Close
0%
0%

Umi hack exploration

I got a fancy brick, a Cisco Umi teleconference device. What can I do with it? This is to try and find out.

Similar projects worth following
I ended up with a Cisco Umi teleconferencing device. It was tied to a service that is now defunct. The unit comes with the set top box, and the camera/mic that goes on top of a TV.

There are a few different approached I can take. I'd like to see if the set top box is running Linux and if I can somehow gain root access to it. I'd then like to see if there is a way I can get something like Skype or an OSS video conferencing package to run on it with the camera.
Perhaps I can learn about the service and spoof the protocol of the original service. I might then be able to run a server that can 'bridge' between another service.
the last idea is to see what parts of the system I can use. The camera pod has an HDMI port for output and a USB port for power and possibly control. Perhaps I can source a single board computer that can take an HDMI capture device to be my Skype platform and use the camera that way.

There will be a lot of RE work to do here.

I tried connecting the camera's HDMI port to my TV to see what would happen. I used a USB port on the TV to supply power. The TV did try to enumerate the camera via USB but didn't recognize it. So it looks like the USB port is for more than just power.
On the HDMI link, it looks like a device was recognized. I don't know if it's running HDCP or not, but I did get info about the resolution and refresh rate, but no picture.

So my guess is that the camera needs the USB connection ad a control channel and not just for power. I'll have to poke at it with a PC, or see if I can l take the setup to work and use a hardware USB protocol analyzer to monitor traffic between the set top box and camera.

I also tried cracking open the set top box to try and look for a UART, look at what ICs are being used, and look for JTAG. I didn't think to take pictures. Inside the plastic shell is a metal box that looks like it may be glued to the shell in some way. I can't see how its fastened to the case but there are other pieces held on by glue and I heard that tape peeling sound when I flexed the shell trying to see if there were clips holding the box in.

I've decided to turn back and try to do some non-destructive probing first.

I expect Cisco has the client-server communication locked down and encrypted but maybe there is something open I can go after, either for a known vulnerability, or try fuzzing and see if I can find a weakness.

The system has 2 USB ports on it, maybe I can get to a shell through one of those somehow. It might also be possible that some pins on one of the HDMI ports might connect to a UART and I'll get lucky.

I hope I can dig up some hardware info on this but it seems like there was never a fire sale on the units which many be why more of these didn't wind up in the hands of hackers. If anyone does have a source of info, please point me in the right direction.




  • Exploring the camera

    elementcarbon1206/14/2015 at 06:20 0 comments

    I just played with the camera a bit. I connected it to my computer and after a bit, it shows up in the Windows device manager as Amba simple class. Google founts lots of hits for people looking for drivers, often for cameras which sounded promising. I checked the VID and PID which is 4255 and 0001 respectively. That matches a GoPro Hero 2 camera. What the heck is in there?!

    I decided to tear the camera down. It was pretty simple, there are six screws, 5 of which were easily visible, one hidden under a black sticker which left the typical VOID marks when I peeled it off. Well, it's unsupported so there's no warranty anyway :P

    Then there were a pair of slots in the bottom rear placed near the center line. I put a Flathead screwdriver in them, wiggled a bit, and the popped off allowing me access to the innards. It should not take any significant force to pop the clips, but it will take a but of force to pull the back of the housing off. Again, it's not a lot, if you feel you are using a bit too much strength, you probably are. Wiggle things and see what's moving and what's not.

    This is what it looks like with the first piece off (please excuse the messy desk :P ).

    Then I removed the from fascia.

    See that rectangle in the front? Here is a closer view of the camera assembly.

    It's a mechanical shutter! Also note the gears on the left hand side. The camera is on a gimbal. I pulled back the shutter and tried connecting it to my TV again, and I got video!

    Here are the boards from the camera starting with the one that runs along the front of the unit.

    That's the main part of the board, and FPGA, an ST SPI flash part and one more tiny IC in the top left corner of this image. I have no idea what P1 and P2 are for. Perhaps programming or debug headers for the FPGA. I don't have any experience with this sort of thing so I don't think it will do me any good.

    Here is a closer shot of the ICs with the marking on the ST part clearly readable.

    Here is the tiny IC in the top left I mentioned before.

    Finally, there are these odd features that run the length of the front of the board. Here is a close up of a few of them.

    These features are really small and it was hard to grab an image. There is something that looks like a segmented border around a big via and 4 pads. They are labeled UXX but I can't spot any ICs on either side. The front fascia has mesh covered slot where these features are. My guess is they are used to pick up audio using capacitance, but that's a wild guess.

    This board also controls the shutter, has an LED, and might have an IR sensor in the same package as the LED (it's either that, or a second LED telling you that you are "on air").

    On to the video board.

    That big one is a Silicon Image Sil9134 which handles the HDMI.

    Here is a better view with the companion buffer chip.

    There was a collection of NXP ICs scattered around and a couple other small ICs. I suspect the there are a couple MCUs to handle USB, motor commands, and some motor driver ICs.

    Here they are in no particular order.

    And finally, a possible way in to the camera subsystems, unpopulated headers!

    One is clearly labeled I2C but I have no idea about the other 2.

    At this point, it's been a while since I've poked at any hardware for fun so I'll need to update my toolbox. Maybe P9 is JTAG, but I don't recall any 10 pin pinouts off the top of my head. P2 is also pretty mysterious, maybe it taps into a UART.

    That wraps up tonight's adventure. I think I need to see if the set top box can do anything without the service. I'd like to see if I can sniff the USB traffic with a hardware analyzer and try to get started on the motor commands. I'd like to be able to activate the shutter and manipulate the gimbal.

    I also want to take a look at the HDMI chip and see if I can get video and audio out of the camera in a way that is more SBC friendly.

    Overall, the camera was pretty simple to take apart and the video board looks like it won't be too hard to figure out. The FPGA is a bit daunting though....

    Read more »

View project log

Enjoy this project?

Share

Discussions

misfitprod wrote 05/03/2016 at 18:41 point

I was wondering if you got any further on the Umi? I acquired one and trying to create an inexpensive video presence in an audio studio to see into recording rooms from the control room and visa versa. I dug into it and got the shutter open, disconnected the motor so it stays open and got signal to an hdmi matrix router to switch between sources/outputs. I haven't been able to control the gimbal or zoom though. Total newb on circuitry and I have it working, just would love to be able to control the Zoom/Pan/Tilt functions bypassing the unit. Also wondering the voltage of the power input on the back of the camera. Might be able to get an adapter to fully power it through AC but can't find ANY info on it. Any help would be much appreciated. Cheers!

  Are you sure? yes | no

Doug Chin wrote 09/20/2015 at 14:47 point

I also ended up with one of these but don't know a lot about it.  However, when I plug the USB port into a high power USB charger from an Asus tablet, the HDMI port puts out video that I can see on a TV.  It looks pretty good and continuously does auto focus.   When powered by a smaller USB charger for an Amazon Kindle, it keeps rebooting.  I suspect it takes more than 1A.  The USB cable that came with it was unusual in that the ends were red and it was rather thick.  I wonder that was to indicate that it is designed higher than average current.   From your pictures I'm guessing it doesn't do video encoding on the board so I'm guessing the USB port is just for power and control of the pan tilt and focus.  

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates