4.694794] LP5523_REG_ENABLE_LEDS_LSB: 0x0
[ 4.719716] ALSA device list:
[ 4.722829] No soundcards found.
[ 4.726363] oprofile: hardware counters not available
[ 4.731954] oprofile: using timer interrupt.
[ 4.736686] TCP cubic registered
[ 4.740237] NET: Registered protocol family 17
[ 4.745009] Registering the dns_resolver key type
[ 4.754221] =====RTC ever lost power=====
[ 4.770835] ambarella-rtc ambarella-rtc: setting system clock to 2004-01-10 13:37:04 UTC (1073741824)
[ 4.782152] UBIFS: parse sync
[ 4.815963] UBIFS: recovery needed
[ 4.943046] UBIFS: recovery completed
[ 4.947093] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[ 4.953572] UBIFS: file system size: 41394176 bytes (40424 KiB, 39 MiB, 326 LEBs)
[ 4.961652] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
[ 4.969324] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 4.975389] UBIFS: default compressor: lzo
[ 4.979704] UBIFS: reserved for root: 0 bytes (0 KiB)
[ 4.986014] VFS: Mounted root (ubifs filesystem) on device 0:13.
[ 4.992559] Freeing init memory: 136K
[ 5.753465] UBI: attaching mtd9 to ubi1
[ 5.757594] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 5.764115] UBI: logical eraseblock size: 126976 bytes
[ 5.769801] UBI: smallest flash I/O unit: 2048
[ 5.774700] UBI: VID header offset: 2048 (aligned 2048)
[ 5.781008] UBI: data offset: 4096
[ 5.824686] UBI: max. sequence number: 7859
[ 5.840109] UBI: attached mtd9 to ubi1
[ 5.844024] UBI: MTD device name: "adc"
[ 5.849138] UBI: MTD device size: 8 MiB
[ 5.854128] UBI: number of good PEBs: 64
[ 5.858956] UBI: number of bad PEBs: 0
[ 5.863591] UBI: number of corrupted PEBs: 0
[ 5.868296] UBI: max. allowed volumes: 128
[ 5.873108] UBI: wear-leveling threshold: 4096
[ 5.878066] UBI: number of internal volumes: 1
[ 5.882691] UBI: number of user volumes: 1
[ 5.887298] UBI: available PEBs: 0
[ 5.891975] UBI: total number of reserved PEBs: 64
[ 5.896959] UBI: number of PEBs reserved for bad PEB handling: 2
[ 5.903268] UBI: max/mean erase counter: 139/123
[ 5.908125] UBI: image sequence number: 432526639
[ 5.913134] UBI: background thread "ubi_bgt1d" started, PID 739
UBI device number 1, total 64 LEBs (8126464 bytes, 7.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
umount: can't umount /mnt/dropcam: Invalid argument
[ 6.019277] UBIFS: recovery needed
[ 6.055795] UBIFS: recovery completed
[ 6.059948] UBIFS: mounted UBI device 1, volume 0, name "adc"
[ 6.066039] UBIFS: file system size: 6094848 bytes (5952 KiB, 5 MiB, 48 LEBs)
[ 6.073755] UBIFS: journal size: 1396736 bytes (1364 KiB, 1 MiB, 11 LEBs)
[ 6.081417] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 6.087534] UBIFS: default compressor: lzo
[ 6.091803] UBIFS: reserved for root: 0 bytes (0 KiB)
rm: can't remove '/root/*.pid': No such file or directory
rm: can't remove '/root/*.log': No such file or directory
Populating dropcam using udev: Done
[ 7.491834] Loading modules backported from Linux version v3.14-0-g455c6fd
[ 7.499098] Backport generated by backports.git v3.14-1-0-g369d49a
[ 7.761917] cfg80211: Calling CRDA to update world regulatory domain
[ 7.779462] cfg80211: World regulatory domain updated:
[ 7.787248] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 7.805488] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 7.814475] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 7.822920] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 7.831883] cfg80211: (5140000 KHz - 5360000 KHz @ 40000 KHz), (N/A, 3000 mBm)
[ 7.839938] cfg80211: (5460000 KHz - 5860000 KHz @ 40000 KHz), (N/A, 3000 mBm)
[ 8.191129] Switching to clocksource jiffies
[ 8.191129] Switching to clocksource ambarella-cs-timer
[ 7.591005] i2c /dev entries driver
[ 7.656341] cfg80211: World regulatory domain updated:
[ 7.661617] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 7.677617] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 7.685958] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 7.694319] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 7.702535] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 7.711419] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 7.746523] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
[ 7.763927] ambarella-spi ambarella-spi.1: ambarella SPI Controller 1 created
[ 8.125771] wm8974_amb.c :: __init wm8974_modinit(void)
[ 8.131150]
[ 8.131162] wm8974 i2c add +
[ 8.139543]
[ 8.139567] wm8974 i2c add -
[ 8.144135]
[ 8.144156] wm8974 init done
[ 8.188739] wm8974 audio codec is provided by amba Wu Dongge
[ 8.214501] asoc: wm8974-hifi <-> ambarella-i2s.0 mapping ok
[ 8.334859] input: AmbInput as /devices/virtual/input/input0
[ 8.350752] ambarella_gpio_irq_set_wake: irq[99] = girq[35] = 1
[ 8.372971] ambarella-input ambarella-input: AmbInput probed!
[ 8.502860] ambarella_udc: version 2 August 2011
[ 8.542229] mmc1: queuing unknown CIS tuple 0x01 (3 bytes)
[ 8.573360] ambarella-crypto ambarella-crypto: Ambarella Media Processor Cryptography Engine probed(polling mode).
[ 8.598157] mmc1: queuing unknown CIS tuple 0x1a (5 bytes)
[ 8.621913] mmc1: queuing unknown CIS tuple 0x1b (8 bytes)
[ 8.643483] mmc1: queuing unknown CIS tuple 0x14 (0 bytes)
[ 8.671185] mmc1:attach sdio array 1
Regdomain US
[ 8.705683] mmc1: queuing unknown CIS tuple 0x80 (1 bytes)
[ 8.723757] mmc1: queuing unknown CIS tuple 0x81 (1 bytes)
[ 8.737312] mmc1: queuing unknown CIS tuple 0x82 (1 bytes)
[ 8.748077] mmc1: new high speed SDIO card at address 0001
[ 8.958183] MAC from EEPROM 00:03:7F:05:81:91
[ 8.992011] Soft MAC 64:16:66:7B:25:04
[ 9.027512] ath6kl: temporary war to avoid sdio crc error
[ 9.542472] ath6kl: ar6003 hw 2.1.1 sdio fw 3.4.0.225.SMARTPHONE api 4
[ 9.553459] ath6kl: Current ath6kl driver version is: 3.4.0.225
[ 9.789738] cfg80211: Calling CRDA for country: US
[ 9.804106] cfg80211: Regulatory domain changed to country: US
[ 9.823179] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 9.852696] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
[ 9.874153] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
Initializing random number generator... [ 9.892938] cfg80211: (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 9.922885] cfg80211: (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 9.931030] cfg80211: (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 9.962920] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
done.
Starting system message bus: done
.:^:.
.o0WMMMMMNOc. lk,
dWMMMMNXNMMMMWl .NMc
dMMMMd. .kMMMMl .oOXNX0kWMc cX0xXNo .oOXNX0d' .0XxxKNNKx; :kKNNKx. .lOXNNKx, :XXxKNXOldKNNKd.
KMMMO KMMM0 lWNd;',lXMMc oMMo'..dWNo,',oXWx .WMWk;',c0M0. .KMO:'':; ;NWx;',cKMK. lMMx'.oWMX;.'0MO
OMMMW; cWMMMx .MM: .WMc oMX 'MM, 'WM;.WMd XMo kM0 KMx .WMd lMM' .XMo cMX
.0MMMM0..cKMMMMk 0M0' .dMMc oMX .XMk' .xMX..WMK; .lWW, cWW: dMX, .oMMd lMM' .XMo cMX
:XM0:dNMMMMO; oNMNKXMNWMc oMX .dNMNKXMNx. .WMWMNKXMWO' ;0WWKKWN, cKMNKXWWWMd lMM' .XMo cMK
;.0MMMMO, .;:;. ';. .;. .;:;. .WMo.,:;'. .,::,. .;:;'..;. .;; ,;. .;.
'ONx' .WM:
..
NestCam login: kernel.panic_on_oops = 1
wpa_supplicant v2.0-Nest_2017a
Successfully initialized wpa_supplicant
rfkill: Cannot open RFKILL control device
rm: can't remove '/usr/bin/connect_unverified': [ 11.511521] ambarella-wdt ambarella-wdt: Not stopping watchdog, V first!
No such file or directory
Firmware version is: 223
Connect version is: 610050
[ 15.474871] ambarella_udc: version 2 August 2011
[ 15.533620] g_mass_storage gadget: Mass Storage Function, version: 2009/09/11
[ 15.540952] g_mass_storage gadget: Number of LUNs=1
[ 15.547959] lun0: LUN: removable file: /tmp/setup.img
[ 15.554535] g_mass_storage gadget: Nest Cam Setup, version: 2015/02/12
[ 15.561265] g_mass_storage gadget: userspace failed to provide iSerialNumber
[ 15.570468] g_mass_storage gadget: g_mass_storage ready
[ 16.066926] Bluetooth: Core ver 2.18
[ 16.083543] NET: Registered protocol family 31
[ 16.088111] Bluetooth: HCI device and connection manager initialized
[ 16.096657] Bluetooth: HCI socket layer initialized
[ 16.101709] Bluetooth: L2CAP socket layer initialized
[ 16.108960] Bluetooth: SCO socket layer initialized
[ 16.232427] vout: module license 'Proprietary' taints kernel.
[ 16.239597] Disabling lock debugging due to kernel taint
[ 16.287782] Vout notice: vout0:0 probed!
[ 16.294933] Vout notice: vout1:1 probed!
[ 16.355136] Vin info: amba_vin_vsync_bind to idsp with 0ns delay!
[ 16.361494] Vin notice: vin0:0 probed!
[ 16.507346] img: aaa_fifo2_base malloc c7680000
[ 16.932314] >>>>>> DSP LOG ADDR START PHY 0xc0080000
[ 17.503480] MT9T002 sensor ID is 0x2604
[ 17.508678] Vin info: OTPM version:5
[ 18.543665] UBI: attaching mtd8 to ubi2
[ 18.547654] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 18.556099] UBI: logical eraseblock size: 126976 bytes
[ 18.561689] UBI: smallest flash I/O unit: 2048
[ 18.568512] UBI: VID header offset: 2048 (aligned 2048)
[ 18.575902] UBI: data offset: 4096
[ 18.778436] UBI: max. sequence number: 7782
[ 18.800708] UBI: attached mtd8 to ubi2
[ 18.815315] UBI: MTD device name: "lnx"
[ 18.820425] UBI: MTD device size: 43 MiB
[ 18.828019] UBI: number of good PEBs: 344
[ 18.834647] UBI: number of bad PEBs: 0
[ 18.839301] UBI: number of corrupted PEBs: 0
[ 18.846277] UBI: max. allowed volumes: 128
[ 18.851651] UBI: wear-leveling threshold: 4096
[ 18.858783] UBI: number of internal volumes: 1
[ 18.867191] UBI: number of user volumes: 2
[ 18.875434] UBI: available PEBs: 0
[ 18.880006] UBI: total number of reserved PEBs: 344
[ 18.887914] UBI: number of PEBs reserved for bad PEB handling: 3
[ 18.895318] UBI: max/mean erase counter: 25/24
[ 18.899921] UBI: image sequence number: 2129170518
[ 18.906952] UBI: background thread "ubi_bgt2d" started, PID 944
[ 18.994002] UBIFS: recovery needed
[ 19.020069] UBIFS: recovery completed
[ 19.026129] UBIFS: mounted UBI device 2, volume 1, name "backup"
[ 19.032341] UBIFS: file system size: 4825088 bytes (4712 KiB, 4 MiB, 38 LEBs)
[ 19.041848] UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
[ 19.050394] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 19.057583] UBIFS: default compressor: lzo
[ 19.061836] UBIFS: reserved for root: 227900 bytes (222 KiB)
[ 22.310860] Bluetooth: HCI UART driver ver 2.2
[ 22.316688] Bluetooth: HCIATH3K protocol initialized