Hacking the Motorola Blink 1 Baby Monitor (Part 2)

Ok, so it’s been quite some time since I posted my first efforts at “hacking” the Motorola Blink 1 Baby Monitor. Suffice to say we’ve been quite busy for a while & I’ve only just gotten around to actually plugging it in again now that our son is with us & at an age where we’re starting to think about being able to put him down in his crib & go into another room.

Anyway, I powered it on for the first time since August today and it asked to perform a firmware upgrade. I though ‘Aha! I’ll capture what it’s up to and see if I can work out where it downloads new firmware from’ but I inadvertently messed-up my tcpdump session & didn’t actually capture anything while it was upgrading. Furthermore, as I should have known from reading the comments here it seems that Motorola have disabled the landing page for the onboard web-server in the new firmware version (08-050) and it now just gives you a 404.

Well obviously this couldn’t be allowed to stand. Suffice to say if you capture all network traffic from the Blink when it powers on you’ll see it makes some web requests to a Monitor Everywhere ‘OTA’ server. It seems this is how it determines if there’s a firmware upgrade to be downloaded & with a bit of jiggery-pokery you too can download bmfwromfs_08_050.tar.gz which contains the latest firmware.

Unpacking the gzip’d tarball you’ll see there is a binary file ‘conprog.bin’ which I’m pretty sure is the kernel image  (2.6.17.14 since you ask) and a file ‘rootfs.bin’ which is a romfs image file containing the root file system for the camera.

You can mount this under Linux using the command:

mount -t romfs -o loop <path to rootfs.bin> <mount-point>

I’ve only just got this going tonight so I’ve yet to have a real poke around in there but for everyone who’s looking for the web interface point your brower at:

http://<camera-ip>/blinkhome.html

– or –

http://<camera-ip>/index2.html

to get it back. Incidentally the pages aren’t quite the same, so worth looking at both!

 

15 Replies to “Hacking the Motorola Blink 1 Baby Monitor (Part 2)”

  1. You are legend ->blinkhome.html -> this is epic!

    I am really frustrated with the java web app blink is running, got in touch with their support cause I have issues on some pcs that have more strict restriction/user policies.

    This is the saviour, thank you much for this!

  2. A million thanks. Finally I can view this directly without needing third party software! blinkhome.html excellent!

  3. This is fantastic! I had no luck at all viewing the camera through the monitor everywhere site and this solves all my connection issues!

    One question for you…my camera is delivering feed upside down, is there something I can do to fix this?

  4. I’ve used your work and tried to take it a step further, documenting it here: http://www.surfrock66.com/improving-the-motorola-blink-baby-monitorcamera/

    So, the actual streamer server is “mjpg-streamer” which has been modified, but is GPL. I’m contacting Motorola to get the source, which they should be obliged to give.

    I think I’m working towards a replacement firmware which can be flashed with a more friendly stream, either way I hope to document the API FULLY.

    1. Good luck Joe, to be honest we’ve just moved to a regular baby monitor so our blink is gathering dust in a cupboard now.

  5. Hi Simon!

    Need a big help… Have one Blink1 camera operating fine and recently added a new one. It worked fine for 3 days until I mistakenly switched one off. After that, the one that powered off was shown unavailable after turned on again. And remained as such.

    I decided to delete it and then tried to add it again through the ME app which is rather easy to set up. But regardless of what I do, it’s a no go! Of course I tried to reset it by pressing the pai button below but nothing happens… it lights up, makes the resetting noise and seems like it will go through and nothing… It doesn’t shows up on wifi networks available.

    As the only way to act on the camera is once connected to a network what would suggest that can be done if it doesn’t show up on the wifi?

    Trowing at the wall would be my next guess….

    1. I have the same issue, I need a procedure to reset the camera, I spent more than 10 minutes pressing the reser button, but nothing happens. Anyone can help me?

  6. any solution for last two question ? i have bought the camera for a week ago, first everything was okey but it suddenly powered off. Now i can’t get it connect to my wifi even i tried everything written above…

  7. Hey Simon,

    I picked up a Motorola Scout 66 (very similar guts) and your posts were helpful in getting me started on the path to getting it set up. I haven’t had any luck finding how to get the filesystem from the OTA upgrade. Would you be able to help me out with that?

    I’m trying to get a Raspberry Pi to run zoneminder to manage the camera, rather than the Hubble service. Understanding what’s available in the file system should help me get there.

    I would love to see a post, or get in touch by email. Thanks!

  8. Anyone find a solution? We just set up our second monitor but after a few days it changed tobunavailable. The camera will not go into setup mode. After 6 seconds a loud beep, 5 seconds later a small beep, then 60 seconds you get about 6 tones which I surmise is a failure to communicate with router

Leave a Reply

Your email address will not be published. Required fields are marked *