Hacking IP-Camera Digoo BB-M2 – Part 1 – Identify serial interface

I have bought an WiFi security camera from banggood. The Digoo BB-M2 Mini WiFi HD 720P costs about 20 €, which is quite cheap for this kind of product.

This article will analyze the serial interface of the IP camera.

The first step ist to remove the cover on the bottom of the device. This is fixed with three screws.

Furthermore the back plate of the camera module must be removed, which is fixed with one screw. After that step, the PCB could be seen.

Now the motors, the speaker and the power connector could be unplugged to remove everything from the case.

For this purpose the infrared (night mode) module is unnecessary, but the motors and the usb power supply must be plugged in again.

Now it is possible to identify interfaces on the PCB. At the left hand side of the picture below, an interface with three pads could be seen. With an oscilloscope it is possible to identify the functionality of this pins.

For this a PicoScope is used. This is a USB oscilloscope with an excellent software package.

The PicoScope software can decode serial signals. With this it is possible to identify the middle pad as the transmission signal of the serial interface.

The right serial configuration is illustrated below.

It is possible now to access the serial interface with a USB to serial converter, which could be connected to the IP camera. With this it is possible to receive and send commands.

Potential hardware specification:

• Processor: Ingenic T10 (MIPS)
• Operating System: Linux
• WiFi Module: ???
• Flash: ???