GoKawiili have been thinking a bit more about security cameras again, because of AXIS starting to push more for every one of their cameras to be able to easily run linux applications on them, they're far more serious targets in an enterprise environment and need to be managed as such for vulnerabilities and credential management etc. someone brought up to me a company that sounded new to me, Hanwha (Vision.) I took a look at the site, and found that they had accessible firmware blobs for each model of camera, which is always a treat.
poking and prodding
i took the image and threw it at binwalk hoping it was just a rootfs or something, but inside there was a separate tarball with some AI stuff for the camera and a fwimage.tgz that binwalk was flagging as encrypted.
I was googling around and saw that Matt Brown has a writeup on these cameras that got me through. basically the passphrase is HTW + the model number so HTWXNP-9300RW worked.
seems like they do some more stuff now, because inside of that tarball was another fwimage.tgz that was encrypted but it wasn't the same scheme, so we can't just re-use the same setup from Matt Brown. I kinda figured I was gonna have to give up and that Hanwha was doing something more advanced, like burning a key into the hardware (which isnt foolproof obviously but you at least need to own the camera to start.) Anyways, there was a fwupgrader binary that was in that outer tarball, so I threw it into ghidra and started poking around.
well I would have been poking around if it was 2023 or something, but i pointed claude code at it and went to make a lovely dinner and spent time with my partner instead, and came back a bit later to a description and a nice rootfs.
Hanwha had built some obfuscation into the fwupgrader to hide how they decrypt the actual rootfs. the AES key is XOR'd against a small static key table in the binary and reassembled at runtime ( the IV is just plaintext in there) the fwupgrader just shells out to the openssl CLI, and even the command fragments are XOR-obfuscated the same way.
reconstructed the command looks like this:
openssl enc -md sha256 -aes-256-cbc -d \ -K <KEY> -iv <IV> -in <INPUT> -out <OUTPUT>
Since the key and iv are just hardcoded (the same across the model line), I will publish them here:
... continue reading